From: Greg Kroah-Hartman Date: Sun, 16 Mar 2025 08:02:15 +0000 (+0100) Subject: 6.13-stable patches X-Git-Tag: v6.6.84~34^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d8ba643f7d9a78a226f4986ebd8aeb953729a55a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.13-stable patches added patches: arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch asoc-intel-sof_sdw-fix-unlikely-uninitialized-variable-use-in-create_sdw_dailinks.patch asoc-tegra-fix-adx-s24_le-audio-format.patch clk-samsung-gs101-fix-synchronous-external-abort-in-samsung_clk_save.patch clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch drm-amd-amdkfd-evict-all-queues-even-hws-remove-queue-failed.patch drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch drm-amd-display-fix-default-brightness.patch drm-amd-display-fix-missing-.is_two_pixels_per_container.patch drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch drm-amdgpu-display-allow-dcc-for-video-formats-on-gfx12.patch drm-amdgpu-null-check-bo-s-backing-store-when-determining-gfx12-pte-flags.patch drm-amdgpu-vce2-fix-ip-block-reference.patch drm-atomic-filter-out-redundant-dpms-calls.patch drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch drm-panic-fix-overindented-list-items-in-documentation.patch drm-panic-use-div_ceil-to-clean-clippy-warning.patch fix-mmu-notifiers-for-range-based-invalidates.patch input-ads7846-fix-gpiod-allocation.patch input-goodix-berlin-fix-vddio-regulator-references.patch input-i8042-add-required-quirks-for-missing-old-boardnames.patch input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch input-iqs7222-preserve-system-status-register.patch input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch input-xpad-add-multiple-supported-devices.patch input-xpad-add-support-for-tecno-pocket-go.patch input-xpad-add-support-for-zotac-gaming-zone.patch input-xpad-rename-qh-controller-to-legion-go-s.patch ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch ksmbd-prevent-connection-release-during-oplock-break-notification.patch net-mana-cleanup-mana-struct-after-debugfs_remove.patch net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch netmem-prevent-tx-of-unreadable-skbs.patch qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch rust-alloc-satisfy-posix-alignment-requirement.patch rust-disallow-btf-generation-with-rust-lto.patch rust-init-fix-zeroable-implementation-for-option-nonnull-t-and-option-kbox-t.patch rust-lockdep-remove-support-for-dynamically-allocated-lockclasskeys.patch rust-remove-leftover-mentions-of-the-alloc-crate.patch smb-client-fix-regression-with-guest-option.patch spi-microchip-core-prevent-rx-overflows-when-transmit-size-fifo-size.patch usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch usb-serial-option-add-telit-cinterion-fe990b-compositions.patch usb-serial-option-fix-telit-cinterion-fe990a-name.patch usb-serial-option-match-on-interface-class-for-telit-fn990b.patch usb-typec-tcpm-fix-state-transition-for-snk_wait_capabilities-state-in-run_state_machine.patch x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch --- diff --git a/queue-6.13/arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch b/queue-6.13/arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch new file mode 100644 index 0000000000..81d1876bd2 --- /dev/null +++ b/queue-6.13/arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch @@ -0,0 +1,62 @@ +From d4234d131b0a3f9e65973f1cdc71bb3560f5d14b Mon Sep 17 00:00:00 2001 +From: Zhenhua Huang +Date: Tue, 4 Mar 2025 15:27:00 +0800 +Subject: arm64: mm: Populate vmemmap at the page level if not section aligned + +From: Zhenhua Huang + +commit d4234d131b0a3f9e65973f1cdc71bb3560f5d14b upstream. + +On the arm64 platform with 4K base page config, SECTION_SIZE_BITS is set +to 27, making one section 128M. The related page struct which vmemmap +points to is 2M then. +Commit c1cc1552616d ("arm64: MMU initialisation") optimizes the +vmemmap to populate at the PMD section level which was suitable +initially since hot plug granule is always one section(128M). However, +commit ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug") +introduced a 2M(SUBSECTION_SIZE) hot plug granule, which disrupted the +existing arm64 assumptions. + +The first problem is that if start or end is not aligned to a section +boundary, such as when a subsection is hot added, populating the entire +section is wasteful. + +The next problem is if we hotplug something that spans part of 128 MiB +section (subsections, let's call it memblock1), and then hotplug something +that spans another part of a 128 MiB section(subsections, let's call it +memblock2), and subsequently unplug memblock1, vmemmap_free() will clear +the entire PMD entry which also supports memblock2 even though memblock2 +is still active. + +Assuming hotplug/unplug sizes are guaranteed to be symmetric. Do the +fix similar to x86-64: populate to pages levels if start/end is not aligned +with section boundary. + +Cc: stable@vger.kernel.org # v5.4+ +Fixes: ba72b4c8cf60 ("mm/sparsemem: support sub-section hotplug") +Acked-by: David Hildenbrand +Signed-off-by: Zhenhua Huang +Reviewed-by: Oscar Salvador +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/20250304072700.3405036-1-quic_zhenhuah@quicinc.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/mm/mmu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1176,8 +1176,11 @@ int __meminit vmemmap_populate(unsigned + struct vmem_altmap *altmap) + { + WARN_ON((start < VMEMMAP_START) || (end > VMEMMAP_END)); ++ /* [start, end] should be within one section */ ++ WARN_ON_ONCE(end - start > PAGES_PER_SECTION * sizeof(struct page)); + +- if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES)) ++ if (!IS_ENABLED(CONFIG_ARM64_4K_PAGES) || ++ (end - start < PAGES_PER_SECTION * sizeof(struct page))) + return vmemmap_populate_basepages(start, end, node, altmap); + else + return vmemmap_populate_hugepages(start, end, node, altmap); diff --git a/queue-6.13/asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch b/queue-6.13/asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch new file mode 100644 index 0000000000..313ab28581 --- /dev/null +++ b/queue-6.13/asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch @@ -0,0 +1,45 @@ +From 0704a15b930cf97073ce091a0cd7ad32f2304329 Mon Sep 17 00:00:00 2001 +From: Thomas Mizrahi +Date: Sat, 8 Mar 2025 01:06:28 -0300 +Subject: ASoC: amd: yc: Support mic on another Lenovo ThinkPad E16 Gen 2 model + +From: Thomas Mizrahi + +commit 0704a15b930cf97073ce091a0cd7ad32f2304329 upstream. + +The internal microphone on the Lenovo ThinkPad E16 model requires a +quirk entry to work properly. This was fixed in a previous patch (linked +below), but depending on the specific variant of the model, the product +name may be "21M5" or "21M6". + +The following patch fixed this issue for the 21M5 variant: + https://lore.kernel.org/all/20240725065442.9293-1-tiwai@suse.de/ + +This patch adds support for the microphone on the 21M6 variant. + +Link: https://github.com/ramaureirac/thinkpad-e14-linux/issues/31 +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Mizrahi +Link: https://patch.msgid.link/20250308041303.198765-1-thomasmizra@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -252,6 +252,13 @@ static const struct dmi_system_id yc_acp + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21M6"), ++ } ++ }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21ME"), + } + }, diff --git a/queue-6.13/asoc-intel-sof_sdw-fix-unlikely-uninitialized-variable-use-in-create_sdw_dailinks.patch