From: Sasha Levin Date: Mon, 29 Apr 2024 13:38:14 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v4.19.313~25^2~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b8ee6a33802407e9367044e17ee384815d6a7ab6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/dma-xilinx_dpdma-fix-locking.patch b/queue-6.6/dma-xilinx_dpdma-fix-locking.patch new file mode 100644 index 00000000000..d7936de7fd7 --- /dev/null +++ b/queue-6.6/dma-xilinx_dpdma-fix-locking.patch @@ -0,0 +1,149 @@ +From 395c130c1b48eac6a8f99b6ad7506fbc9735f19b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:00:32 -0500 +Subject: dma: xilinx_dpdma: Fix locking + +From: Sean Anderson + +[ Upstream commit 244296cc3a155199a8b080d19e645d7d49081a38 ] + +There are several places where either chan->lock or chan->vchan.lock was +not held. Add appropriate locking. This fixes lockdep warnings like + +[ 31.077578] ------------[ cut here ]------------ +[ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 +[ 31.077953] Modules linked in: +[ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98 +[ 31.078102] Hardware name: xlnx,zynqmp (DT) +[ 31.078169] Workqueue: events_unbound deferred_probe_work_func +[ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 +[ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 +[ 31.078550] sp : ffffffc083bb2e10 +[ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 +[ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 +[ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 +[ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 +[ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 +[ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 +[ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def +[ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 +[ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff +[ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 +[ 31.080307] Call trace: +[ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 +[ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 +[ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac +[ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c +[ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 +[ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 +[ 31.081139] commit_tail+0x234/0x294 +[ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 +[ 31.081363] drm_atomic_commit+0x100/0x140 +[ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 +[ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c +[ 31.081725] drm_client_modeset_commit+0x34/0x5c +[ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 +[ 31.081899] drm_fb_helper_set_par+0x50/0x70 +[ 31.081971] fbcon_init+0x538/0xc48 +[ 31.082047] visual_init+0x16c/0x23c +[ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 +[ 31.082320] do_take_over_console+0x24c/0x33c +[ 31.082429] do_fbcon_takeover+0xbc/0x1b0 +[ 31.082503] fbcon_fb_registered+0x2d0/0x34c +[ 31.082663] register_framebuffer+0x27c/0x38c +[ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c +[ 31.082939] drm_fb_helper_initial_config+0x50/0x74 +[ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 +[ 31.083115] drm_client_register+0xa0/0xf4 +[ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc +[ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 +[ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 +[ 31.083616] platform_probe+0x8c/0x13c +[ 31.083713] really_probe+0x258/0x59c +[ 31.083793] __driver_probe_device+0xc4/0x224 +[ 31.083878] driver_probe_device+0x70/0x1c0 +[ 31.083961] __device_attach_driver+0x108/0x1e0 +[ 31.084052] bus_for_each_drv+0x9c/0x100 +[ 31.084125] __device_attach+0x100/0x298 +[ 31.084207] device_initial_probe+0x14/0x20 +[ 31.084292] bus_probe_device+0xd8/0xdc +[ 31.084368] deferred_probe_work_func+0x11c/0x180 +[ 31.084451] process_one_work+0x3ac/0x988 +[ 31.084643] worker_thread+0x398/0x694 +[ 31.084752] kthread+0x1bc/0x1c0 +[ 31.084848] ret_from_fork+0x10/0x20 +[ 31.084932] irq event stamp: 64549 +[ 31.084970] hardirqs last enabled at (64548): [] _raw_spin_unlock_irqrestore+0x80/0x90 +[ 31.085157] hardirqs last disabled at (64549): [] _raw_spin_lock_irqsave+0xc0/0xdc +[ 31.085277] softirqs last enabled at (64503): [] __do_softirq+0x47c/0x500 +[ 31.085390] softirqs last disabled at (64498): [] ____do_softirq+0x10/0x1c +[ 31.085501] ---[ end trace 0000000000000000 ]--- + +Fixes: 7cbb0c63de3f ("dmaengine: xilinx: dpdma: Add the Xilinx DisplayPort DMA engine driver") +Signed-off-by: Sean Anderson +Reviewed-by: Tomi Valkeinen +Link: https://lore.kernel.org/r/20240308210034.3634938-2-sean.anderson@linux.dev +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dpdma.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dpdma.c b/drivers/dma/xilinx/xilinx_dpdma.c +index 84dc5240a8074..93938ed80fc83 100644 +--- a/drivers/dma/xilinx/xilinx_dpdma.c ++++ b/drivers/dma/xilinx/xilinx_dpdma.c +@@ -214,7 +214,8 @@ struct xilinx_dpdma_tx_desc { + * @running: true if the channel is running + * @first_frame: flag for the first frame of stream + * @video_group: flag if multi-channel operation is needed for video channels +- * @lock: lock to access struct xilinx_dpdma_chan ++ * @lock: lock to access struct xilinx_dpdma_chan. Must be taken before ++ * @vchan.lock, if both are to be held. + * @desc_pool: descriptor allocation pool + * @err_task: error IRQ bottom half handler + * @desc: References to descriptors being processed +@@ -1097,12 +1098,14 @@ static void xilinx_dpdma_chan_vsync_irq(struct xilinx_dpdma_chan *chan) + * Complete the active descriptor, if any, promote the pending + * descriptor to active, and queue the next transfer, if any. + */ ++ spin_lock(&chan->vchan.lock); + if (chan->desc.active) + vchan_cookie_complete(&chan->desc.active->vdesc); + chan->desc.active = pending; + chan->desc.pending = NULL; + + xilinx_dpdma_chan_queue_transfer(chan); ++ spin_unlock(&chan->vchan.lock); + + out: + spin_unlock_irqrestore(&chan->lock, flags); +@@ -1264,10 +1267,12 @@ static void xilinx_dpdma_issue_pending(struct dma_chan *dchan) + struct xilinx_dpdma_chan *chan = to_xilinx_chan(dchan); + unsigned long flags; + +- spin_lock_irqsave(&chan->vchan.lock, flags); ++ spin_lock_irqsave(&chan->lock, flags); ++ spin_lock(&chan->vchan.lock); + if (vchan_issue_pending(&chan->vchan)) + xilinx_dpdma_chan_queue_transfer(chan); +- spin_unlock_irqrestore(&chan->vchan.lock, flags); ++ spin_unlock(&chan->vchan.lock); ++ spin_unlock_irqrestore(&chan->lock, flags); + } + + static int xilinx_dpdma_config(struct dma_chan *dchan, +@@ -1495,7 +1500,9 @@ static void xilinx_dpdma_chan_err_task(struct tasklet_struct *t) + XILINX_DPDMA_EINTR_CHAN_ERR_MASK << chan->id); + + spin_lock_irqsave(&chan->lock, flags); ++ spin_lock(&chan->vchan.lock); + xilinx_dpdma_chan_queue_transfer(chan); ++ spin_unlock(&chan->vchan.lock); + spin_unlock_irqrestore(&chan->lock, flags); + } + +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-idxd-convert-spinlock-to-mutex-to-lock-evl.patch b/queue-6.6/dmaengine-idxd-convert-spinlock-to-mutex-to-lock-evl.patch new file mode 100644 index 00000000000..16a9e05a443 --- /dev/null +++ b/queue-6.6/dmaengine-idxd-convert-spinlock-to-mutex-to-lock-evl.patch @@ -0,0 +1,204 @@ +From 7407e483cbf3a927fd2c0019d94ac0044b9a3498 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 15:39:49 -0700 +Subject: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue + +From: Rex Zhang + +[ Upstream commit d5638de827cff0fce77007e426ec0ffdedf68a44 ] + +drain_workqueue() cannot be called safely in a spinlocked context due to +possible task rescheduling. In the multi-task scenario, calling +queue_work() while drain_workqueue() will lead to a Call Trace as +pushing a work on a draining workqueue is not permitted in spinlocked +context. + Call Trace: + + ? __warn+0x7d/0x140 + ? __queue_work+0x2b2/0x440 + ? report_bug+0x1f8/0x200 + ? handle_bug+0x3c/0x70 + ? exc_invalid_op+0x18/0x70 + ? asm_exc_invalid_op+0x1a/0x20 + ? __queue_work+0x2b2/0x440 + queue_work_on+0x28/0x30 + idxd_misc_thread+0x303/0x5a0 [idxd] + ? __schedule+0x369/0xb40 + ? __pfx_irq_thread_fn+0x10/0x10 + ? irq_thread+0xbc/0x1b0 + irq_thread_fn+0x21/0x70 + irq_thread+0x102/0x1b0 + ? preempt_count_add+0x74/0xa0 + ? __pfx_irq_thread_dtor+0x10/0x10 + ? __pfx_irq_thread+0x10/0x10 + kthread+0x103/0x140 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x31/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +The current implementation uses a spinlock to protect event log workqueue +and will lead to the Call Trace due to potential task rescheduling. + +To address the locking issue, convert the spinlock to mutex, allowing +the drain_workqueue() to be called in a safe mutex-locked context. + +This change ensures proper synchronization when accessing the event log +workqueue, preventing potential Call Trace and improving the overall +robustness of the code. + +Fixes: c40bd7d9737b ("dmaengine: idxd: process user page faults for completion record") +Signed-off-by: Rex Zhang +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Reviewed-by: Lijun Pan +Link: https://lore.kernel.org/r/20240404223949.2885604-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/cdev.c | 5 ++--- + drivers/dma/idxd/debugfs.c | 4 ++-- + drivers/dma/idxd/device.c | 8 ++++---- + drivers/dma/idxd/idxd.h | 2 +- + drivers/dma/idxd/init.c | 2 +- + drivers/dma/idxd/irq.c | 4 ++-- + 6 files changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c +index 4eeec95a66751..ad7b55dd9596d 100644 +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -342,7 +342,7 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid) + if (!evl) + return; + +- spin_lock(&evl->lock); ++ mutex_lock(&evl->lock); + status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + t = status.tail; + h = status.head; +@@ -354,9 +354,8 @@ static void idxd_cdev_evl_drain_pasid(struct idxd_wq *wq, u32 pasid) + set_bit(h, evl->bmap); + h = (h + 1) % size; + } +- spin_unlock(&evl->lock); +- + drain_workqueue(wq->wq); ++ mutex_unlock(&evl->lock); + } + + static int idxd_cdev_release(struct inode *node, struct file *filep) +diff --git a/drivers/dma/idxd/debugfs.c b/drivers/dma/idxd/debugfs.c +index f3f25ee676f30..ad4245cb301d5 100644 +--- a/drivers/dma/idxd/debugfs.c ++++ b/drivers/dma/idxd/debugfs.c +@@ -66,7 +66,7 @@ static int debugfs_evl_show(struct seq_file *s, void *d) + if (!evl || !evl->log) + return 0; + +- spin_lock(&evl->lock); ++ mutex_lock(&evl->lock); + + evl_status.bits = ioread64(idxd->reg_base + IDXD_EVLSTATUS_OFFSET); + t = evl_status.tail; +@@ -87,7 +87,7 @@ static int debugfs_evl_show(struct seq_file *s, void *d) + dump_event_entry(idxd, s, i, &count, processed); + } + +- spin_unlock(&evl->lock); ++ mutex_unlock(&evl->lock); + return 0; + } + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index fa0f880beae64..542d340552dd7 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -770,7 +770,7 @@ static int idxd_device_evl_setup(struct idxd_device *idxd) + goto err_alloc; + } + +- spin_lock(&evl->lock); ++ mutex_lock(&evl->lock); + evl->log = addr; + evl->dma = dma_addr; + evl->log_size = size; +@@ -791,7 +791,7 @@ static int idxd_device_evl_setup(struct idxd_device *idxd) + gencfg.evl_en = 1; + iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET); + +- spin_unlock(&evl->lock); ++ mutex_unlock(&evl->lock); + return 0; + + err_alloc: +@@ -814,7 +814,7 @@ static void idxd_device_evl_free(struct idxd_device *idxd) + if (!gencfg.evl_en) + return; + +- spin_lock(&evl->lock); ++ mutex_lock(&evl->lock); + gencfg.evl_en = 0; + iowrite32(gencfg.bits, idxd->reg_base + IDXD_GENCFG_OFFSET); + +@@ -831,7 +831,7 @@ static void idxd_device_evl_free(struct idxd_device *idxd) + evl_dma = evl->dma; + evl->log = NULL; + evl->size = IDXD_EVL_SIZE_MIN; +- spin_unlock(&evl->lock); ++ mutex_unlock(&evl->lock); + + dma_free_coherent(dev, evl_log_size, evl_log, evl_dma); + } +diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h +index 6fc79deb99bfd..df62dd1291189 100644 +--- a/drivers/dma/idxd/idxd.h ++++ b/drivers/dma/idxd/idxd.h +@@ -279,7 +279,7 @@ struct idxd_driver_data { + + struct idxd_evl { + /* Lock to protect event log access. */ +- spinlock_t lock; ++ struct mutex lock; + void *log; + dma_addr_t dma; + /* Total size of event log = number of entries * entry size. */ +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index d09a8553ea71d..2e323c9b2068d 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -353,7 +353,7 @@ static int idxd_init_evl(struct idxd_device *idxd) + if (!evl) + return -ENOMEM; + +- spin_lock_init(&evl->lock); ++ mutex_init(&evl->lock); + evl->size = IDXD_EVL_SIZE_MIN; + + idxd_name = dev_name(idxd_confdev(idxd)); +diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c +index 0bbc6bdc6145e..b2ca9c1f194c9 100644 +--- a/drivers/dma/idxd/irq.c ++++ b/drivers/dma/idxd/irq.c +@@ -363,7 +363,7 @@ static void process_evl_entries(struct idxd_device *idxd) + evl_status.bits = 0; + evl_status.int_pending = 1; + +- spin_lock(&evl->lock); ++ mutex_lock(&evl->lock); + /* Clear interrupt pending bit */ + iowrite32(evl_status.bits_upper32, + idxd->reg_base + IDXD_EVLSTATUS_OFFSET + sizeof(u32)); +@@ -380,7 +380,7 @@ static void process_evl_entries(struct idxd_device *idxd) + + evl_status.head = h; + iowrite32(evl_status.bits_lower32, idxd->reg_base + IDXD_EVLSTATUS_OFFSET); +- spin_unlock(&evl->lock); ++ mutex_unlock(&evl->lock); + } + + irqreturn_t idxd_misc_thread(int vec, void *data) +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch b/queue-6.6/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch new file mode 100644 index 00000000000..5868897b89b --- /dev/null +++ b/queue-6.6/dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch @@ -0,0 +1,87 @@ +From 5fe019bc9880854caf8d918dc636469fafacec9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 14:40:31 -0700 +Subject: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms + +From: Fenghua Yu + +[ Upstream commit f221033f5c24659dc6ad7e5cf18fb1b075f4a8be ] + +During the removal of the idxd driver, registered offline callback is +invoked as part of the clean up process. However, on systems with only +one CPU online, no valid target is available to migrate the +perf context, resulting in a kernel oops: + + BUG: unable to handle page fault for address: 000000000002a2b8 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 1470e1067 P4D 0 + Oops: 0002 [#1] PREEMPT SMP NOPTI + CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57 + Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 + RIP: 0010:mutex_lock+0x2e/0x50 + ... + Call Trace: + + __die+0x24/0x70 + page_fault_oops+0x82/0x160 + do_user_addr_fault+0x65/0x6b0 + __pfx___rdmsr_safe_on_cpu+0x10/0x10 + exc_page_fault+0x7d/0x170 + asm_exc_page_fault+0x26/0x30 + mutex_lock+0x2e/0x50 + mutex_lock+0x1e/0x50 + perf_pmu_migrate_context+0x87/0x1f0 + perf_event_cpu_offline+0x76/0x90 [idxd] + cpuhp_invoke_callback+0xa2/0x4f0 + __pfx_perf_event_cpu_offline+0x10/0x10 [idxd] + cpuhp_thread_fun+0x98/0x150 + smpboot_thread_fn+0x27/0x260 + smpboot_thread_fn+0x1af/0x260 + __pfx_smpboot_thread_fn+0x10/0x10 + kthread+0x103/0x140 + __pfx_kthread+0x10/0x10 + ret_from_fork+0x31/0x50 + __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +Fix the issue by preventing the migration of the perf context to an +invalid target. + +Fixes: 81dd4d4d6178 ("dmaengine: idxd: Add IDXD performance monitor support") +Reported-by: Terrence Xu +Tested-by: Terrence Xu +Signed-off-by: Fenghua Yu +Link: https://lore.kernel.org/r/20240313214031.1658045-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/perfmon.