From: Greg Kroah-Hartman Date: Sat, 23 Aug 2025 11:30:38 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.16.3~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c8bac26cad15c6d1002b4977f577648e3520e703;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch ext4-preserve-sb_i_version-on-remount.patch pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch pci-imx6-delay-link-start-until-configfs-start-written.patch pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch pci-rockchip-use-standard-pcie-definitions.patch scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch --- diff --git a/queue-6.6/arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch b/queue-6.6/arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch new file mode 100644 index 0000000000..55cae7e11c --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch @@ -0,0 +1,39 @@ +From stable+bounces-172400-greg=kroah.com@vger.kernel.org Fri Aug 22 16:07:07 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 09:59:41 -0400 +Subject: arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support +To: stable@vger.kernel.org +Cc: Judith Mendez , Vignesh Raghavendra , Sasha Levin +Message-ID: <20250822135941.1245318-1-sashal@kernel.org> + +From: Judith Mendez + +[ Upstream commit 265f70af805f33a0dfc90f50cc0f116f702c3811 ] + +For eMMC, High Speed DDR mode is not supported [0], so remove +mmc-ddr-1_8v flag which adds the capability. + +[0] https://www.ti.com/lit/gpn/am625 + +Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Judith Mendez +Link: https://lore.kernel.org/r/20250707191250.3953990-1-jm@ti.com +Signed-off-by: Vignesh Raghavendra +[ adapted context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -531,7 +531,6 @@ + clock-names = "clk_ahb", "clk_xin"; + assigned-clocks = <&k3_clks 57 6>; + assigned-clock-parents = <&k3_clks 57 8>; +- mmc-ddr-1_8v; + mmc-hs200-1_8v; + ti,trm-icp = <0x2>; + bus-width = <8>; diff --git a/queue-6.6/ext4-preserve-sb_i_version-on-remount.patch b/queue-6.6/ext4-preserve-sb_i_version-on-remount.patch new file mode 100644 index 0000000000..eda4a376a4 --- /dev/null +++ b/queue-6.6/ext4-preserve-sb_i_version-on-remount.patch @@ -0,0 +1,60 @@ +From stable+bounces-172426-greg=kroah.com@vger.kernel.org Fri Aug 22 16:27:59 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 10:19:40 -0400 +Subject: ext4: preserve SB_I_VERSION on remount +To: stable@vger.kernel.org +Cc: Baokun Li , stable@kernel.org, Jan Kara , Theodore Ts'o , Sasha Levin +Message-ID: <20250822141940.1257026-1-sashal@kernel.org> + +From: Baokun Li + +[ Upstream commit f2326fd14a224e4cccbab89e14c52279ff79b7ec ] + +IMA testing revealed that after an ext4 remount, file accesses triggered +full measurements even without modifications, instead of skipping as +expected when i_version is unchanged. + +Debugging showed `SB_I_VERSION` was cleared in reconfigure_super() during +remount due to commit 1ff20307393e ("ext4: unconditionally enable the +i_version counter") removing the fix from commit 960e0ab63b2e ("ext4: fix +i_version handling on remount"). + +To rectify this, `SB_I_VERSION` is always set for `fc->sb_flags` in +ext4_init_fs_context(), instead of `sb->s_flags` in __ext4_fill_super(), +ensuring it persists across all mounts. + +Cc: stable@kernel.org +Fixes: 1ff20307393e ("ext4: unconditionally enable the i_version counter") +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://patch.msgid.link/20250703073903.6952-2-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/super.