b/queue-6.13/asoc-intel-sof_sdw-fix-unlikely-uninitialized-variable-use-in-create_sdw_dailinks.patch new file mode 100644 index 0000000000..3ec1a207fe --- /dev/null +++ b/queue-6.13/asoc-intel-sof_sdw-fix-unlikely-uninitialized-variable-use-in-create_sdw_dailinks.patch @@ -0,0 +1,39 @@ +From 4363f02a39e25e80e68039b4323c570b0848ec66 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Mon, 3 Mar 2025 14:55:52 +0800 +Subject: ASoC: Intel: sof_sdw: Fix unlikely uninitialized variable use in create_sdw_dailinks() + +From: Peter Ujfalusi + +commit 4363f02a39e25e80e68039b4323c570b0848ec66 upstream. + +Initialize current_be_id to 0 to handle the unlikely case when there are +no devices connected to a DAI. +In this case create_sdw_dailink() would return without touching the passed +pointer to current_be_id. + +Found by gcc -fanalyzer + +Fixes: 59bf457d8055 ("ASoC: intel: sof_sdw: Factor out SoundWire DAI creation") +Signed-off-by: Peter Ujfalusi +Cc: stable@vger.kernel.org +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://patch.msgid.link/20250303065552.78328-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/intel/boards/sof_sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -945,7 +945,7 @@ static int create_sdw_dailinks(struct sn + + /* generate DAI links by each sdw link */ + while (sof_dais->initialised) { +- int current_be_id; ++ int current_be_id = 0; + + ret = create_sdw_dailink(card, sof_dais, dai_links, + ¤t_be_id, codec_conf); diff --git a/queue-6.13/asoc-tegra-fix-adx-s24_le-audio-format.patch b/queue-6.13/asoc-tegra-fix-adx-s24_le-audio-format.patch new file mode 100644 index 0000000000..bcd4f60c86 --- /dev/null +++ b/queue-6.13/asoc-tegra-fix-adx-s24_le-audio-format.patch @@ -0,0 +1,47 @@ +From 3d6c9dd4cb3013fe83524949b914f1497855e3de Mon Sep 17 00:00:00 2001 +From: Thorsten Blum +Date: Sat, 22 Feb 2025 23:56:59 +0100 +Subject: ASoC: tegra: Fix ADX S24_LE audio format + +From: Thorsten Blum + +commit 3d6c9dd4cb3013fe83524949b914f1497855e3de upstream. + +Commit 4204eccc7b2a ("ASoC: tegra: Add support for S24_LE audio format") +added support for the S24_LE audio format, but duplicated S16_LE in +OUT_DAI() for ADX instead. + +Fix this by adding support for the S24_LE audio format. + +Compile-tested only. + +Cc: stable@vger.kernel.org +Fixes: 4204eccc7b2a ("ASoC: tegra: Add support for S24_LE audio format") +Signed-off-by: Thorsten Blum +Link: https://patch.msgid.link/20250222225700.539673-2-thorsten.blum@linux.dev +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/tegra/tegra210_adx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/tegra/tegra210_adx.c ++++ b/sound/soc/tegra/tegra210_adx.c +@@ -264,7 +264,7 @@ static const struct snd_soc_dai_ops tegr + .rates = SNDRV_PCM_RATE_8000_192000, \ + .formats = SNDRV_PCM_FMTBIT_S8 | \ + SNDRV_PCM_FMTBIT_S16_LE | \ +- SNDRV_PCM_FMTBIT_S16_LE | \ ++ SNDRV_PCM_FMTBIT_S24_LE | \ + SNDRV_PCM_FMTBIT_S32_LE, \ + }, \ + .capture = { \ +@@ -274,7 +274,7 @@ static const struct snd_soc_dai_ops tegr + .rates = SNDRV_PCM_RATE_8000_192000, \ + .formats = SNDRV_PCM_FMTBIT_S8 | \ + SNDRV_PCM_FMTBIT_S16_LE | \ +- SNDRV_PCM_FMTBIT_S16_LE | \ ++ SNDRV_PCM_FMTBIT_S24_LE | \ + SNDRV_PCM_FMTBIT_S32_LE, \ + }, \ + .ops = &tegra210_adx_out_dai_ops, \ diff --git a/queue-6.13/clk-samsung-gs101-fix-synchronous-external-abort-in-samsung_clk_save.patch b/queue-6.13/clk-samsung-gs101-fix-synchronous-external-abort-in-samsung_clk_save.patch new file mode 100644 index 0000000000..71d1b6e7f6 --- /dev/null +++ b/queue-6.13/clk-samsung-gs101-fix-synchronous-external-abort-in-samsung_clk_save.patch @@ -0,0 +1,49 @@ +From f2052a4a62465c0037aef7ea7426bffdb3531e41 Mon Sep 17 00:00:00 2001 +From: Peter Griffin +Date: Mon, 3 Mar 2025 13:11:21 +0000 +Subject: clk: samsung: gs101: fix synchronous external abort in samsung_clk_save() + +From: Peter Griffin + +commit f2052a4a62465c0037aef7ea7426bffdb3531e41 upstream. + +EARLY_WAKEUP_SW_TRIG_*_SET and EARLY_WAKEUP_SW_TRIG_*_CLEAR +registers are only writeable. Attempting to read these registers +during samsung_clk_save() causes a synchronous external abort. + +Remove these 8 registers from cmu_top_clk_regs[] array so that +system suspend gets further. + +Note: the code path can be exercised using the following command: +echo mem > /sys/power/state + +Fixes: 2c597bb7d66a ("clk: samsung: clk-gs101: Add cmu_top, cmu_misc and cmu_apm support") +Signed-off-by: Peter Griffin +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250303-clk-suspend-fix-v1-1-c2edaf66260f@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/samsung/clk-gs101.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/clk/samsung/clk-gs101.c ++++ b/drivers/clk/samsung/clk-gs101.c +@@ -382,17 +382,9 @@ static const unsigned long cmu_top_clk_r + EARLY_WAKEUP_DPU_DEST, + EARLY_WAKEUP_CSIS_DEST, + EARLY_WAKEUP_SW_TRIG_APM, +- EARLY_WAKEUP_SW_TRIG_APM_SET, +- EARLY_WAKEUP_SW_TRIG_APM_CLEAR, + EARLY_WAKEUP_SW_TRIG_CLUSTER0, +- EARLY_WAKEUP_SW_TRIG_CLUSTER0_SET, +- EARLY_WAKEUP_SW_TRIG_CLUSTER0_CLEAR, + EARLY_WAKEUP_SW_TRIG_DPU, +- EARLY_WAKEUP_SW_TRIG_DPU_SET, +- EARLY_WAKEUP_SW_TRIG_DPU_CLEAR, + EARLY_WAKEUP_SW_TRIG_CSIS, +- EARLY_WAKEUP_SW_TRIG_CSIS_SET, +- EARLY_WAKEUP_SW_TRIG_CSIS_CLEAR, + CLK_CON_MUX_MUX_CLKCMU_BO_BUS, + CLK_CON_MUX_MUX_CLKCMU_BUS0_BUS, + CLK_CON_MUX_MUX_CLKCMU_BUS1_BUS, diff --git a/queue-6.13/clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch b/queue-6.13/clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch new file mode 100644 index 0000000000..6d9c903863 --- /dev/null +++ b/queue-6.13/clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch @@ -0,0 +1,45 @@ +From 53517a70873c7a91675f7244768aad5006cc45de Mon Sep 17 00:00:00 2001 +From: Varada Pavani +Date: Tue, 25 Feb 2025 18:49:18 +0530 +Subject: clk: samsung: update PLL locktime for PLL142XX used on FSD platform + +From: Varada Pavani + +commit 53517a70873c7a91675f7244768aad5006cc45de upstream. + +Currently PLL142XX locktime is 270. As per spec, it should be 150. Hence +update PLL142XX controller locktime to 150. + +Cc: stable@vger.kernel.org +Fixes: 4f346005aaed ("clk: samsung: fsd: Add initial clock support") +Signed-off-by: Varada Pavani +Link: https://lore.kernel.org/r/20250225131918.50925-3-v.pavani@samsung.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/samsung/clk-pll.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/clk/samsung/clk-pll.c ++++ b/drivers/clk/samsung/clk-pll.c +@@ -206,6 +206,7 @@ static const struct clk_ops samsung_pll3 + */ + /* Maximum lock time can be 270 * PDIV cycles */ + #define PLL35XX_LOCK_FACTOR (270) ++#define PLL142XX_LOCK_FACTOR (150) + + #define PLL35XX_MDIV_MASK (0x3FF) + #define PLL35XX_PDIV_MASK (0x3F) +@@ -272,7 +273,11 @@ static int samsung_pll35xx_set_rate(stru + } + + /* Set PLL lock time. */ +- writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR, ++ if (pll->type == pll_142xx) ++ writel_relaxed(rate->pdiv * PLL142XX_LOCK_FACTOR, ++ pll->lock_reg); ++ else ++ writel_relaxed(rate->pdiv * PLL35XX_LOCK_FACTOR, + pll->lock_reg); + + /* Change PLL PMS values */ diff --git a/queue-6.13/dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch b/queue-6.13/dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch new file mode 100644 index 0000000000..647b0992d2 --- /dev/null +++ b/queue-6.13/dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch @@ -0,0 +1,31 @@ +From 57e9417f69839cb10f7ffca684c38acd28ceb57b Mon Sep 17 00:00:00 2001 +From: Kent Overstreet +Date: Sat, 8 Mar 2025 10:50:08 -0500 +Subject: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature + +From: Kent Overstreet + +commit 57e9417f69839cb10f7ffca684c38acd28ceb57b upstream. + +Fix memory corruption due to incorrect parameter being passed to bio_init + +Signed-off-by: Kent Overstreet +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org # v6.5+ +Fixes: 1d9a94389853 ("dm flakey: clone pages on write bio before corrupting them") +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-flakey.