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/idxd/perfmon.c b/drivers/dma/idxd/perfmon.c +index fdda6d6042629..5e94247e1ea70 100644 +--- a/drivers/dma/idxd/perfmon.c ++++ b/drivers/dma/idxd/perfmon.c +@@ -528,14 +528,11 @@ static int perf_event_cpu_offline(unsigned int cpu, struct hlist_node *node) + return 0; + + target = cpumask_any_but(cpu_online_mask, cpu); +- + /* migrate events if there is a valid target */ +- if (target < nr_cpu_ids) ++ if (target < nr_cpu_ids) { + cpumask_set_cpu(target, &perfmon_dsa_cpu_mask); +- else +- target = -1; +- +- perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target); ++ perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target); ++ } + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-owl-fix-register-access-functions.patch b/queue-6.6/dmaengine-owl-fix-register-access-functions.patch new file mode 100644 index 00000000000..28d34d0beeb --- /dev/null +++ b/queue-6.6/dmaengine-owl-fix-register-access-functions.patch @@ -0,0 +1,58 @@ +From 0bd3a6572258c1f5c4f0e84a84f13f6b64dead55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 14:21:07 +0100 +Subject: dmaengine: owl: fix register access functions + +From: Arnd Bergmann + +[ Upstream commit 43c633ef93a5d293c96ebcedb40130df13128428 ] + +When building with 'make W=1', clang notices that the computed register +values are never actually written back but instead the wrong variable +is set: + +drivers/dma/owl-dma.c:244:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable] + 244 | u32 regval; + | ^ +drivers/dma/owl-dma.c:268:6: error: variable 'regval' set but not used [-Werror,-Wunused-but-set-variable] + 268 | u32 regval; + | ^ + +Change these to what was most likely intended. + +Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver") +Signed-off-by: Arnd Bergmann +Reviewed-by: Peter Korsgaard +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240322132116.906475-1-arnd@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/owl-dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c +index 384476757c5e3..3bcf73ef69dc7 100644 +--- a/drivers/dma/owl-dma.c ++++ b/drivers/dma/owl-dma.c +@@ -250,7 +250,7 @@ static void pchan_update(struct owl_dma_pchan *pchan, u32 reg, + else + regval &= ~val; + +- writel(val, pchan->base + reg); ++ writel(regval, pchan->base + reg); + } + + static void pchan_writel(struct owl_dma_pchan *pchan, u32 reg, u32 data) +@@ -274,7 +274,7 @@ static void dma_update(struct owl_dma *od, u32 reg, u32 val, bool state) + else + regval &= ~val; + +- writel(val, od->base + reg); ++ writel(regval, od->base + reg); + } + + static void dma_writel(struct owl_dma *od, u32 reg, u32 data) +-- +2.43.0 + diff --git a/queue-6.6/dmaengine-tegra186-fix-residual-calculation.patch b/queue-6.6/dmaengine-tegra186-fix-residual-calculation.patch new file mode 100644 index 00000000000..35da1e284d3 --- /dev/null +++ b/queue-6.6/dmaengine-tegra186-fix-residual-calculation.patch @@ -0,0 +1,45 @@ +From 8c93ef3f4c744e4375eeaada0c2949ebfa702c88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 18:14:11 +0530 +Subject: dmaengine: tegra186: Fix residual calculation + +From: Akhil R + +[ Upstream commit 30f0ced9971b2d8c8c24ae75786f9079489a012d ] + +The existing residual calculation returns an incorrect value when +bytes_xfer == bytes_req. This scenario occurs particularly with drivers +like UART where DMA is scheduled for maximum number of bytes and is +terminated when the bytes inflow stops. At higher baud rates, it could +request the tx_status while there is no bytes left to transfer. This will +lead to incorrect residual being set. Hence return residual as '0' when +bytes transferred equals to the bytes requested. + +Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") +Signed-off-by: Akhil R +Reviewed-by: Jon Hunter +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20240315124411.17582-1-akhilrajeev@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra186-gpc-dma.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c +index 33b1010011009..674cf63052838 100644 +--- a/drivers/dma/tegra186-gpc-dma.c ++++ b/drivers/dma/tegra186-gpc-dma.c +@@ -746,6 +746,9 @@ static int tegra_dma_get_residual(struct tegra_dma_channel *tdc) + bytes_xfer = dma_desc->bytes_xfer + + sg_req[dma_desc->sg_idx].len - (wcount * 4); + ++ if (dma_desc->bytes_req == bytes_xfer) ++ return 0; ++ + residual = dma_desc->bytes_req - (bytes_xfer % dma_desc->bytes_req); + + return residual; +-- +2.43.0 + diff --git a/queue-6.6/i2c-smbus-fix-null-function-pointer-dereference.patch b/queue-6.6/i2c-smbus-fix-null-function-pointer-dereference.patch new file mode 100644 index 00000000000..23181433c6e --- /dev/null +++ b/queue-6.6/i2c-smbus-fix-null-function-pointer-dereference.patch @@ -0,0 +1,64 @@ +From 71d8cc481d3110be696a3af6b98768c1deb12fa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Apr 2024 08:44:08 +0200 +Subject: i2c: smbus: fix NULL function pointer dereference + +From: Wolfram Sang + +[ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] + +Baruch reported an OOPS when using the designware controller as target +only. Target-only modes break the assumption of one transfer function +always being available. Fix this by always checking the pointer in +__i2c_transfer. + +Reported-by: Baruch Siach +Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.1712761976.git.baruch@tkos.co.il +Fixes: 4b1acc43331d ("i2c: core changes for slave support") +[wsa: dropped the simplification in core-smbus to avoid theoretical regressions] +Signed-off-by: Wolfram Sang +Tested-by: Baruch Siach +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 7f30bcceebaed..3642d42463209 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -2187,13 +2187,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, + * Returns negative errno, else the number of messages executed. + * + * Adapter lock must be held when calling this function. No debug logging +- * takes place. adap->algo->master_xfer existence isn't checked. ++ * takes place. + */ + int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + { + unsigned long orig_jiffies; + int ret, try; + ++ if (!adap->algo->master_xfer) { ++ dev_dbg(&adap->dev, "I2C level transfers not supported\n"); ++ return -EOPNOTSUPP; ++ } ++ + if (WARN_ON(!msgs || num < 1)) + return -EINVAL; + +@@ -2260,11 +2265,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + { + int ret; + +- if (!adap->algo->master_xfer) { +- dev_dbg(&adap->dev, "I2C level transfers not supported\n"); +- return -EOPNOTSUPP; +- } +- + /* REVISIT the fault reporting model here is weak: + * + * - When we get an error after receiving N bytes from a slave, +-- +2.43.0 + diff --git a/queue-6.6/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch b/queue-6.6/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch new file mode 100644 index 00000000000..8fc2b7233b6 --- /dev/null +++ b/queue-6.6/idma64-don-t-try-to-serve-interrupts-when-device-is-.patch @@ -0,0 +1,44 @@ +From f1edb5c69738c26e69637affa78aeba27f770520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 14:04:21 +0200 +Subject: idma64: Don't try to serve interrupts when device is powered off + +From: Andy Shevchenko + +[ Upstream commit 9140ce47872bfd89fca888c2f992faa51d20c2bc ] + +When iDMA 64-bit device is powered off, the IRQ status register +is all 1:s. This is never happen in real case and signalling that +the device is simply powered off. Don't try to serve interrupts +that are not ours. + +Fixes: 667dfed98615 ("dmaengine: add a driver for Intel integrated DMA 64-bit") +Reported-by: Heiner Kallweit +Closes: https://lore.kernel.org/r/700bbb84-90e1-4505-8ff0-3f17ea8bc631@gmail.com +Tested-by: Heiner Kallweit +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240321120453.1360138-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idma64.