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2028,6 +2028,9 @@ int ext4_init_fs_context(struct fs_conte + fc->fs_private = ctx; + fc->ops = &ext4_context_ops; + ++ /* i_version is always enabled now */ ++ fc->sb_flags |= SB_I_VERSION; ++ + return 0; + } + +@@ -5305,9 +5308,6 @@ static int __ext4_fill_super(struct fs_c + sb->s_flags = (sb->s_flags & ~SB_POSIXACL) | + (test_opt(sb, POSIX_ACL) ? SB_POSIXACL : 0); + +- /* i_version is always enabled now */ +- sb->s_flags |= SB_I_VERSION; +- + err = ext4_check_feature_compatibility(sb, es, silent); + if (err) + goto failed_mount; diff --git a/queue-6.6/pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch b/queue-6.6/pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch new file mode 100644 index 0000000000..c4562c3524 --- /dev/null +++ b/queue-6.6/pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch @@ -0,0 +1,43 @@ +From stable+bounces-172513-greg=kroah.com@vger.kernel.org Fri Aug 22 22:27:27 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:27:13 -0400 +Subject: PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features +To: stable@vger.kernel.org +Cc: Richard Zhu , Bjorn Helgaas , Frank Li , Sasha Levin +Message-ID: <20250822202713.1483619-1-sashal@kernel.org> + +From: Richard Zhu + +[ Upstream commit 399444a87acdea5d21c218bc8e9b621fea1cd218 ] + +For IMX8MM_EP and IMX8MP_EP, add fixed 256-byte BAR 4 and reserved BAR 5 +in imx8m_pcie_epc_features. + +Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") +Signed-off-by: Richard Zhu +[bhelgaas: add details in subject] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Frank Li +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250708091003.2582846-3-hongxing.zhu@nxp.com +[ Adapted BAR configuration to use reserved_bar bitmap and bar_fixed_size ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-imx6.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1043,7 +1043,10 @@ static const struct pci_epc_features imx + .linkup_notifier = false, + .msi_capable = true, + .msix_capable = false, +- .reserved_bar = 1 << BAR_1 | 1 << BAR_3, ++ .reserved_bar = 1 << BAR_1 | 1 << BAR_3 | 1 << BAR_5, ++ .bar_fixed_size = { ++ [BAR_4] = SZ_256, ++ }, + .align = SZ_64K, + }; + diff --git a/queue-6.6/pci-imx6-delay-link-start-until-configfs-start-written.patch b/queue-6.6/pci-imx6-delay-link-start-until-configfs-start-written.patch new file mode 100644 index 0000000000..b5f83f00ec --- /dev/null +++ b/queue-6.6/pci-imx6-delay-link-start-until-configfs-start-written.patch @@ -0,0 +1,48 @@ +From stable+bounces-172517-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:04 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:40:52 -0400 +Subject: PCI: imx6: Delay link start until configfs 'start' written +To: stable@vger.kernel.org +Cc: Richard Zhu , Manivannan Sadhasivam , Bjorn Helgaas , Frank Li , Sasha Levin +Message-ID: <20250822204052.1519937-1-sashal@kernel.org> + +From: Richard Zhu + +[ Upstream commit 2e6ea70690ddd1ffa422423fd0d4523e4dfe4b62 ] + +According to Documentation/PCI/endpoint/pci-endpoint-cfs.rst, the Endpoint +controller (EPC) should only start the link when userspace writes '1' to +the '/sys/kernel/config/pci_ep/controllers//start' attribute, which +ultimately results in calling imx_pcie_start_link() via +pci_epc_start_store(). + +To align with the documented behavior, do not start the link automatically +when adding the EP controller. + +Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") +Signed-off-by: Richard Zhu +[mani: reworded commit subject and description] +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: commit log] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Frank Li +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250709033722.2924372-3-hongxing.zhu@nxp.com +[ imx_pcie_ltssm_enable() => imx6_pcie_ltssm_enable() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-imx6.