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-flakey.c ++++ b/drivers/md/dm-flakey.c +@@ -426,7 +426,7 @@ static struct bio *clone_bio(struct dm_t + if (!clone) + return NULL; + +- bio_init(clone, fc->dev->bdev, bio->bi_inline_vecs, nr_iovecs, bio->bi_opf); ++ bio_init(clone, fc->dev->bdev, clone->bi_inline_vecs, nr_iovecs, bio->bi_opf); + + clone->bi_iter.bi_sector = flakey_map_sector(ti, bio->bi_iter.bi_sector); + clone->bi_private = bio; diff --git a/queue-6.13/drm-amd-amdkfd-evict-all-queues-even-hws-remove-queue-failed.patch b/queue-6.13/drm-amd-amdkfd-evict-all-queues-even-hws-remove-queue-failed.patch new file mode 100644 index 0000000000..3094726f2b --- /dev/null +++ b/queue-6.13/drm-amd-amdkfd-evict-all-queues-even-hws-remove-queue-failed.patch @@ -0,0 +1,52 @@ +From 0882ca4eecfe8b0013f339144acf886a0a0de41f Mon Sep 17 00:00:00 2001 +From: Yifan Zha +Date: Wed, 5 Mar 2025 13:14:55 +0800 +Subject: drm/amd/amdkfd: Evict all queues even HWS remove queue failed + +From: Yifan Zha + +commit 0882ca4eecfe8b0013f339144acf886a0a0de41f upstream. + +[Why] +If reset is detected and kfd need to evict working queues, HWS moving queue will be failed. +Then remaining queues are not evicted and in active state. + +After reset done, kfd uses HWS to termination remaining activated queues but HWS is resetted. +So remove queue will be failed again. + +[How] +Keep removing all queues even if HWS returns failed. +It will not affect cpsch as it checks reset_domain->sem. + +v2: If any queue failed, evict queue returns error. +v3: Declare err inside the if-block. + +Reviewed-by: Felix Kuehling +Signed-off-by: Yifan Zha +Signed-off-by: Alex Deucher +(cherry picked from commit 42c854b8fb0cce512534aa2b7141948e80c6ebb0) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -1230,11 +1230,13 @@ static int evict_process_queues_cpsch(st + decrement_queue_count(dqm, qpd, q); + + if (dqm->dev->kfd->shared_resources.enable_mes) { +- retval = remove_queue_mes(dqm, q, qpd); +- if (retval) { ++ int err; ++ ++ err = remove_queue_mes(dqm, q, qpd); ++ if (err) { + dev_err(dev, "Failed to evict queue %d\n", + q->properties.queue_id); +- goto out; ++ retval = err; + } + } + } diff --git a/queue-6.13/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch b/queue-6.13/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch new file mode 100644 index 0000000000..4580ffe673 --- /dev/null +++ b/queue-6.13/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch @@ -0,0 +1,49 @@ +From 79e31396fdd7037c503e6add15af7cb00633ea92 Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Thu, 27 Feb 2025 16:36:25 -0700 +Subject: drm/amd/display: Assign normalized_pix_clk when color depth = 14 + +From: Alex Hung + +commit 79e31396fdd7037c503e6add15af7cb00633ea92 upstream. + +[WHY & HOW] +A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 +calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the +display_color_depth == COLOR_DEPTH_141414 is not handled. This is +observed in Radeon RX 6600 XT. + +It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests. + +Also fixes the indentation in get_norm_pix_clk. + +Reviewed-by: Harry Wentland +Signed-off-by: Alex Hung +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 274a87eb389f58eddcbc5659ab0b180b37e92775) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -3389,10 +3389,13 @@ static int get_norm_pix_clk(const struct + break; + case COLOR_DEPTH_121212: + normalized_pix_clk = (pix_clk * 36) / 24; +- break; ++ break; ++ case COLOR_DEPTH_141414: ++ normalized_pix_clk = (pix_clk * 42) / 24; ++ break; + case COLOR_DEPTH_161616: + normalized_pix_clk = (pix_clk * 48) / 24; +- break; ++ break; + default: + ASSERT(0); + break; diff --git a/queue-6.13/drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch b/queue-6.13/drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch new file mode 100644 index 0000000000..20dcbee7af --- /dev/null +++ b/queue-6.13/drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch @@ -0,0 +1,161 @@ +From 40b8c14936bd2726354c856251f6baed9869e760 Mon Sep 17 00:00:00 2001 +From: Leo Li +Date: Thu, 20 Feb 2025 16:20:26 -0500 +Subject: drm/amd/display: Disable unneeded hpd interrupts during dm_init + +From: Leo Li + +commit 40b8c14936bd2726354c856251f6baed9869e760 upstream. + +[Why] + +It seems HPD interrupts are enabled by default for all connectors, even +if the hpd source isn't valid. An eDP for example, does not have a valid +hpd source (but does have a valid hpdrx source; see construct_phy()). +Thus, eDPs should have their hpd interrupt disabled. + +In the past, this wasn't really an issue. Although the driver gets +interrupted, then acks by writing to hw registers, there weren't any +subscribed handlers that did anything meaningful (see +register_hpd_handlers()). + +But things changed with the introduction of IPS. s2idle requires that +the driver allows IPS for DMUB fw to put hw to sleep. Since register +access requires hw to be awake, the driver will block IPS entry to do +so. And no IPS means no hw sleep during s2idle. + +This was the observation on DCN35 systems with an eDP. During suspend, +the eDP toggled its hpd pin as part of the panel power down sequence. +The driver was then interrupted, and acked by writing to registers, +blocking IPS entry. + +[How] + +Since DC marks eDP connections as having invalid hpd sources (see +construct_phy()), DM should disable them at the hw level. Do so in +amdgpu_dm_hpd_init() by disabling all hpd ints first, then selectively +enabling ones for connectors that have valid hpd sources. + +Cc: Mario Limonciello +Cc: Alex Deucher +Reviewed-by: Harry Wentland +Signed-off-by: Leo Li +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 7b1ba19eb15f88e70782642ce2d934211269337b) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 64 ++++++++++++------ + 1 file changed, 45 insertions(+), 19 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +@@ -894,8 +894,16 @@ void amdgpu_dm_hpd_init(struct amdgpu_de + struct drm_device *dev = adev_to_drm(adev); + struct drm_connector *connector; + struct drm_connector_list_iter iter; ++ int irq_type; + int i; + ++ /* First, clear all hpd and hpdrx interrupts */ ++ for (i = DC_IRQ_SOURCE_HPD1; i <= DC_IRQ_SOURCE_HPD6RX; i++) { ++ if (!dc_interrupt_set(adev->dm.dc, i, false)) ++ drm_err(dev, "Failed to clear hpd(rx) source=%d on init\n", ++ i); ++ } ++ + drm_connector_list_iter_begin(dev, &iter); + drm_for_each_connector_iter(connector, &iter) { + struct amdgpu_dm_connector *amdgpu_dm_connector; +@@ -908,10 +916,31 @@ void amdgpu_dm_hpd_init(struct amdgpu_de + + dc_link = amdgpu_dm_connector->dc_link; + ++ /* ++ * Get a base driver irq reference for hpd ints for the lifetime ++ * of dm. Note that only hpd interrupt types are registered with ++ * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on ++ * hpd_rx isn't available. DM currently controls hpd_rx ++ * explicitly with dc_interrupt_set() ++ */ + if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { +- dc_interrupt_set(adev->dm.dc, +- dc_link->irq_source_hpd, +- true); ++ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; ++ /* ++ * TODO: There's a mismatch between mode_info.num_hpd ++ * and what bios reports as the # of connectors with hpd ++ * sources. Since the # of hpd source types registered ++ * with base driver == mode_info.num_hpd, we have to ++ * fallback to dc_interrupt_set for the remaining types. ++ */ ++ if (irq_type < adev->mode_info.num_hpd) { ++ if (amdgpu_irq_get(adev, &adev->hpd_irq, irq_type)) ++ drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", ++ dc_link->irq_source_hpd); ++ } else { ++ dc_interrupt_set(adev->dm.dc, ++ dc_link->irq_source_hpd, ++ true); ++ } + } + + if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) { +@@ -921,12 +950,6 @@ void amdgpu_dm_hpd_init(struct amdgpu_de + } + } + drm_connector_list_iter_end(&iter); +- +- /* Update reference counts for HPDs */ +- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { +- if (amdgpu_irq_get(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) +- drm_err(dev, "DM_IRQ: Failed get HPD for source=%d)!