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c +index 0ac634a51c5e3..f86939fa33b95 100644 +--- a/drivers/dma/idma64.c ++++ b/drivers/dma/idma64.c +@@ -171,6 +171,10 @@ static irqreturn_t idma64_irq(int irq, void *dev) + u32 status_err; + unsigned short i; + ++ /* Since IRQ may be shared, check if DMA controller is powered on */ ++ if (status == GENMASK(31, 0)) ++ return IRQ_NONE; ++ + dev_vdbg(idma64->dma.dev, "%s: status=%#x\n", __func__, status); + + /* Check if we have any interrupt from the DMA controller */ +-- +2.43.0 + diff --git a/queue-6.6/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch b/queue-6.6/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch new file mode 100644 index 00000000000..1ffb4f56538 --- /dev/null +++ b/queue-6.6/phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch @@ -0,0 +1,43 @@ +From c2e389748765239a0034e95c75ab4bb801302760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 14:06:32 +0100 +Subject: phy: freescale: imx8m-pcie: fix pcie link-up instability + +From: Marcel Ziswiler + +[ Upstream commit 3a161017f1de55cc48be81f6156004c151f32677 ] + +Leaving AUX_PLL_REFCLK_SEL at its reset default of AUX_IN (PLL clock) +proves to be more stable on the i.MX 8M Mini. + +Fixes: 1aa97b002258 ("phy: freescale: pcie: Initialize the imx8 pcie standalone phy driver") + +Signed-off-by: Marcel Ziswiler +Reviewed-by: Richard Zhu +Link: https://lore.kernel.org/r/20240322130646.1016630-2-marcel@ziswiler.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/freescale/phy-fsl-imx8m-pcie.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c +index b700f52b7b679..11fcb1867118c 100644 +--- a/drivers/phy/freescale/phy-fsl-imx8m-pcie.c ++++ b/drivers/phy/freescale/phy-fsl-imx8m-pcie.c +@@ -110,8 +110,10 @@ static int imx8_pcie_phy_power_on(struct phy *phy) + /* Source clock from SoC internal PLL */ + writel(ANA_PLL_CLK_OUT_TO_EXT_IO_SEL, + imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG062); +- writel(AUX_PLL_REFCLK_SEL_SYS_PLL, +- imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063); ++ if (imx8_phy->drvdata->variant != IMX8MM) { ++ writel(AUX_PLL_REFCLK_SEL_SYS_PLL, ++ imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG063); ++ } + val = ANA_AUX_RX_TX_SEL_TX | ANA_AUX_TX_TERM; + writel(val | ANA_AUX_RX_TERM_GND_EN, + imx8_phy->base + IMX8MM_PCIE_PHY_CMN_REG064); +-- +2.43.0 + diff --git a/queue-6.6/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch b/queue-6.6/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch new file mode 100644 index 00000000000..910e9fd64e3 --- /dev/null +++ b/queue-6.6/phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch @@ -0,0 +1,36 @@ +From 7d55c56f915fd9b7ecce121289ec7fed7ecd6bd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 19:47:31 +0300 +Subject: phy: marvell: a3700-comphy: Fix hardcoded array size + +From: Mikhail Kobuk + +[ Upstream commit 627207703b73615653eea5ab7a841d5b478d961e ] + +Replace hardcoded 'gbe_phy_init' array size by explicit one. + +Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation") +Signed-off-by: Mikhail Kobuk +Link: https://lore.kernel.org/r/20240321164734.49273-2-m.kobuk@ispras.ru +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c +index e2d0bf92a9ada..27f221a0f922d 100644 +--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c ++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c +@@ -603,7 +603,7 @@ static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane, + u16 val; + + fix_idx = 0; +- for (addr = 0; addr < 512; addr++) { ++ for (addr = 0; addr < ARRAY_SIZE(gbe_phy_init); addr++) { + /* + * All PHY register values are defined in full for 3.125Gbps + * SERDES speed. The values required for 1.25 Gbps are almost +-- +2.43.0 + diff --git a/queue-6.6/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch b/queue-6.6/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch new file mode 100644 index 00000000000..e658ad2401a --- /dev/null +++ b/queue-6.6/phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch @@ -0,0 +1,50 @@ +From c3cb0fce4262cdc2b1b86076317743264d2bc286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 19:47:30 +0300 +Subject: phy: marvell: a3700-comphy: Fix out of bounds read + +From: Mikhail Kobuk + +[ Upstream commit e4308bc22b9d46cf33165c9dfaeebcf29cd56f04 ] + +There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' +every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. + +Make sure 'gbe_phy_init[addr]' is used when all elements of +'gbe_phy_init_fix' array are handled. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 934337080c6c ("phy: marvell: phy-mvebu-a3700-comphy: Add native kernel implementation") +Signed-off-by: Mikhail Kobuk +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20240321164734.49273-1-m.kobuk@ispras.ru +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c +index 24c3371e2bb29..e2d0bf92a9ada 100644 +--- a/drivers/phy/marvell/phy-mvebu-a3700-comphy.c ++++ b/drivers/phy/marvell/phy-mvebu-a3700-comphy.c +@@ -611,11 +611,12 @@ static void comphy_gbe_phy_init(struct mvebu_a3700_comphy_lane *lane, + * comparison to 3.125 Gbps values. These register values are + * stored in "gbe_phy_init_fix" array. + */ +- if (!is_1gbps && gbe_phy_init_fix[fix_idx].addr == addr) { ++ if (!is_1gbps && ++ fix_idx < ARRAY_SIZE(gbe_phy_init_fix) && ++ gbe_phy_init_fix[fix_idx].addr == addr) { + /* Use new value */ + val = gbe_phy_init_fix[fix_idx].value; +- if (fix_idx < ARRAY_SIZE(gbe_phy_init_fix)) +- fix_idx++; ++ fix_idx++; + } else { + val = gbe_phy_init[addr]; + } +-- +2.43.0 + diff --git a/queue-6.6/phy-qcom-m31-match-requested-regulator-name-with-dt-.patch b/queue-6.6/phy-qcom-m31-match-requested-regulator-name-with-dt-.patch new file mode 100644 index 00000000000..89dedf08041 --- /dev/null +++ b/queue-6.6/phy-qcom-m31-match-requested-regulator-name-with-dt-.patch @@ -0,0 +1,52 @@ +From b477b2ce8a7dd0cfabc0bc2ad2572ccd638280af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 15:37:09 +0200 +Subject: phy: qcom: m31: match requested regulator name with dt schema + +From: Gabor Juhos + +[ Upstream commit 47b3e2f3914ae5e8d9025d65ae5cffcbb54bc9c3 ] + +According to the 'qcom,ipq5332-usb-hsphy.yaml' schema, the 5V +supply regulator must be defined via the 'vdd-supply' property. +The driver however requests for the 'vdda-phy' regulator which +results in the following message when the driver is probed on +a IPQ5018 based board with a device tree matching to the schema: + + qcom-m31usb-phy 5b000.phy: supply vdda-phy not found, using dummy regulator + qcom-m31usb-phy 5b000.phy: Registered M31 USB phy + +This means that the regulator specified in the device tree never +gets enabled. + +Change the driver to use the 'vdd' name for the regulator as per +defined in the schema in order to ensure that the corresponding +regulator gets enabled. + +Fixes: 08e49af50701 ("phy: qcom: Introduce M31 USB PHY driver") +Reviewed-by: Varadarajan Narayanan +Signed-off-by: Gabor Juhos +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240406-phy-qcom-m31-regulator-fix-v2-1-c8e9795bc071@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-m31.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-m31.c b/drivers/phy/qualcomm/phy-qcom-m31.c +index 5cb7e79b99b3f..89c9d74e35466 100644 +--- a/drivers/phy/qualcomm/phy-qcom-m31.c ++++ b/drivers/phy/qualcomm/phy-qcom-m31.c +@@ -253,7 +253,7 @@ static int m31usb_phy_probe(struct platform_device *pdev) + return dev_err_probe(dev, PTR_ERR(qphy->phy), + "failed to create phy\n"); + +- qphy->vreg = devm_regulator_get(dev, "vdda-phy"); ++ qphy->vreg = devm_regulator_get(dev, "vdd"); + if (IS_ERR(qphy->vreg)) + return dev_err_probe(dev, PTR_ERR(qphy->vreg), + "failed to get vreg\n"); +-- +2.43.0 + diff --git a/queue-6.6/phy-rockchip-naneng-combphy-fix-mux-on-rk3588.patch b/queue-6.6/phy-rockchip-naneng-combphy-fix-mux-on-rk3588.patch new file mode 100644 index 00000000000..76e17e049fd --- /dev/null +++ b/queue-6.6/phy-rockchip-naneng-combphy-fix-mux-on-rk3588.patch @@ -0,0 +1,134 @@ +From 3717a2457430c46ee9fcb7bf6ef9388d4a5e7252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 19:11:28 +0200 +Subject: phy: rockchip: naneng-combphy: Fix mux on rk3588 + +From: Sebastian Reichel + +[ Upstream commit d16d4002fea69b6609b852dd8db1f5844c02fbe4 ] + +The pcie1l0_sel and pcie1l1_sel bits in PCIESEL_CON configure