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1098,8 +1098,6 @@ static int imx6_add_pcie_ep(struct imx6_ + dev_err(dev, "failed to initialize endpoint\n"); + return ret; + } +- /* Start LTSSM. */ +- imx6_pcie_ltssm_enable(dev); + + return 0; + } diff --git a/queue-6.6/pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch b/queue-6.6/pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch new file mode 100644 index 0000000000..ad6c80bab2 --- /dev/null +++ b/queue-6.6/pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch @@ -0,0 +1,44 @@ +From stable+bounces-172519-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:13 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:40:59 -0400 +Subject: PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining +To: stable@vger.kernel.org +Cc: Geraldo Nascimento , Manivannan Sadhasivam , Bjorn Helgaas , Robin Murphy , Sasha Levin +Message-ID: <20250822204059.1520239-2-sashal@kernel.org> + +From: Geraldo Nascimento + +[ Upstream commit 114b06ee108cabc82b995fbac6672230a9776936 ] + +Rockchip controllers can support up to 5.0 GT/s link speed. But the driver +doesn't set the Target Link Speed currently. This may cause failure in +retraining the link to 5.0 GT/s if supported by the endpoint. So set the +Target Link Speed to 5.0 GT/s in the Link Control and Status Register 2. + +Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support") +Signed-off-by: Geraldo Nascimento +[mani: fixed whitespace warning, commit message rewording, added fixes tag] +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Tested-by: Robin Murphy +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/0afa6bc47b7f50e2e81b0b47d51c66feb0fb565f.1751322015.git.geraldogabriel@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-rockchip-host.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pci/controller/pcie-rockchip-host.c ++++ b/drivers/pci/controller/pcie-rockchip-host.c +@@ -339,6 +339,10 @@ static int rockchip_pcie_host_init_port( + * Enable retrain for gen2. This should be configured only after + * gen1 finished. + */ ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2); ++ status &= ~PCI_EXP_LNKCTL2_TLS; ++ status |= PCI_EXP_LNKCTL2_TLS_5_0GT; ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL2); + status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= PCI_EXP_LNKCTL_RL; + rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); diff --git a/queue-6.6/pci-rockchip-use-standard-pcie-definitions.patch b/queue-6.6/pci-rockchip-use-standard-pcie-definitions.patch new file mode 100644 index 0000000000..614010b0ab --- /dev/null +++ b/queue-6.6/pci-rockchip-use-standard-pcie-definitions.patch @@ -0,0 +1,162 @@ +From stable+bounces-172518-greg=kroah.com@vger.kernel.org Fri Aug 22 22:41:09 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 16:40:58 -0400 +Subject: PCI: rockchip: Use standard PCIe definitions +To: stable@vger.kernel.org +Cc: Geraldo Nascimento , Bjorn Helgaas , Manivannan Sadhasivam , Sasha Levin +Message-ID: <20250822204059.1520239-1-sashal@kernel.org> + +From: Geraldo Nascimento + +[ Upstream commit cbbfe9f683f0f9b6a1da2eaa53b995a4b5961086 ] + +Current code uses custom-defined register offsets and bitfields for the +standard PCIe registers. This creates duplication as the PCI header already +defines them. So, switch to using the standard PCIe definitions and drop +the custom ones. + +Suggested-by: Bjorn Helgaas +Signed-off-by: Geraldo Nascimento +[mani: commit message rewording] +Signed-off-by: Manivannan Sadhasivam +[bhelgaas: include bitfield.h] +Signed-off-by: Bjorn Helgaas +Link: https://patch.msgid.link/e81700ef4b49f584bc8834bfb07b6d8995fc1f42.1751322015.git.geraldogabriel@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-rockchip-host.c | 45 ++++++++++++++-------------- + drivers/pci/controller/pcie-rockchip.h | 11 ------ + 2 files changed, 24 insertions(+), 32 deletions(-) + +--- a/drivers/pci/controller/pcie-rockchip-host.c ++++ b/drivers/pci/controller/pcie-rockchip-host.c +@@ -11,6 +11,7 @@ + * ARM PCI Host generic driver. + */ + ++#include + #include + #include + #include +@@ -40,18 +41,18 @@ static void rockchip_pcie_enable_bw_int( + { + u32 status; + +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= (PCI_EXP_LNKCTL_LBMIE | PCI_EXP_LNKCTL_LABIE); +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + } + + static void rockchip_pcie_clr_bw_int(struct rockchip_pcie *rockchip) + { + u32 status; + +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= (PCI_EXP_LNKSTA_LBMS | PCI_EXP_LNKSTA_LABS) << 16; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + } + + static void rockchip_pcie_update_txcredit_mui(struct rockchip_pcie *rockchip) +@@ -269,7 +270,7 @@ static void rockchip_pcie_set_power_limi + scale = 3; /* 0.001x */ + curr = curr / 1000; /* convert to mA */ + power = (curr * 3300) / 1000; /* milliwatt */ +- while (power > PCIE_RC_CONFIG_DCR_CSPL_LIMIT) { ++ while (power > FIELD_MAX(PCI_EXP_DEVCAP_PWR_VAL)) { + if (!scale) { + dev_warn(rockchip->dev, "invalid power supply\n"); + return; +@@ -278,10 +279,10 @@ static void rockchip_pcie_set_power_limi + power = power / 10; + } + +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCR); +- status |= (power << PCIE_RC_CONFIG_DCR_CSPL_SHIFT) | +- (scale << PCIE_RC_CONFIG_DCR_CPLS_SHIFT); +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCR); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP); ++ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_VAL, power); ++ status |= FIELD_PREP(PCI_EXP_DEVCAP_PWR_SCL, scale); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCAP); + } + + /** +@@ -309,14 +310,14 @@ static int rockchip_pcie_host_init_port( + rockchip_pcie_set_power_limit(rockchip); + + /* Set RC's clock architecture as common clock */ +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= PCI_EXP_LNKSTA_SLC << 16; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + + /* Set RC's RCB to 128 */ +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= PCI_EXP_LNKCTL_RCB; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + + /* Enable Gen1 training */ + rockchip_pcie_write(rockchip, PCIE_CLIENT_LINK_TRAIN_ENABLE, +@@ -338,9 +339,9 @@ static int rockchip_pcie_host_init_port( + * Enable retrain for gen2. This should be configured only after + * gen1 finished. + */ +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LCS); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + status |= PCI_EXP_LNKCTL_RL; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LCS); ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCTL); + + err = readl_poll_timeout(rockchip->apb_base + PCIE_CORE_CTRL, + status, PCIE_LINK_IS_GEN2(status), 20, +@@ -377,15 +378,15 @@ static int rockchip_pcie_host_init_port( + + /* Clear L0s from RC's link cap */ + if (of_property_read_bool(dev->of_node, "aspm-no-l0s")) { +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_LINK_CAP); +- status &= ~PCIE_RC_CONFIG_LINK_CAP_L0S; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_LINK_CAP); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP); ++ status &= ~PCI_EXP_LNKCAP_ASPM_L0S; ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_LNKCAP); + } + +- status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_DCSR); +- status &= ~PCIE_RC_CONFIG_DCSR_MPS_MASK; +- status |= PCIE_RC_CONFIG_DCSR_MPS_256; +- rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_DCSR); ++ status = rockchip_pcie_read(rockchip, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL); ++ status &= ~PCI_EXP_DEVCTL_PAYLOAD; ++ status |= PCI_EXP_DEVCTL_PAYLOAD_256B; ++ rockchip_pcie_write(rockchip, status, PCIE_RC_CONFIG_CR + PCI_EXP_DEVCTL); + + return 0; + err_power_off_phy: +--- a/drivers/pci/controller/pcie-rockchip.h ++++ b/drivers/pci/controller/pcie-rockchip.h +@@ -144,16 +144,7 @@ + #define PCIE_EP_CONFIG_BASE 0xa00000 + #define PCIE_EP_CONFIG_DID_VID (PCIE_EP_CONFIG_BASE + 0x00) + #define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08) +-#define PCIE_RC_CONFIG_DCR (PCIE_RC_CONFIG_BASE + 0xc4) +-#define PCIE_RC_CONFIG_DCR_CSPL_SHIFT 18 +-#define PCIE_RC_CONFIG_DCR_CSPL_LIMIT 0xff +-#define PCIE_RC_CONFIG_DCR_CPLS_SHIFT 26 +-#define PCIE_RC_CONFIG_DCSR (PCIE_RC_CONFIG_BASE + 0xc8) +-#define PCIE_RC_CONFIG_DCSR_MPS_MASK GENMASK(7, 5) +-#define PCIE_RC_CONFIG_DCSR_MPS_256 (0x1 << 5) +-#define PCIE_RC_CONFIG_LINK_CAP (PCIE_RC_CONFIG_BASE + 0xcc) +-#define PCIE_RC_CONFIG_LINK_CAP_L0S BIT(10) +-#define PCIE_RC_CONFIG_LCS (PCIE_RC_CONFIG_BASE + 0xd0) ++#define PCIE_RC_CONFIG_CR (PCIE_RC_CONFIG_BASE + 0xc0) + #define PCIE_RC_CONFIG_L1_SUBSTATE_CTRL2 (PCIE_RC_CONFIG_BASE + 0x90c) + #define PCIE_RC_CONFIG_THP_CAP (PCIE_RC_CONFIG_BASE + 0x274) + #define PCIE_RC_CONFIG_THP_CAP_NEXT_MASK GENMASK(31, 20) diff --git a/queue-6.6/scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch b/queue-6.6/scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch new file mode 100644 index 0000000000..e40548b604 --- /dev/null +++ b/queue-6.6/scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch @@ -0,0 +1,56 @@ +From stable+bounces-172452-greg=kroah.com@vger.kernel.org Fri Aug 22 17:13:57 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 10:59:41 -0400 +Subject: scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers +To: stable@vger.kernel.org +Cc: Ranjan Kumar , "Martin K. Petersen" , Sasha Levin +Message-ID: <20250822145943.1276044-1-sashal@kernel.org> + +From: Ranjan Kumar + +[ Upstream commit 6853885b21cb1d7157cc14c9d30cc17141565bae ] + +The volatile qualifier is redundant for __iomem pointers. + +Cleaned up usage in mpi3mr_writeq() and sysif_regs pointer as per +Upstream compliance. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20250627194539.48851-3-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Stable-dep-of: c91e140c82eb ("scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/mpi3mr/mpi3mr.h | 2 +- + drivers/scsi/mpi3mr/mpi3mr_fw.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/mpi3mr/mpi3mr.h ++++ b/drivers/scsi/mpi3mr/mpi3mr.h +@@ -1055,7 +1055,7 @@ struct mpi3mr_ioc { + char name[MPI3MR_NAME_LENGTH]; + char driver_name[MPI3MR_NAME_LENGTH]; + +- volatile struct mpi3_sysif_registers __iomem *sysif_regs; ++ struct mpi3_sysif_registers __iomem *sysif_regs; + resource_size_t sysif_regs_phys; + int bars; + u64 dma_mask; +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -23,12 +23,12 @@ module_param(poll_queues, int, 0444); + MODULE_PARM_DESC(poll_queues, "Number of queues for io_uring poll mode. (Range 1 - 126)"); + + #if defined(writeq) && defined(CONFIG_64BIT) +-static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr) ++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr) + { + writeq(b, addr); + } + #else +-static inline void mpi3mr_writeq(__u64 b, volatile void __iomem *addr) ++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr) + { + __u64 data_out = b; + diff --git a/queue-6.6/scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch b/queue-6.6/scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch new file mode 100644 index 0000000000..50de30baee --- /dev/null +++ b/queue-6.6/scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch @@ -0,0 +1,104 @@ +From stable+bounces-172453-greg=kroah.com@vger.kernel.org Fri Aug 22 17:03:58 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 