\n", i); +- } + } + + /** +@@ -942,7 +965,7 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de + struct drm_device *dev = adev_to_drm(adev); + struct drm_connector *connector; + struct drm_connector_list_iter iter; +- int i; ++ int irq_type; + + drm_connector_list_iter_begin(dev, &iter); + drm_for_each_connector_iter(connector, &iter) { +@@ -956,9 +979,18 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de + dc_link = amdgpu_dm_connector->dc_link; + + if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { +- dc_interrupt_set(adev->dm.dc, +- dc_link->irq_source_hpd, +- false); ++ irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; ++ ++ /* TODO: See same TODO in amdgpu_dm_hpd_init() */ ++ if (irq_type < adev->mode_info.num_hpd) { ++ if (amdgpu_irq_put(adev, &adev->hpd_irq, irq_type)) ++ drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", ++ dc_link->irq_source_hpd); ++ } else { ++ dc_interrupt_set(adev->dm.dc, ++ dc_link->irq_source_hpd, ++ false); ++ } + } + + if (dc_link->irq_source_hpd_rx != DC_IRQ_SOURCE_INVALID) { +@@ -968,10 +1000,4 @@ void amdgpu_dm_hpd_fini(struct amdgpu_de + } + } + drm_connector_list_iter_end(&iter); +- +- /* Update reference counts for HPDs */ +- for (i = DC_IRQ_SOURCE_HPD1; i <= adev->mode_info.num_hpd; i++) { +- if (amdgpu_irq_put(adev, &adev->hpd_irq, i - DC_IRQ_SOURCE_HPD1)) +- drm_err(dev, "DM_IRQ: Failed put HPD for source=%d!\n", i); +- } + } diff --git a/queue-6.13/drm-amd-display-fix-default-brightness.patch b/queue-6.13/drm-amd-display-fix-default-brightness.patch new file mode 100644 index 0000000000..5165cf4604 --- /dev/null +++ b/queue-6.13/drm-amd-display-fix-default-brightness.patch @@ -0,0 +1,54 @@ +From b5a981e1b34e44f94a5967f730fff4166f2101e8 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Sat, 22 Feb 2025 23:37:32 -0600 +Subject: drm/amd/display: fix default brightness + +From: Mario Limonciello + +commit b5a981e1b34e44f94a5967f730fff4166f2101e8 upstream. + +[Why] +To avoid flickering during boot default brightness level set by BIOS +should be maintained for as much of the boot as feasible. +commit 2fe87f54abdc ("drm/amd/display: Set default brightness according +to ACPI") attempted to set the right levels for AC vs DC, but brightness +still got reset to maximum level in initialization code for +setup_backlight_device(). + +[How] +Remove the hardcoded initialization in setup_backlight_device() and +instead program brightness value to match BIOS (AC or DC). This avoids a +brightness flicker from kernel changing the value. Userspace may however +still change it during boot. + +Fixes: 2fe87f54abdc ("drm/amd/display: Set default brightness according to ACPI") +Acked-by: Wayne Lin +Signed-off-by: Mario Limonciello +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 0747acf3311229e22009bec4a9e7fc30c879e842) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4848,6 +4848,7 @@ amdgpu_dm_register_backlight_device(stru + dm->backlight_dev[aconnector->bl_idx] = + backlight_device_register(bl_name, aconnector->base.kdev, dm, + &amdgpu_dm_backlight_ops, &props); ++ dm->brightness[aconnector->bl_idx] = props.brightness; + + if (IS_ERR(dm->backlight_dev[aconnector->bl_idx])) { + DRM_ERROR("DM: Backlight registration failed!\n"); +@@ -4915,7 +4916,6 @@ static void setup_backlight_device(struc + aconnector->bl_idx = bl_idx; + + amdgpu_dm_update_backlight_caps(dm, bl_idx); +- dm->brightness[bl_idx] = AMDGPU_MAX_BL_LEVEL; + dm->backlight_link[bl_idx] = link; + dm->num_of_edps++; + diff --git a/queue-6.13/drm-amd-display-fix-missing-.is_two_pixels_per_container.patch b/queue-6.13/drm-amd-display-fix-missing-.is_two_pixels_per_container.patch new file mode 100644 index 0000000000..5e65c4b164 --- /dev/null +++ b/queue-6.13/drm-amd-display-fix-missing-.is_two_pixels_per_container.patch @@ -0,0 +1,37 @@ +From e204aab79e01bc8ff750645666993ed8b719de57 Mon Sep 17 00:00:00 2001 +From: Aliaksei Urbanski +Date: Thu, 6 Mar 2025 13:36:03 +0300 +Subject: drm/amd/display: fix missing .is_two_pixels_per_container + +From: Aliaksei Urbanski + +commit e204aab79e01bc8ff750645666993ed8b719de57 upstream. + +Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, +due to lack of .is_two_pixels_per_container function in dce60_tg_funcs, +causes a NULL pointer dereference on PCs with old GPUs, such as R9 280X. + +So this fix adds missing .is_two_pixels_per_container to dce60_tg_funcs. + +Reported-by: Rosen Penev +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3942 +Fixes: e6a901a00822 ("drm/amd/display: use even ODM slice width for two pixels per container") +Signed-off-by: Aliaksei Urbanski +Signed-off-by: Alex Deucher +(cherry picked from commit bd4b125eb949785c6f8a53b0494e32795421209d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce60/dce60_timing_generator.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/display/dc/dce60/dce60_timing_generator.c ++++ b/drivers/gpu/drm/amd/display/dc/dce60/dce60_timing_generator.c +@@ -239,6 +239,7 @@ static const struct timing_generator_fun + dce60_timing_generator_enable_advanced_request, + .configure_crc = dce60_configure_crc, + .get_crc = dce110_get_crc, ++ .is_two_pixels_per_container = dce110_is_two_pixels_per_container, + }; + + void dce60_timing_generator_construct( diff --git a/queue-6.13/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch b/queue-6.13/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch new file mode 100644 index 0000000000..2ae6dfbceb --- /dev/null +++ b/queue-6.13/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch @@ -0,0 +1,41 @@ +From e65e7bea220c3ce8c4c793b4ba35557f4994ab2b Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Fri, 28 Feb 2025 13:18:14 -0600 +Subject: drm/amd/display: Fix slab-use-after-free on hdcp_work + +From: Mario Limonciello + +commit e65e7bea220c3ce8c4c793b4ba35557f4994ab2b upstream. + +[Why] +A slab-use-after-free is reported when HDCP is destroyed but the +property_validate_dwork queue is still running. + +[How] +Cancel the delayed work when destroying workqueue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4006 +Fixes: da3fd7ac0bcf ("drm/amd/display: Update CP property based on HW query") +Cc: Alex Deucher +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -455,6 +455,7 @@ void hdcp_destroy(struct kobject *kobj, + for (i = 0; i < hdcp_work->max_link; i++) { + cancel_delayed_work_sync(&hdcp_work[i].callback_dwork); + cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork); ++ cancel_delayed_work_sync(&hdcp_work[i].property_validate_dwork); + } + + sysfs_remove_bin_file(kobj, &hdcp_work[0].attr); diff --git a/queue-6.13/drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch b/queue-6.13/drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch new file mode 100644 index 0000000000..4e0d126f8e --- /dev/null +++ b/queue-6.13/drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch @@ -0,0 +1,56 @@ +From 5760388d9681ac743038b846b9082b9023969551 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Sun, 23 Feb 2025 00:04:35 -0600 +Subject: drm/amd/display: Restore correct backlight brightness after a GPU reset + +From: Mario Limonciello + +commit 5760388d9681ac743038b846b9082b9023969551 upstream. + +[Why] +GPU reset will attempt to restore cached state, but brightness doesn't +get restored. It will come back at 100% brightness, but userspace thinks +it's the previous value. + +[How] +When running resume sequence if GPU is in reset restore brightness +to previous value. + +Acked-by: Wayne Lin +Signed-off-by: Mario Limonciello +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 5e19e2b57b6bb640d68dfc7991e1e182922cf867) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -244,6 +244,10 @@ static int amdgpu_dm_atomic_check(struct + static void handle_hpd_irq_helper(struct amdgpu_dm_connector *aconnector); + static void handle_hpd_rx_irq(void *param); + ++static void amdgpu_dm_backlight_set_level(struct amdgpu_display_manager *dm, ++ int bl_idx, ++ u32 user_brightness); ++ + static bool + is_timing_unchanged_for_freesync(struct drm_crtc_state *old_crtc_state, + struct drm_crtc_state *new_crtc_state); +@@ -3318,6 +3322,12 @@ static int dm_resume(struct amdgpu_ip_bl + + mutex_unlock(&dm->dc_lock); + ++ /* set the backlight after a reset */ ++ for (i = 0; i < dm->num_of_edps; i++) { ++ if (dm->backlight_dev[i]) ++ amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]); ++ } ++ + return 0; + } + /* Recreate dc_state - DC invalidates it when setting power state to S3. */ diff --git a/queue-6.13/drm-amdgpu-display-allow-dcc-for-video-formats-on-gfx12.patch b/queue-6.13/drm-amdgpu-display-allow-dcc-for-video-formats-on-gfx12.patch new file mode 100644 index 0000000000..043eb1f985 --- /dev/null +++ b/queue-6.13/drm-amdgpu-display-allow-dcc-for-video-formats-on-gfx12.patch @@ -0,0 +1,38 @@ +From df1e82e7acd3c50b65ca0e2e09089b78382d14ab Mon Sep 17 00:00:00 2001 +From: David Rosca +Date: Thu, 13 Feb 2025 15:30:37 +0100 +Subject: drm/amdgpu/display: Allow DCC for video formats on GFX12 + +From: David Rosca + +commit df1e82e7acd3c50b65ca0e2e09089b78382d14ab upstream. + +We advertise DCC as supported for NV12/P010 formats on GFX12, +but it would fail on this check on atomic commit. + +Signed-off-by: David Rosca +Reviewed-by: Ruijing Dong +Signed-off-by: Alex Deucher +(cherry picked from commit ba795235a2b99ba9bbef647ab003b2f3145d9bbb) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +@@ -275,8 +275,11 @@ static int amdgpu_dm_plane_validate_dcc( + if (!dcc->enable) + return 0; + +- if (format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN || +- !dc->cap_funcs.get_dcc_compression_cap) ++ if (adev->family < AMDGPU_FAMILY_GC_12_0_0 && ++ format >= SURFACE_PIXEL_FORMAT_VIDEO_BEGIN) ++ return -EINVAL; ++ ++ if (!dc->cap_funcs.get_dcc_compression_cap) + return -EINVAL; + + input.format = format; diff --git a/queue-6.13/drm-amdgpu-null-check-bo-s-backing-store-when-determining-gfx12-pte-flags.patch b/queue-6.13/drm-amdgpu-null-check-bo-s-backing-store-when-determining-gfx12-pte-flags.patch new file mode 100644 index 0000000000..3cefbe3d28 --- /dev/null +++ b/queue-6.13/drm-amdgpu-null-check-bo-s-backing-store-when-determining-gfx12-pte-flags.patch @@ -0,0 +1,40 @@ +From 6cc30748e17ea2a64051ceaf83a8372484e597f1 Mon Sep 17 00:00:00 2001 +From: Natalie Vock +Date: Mon, 10 Mar 2025 18:08:05 +0100 +Subject: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Natalie Vock + +commit 6cc30748e17ea2a64051ceaf83a8372484e597f1 upstream. + +PRT BOs may not have any backing store, so bo->tbo.resource will be +NULL. Check for that before dereferencing. + +Fixes: 0cce5f285d9a ("drm/amdkfd: Check correct memory types for is_system variable") +Reviewed-by: Christian König +Signed-off-by: Natalie Vock +Signed-off-by: Alex Deucher +(cherry picked from commit 3e3fcd29b505cebed659311337ea03b7698767fc) +Cc: stable@vger.kernel.org # 6.12.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c +@@ -528,8 +528,9 @@ static void gmc_v12_0_get_vm_pte(struct + + bo_adev = amdgpu_ttm_adev(bo->tbo.bdev); + coherent = bo->flags & AMDGPU_GEM_CREATE_COHERENT; +- is_system = (bo->tbo.resource->mem_type == TTM_PL_TT) || +- (bo->tbo.resource->mem_type == AMDGPU_PL_PREEMPT); ++ is_system = bo->tbo.resource && ++ (bo->tbo.resource->mem_type == TTM_PL_TT || ++ bo->tbo.resource->mem_type == AMDGPU_PL_PREEMPT); + + if (bo && bo->flags & AMDGPU_GEM_CREATE_GFX12_DCC) + *flags |= AMDGPU_PTE_DCC; diff --git a/queue-6.13/drm-amdgpu-vce2-fix-ip-block-reference.patch b/queue-6.13/drm-amdgpu-vce2-fix-ip-block-reference.patch new file mode 100644 index 0000000000..9d1da9cc4c --- /dev/null +++ b/queue-6.13/drm-amdgpu-vce2-fix-ip-block-reference.patch @@ -0,0 +1,42 @@ +From ded6ad4c6e2005e959ea09abba16c451433dd34b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Sun, 9 Mar 2025 12:26:50 -0400 +Subject: drm/amdgpu/vce2: fix ip block reference + +From: Alex Deucher + +commit ded6ad4c6e2005e959ea09abba16c451433dd34b upstream. + +Need to use the correct IP block type. VCE vs VCN. +Fixes mclk issues on Hawaii. + +Suggested by selendym. + +Fixes: 82ae6619a450 ("drm/amdgpu: update the handle ptr in wait_for_idle") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3997 +Reviewed-by: Boyuan Zhang +Cc: Sunil Khatri +Signed-off-by: Alex Deucher +(cherry picked from commit 02438acd252395628d74cfac692efbb676d21521) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/vce_v2_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c +index c633b7ff2943..09fd6ef99b3d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c +@@ -284,7 +284,7 @@ static int vce_v2_0_stop(struct amdgpu_device *adev) + return 0; + } + +- ip_block = amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_VCN); ++ ip_block = amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_VCE); + if (!ip_block) + return -EINVAL; + +-- +2.48.1 + diff --git a/queue-6.13/drm-atomic-filter-out-redundant-dpms-calls.patch b/queue-6.13/drm-atomic-filter-out-redundant-dpms-calls.patch new file mode 100644 index 0000000000..3641740e0c --- /dev/null +++ b/queue-6.13/drm-atomic-filter-out-redundant-dpms-calls.patch @@ -0,0 +1,63 @@ +From de93ddf88088f7624b589d0ff3af9effb87e8f3b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 19 Feb 2025 18:02:39 +0200 +Subject: drm/atomic: Filter out redundant DPMS calls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit de93ddf88088f7624b589d0ff3af9effb87e8f3b upstream. + +Video players (eg. mpv) do periodic XResetScreenSaver() calls to +keep the screen on while the video playing. The modesetting ddx +plumbs these straight through into the kernel as DPMS setproperty +ioctls, without any filtering whatsoever. When implemented via +atomic these end up as empty commits on the crtc (which will +nonetheless take one full frame), which leads to a dropped +frame every time XResetScreenSaver() is called. + +Let's just filter out redundant DPMS property changes in the +kernel to avoid this issue. + +v2: Explain the resulting commits a bit better (Sima) + Document the behaviour in uapi docs (Sima) + +Cc: stable@vger.kernel.org +Testcase: igt/kms_flip/flip-vs-dpms-on-nop +Reviewed-by: Simona Vetter +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20250219160239.17502-1-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic_uapi.c | 4 ++++ + drivers/gpu/drm/drm_connector.