the +mux for PCIe1L0 and PCIe1L1 to either the PIPE Combo PHYs or the +PCIe3 PHY. Thus this configuration interfers with the data-lanes +configuration done by the PCIe3 PHY. + +RK3588 has three Combo PHYs. The first one has a dedicated PCIe +controller and is not affected by this. For the other two Combo +PHYs, there is one mux for each of them. + +pcie1l0_sel selects if PCIe 1L0 is muxed to Combo PHY 1 when +bit is set to 0 or to the PCIe3 PHY when bit is set to 1. + +pcie1l1_sel selects if PCIe 1L1 is muxed to Combo PHY 2 when +bit is set to 0 or to the PCIe3 PHY when bit is set to 1. + +Currently the code always muxes 1L0 and 1L1 to the Combi PHYs +once one of them is being used in PCIe mode. This is obviously +wrong when at least one of the ports should be muxed to the +PCIe3 PHY. + +Fix this by introducing Combo PHY identification and then only +setting up the required bit. + +Fixes: a03c44277253 ("phy: rockchip: Add naneng combo phy support for RK3588") +Reported-by: Michal Tomek +Signed-off-by: Sebastian Reichel +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240404-rk3588-pcie-bifurcation-fixes-v1-3-9907136eeafd@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + .../rockchip/phy-rockchip-naneng-combphy.c | 36 +++++++++++++++++-- + 1 file changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +index 5de5e2e97ffa0..26b157f53f3da 100644 +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -125,12 +125,15 @@ struct rockchip_combphy_grfcfg { + }; + + struct rockchip_combphy_cfg { ++ unsigned int num_phys; ++ unsigned int phy_ids[3]; + const struct rockchip_combphy_grfcfg *grfcfg; + int (*combphy_cfg)(struct rockchip_combphy_priv *priv); + }; + + struct rockchip_combphy_priv { + u8 type; ++ int id; + void __iomem *mmio; + int num_clks; + struct clk_bulk_data *clks; +@@ -320,7 +323,7 @@ static int rockchip_combphy_probe(struct platform_device *pdev) + struct rockchip_combphy_priv *priv; + const struct rockchip_combphy_cfg *phy_cfg; + struct resource *res; +- int ret; ++ int ret, id; + + phy_cfg = of_device_get_match_data(dev); + if (!phy_cfg) { +@@ -338,6 +341,15 @@ static int rockchip_combphy_probe(struct platform_device *pdev) + return ret; + } + ++ /* find the phy-id from the io address */ ++ priv->id = -ENODEV; ++ for (id = 0; id < phy_cfg->num_phys; id++) { ++ if (res->start == phy_cfg->phy_ids[id]) { ++ priv->id = id; ++ break; ++ } ++ } ++ + priv->dev = dev; + priv->type = PHY_NONE; + priv->cfg = phy_cfg; +@@ -562,6 +574,12 @@ static const struct rockchip_combphy_grfcfg rk3568_combphy_grfcfgs = { + }; + + static const struct rockchip_combphy_cfg rk3568_combphy_cfgs = { ++ .num_phys = 3, ++ .phy_ids = { ++ 0xfe820000, ++ 0xfe830000, ++ 0xfe840000, ++ }, + .grfcfg = &rk3568_combphy_grfcfgs, + .combphy_cfg = rk3568_combphy_cfg, + }; +@@ -578,8 +596,14 @@ static int rk3588_combphy_cfg(struct rockchip_combphy_priv *priv) + rockchip_combphy_param_write(priv->phy_grf, &cfg->con1_for_pcie, true); + rockchip_combphy_param_write(priv->phy_grf, &cfg->con2_for_pcie, true); + rockchip_combphy_param_write(priv->phy_grf, &cfg->con3_for_pcie, true); +- rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l0_sel, true); +- rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l1_sel, true); ++ switch (priv->id) { ++ case 1: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l0_sel, true); ++ break; ++ case 2: ++ rockchip_combphy_param_write(priv->pipe_grf, &cfg->pipe_pcie1l1_sel, true); ++ break; ++ } + break; + case PHY_TYPE_USB3: + /* Set SSC downward spread spectrum */ +@@ -736,6 +760,12 @@ static const struct rockchip_combphy_grfcfg rk3588_combphy_grfcfgs = { + }; + + static const struct rockchip_combphy_cfg rk3588_combphy_cfgs = { ++ .num_phys = 3, ++ .phy_ids = { ++ 0xfee00000, ++ 0xfee10000, ++ 0xfee20000, ++ }, + .grfcfg = &rk3588_combphy_grfcfgs, + .combphy_cfg = rk3588_combphy_cfg, + }; +-- +2.43.0 + diff --git a/queue-6.6/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch b/queue-6.6/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch new file mode 100644 index 00000000000..eacd9e64c74 --- /dev/null +++ b/queue-6.6/phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch @@ -0,0 +1,105 @@ +From 207ea4cfa5d7da8d04a7560aee5bda50c0fb7c0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 19:11:26 +0200 +Subject: phy: rockchip-snps-pcie3: fix bifurcation on rk3588 + +From: Michal Tomek + +[ Upstream commit f8020dfb311d2b6cf657668792aaa5fa8863a7dd ] + +So far all RK3588 boards use fully aggregated PCIe. CM3588 is one +of the few boards using this feature and apparently it is broken. + +The PHY offers the following mapping options: + + port 0 lane 0 - always mapped to controller 0 (4L) + port 0 lane 1 - to controller 0 or 2 (1L0) + port 1 lane 0 - to controller 0 or 1 (2L) + port 1 lane 1 - to controller 0, 1 or 3 (1L1) + +The data-lanes DT property maps these as follows: + + 0 = no controller (unsupported by the HW) + 1 = 4L + 2 = 2L + 3 = 1L0 + 4 = 1L1 + +That allows the following configurations with first column being the +mainline data-lane mapping, second column being the downstream name, +third column being PCIE3PHY_GRF_CMN_CON0 and PHP_GRF_PCIESEL register +values and final column being the user visible lane setup: + + <1 1 1 1> = AGGREG = [4 0] = x4 (aggregation) + <1 1 2 2> = NANBNB = [0 0] = x2 x2 (no bif.) + <1 3 2 2> = NANBBI = [1 1] = x2 x1x1 (bif. of port 0) + <1 1 2 4> = NABINB = [2 2] = x1x1 x2 (bif. of port 1) + <1 3 2 4> = NABIBI = [3 3] = x1x1 x1x1 (bif. of both ports) + +The driver currently does not program PHP_GRF_PCIESEL correctly, which +is fixed by this patch. As a side-effect the new logic is much simpler +than the old logic. + +Fixes: 2e9bffc4f713 ("phy: rockchip: Support PCIe v3") +Signed-off-by: Michal Tomek +Signed-off-by: Sebastian Reichel +Acked-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240404-rk3588-pcie-bifurcation-fixes-v1-1-9907136eeafd@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + .../phy/rockchip/phy-rockchip-snps-pcie3.c | 24 +++++++------------ + 1 file changed, 8 insertions(+), 16 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c +index 121e5961ce114..d5bcc9c42b284 100644 +--- a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c ++++ b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c +@@ -132,7 +132,7 @@ static const struct rockchip_p3phy_ops rk3568_ops = { + static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv) + { + u32 reg = 0; +- u8 mode = 0; ++ u8 mode = RK3588_LANE_AGGREGATION; /* default */ + int ret; + + /* Deassert PCIe PMA output clamp mode */ +@@ -140,28 +140,20 @@ static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv) + + /* Set bifurcation if needed */ + for (int i = 0; i < priv->num_lanes; i++) { +- if (!priv->lanes[i]) +- mode |= (BIT(i) << 3); +- + if (priv->lanes[i] > 1) +- mode |= (BIT(i) >> 1); +- } +- +- if (!mode) +- reg = RK3588_LANE_AGGREGATION; +- else { +- if (mode & (BIT(0) | BIT(1))) +- reg |= RK3588_BIFURCATION_LANE_0_1; +- +- if (mode & (BIT(2) | BIT(3))) +- reg |= RK3588_BIFURCATION_LANE_2_3; ++ mode &= ~RK3588_LANE_AGGREGATION; ++ if (priv->lanes[i] == 3) ++ mode |= RK3588_BIFURCATION_LANE_0_1; ++ if (priv->lanes[i] == 4) ++ mode |= RK3588_BIFURCATION_LANE_2_3; + } + ++ reg = mode; + regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, (0x7<<16) | reg); + + /* Set pcie1ln_sel in PHP_GRF_PCIESEL_CON */ + if (!IS_ERR(priv->pipe_grf)) { +- reg = (mode & (BIT(6) | BIT(7))) >> 6; ++ reg = mode & 3; + if (reg) + regmap_write(priv->pipe_grf, PHP_GRF_PCIESEL_CON, + (reg << 16) | reg); +-- +2.43.0 + diff --git a/queue-6.6/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch b/queue-6.6/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch new file mode 100644 index 00000000000..14a381e23da --- /dev/null +++ b/queue-6.6/phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch @@ -0,0 +1,61 @@ +From 0d776460482d5289d054b9fa26d4b5060732039e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 19:11:27 +0200 +Subject: phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits + +From: Sebastian Reichel + +[ Upstream commit 55491a5fa163bf15158f34f3650b3985f25622b9 ] + +Currently the PCIe v3 PHY driver only sets the pcie1ln_sel bits, but +does not clear them because of an incorrect write mask. This fixes up +the issue by using a newly introduced constant for the write mask. + +While at it also introduces a proper GENMASK based constant for the +PCIE30_PHY_MODE. + +Fixes: 2e9bffc4f713 ("phy: rockchip: Support PCIe v3") +Signed-off-by: Sebastian Reichel +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240404-rk3588-pcie-bifurcation-fixes-v1-2-9907136eeafd@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-snps-pcie3.