10:59:42 -0400 +Subject: scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems +To: stable@vger.kernel.org +Cc: Ranjan Kumar , "Martin K. Petersen" , Sasha Levin +Message-ID: <20250822145943.1276044-2-sashal@kernel.org> + +From: Ranjan Kumar + +[ Upstream commit c91e140c82eb58724c435f623702e51cc7896646 ] + +On 32-bit systems, 64-bit BAR writes to admin queue registers are +performed as two 32-bit writes. Without locking, this can cause partial +writes when accessed concurrently. + +Updated per-queue spinlocks is used to serialize these writes and prevent +race conditions. + +Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") +Cc: stable@vger.kernel.org +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20250627194539.48851-4-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/mpi3mr/mpi3mr.h | 4 ++++ + drivers/scsi/mpi3mr/mpi3mr_fw.c | 15 +++++++++++---- + drivers/scsi/mpi3mr/mpi3mr_os.c | 2 ++ + 3 files changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/mpi3mr/mpi3mr.h ++++ b/drivers/scsi/mpi3mr/mpi3mr.h +@@ -1025,6 +1025,8 @@ struct scmd_priv { + * @logdata_buf: Circular buffer to store log data entries + * @logdata_buf_idx: Index of entry in buffer to store + * @logdata_entry_sz: log data entry size ++ * @adm_req_q_bar_writeq_lock: Admin request queue lock ++ * @adm_reply_q_bar_writeq_lock: Admin reply queue lock + * @pend_large_data_sz: Counter to track pending large data + * @io_throttle_data_length: I/O size to track in 512b blocks + * @io_throttle_high: I/O size to start throttle in 512b blocks +@@ -1207,6 +1209,8 @@ struct mpi3mr_ioc { + u8 *logdata_buf; + u16 logdata_buf_idx; + u16 logdata_entry_sz; ++ spinlock_t adm_req_q_bar_writeq_lock; ++ spinlock_t adm_reply_q_bar_writeq_lock; + + atomic_t pend_large_data_sz; + u32 io_throttle_data_length; +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -23,17 +23,22 @@ module_param(poll_queues, int, 0444); + MODULE_PARM_DESC(poll_queues, "Number of queues for io_uring poll mode. (Range 1 - 126)"); + + #if defined(writeq) && defined(CONFIG_64BIT) +-static inline void mpi3mr_writeq(__u64 b, void __iomem *addr) ++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr, ++ spinlock_t *write_queue_lock) + { + writeq(b, addr); + } + #else +-static inline void mpi3mr_writeq(__u64 b, void __iomem *addr) ++static inline void mpi3mr_writeq(__u64 b, void __iomem *addr, ++ spinlock_t *write_queue_lock) + { + __u64 data_out = b; ++ unsigned long flags; + ++ spin_lock_irqsave(write_queue_lock, flags); + writel((u32)(data_out), addr); + writel((u32)(data_out >> 32), (addr + 4)); ++ spin_unlock_irqrestore(write_queue_lock, flags); + } + #endif + +@@ -2666,9 +2671,11 @@ static int mpi3mr_setup_admin_qpair(stru + (mrioc->num_admin_req); + writel(num_admin_entries, &mrioc->sysif_regs->admin_queue_num_entries); + mpi3mr_writeq(mrioc->admin_req_dma, +- &mrioc->sysif_regs->admin_request_queue_address); ++ &mrioc->sysif_regs->admin_request_queue_address, ++ &mrioc->adm_req_q_bar_writeq_lock); + mpi3mr_writeq(mrioc->admin_reply_dma, +- &mrioc->sysif_regs->admin_reply_queue_address); ++ &mrioc->sysif_regs->admin_reply_queue_address, ++ &mrioc->adm_reply_q_bar_writeq_lock); + writel(mrioc->admin_req_pi, &mrioc->sysif_regs->admin_request_queue_pi); + writel(mrioc->admin_reply_ci, &mrioc->sysif_regs->admin_reply_queue_ci); + return retval; +--- a/drivers/scsi/mpi3mr/mpi3mr_os.