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -956,6 +956,10 @@ int drm_atomic_connector_commit_dpms(str + + if (mode != DRM_MODE_DPMS_ON) + mode = DRM_MODE_DPMS_OFF; ++ ++ if (connector->dpms == mode) ++ goto out; ++ + connector->dpms = mode; + + crtc = connector->state->crtc; +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -1308,6 +1308,10 @@ EXPORT_SYMBOL(drm_hdmi_connector_get_out + * callback. For atomic drivers the remapping to the "ACTIVE" property is + * implemented in the DRM core. + * ++ * On atomic drivers any DPMS setproperty ioctl where the value does not ++ * change is completely skipped, otherwise a full atomic commit will occur. ++ * On legacy drivers the exact behavior is driver specific. ++ * + * Note that this property cannot be set through the MODE_ATOMIC ioctl, + * userspace must use "ACTIVE" on the CRTC instead. + * diff --git a/queue-6.13/drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch b/queue-6.13/drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch new file mode 100644 index 0000000000..ba026b527f --- /dev/null +++ b/queue-6.13/drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch @@ -0,0 +1,124 @@ +From 12d8f318347b1d4feac48e8ac351d3786af39599 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Fri, 7 Mar 2025 20:31:52 +0200 +Subject: drm/dp_mst: Fix locking when skipping CSN before topology probing + +From: Imre Deak + +commit 12d8f318347b1d4feac48e8ac351d3786af39599 upstream. + +The handling of the MST Connection Status Notify message is skipped if +the probing of the topology is still pending. Acquiring the +drm_dp_mst_topology_mgr::probe_lock for this in +drm_dp_mst_handle_up_req() is problematic: the task/work this function +is called from is also responsible for handling MST down-request replies +(in drm_dp_mst_handle_down_rep()). Thus drm_dp_mst_link_probe_work() - +holding already probe_lock - could be blocked waiting for an MST +down-request reply while drm_dp_mst_handle_up_req() is waiting for +probe_lock while processing a CSN message. This leads to the probe +work's down-request message timing out. + +A scenario similar to the above leading to a down-request timeout is +handling a CSN message in drm_dp_mst_handle_conn_stat(), holding the +probe_lock and sending down-request messages while a second CSN message +sent by the sink subsequently is handled by drm_dp_mst_handle_up_req(). + +Fix the above by moving the logic to skip the CSN handling to +drm_dp_mst_process_up_req(). This function is called from a work +(separate from the task/work handling new up/down messages), already +holding probe_lock. This solves the above timeout issue, since handling +of down-request replies won't be blocked by probe_lock. + +Fixes: ddf983488c3e ("drm/dp_mst: Skip CSN if topology probing is not done yet") +Cc: Wayne Lin +Cc: Lyude Paul +Cc: stable@vger.kernel.org # v6.6+ +Reviewed-by: Wayne Lin +Reviewed-by: Lyude Paul +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20250307183152.3822170-1-imre.deak@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 40 +++++++++++++++----------- + 1 file changed, 24 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4035,6 +4035,22 @@ out: + return 0; + } + ++static bool primary_mstb_probing_is_done(struct drm_dp_mst_topology_mgr *mgr) ++{ ++ bool probing_done = false; ++ ++ mutex_lock(&mgr->lock); ++ ++ if (mgr->mst_primary && drm_dp_mst_topology_try_get_mstb(mgr->mst_primary)) { ++ probing_done = mgr->mst_primary->link_address_sent; ++ drm_dp_mst_topology_put_mstb(mgr->mst_primary); ++ } ++ ++ mutex_unlock(&mgr->lock); ++ ++ return probing_done; ++} ++ + static inline bool + drm_dp_mst_process_up_req(struct drm_dp_mst_topology_mgr *mgr, + struct drm_dp_pending_up_req *up_req) +@@ -4065,8 +4081,12 @@ drm_dp_mst_process_up_req(struct drm_dp_ + + /* TODO: Add missing handler for DP_RESOURCE_STATUS_NOTIFY events */ + if (msg->req_type == DP_CONNECTION_STATUS_NOTIFY) { +- dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat); +- hotplug = true; ++ if (!primary_mstb_probing_is_done(mgr)) { ++ drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.\n"); ++ } else { ++ dowork = drm_dp_mst_handle_conn_stat(mstb, &msg->u.conn_stat); ++ hotplug = true; ++ } + } + + drm_dp_mst_topology_put_mstb(mstb); +@@ -4148,10 +4168,11 @@ static int drm_dp_mst_handle_up_req(stru + drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, + false); + ++ drm_dp_mst_topology_put_mstb(mst_primary); ++ + if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { + const struct drm_dp_connection_status_notify *conn_stat = + &up_req->msg.u.conn_stat; +- bool handle_csn; + + drm_dbg_kms(mgr->dev, "Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", + conn_stat->port_number, +@@ -4160,16 +4181,6 @@ static int drm_dp_mst_handle_up_req(stru + conn_stat->message_capability_status, + conn_stat->input_port, + conn_stat->peer_device_type); +- +- mutex_lock(&mgr->probe_lock); +- handle_csn = mst_primary->link_address_sent; +- mutex_unlock(&mgr->probe_lock); +- +- if (!handle_csn) { +- drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); +- kfree(up_req); +- goto out_put_primary; +- } + } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { + const struct drm_dp_resource_status_notify *res_stat = + &up_req->msg.u.resource_stat; +@@ -4184,9 +4195,6 @@ static int drm_dp_mst_handle_up_req(stru + list_add_tail(&up_req->next, &mgr->up_req_list); + mutex_unlock(&mgr->up_req_lock); + queue_work(system_long_wq, &mgr->up_req_work); +- +-out_put_primary: +- drm_dp_mst_topology_put_mstb(mst_primary); + out_clear_reply: + reset_msg_rx_state(&mgr->up_req_recv); + return ret; diff --git a/queue-6.13/drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch b/queue-6.13/drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch new file mode 100644 index 0000000000..686e932506 --- /dev/null +++ b/queue-6.13/drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch @@ -0,0 +1,56 @@ +From 6266f4a78131c795631440ea9c7b66cdfd399484 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 18 Feb 2025 23:18:55 +0200 +Subject: drm/i915/cdclk: Do cdclk post plane programming later +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 6266f4a78131c795631440ea9c7b66cdfd399484 upstream. + +We currently call intel_set_cdclk_post_plane_update() far +too early. When pipes are active during the reprogramming +the current spot only works for the cd2x divider update +case, as that is synchronize to the pipe's vblank. Squashing +and crawling are not synchronized in any way, so doing the +programming while the pipes/planes are potentially still using +the old hardware state could lead to underruns. + +Move the post plane reprgramming to a spot where we know +that the pipes/planes have switched over the new hardware +state. + +Cc: stable@vger.kernel.org +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20250218211913.27867-2-ville.syrjala@linux.intel.com +Reviewed-by: Vinod Govindapillai +(cherry picked from commit fb64f5568c0e0b5730733d70a012ae26b1a55815) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_display.