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c +index d5bcc9c42b284..9857ee45b89e0 100644 +--- a/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c ++++ b/drivers/phy/rockchip/phy-rockchip-snps-pcie3.c +@@ -40,6 +40,8 @@ + #define RK3588_BIFURCATION_LANE_0_1 BIT(0) + #define RK3588_BIFURCATION_LANE_2_3 BIT(1) + #define RK3588_LANE_AGGREGATION BIT(2) ++#define RK3588_PCIE1LN_SEL_EN (GENMASK(1, 0) << 16) ++#define RK3588_PCIE30_PHY_MODE_EN (GENMASK(2, 0) << 16) + + struct rockchip_p3phy_ops; + +@@ -149,14 +151,15 @@ static int rockchip_p3phy_rk3588_init(struct rockchip_p3phy_priv *priv) + } + + reg = mode; +- regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, (0x7<<16) | reg); ++ regmap_write(priv->phy_grf, RK3588_PCIE3PHY_GRF_CMN_CON0, ++ RK3588_PCIE30_PHY_MODE_EN | reg); + + /* Set pcie1ln_sel in PHP_GRF_PCIESEL_CON */ + if (!IS_ERR(priv->pipe_grf)) { +- reg = mode & 3; ++ reg = mode & (RK3588_BIFURCATION_LANE_0_1 | RK3588_BIFURCATION_LANE_2_3); + if (reg) + regmap_write(priv->pipe_grf, PHP_GRF_PCIESEL_CON, +- (reg << 16) | reg); ++ RK3588_PCIE1LN_SEL_EN | reg); + } + + reset_control_deassert(priv->p30phy); +-- +2.43.0 + diff --git a/queue-6.6/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch b/queue-6.6/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch new file mode 100644 index 00000000000..eca5931048d --- /dev/null +++ b/queue-6.6/phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch @@ -0,0 +1,94 @@ +From 29a28801ef780ecf882a9a451e1221ed1d855868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 16:08:21 +0200 +Subject: phy: ti: tusb1210: Resolve charger-det crash if charger psy is + unregistered + +From: Hans de Goede + +[ Upstream commit bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 ] + +The power_supply frame-work is not really designed for there to be +long living in kernel references to power_supply devices. + +Specifically unregistering a power_supply while some other code has +a reference to it triggers a WARN in power_supply_unregister(): + + WARN_ON(atomic_dec_return(&psy->use_cnt)); + +Folllowed by the power_supply still getting removed and the +backing data freed anyway, leaving the tusb1210 charger-detect code +with a dangling reference, resulting in a crash the next time +tusb1210_get_online() is called. + +Fix this by only holding the reference in tusb1210_get_online() +freeing it at the end of the function. Note this still leaves +a theoretical race window, but it avoids the issue when manually +rmmod-ing the charger chip driver during development. + +Fixes: 48969a5623ed ("phy: ti: tusb1210: Add charger detection") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240406140821.18624-1-hdegoede@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-tusb1210.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/phy/ti/phy-tusb1210.c b/drivers/phy/ti/phy-tusb1210.c +index b4881cb344759..c23eecc7d1800 100644 +--- a/drivers/phy/ti/phy-tusb1210.c ++++ b/drivers/phy/ti/phy-tusb1210.c +@@ -65,7 +65,6 @@ struct tusb1210 { + struct delayed_work chg_det_work; + struct notifier_block psy_nb; + struct power_supply *psy; +- struct power_supply *charger; + #endif + }; + +@@ -231,19 +230,24 @@ static const char * const tusb1210_chargers[] = { + + static bool tusb1210_get_online(struct tusb1210 *tusb) + { ++ struct power_supply *charger = NULL; + union power_supply_propval val; +- int i; ++ bool online = false; ++ int i, ret; + +- for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !tusb->charger; i++) +- tusb->charger = power_supply_get_by_name(tusb1210_chargers[i]); ++ for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !charger; i++) ++ charger = power_supply_get_by_name(tusb1210_chargers[i]); + +- if (!tusb->charger) ++ if (!charger) + return false; + +- if (power_supply_get_property(tusb->charger, POWER_SUPPLY_PROP_ONLINE, &val)) +- return false; ++ ret = power_supply_get_property(charger, POWER_SUPPLY_PROP_ONLINE, &val); ++ if (ret == 0) ++ online = val.intval; ++ ++ power_supply_put(charger); + +- return val.intval; ++ return online; + } + + static void tusb1210_chg_det_work(struct work_struct *work) +@@ -467,9 +471,6 @@ static void tusb1210_remove_charger_detect(struct tusb1210 *tusb) + cancel_delayed_work_sync(&tusb->chg_det_work); + power_supply_unregister(tusb->psy); + } +- +- if (tusb->charger) +- power_supply_put(tusb->charger); + } + #else + static void tusb1210_probe_charger_detect(struct tusb1210 *tusb) { } +-- +2.43.0 + diff --git a/queue-6.6/riscv-fix-loading-64-bit-nommu-kernels-past-the-star.patch b/queue-6.6/riscv-fix-loading-64-bit-nommu-kernels-past-the-star.patch new file mode 100644 index 00000000000..703bbe9f39f --- /dev/null +++ b/queue-6.6/riscv-fix-loading-64-bit-nommu-kernels-past-the-star.patch @@ -0,0 +1,56 @@ +From 4ed76ea1f0f1cc1b03d61cde70fc70c72e13aeeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 16:34:47 -0800 +Subject: riscv: Fix loading 64-bit NOMMU kernels past the start of RAM + +From: Samuel Holland + +[ Upstream commit aea702dde7e9876fb00571a2602f25130847bf0f ] + +commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear +mapping") added logic to allow using RAM below the kernel load address. +However, this does not work for NOMMU, where PAGE_OFFSET is fixed to the +kernel load address. Since that range of memory corresponds to PFNs +below ARCH_PFN_OFFSET, mm initialization runs off the beginning of +mem_map and corrupts adjacent kernel memory. Fix this by restoring the +previous behavior for NOMMU kernels. + +Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") +Signed-off-by: Samuel Holland +Link: https://lore.kernel.org/r/20240227003630.3634533-3-samuel.holland@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/page.h | 2 +- + arch/riscv/mm/init.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h +index 57e887bfa34cb..94b3d6930fc37 100644 +--- a/arch/riscv/include/asm/page.h ++++ b/arch/riscv/include/asm/page.h +@@ -89,7 +89,7 @@ typedef struct page *pgtable_t; + #define PTE_FMT "%08lx" + #endif + +-#ifdef CONFIG_64BIT ++#if defined(CONFIG_64BIT) && defined(CONFIG_MMU) + /* + * We override this value as its generic definition uses __pa too early in + * the boot process (before kernel_map.va_pa_offset is set). +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index b50faa232b5e9..ec02ea86aa39f 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -230,7 +230,7 @@ static void __init setup_bootmem(void) + * In 64-bit, any use of __va/__pa before this point is wrong as we + * did not know the start of DRAM before. + */ +- if (IS_ENABLED(CONFIG_64BIT)) ++ if (IS_ENABLED(CONFIG_64BIT) && IS_ENABLED(CONFIG_MMU)) + kernel_map.va_pa_offset = PAGE_OFFSET - phys_ram_base; + + /* +-- +2.43.0 + diff --git a/queue-6.6/riscv-fix-task_size-on-64-bit-nommu.patch b/queue-6.6/riscv-fix-task_size-on-64-bit-nommu.patch new file mode 100644 index 00000000000..12ba8c7d89c --- /dev/null +++ b/queue-6.6/riscv-fix-task_size-on-64-bit-nommu.patch @@ -0,0 +1,41 @@ +From f72c1cdf080507ea24b9a628a9057c0ad76204d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 16:34:46 -0800 +Subject: riscv: Fix TASK_SIZE on 64-bit NOMMU + +From: Samuel Holland + +[ Upstream commit 6065e736f82c817c9a597a31ee67f0ce4628e948 ] + +On NOMMU, userspace memory can come from anywhere in physical RAM. The +current definition of TASK_SIZE is wrong if any RAM exists above 4G, +causing spurious failures in the userspace access routines. + +Fixes: 6bd33e1ece52 ("riscv: add nommu support") +Fixes: c3f896dcf1e4 ("mm: switch the test_vmalloc module to use __vmalloc_node") +Signed-off-by: Samuel Holland +Reviewed-by: Jisheng Zhang +Reviewed-by: Bo Gan +Link: https://lore.kernel.org/r/20240227003630.3634533-2-samuel.holland@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/pgtable.