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c +@@ -5102,6 +5102,8 @@ mpi3mr_probe(struct pci_dev *pdev, const + spin_lock_init(&mrioc->tgtdev_lock); + spin_lock_init(&mrioc->watchdog_lock); + spin_lock_init(&mrioc->chain_buf_lock); ++ spin_lock_init(&mrioc->adm_req_q_bar_writeq_lock); ++ spin_lock_init(&mrioc->adm_reply_q_bar_writeq_lock); + spin_lock_init(&mrioc->sas_node_lock); + + INIT_LIST_HEAD(&mrioc->fwevt_list); diff --git a/queue-6.6/scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch b/queue-6.6/scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch new file mode 100644 index 0000000000..903678d5e3 --- /dev/null +++ b/queue-6.6/scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch @@ -0,0 +1,58 @@ +From stable+bounces-172470-greg=kroah.com@vger.kernel.org Fri Aug 22 19:00:37 2025 +From: Sasha Levin +Date: Fri, 22 Aug 2025 13:00:28 -0400 +Subject: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE +To: stable@vger.kernel.org +Cc: "André Draszik" , "Bart Van Assche" , "Peter Griffin" , "Martin K. Petersen" , "Sasha Levin" +Message-ID: <20250822170028.1318459-1-sashal@kernel.org> + +From: André Draszik + +[ Upstream commit 01aad16c2257ab8ff33b152b972c9f2e1af47912 ] + +On Google gs101, the number of UTP transfer request slots (nutrs) is 32, +and in this case the driver ends up programming the UTRL_NEXUS_TYPE +incorrectly as 0. + +This is because the left hand side of the shift is 1, which is of type +int, i.e. 31 bits wide. Shifting by more than that width results in +undefined behaviour. + +Fix this by switching to the BIT() macro, which applies correct type +casting as required. This ensures the correct value is written to +UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift +warning: + + UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 + shift exponent 32 is too large for 32-bit type 'int' + +For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE +write. + +Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs") +Cc: stable@vger.kernel.org +Signed-off-by: André Draszik +Link: https://lore.kernel.org/r/20250707-ufs-exynos-shift-v1-1-1418e161ae40@linaro.org +Reviewed-by: Bart Van Assche +Reviewed-by: Peter Griffin +Signed-off-by: Martin K. Petersen +[ Adapted context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/host/ufs-exynos.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/ufs/host/ufs-exynos.c ++++ b/drivers/ufs/host/ufs-exynos.c +@@ -1028,8 +1028,8 @@ static int exynos_ufs_post_link(struct u + hci_writel(ufs, 0xa, HCI_DATA_REORDER); + hci_writel(ufs, PRDT_SET_SIZE(12), HCI_TXPRDT_ENTRY_SIZE); + hci_writel(ufs, PRDT_SET_SIZE(12), HCI_RXPRDT_ENTRY_SIZE); +- hci_writel(ufs, (1 << hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE); +- hci_writel(ufs, (1 << hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE); ++ hci_writel(ufs, BIT(hba->nutrs) - 1, HCI_UTRL_NEXUS_TYPE); ++ hci_writel(ufs, BIT(hba->nutmrs) - 1, HCI_UTMRL_NEXUS_TYPE); + hci_writel(ufs, 0xf, HCI_AXIDMA_RWDATA_BURST_LEN); + + if (ufs->opts & EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB) diff --git a/queue-6.6/series b/queue-6.6/series index dfab38daeb..ea891e4914 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -490,3 +490,12 @@ drm-amd-display-fix-dp-audio-dto1-clock-source-on-dce-6.patch drm-amd-display-find-first-crtc-and-its-line-time-in-dce110_fill_display_configs.patch drm-amd-display-fill-display-clock-and-vblank-time-in-dce110_fill_display_configs.patch soc-qcom-mdt_loader-fix-error-return-values-in-mdt_header_valid.patch +pci-rockchip-use-standard-pcie-definitions.patch +pci-rockchip-set-target-link-speed-to-5.0-gt-s-before-retraining.patch +pci-imx6-delay-link-start-until-configfs-start-written.patch +pci-imx6-add-imx8mm_ep-and-imx8mp_ep-fixed-256-byte-bar-4-in-epc_features.patch +scsi-ufs-exynos-fix-programming-of-hci_utrl_nexus_type.patch +scsi-mpi3mr-drop-unnecessary-volatile-from-__iomem-pointers.patch +scsi-mpi3mr-serialize-admin-queue-bar-writes-on-32-bit-systems.patch +ext4-preserve-sb_i_version-on-remount.patch +arm64-dts-ti-k3-am62-main-remove-emmc-high-speed-ddr-support.patch