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -7840,9 +7840,6 @@ static void intel_atomic_commit_tail(str + /* Now enable the clocks, plane, pipe, and connectors that we set up. */ + dev_priv->display.funcs.display->commit_modeset_enables(state); + +- if (state->modeset) +- intel_set_cdclk_post_plane_update(state); +- + intel_wait_for_vblank_workers(state); + + /* FIXME: We should call drm_atomic_helper_commit_hw_done() here +@@ -7916,6 +7913,8 @@ static void intel_atomic_commit_tail(str + intel_verify_planes(state); + + intel_sagv_post_plane_update(state); ++ if (state->modeset) ++ intel_set_cdclk_post_plane_update(state); + intel_pmdemand_post_plane_update(state); + + drm_atomic_helper_commit_hw_done(&state->base); diff --git a/queue-6.13/drm-panic-fix-overindented-list-items-in-documentation.patch b/queue-6.13/drm-panic-fix-overindented-list-items-in-documentation.patch new file mode 100644 index 0000000000..c2b3f2efd4 --- /dev/null +++ b/queue-6.13/drm-panic-fix-overindented-list-items-in-documentation.patch @@ -0,0 +1,62 @@ +From cba3b86974a3388b12130654809e50cd19294849 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Sun, 2 Mar 2025 00:16:02 +0100 +Subject: drm/panic: fix overindented list items in documentation + +From: Miguel Ojeda + +commit cba3b86974a3388b12130654809e50cd19294849 upstream. + +Starting with the upcoming Rust 1.86.0 (to be released 2025-04-03), +Clippy warns: + + error: doc list item overindented + --> drivers/gpu/drm/drm_panic_qr.rs:914:5 + | + 914 | /// will be encoded as binary segment, otherwise it will be encoded + | ^^^ help: try using ` ` (2 spaces) + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#doc_overindented_list_items + +The overindentation is slightly hard to notice, since all the items +start with a backquote that makes it look OK, but it is there. + +Thus fix it. + +Signed-off-by: Miguel Ojeda +Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen") +Cc: stable@vger.kernel.org # Needed in 6.12.y and 6.13.y only (Rust is pinned in older LTSs). +Reviewed-by: Jocelyn Falempe +Reviewed-by: Alice Ryhl +Signed-off-by: Jocelyn Falempe +Link: https://patchwork.freedesktop.org/patch/msgid/20250301231602.917580-2-ojeda@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_panic_qr.rs | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/drm_panic_qr.rs ++++ b/drivers/gpu/drm/drm_panic_qr.rs +@@ -911,16 +911,16 @@ impl QrImage<'_> { + /// + /// * `url`: The base URL of the QR code. It will be encoded as Binary segment. + /// * `data`: A pointer to the binary data, to be encoded. if URL is NULL, it +-/// will be encoded as binary segment, otherwise it will be encoded +-/// efficiently as a numeric segment, and appended to the URL. ++/// will be encoded as binary segment, otherwise it will be encoded ++/// efficiently as a numeric segment, and appended to the URL. + /// * `data_len`: Length of the data, that needs to be encoded, must be less +-/// than data_size. ++/// than data_size. + /// * `data_size`: Size of data buffer, it should be at least 4071 bytes to hold +-/// a V40 QR code. It will then be overwritten with the QR code image. ++/// a V40 QR code. It will then be overwritten with the QR code image. + /// * `tmp`: A temporary buffer that the QR code encoder will use, to write the +-/// segments and ECC. ++/// segments and ECC. + /// * `tmp_size`: Size of the temporary buffer, it must be at least 3706 bytes +-/// long for V40. ++/// long for V40. + /// + /// # Safety + /// diff --git a/queue-6.13/drm-panic-use-div_ceil-to-clean-clippy-warning.patch b/queue-6.13/drm-panic-use-div_ceil-to-clean-clippy-warning.patch new file mode 100644 index 0000000000..e5538089d8 --- /dev/null +++ b/queue-6.13/drm-panic-use-div_ceil-to-clean-clippy-warning.patch @@ -0,0 +1,60 @@ +From 986c2e9ca818b0b74cfc737517549fd0b80ff15d Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Sun, 2 Mar 2025 00:16:01 +0100 +Subject: drm/panic: use `div_ceil` to clean Clippy warning + +From: Miguel Ojeda + +commit 986c2e9ca818b0b74cfc737517549fd0b80ff15d upstream. + +Starting with the upcoming Rust 1.86.0 (to be released 2025-04-03), +Clippy warns: + + error: manually reimplementing `div_ceil` + --> drivers/gpu/drm/drm_panic_qr.rs:548:26 + | + 548 | let pad_offset = (offset + 7) / 8; + | ^^^^^^^^^^^^^^^^ help: consider using `.div_ceil()`: `offset.div_ceil(8)` + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_div_ceil + +And similarly for `stride`. Thus apply the suggestion to both. + +The behavior (and thus codegen) is not exactly equivalent [1][2], since +`div_ceil()` returns the right value for the values that currently +would overflow. + +Link: https://github.com/rust-lang/rust-clippy/issues/14333 [1] +Link: https://godbolt.org/z/dPq6nGnv3 [2] +Signed-off-by: Miguel Ojeda +Fixes: cb5164ac43d0 ("drm/panic: Add a QR code panic screen") +Cc: stable@vger.kernel.org # Needed in 6.12.y and 6.13.y only (Rust is pinned in older LTSs). +Reviewed-by: Alice Ryhl +Reviewed-by: Jocelyn Falempe +Signed-off-by: Jocelyn Falempe +Link: https://patchwork.freedesktop.org/patch/msgid/20250301231602.917580-1-ojeda@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_panic_qr.rs | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_panic_qr.rs ++++ b/drivers/gpu/drm/drm_panic_qr.rs +@@ -545,7 +545,7 @@ impl EncodedMsg<'_> { + } + self.push(&mut offset, (MODE_STOP, 4)); + +- let pad_offset = (offset + 7) / 8; ++ let pad_offset = offset.div_ceil(8); + for i in pad_offset..self.version.max_data() { + self.data[i] = PADDING[(i & 1) ^ (pad_offset & 1)]; + } +@@ -659,7 +659,7 @@ struct QrImage<'a> { + impl QrImage<'_> { + fn new<'a, 'b>(em: &'b EncodedMsg<'b>, qrdata: &'a mut [u8]) -> QrImage<'a> { + let width = em.version.width(); +- let stride = (width + 7) / 8; ++ let stride = width.div_ceil(8); + let data = qrdata; + + let mut qr_image = QrImage { diff --git a/queue-6.13/fix-mmu-notifiers-for-range-based-invalidates.patch b/queue-6.13/fix-mmu-notifiers-for-range-based-invalidates.patch new file mode 100644 index 0000000000..6d62367272 --- /dev/null +++ b/queue-6.13/fix-mmu-notifiers-for-range-based-invalidates.patch @@ -0,0 +1,98 @@ +From f7edb07ad7c66eab3dce57384f33b9799d579133 Mon Sep 17 00:00:00 2001 +From: Piotr Jaroszynski +Date: Tue, 4 Mar 2025 00:51:27 -0800 +Subject: Fix mmu notifiers for range-based invalidates + +From: Piotr Jaroszynski + +commit f7edb07ad7c66eab3dce57384f33b9799d579133 upstream. + +Update the __flush_tlb_range_op macro not to modify its parameters as +these are unexepcted semantics. In practice, this fixes the call to +mmu_notifier_arch_invalidate_secondary_tlbs() in +__flush_tlb_range_nosync() to use the correct range instead of an empty +range with start=end. The empty range was (un)lucky as it results in +taking the invalidate-all path that doesn't cause correctness issues, +but can certainly result in suboptimal perf. + +This has been broken since commit 6bbd42e2df8f ("mmu_notifiers: call +invalidate_range() when invalidating TLBs") when the call to the +notifiers was added to __flush_tlb_range(). It predates the addition of +the __flush_tlb_range_op() macro from commit 360839027a6e ("arm64: tlb: +Refactor the core flush algorithm of __flush_tlb_range") that made the +bug hard to spot. + +Fixes: 6bbd42e2df8f ("mmu_notifiers: call invalidate_range() when invalidating TLBs") + +Signed-off-by: Piotr Jaroszynski +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Robin Murphy +Cc: Alistair Popple +Cc: Raghavendra Rao Ananta +Cc: SeongJae Park +Cc: Jason Gunthorpe +Cc: John Hubbard +Cc: Nicolin Chen +Cc: linux-arm-kernel@lists.infradead.org +Cc: iommu@lists.linux.dev +Cc: linux-mm@kvack.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org +Reviewed-by: Catalin Marinas +Reviewed-by: Alistair Popple +Link: https://lore.kernel.org/r/20250304085127.2238030-1-pjaroszynski@nvidia.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/tlbflush.h | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/arch/arm64/include/asm/tlbflush.h ++++ b/arch/arm64/include/asm/tlbflush.h +@@ -396,33 +396,35 @@ static inline void arch_tlbbatch_flush(s + #define __flush_tlb_range_op(op, start, pages, stride, \ + asid, tlb_level, tlbi_user, lpa2) \ + do { \ ++ typeof(start) __flush_start = start; \ ++ typeof(pages) __flush_pages = pages; \ + int num = 0; \ + int scale = 3; \ + int shift = lpa2 ? 