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index eaa54a3a16212..719c3041ae1c2 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -903,7 +903,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) + #define PAGE_SHARED __pgprot(0) + #define PAGE_KERNEL __pgprot(0) + #define swapper_pg_dir NULL +-#define TASK_SIZE 0xffffffffUL ++#define TASK_SIZE _AC(-1, UL) + #define VMALLOC_START _AC(0, UL) + #define VMALLOC_END TASK_SIZE + +-- +2.43.0 + diff --git a/queue-6.6/riscv-fix-vmalloc_start-definition.patch b/queue-6.6/riscv-fix-vmalloc_start-definition.patch new file mode 100644 index 00000000000..a280e045830 --- /dev/null +++ b/queue-6.6/riscv-fix-vmalloc_start-definition.patch @@ -0,0 +1,70 @@ +From 27fb4b48adc1819701615802462f48bc8b3231e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 11:02:55 +0800 +Subject: riscv: fix VMALLOC_START definition + +From: Baoquan He + +[ Upstream commit ac88ff6b9d7dea9f0907c86bdae204dde7d5c0e6 ] + +When below config items are set, compiler complained: + +-------------------- +CONFIG_CRASH_CORE=y +CONFIG_KEXEC_CORE=y +CONFIG_CRASH_DUMP=y +...... +----------------------- + +------------------------------------------------------------------- +arch/riscv/kernel/crash_core.c: In function 'arch_crash_save_vmcoreinfo': +arch/riscv/kernel/crash_core.c:11:58: warning: format '%lx' expects argument of type 'long unsigned int', but argument 2 has type 'int' [-Wformat=] +11 | vmcoreinfo_append_str("NUMBER(VMALLOC_START)=0x%lx\n", VMALLOC_START); + | ~~^ + | | + | long unsigned int + | %x +---------------------------------------------------------------------- + +This is because on riscv macro VMALLOC_START has different type when +CONFIG_MMU is set or unset. + +arch/riscv/include/asm/pgtable.h: +-------------------------------------------------- + +Changing it to _AC(0, UL) in case CONFIG_MMU=n can fix the warning. + +Link: https://lkml.kernel.org/r/ZW7OsX4zQRA3mO4+@MiWiFi-R3L-srv +Signed-off-by: Baoquan He +Reported-by: Randy Dunlap +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap # build-tested +Cc: Eric DeVolder +Cc: Ignat Korchagin +Cc: Stephen Rothwell +Cc: Paul Walmsley +Cc: Palmer Dabbelt +Cc: Albert Ou +Signed-off-by: Andrew Morton +Stable-dep-of: 6065e736f82c ("riscv: Fix TASK_SIZE on 64-bit NOMMU") +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/pgtable.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index 2793304bf1b76..eaa54a3a16212 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -904,7 +904,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) + #define PAGE_KERNEL __pgprot(0) + #define swapper_pg_dir NULL + #define TASK_SIZE 0xffffffffUL +-#define VMALLOC_START 0 ++#define VMALLOC_START _AC(0, UL) + #define VMALLOC_END TASK_SIZE + + #endif /* !CONFIG_MMU */ +-- +2.43.0 + diff --git a/queue-6.6/sched-eevdf-always-update-v-if-se-on_rq-when-reweigh.patch b/queue-6.6/sched-eevdf-always-update-v-if-se-on_rq-when-reweigh.patch new file mode 100644 index 00000000000..87ffbc09ae5 --- /dev/null +++ b/queue-6.6/sched-eevdf-always-update-v-if-se-on_rq-when-reweigh.patch @@ -0,0 +1,44 @@ +From 5852e7a236db40e4713f3bb6182b2d25bdc59803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 10:21:32 +0800 +Subject: sched/eevdf: Always update V if se->on_rq when reweighting + +From: Tianchen Ding + +[ Upstream commit 11b1b8bc2b98e21ddf47e08b56c21502c685b2c3 ] + +reweight_eevdf() needs the latest V to do accurate calculation for new +ve and vd. So update V unconditionally when se is runnable. + +Fixes: eab03c23c2a1 ("sched/eevdf: Fix vruntime adjustment on reweight") +Suggested-by: Abel Wu +Signed-off-by: Tianchen Ding +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Abel Wu +Tested-by: K Prateek Nayak +Tested-by: Chen Yu +Link: https://lore.kernel.org/r/20240306022133.81008-2-dtcccc@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 69fe62126a28e..71e7cf6f77f65 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3740,9 +3740,8 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + + if (se->on_rq) { + /* commit outstanding execution time */ +- if (curr) +- update_curr(cfs_rq); +- else ++ update_curr(cfs_rq); ++ if (!curr) + __dequeue_entity(cfs_rq, se); + update_load_sub(&cfs_rq->load, se->load.weight); + } +-- +2.43.0 + diff --git a/queue-6.6/sched-eevdf-fix-miscalculation-in-reweight_entity-wh.patch b/queue-6.6/sched-eevdf-fix-miscalculation-in-reweight_entity-wh.patch new file mode 100644 index 00000000000..e3f0e66e3b6 --- /dev/null +++ b/queue-6.6/sched-eevdf-fix-miscalculation-in-reweight_entity-wh.patch @@ -0,0 +1,76 @@ +From 430214b0569e1f00bb26ccbc9760f8ec85c505c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 10:21:33 +0800 +Subject: sched/eevdf: Fix miscalculation in reweight_entity() when se is not + curr + +From: Tianchen Ding + +[ Upstream commit afae8002b4fd3560c8f5f1567f3c3202c30a70fa ] + +reweight_eevdf() only keeps V unchanged inside itself. When se != +cfs_rq->curr, it would be dequeued from rb tree first. So that V is +changed and the result is wrong. Pass the original V to reweight_eevdf() +to fix this issue. + +Fixes: eab03c23c2a1 ("sched/eevdf: Fix vruntime adjustment on reweight") +Signed-off-by: Tianchen Ding +[peterz: flip if() condition for clarity] +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Abel Wu +Link: https://lkml.kernel.org/r/20240306022133.81008-3-dtcccc@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 71e7cf6f77f65..a5466eb6a1f15 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3626,11 +3626,10 @@ static inline void + dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { } + #endif + +-static void reweight_eevdf(struct cfs_rq *cfs_rq, struct sched_entity *se, ++static void reweight_eevdf(struct sched_entity *se, u64 avruntime, + unsigned long weight) + { + unsigned long old_weight = se->load.weight; +- u64 avruntime = avg_vruntime(cfs_rq); + s64 vlag, vslice; + + /* +@@ -3737,24 +3736,26 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, + unsigned long weight) + { + bool curr = cfs_rq->curr == se; ++ u64 avruntime; + + if (se->on_rq) { + /* commit outstanding execution time */ + update_curr(cfs_rq); ++ avruntime = avg_vruntime(cfs_rq); + if (!curr) + __dequeue_entity(cfs_rq, se); + update_load_sub(&cfs_rq->load, se->load.weight); + } + dequeue_load_avg(cfs_rq, se); + +- if (!se->on_rq) { ++ if (se->on_rq) { ++ reweight_eevdf(se, avruntime, weight); ++ } else { + /* + * Because we keep se->vlag = V - v_i, while: lag_i = w_i*(V - v_i), + * we need to scale se->vlag when w_i changes. + */ + se->vlag = div_s64(se->vlag * se->load.weight, weight); +- } else { +- reweight_eevdf(cfs_rq, se, weight); + } + + update_load_set(&se->load, weight); +-- +2.43.0 + diff --git a/queue-6.6/sched-eevdf-prevent-vlag-from-going-out-of-bounds-in.patch b/queue-6.6/sched-eevdf-prevent-vlag-from-going-out-of-bounds-in.patch new file mode 100644 index 00000000000..930b9f7bde6 --- /dev/null +++ b/queue-6.6/sched-eevdf-prevent-vlag-from-going-out-of-bounds-in.patch @@ -0,0 +1,86 @@ +From 650a2fadd43573b8c3271d1b5e3d37c98f447fc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 16:22:38 +0800 +Subject: sched/eevdf: Prevent vlag from going out of bounds in + reweight_eevdf() + +From: Xuewen Yan + +[ Upstream commit 1560d1f6eb6b398bddd80c16676776c0325fe5fe ] + +It was possible to have pick_eevdf() return NULL, which then causes a +NULL-deref. This turned out to be due to entity_eligible() returning +falsely negative because of a s64 multiplcation overflow. + +Specifically, reweight_eevdf() computes the vlag without considering +the limit placed upon vlag as update_entity_lag() does, and then the +scaling multiplication (remember that weight is 20bit fixed point) can +overflow. This then leads to the new vruntime being weird which then +causes the above entity_eligible() to go side-ways and claim nothing +is eligible. + +Thus limit the range of vlag accordingly. + +All this was quite rare, but fatal when it does happen. + +Closes: https://lore.kernel.org/all/ZhuYyrh3mweP_Kd8@nz.home/ +Closes: https://lore.kernel.org/all/CA+9S74ih+45M_2TPUY_mPPVDhNvyYfy1J1ftSix+KjiTVxg8nw@mail.gmail.com/ +Closes: https://lore.kernel.org/lkml/202401301012.2ed95df0-oliver.sang@intel.com/ +Fixes: eab03c23c2a1 ("sched/eevdf: Fix vruntime adjustment on reweight") +Reported-by: Sergei Trofimovich +Reported-by: Igor Raits +Reported-by: Breno Leitao +Reported-by: kernel test robot +Reported-by: Yujie Liu +Signed-off-by: Xuewen Yan +Reviewed-and-tested-by: Chen Yu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240422082238.5784-1-xuewen.yan@unisoc.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index a5466eb6a1f15..397ef27c9bdb1 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -707,15 +707,21 @@ u64 avg_vruntime(struct cfs_rq *cfs_rq) + * + * XXX could add max_slice to the augmented data to track this. + */ +-static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se) ++static s64 entity_lag(u64 avruntime, struct sched_entity *se) + { +- s64 lag, limit; ++ s64 vlag, limit; ++ ++ vlag = avruntime - se->vruntime; ++ limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se); ++ ++ return clamp(vlag, -limit, limit); ++} + ++static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *se) ++{ + SCHED_WARN_ON(!se->on_rq); +- lag = avg_vruntime(cfs_rq) - se->vruntime; + +- limit = calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se); +- se->vlag = clamp(lag, -limit, limit); ++ se->vlag = entity_lag(avg_vruntime(cfs_rq), se); + } + + /* +@@ -3710,7 +3716,7 @@ static void reweight_eevdf(struct sched_entity *se, u64 avruntime, + * = V - vl' + */ + if (avruntime != se->vruntime) { +- vlag = (s64)(avruntime - se->vruntime); ++ vlag = entity_lag(avruntime, se); + vlag = div_s64(vlag * old_weight, weight); + se->vruntime = avruntime - vlag; + } +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 5dabd1613dc..da02179439c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -155,3 +155,25 @@ phy-qcom-qmp-combo-fix-register-base-for-qserdes_dp_phy_mode.patch phy-qcom-qmp-combo-fix-vco-div-offset-on-v3.patch x86-tdx-preserve-shared-bit-on-mprotect.patch mm-turn-folio_test_hugetlb-into-a-pagetype.patch +dmaengine-owl-fix-register-access-functions.patch +dmaengine-tegra186-fix-residual-calculation.patch +idma64-don-t-try-to-serve-interrupts-when-device-is-.patch +soundwire-amd-fix-for-wake-interrupt-handling-for-cl.patch +phy-marvell-a3700-comphy-fix-out-of-bounds-read.patch +phy-marvell-a3700-comphy-fix-hardcoded-array-size.patch +phy-freescale-imx8m-pcie-fix-pcie-link-up-instabilit.patch +phy-rockchip-snps-pcie3-fix-bifurcation-on-rk3588.patch +phy-rockchip-snps-pcie3-fix-clearing-php_grf_pciesel.patch +phy-rockchip-naneng-combphy-fix-mux-on-rk3588.patch +phy-qcom-m31-match-requested-regulator-name-with-dt-.patch +dmaengine-idxd-convert-spinlock-to-mutex-to-lock-evl.patch +dma-xilinx_dpdma-fix-locking.patch +dmaengine-idxd-fix-oops-during-rmmod-on-single-cpu-p.patch +riscv-fix-vmalloc_start-definition.patch +riscv-fix-task_size-on-64-bit-nommu.patch +riscv-fix-loading-64-bit-nommu-kernels-past-the-star.patch +phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch +sched-eevdf-always-update-v-if-se-on_rq-when-reweigh.patch +sched-eevdf-fix-miscalculation-in-reweight_entity-wh.patch +sched-eevdf-prevent-vlag-from-going-out-of-bounds-in.patch +i2c-smbus-fix-null-function-pointer-dereference.patch diff --git a/queue-6.6/soundwire-amd-fix-for-wake-interrupt-handling-for-cl.patch b/queue-6.6/soundwire-amd-fix-for-wake-interrupt-handling-for-cl.patch new file mode 100644 index 00000000000..ed5a69c5638 --- /dev/null +++ b/queue-6.6/soundwire-amd-fix-for-wake-interrupt-handling-for-cl.patch @@ -0,0 +1,96 @@ +From 6cd097baa849d9c3f28ac05d8ab6e83d38b59416 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 12:01:43 +0530 +Subject: soundwire: amd: fix for wake interrupt handling for clockstop mode + +From: Vijendar Mukunda + +[ Upstream commit 63dc588e7af1392576071a1841298198c9cddee3 ] + +When SoundWire Wake interrupt is enabled along with SoundWire Wake +enable register, SoundWire wake interrupt will be reported +when SoundWire manager is in D3 state and ACP is in D3 state. + +When SoundWire Wake interrupt is reported, it will invoke runtime +resume of the SoundWire manager device. + +In case of system level suspend, for ClockStop Mode SoundWire Wake +interrupt should be disabled. +It should be enabled only for runtime suspend scenario. +Change wake interrupt enable/disable sequence for ClockStop Mode in +system level suspend and runtime suspend sceanrio. + +Fixes: 9cf1efc5ed2d ("soundwire: amd: add pm_prepare callback and pm ops support") +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20240327063143.2266464-2-Vijendar.Mukunda@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/amd_manager.c | 15 +++++++++++++++ + drivers/soundwire/amd_manager.h | 3 ++- + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/amd_manager.c b/drivers/soundwire/amd_manager.c +index a3b1f4e6f0f90..79173ab540a6b 100644 +--- a/drivers/soundwire/amd_manager.c ++++ b/drivers/soundwire/amd_manager.c +@@ -148,6 +148,19 @@ static void amd_sdw_set_frameshape(struct amd_sdw_manager *amd_manager) + writel(frame_size, amd_manager->mmio + ACP_SW_FRAMESIZE); + } + ++static void amd_sdw_wake_enable(struct amd_sdw_manager *amd_manager, bool enable) ++{ ++ u32 wake_ctrl; ++ ++ wake_ctrl = readl(amd_manager->mmio + ACP_SW_STATE_CHANGE_STATUS_MASK_8TO11); ++ if (enable) ++ wake_ctrl |= AMD_SDW_WAKE_INTR_MASK; ++ else ++ wake_ctrl &= ~AMD_SDW_WAKE_INTR_MASK; ++ ++ writel(wake_ctrl, amd_manager->mmio + ACP_SW_STATE_CHANGE_STATUS_MASK_8TO11); ++} ++ + static void amd_sdw_ctl_word_prep(u32 *lower_word, u32 *upper_word, struct sdw_msg *msg, + int cmd_offset) + { +@@ -1122,6 +1135,7 @@ static int __maybe_unused amd_suspend(struct device *dev) + } + + if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { ++ amd_sdw_wake_enable(amd_manager, false); + return amd_sdw_clock_stop(amd_manager); + } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + /* +@@ -1148,6 +1162,7 @@ static int __maybe_unused amd_suspend_runtime(struct device *dev) + return 0; + } + if (amd_manager->power_mode_mask & AMD_SDW_CLK_STOP_MODE) { ++ amd_sdw_wake_enable(amd_manager, true); + return amd_sdw_clock_stop(amd_manager); + } else if (amd_manager->power_mode_mask & AMD_SDW_POWER_OFF_MODE) { + ret = amd_sdw_clock_stop(amd_manager); +diff --git a/drivers/soundwire/amd_manager.h b/drivers/soundwire/amd_manager.h +index 5f040151a259b..6dcc7a449346e 100644 +--- a/drivers/soundwire/amd_manager.h ++++ b/drivers/soundwire/amd_manager.h +@@ -152,7 +152,7 @@ + #define AMD_SDW0_EXT_INTR_MASK 0x200000 + #define AMD_SDW1_EXT_INTR_MASK 4 + #define AMD_SDW_IRQ_MASK_0TO7 0x77777777 +-#define AMD_SDW_IRQ_MASK_8TO11 0x000d7777 ++#define AMD_SDW_IRQ_MASK_8TO11 0x000c7777 + #define AMD_SDW_IRQ_ERROR_MASK 0xff + #define AMD_SDW_MAX_FREQ_NUM 1 + #define AMD_SDW0_MAX_TX_PORTS 3 +@@ -190,6 +190,7 @@ + #define AMD_SDW_CLK_RESUME_REQ 2 + #define AMD_SDW_CLK_RESUME_DONE 3 + #define AMD_SDW_WAKE_STAT_MASK BIT(16) ++#define AMD_SDW_WAKE_INTR_MASK BIT(16) + + static u32 amd_sdw_freq_tbl[AMD_SDW_MAX_FREQ_NUM] = { + AMD_SDW_DEFAULT_CLK_FREQ, +-- +2.43.0 +