16 : PAGE_SHIFT; \ + unsigned long addr; \ + \ +- while (pages > 0) { \ ++ while (__flush_pages > 0) { \ + if (!system_supports_tlb_range() || \ +- pages == 1 || \ +- (lpa2 && start != ALIGN(start, SZ_64K))) { \ +- addr = __TLBI_VADDR(start, asid); \ ++ __flush_pages == 1 || \ ++ (lpa2 && __flush_start != ALIGN(__flush_start, SZ_64K))) { \ ++ addr = __TLBI_VADDR(__flush_start, asid); \ + __tlbi_level(op, addr, tlb_level); \ + if (tlbi_user) \ + __tlbi_user_level(op, addr, tlb_level); \ +- start += stride; \ +- pages -= stride >> PAGE_SHIFT; \ ++ __flush_start += stride; \ ++ __flush_pages -= stride >> PAGE_SHIFT; \ + continue; \ + } \ + \ +- num = __TLBI_RANGE_NUM(pages, scale); \ ++ num = __TLBI_RANGE_NUM(__flush_pages, scale); \ + if (num >= 0) { \ +- addr = __TLBI_VADDR_RANGE(start >> shift, asid, \ ++ addr = __TLBI_VADDR_RANGE(__flush_start >> shift, asid, \ + scale, num, tlb_level); \ + __tlbi(r##op, addr); \ + if (tlbi_user) \ + __tlbi_user(r##op, addr); \ +- start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ +- pages -= __TLBI_RANGE_PAGES(num, scale); \ ++ __flush_start += __TLBI_RANGE_PAGES(num, scale) << PAGE_SHIFT; \ ++ __flush_pages -= __TLBI_RANGE_PAGES(num, scale);\ + } \ + scale--; \ + } \ diff --git a/queue-6.13/input-ads7846-fix-gpiod-allocation.patch b/queue-6.13/input-ads7846-fix-gpiod-allocation.patch new file mode 100644 index 0000000000..4810d0ef61 --- /dev/null +++ b/queue-6.13/input-ads7846-fix-gpiod-allocation.patch @@ -0,0 +1,36 @@ +From c9ccb88f534ca760d06590b67571c353a2f0cbcd Mon Sep 17 00:00:00 2001 +From: "H. Nikolaus Schaller" +Date: Sat, 1 Feb 2025 12:43:24 +0100 +Subject: Input: ads7846 - fix gpiod allocation + +From: H. Nikolaus Schaller + +commit c9ccb88f534ca760d06590b67571c353a2f0cbcd upstream. + +commit 767d83361aaa ("Input: ads7846 - Convert to use software nodes") + +has simplified the code but accidentially converted a devm_gpiod_get() +to gpiod_get(). This leaves the gpio reserved on module remove and the +driver can no longer be loaded again. + +Fixes: 767d83361aaa ("Input: ads7846 - Convert to use software nodes") +Cc: stable@vger.kernel.org +Signed-off-by: H. Nikolaus Schaller +Link: https://lore.kernel.org/r/6e9b143f19cdfda835711a8a7a3966e5a2494cff.1738410204.git.hns@goldelico.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/touchscreen/ads7846.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -1021,7 +1021,7 @@ static int ads7846_setup_pendown(struct + if (pdata->get_pendown_state) { + ts->get_pendown_state = pdata->get_pendown_state; + } else { +- ts->gpio_pendown = gpiod_get(&spi->dev, "pendown", GPIOD_IN); ++ ts->gpio_pendown = devm_gpiod_get(&spi->dev, "pendown", GPIOD_IN); + if (IS_ERR(ts->gpio_pendown)) { + dev_err(&spi->dev, "failed to request pendown GPIO\n"); + return PTR_ERR(ts->gpio_pendown); diff --git a/queue-6.13/input-goodix-berlin-fix-vddio-regulator-references.patch b/queue-6.13/input-goodix-berlin-fix-vddio-regulator-references.patch new file mode 100644 index 0000000000..a3f44ef815 --- /dev/null +++ b/queue-6.13/input-goodix-berlin-fix-vddio-regulator-references.patch @@ -0,0 +1,94 @@ +From 3b0011059334a1cf554c2c1f67d7a7b822d8238a Mon Sep 17 00:00:00 2001 +From: Luca Weiss +Date: Fri, 3 Jan 2025 10:21:36 +0100 +Subject: Input: goodix-berlin - fix vddio regulator references + +From: Luca Weiss + +commit 3b0011059334a1cf554c2c1f67d7a7b822d8238a upstream. + +As per dt-bindings the property is called vddio-supply, so use the +correct name in the driver instead of iovdd. The datasheet also calls +the supply 'VDDIO'. + +Fixes: 44362279bdd4 ("Input: add core support for Goodix Berlin Touchscreen IC") +Cc: stable@vger.kernel.org +Signed-off-by: Luca Weiss +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20250103-goodix-berlin-fixes-v1-2-b014737b08b2@fairphone.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/touchscreen/goodix_berlin_core.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/input/touchscreen/goodix_berlin_core.c ++++ b/drivers/input/touchscreen/goodix_berlin_core.c +@@ -165,7 +165,7 @@ struct goodix_berlin_core { + struct device *dev; + struct regmap *regmap; + struct regulator *avdd; +- struct regulator *iovdd; ++ struct regulator *vddio; + struct gpio_desc *reset_gpio; + struct touchscreen_properties props; + struct goodix_berlin_fw_version fw_version; +@@ -248,19 +248,19 @@ static int goodix_berlin_power_on(struct + { + int error; + +- error = regulator_enable(cd->iovdd); ++ error = regulator_enable(cd->vddio); + if (error) { +- dev_err(cd->dev, "Failed to enable iovdd: %d\n", error); ++ dev_err(cd->dev, "Failed to enable vddio: %d\n", error); + return error; + } + +- /* Vendor waits 3ms for IOVDD to settle */ ++ /* Vendor waits 3ms for VDDIO to settle */ + usleep_range(3000, 3100); + + error = regulator_enable(cd->avdd); + if (error) { + dev_err(cd->dev, "Failed to enable avdd: %d\n", error); +- goto err_iovdd_disable; ++ goto err_vddio_disable; + } + + /* Vendor waits 15ms for IOVDD to settle */ +@@ -283,8 +283,8 @@ static int goodix_berlin_power_on(struct + err_dev_reset: + gpiod_set_value_cansleep(cd->reset_gpio, 1); + regulator_disable(cd->avdd); +-err_iovdd_disable: +- regulator_disable(cd->iovdd); ++err_vddio_disable: ++ regulator_disable(cd->vddio); + return error; + } + +@@ -292,7 +292,7 @@ static void goodix_berlin_power_off(stru + { + gpiod_set_value_cansleep(cd->reset_gpio, 1); + regulator_disable(cd->avdd); +- regulator_disable(cd->iovdd); ++ regulator_disable(cd->vddio); + } + + static int goodix_berlin_read_version(struct goodix_berlin_core *cd) +@@ -744,10 +744,10 @@ int goodix_berlin_probe(struct device *d + return dev_err_probe(dev, PTR_ERR(cd->avdd), + "Failed to request avdd regulator\n"); + +- cd->iovdd = devm_regulator_get(dev, "iovdd"); +- if (IS_ERR(cd->iovdd)) +- return dev_err_probe(dev, PTR_ERR(cd->iovdd), +- "Failed to request iovdd regulator\n"); ++ cd->vddio = devm_regulator_get(dev, "vddio"); ++ if (IS_ERR(cd->vddio)) ++ return dev_err_probe(dev, PTR_ERR(cd->vddio), ++ "Failed to request vddio regulator\n"); + + error = goodix_berlin_power_on(cd); + if (error) { diff --git a/queue-6.13/input-i8042-add-required-quirks-for-missing-old-boardnames.patch b/queue-6.13/input-i8042-add-required-quirks-for-missing-old-boardnames.patch new file mode 100644 index 0000000000..462897b245 --- /dev/null +++ b/queue-6.13/input-i8042-add-required-quirks-for-missing-old-boardnames.patch @@ -0,0 +1,77 @@ +From 9ed468e17d5b80e7116fd35842df3648e808ae47 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Sat, 22 Feb 2025 00:01:23 +0100 +Subject: Input: i8042 - add required quirks for missing old boardnames + +From: Werner Sembach + +commit 9ed468e17d5b80e7116fd35842df3648e808ae47 upstream. + +Some older Clevo barebones have problems like no or laggy keyboard after +resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE +quirk. + +The PB71RD keyboard is sometimes laggy after resume and the PC70DR, PB51RF, +P640RE, and PCX0DX_GN20 keyboard is sometimes unresponsive after resume. +This quirk fixes that. + +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://lore.kernel.org/r/20250221230137.70292-2-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1261,6 +1261,12 @@ static const struct dmi_system_id i8042_ + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "P640RE"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) ++ }, ++ { + /* + * This is only a partial board_name and might be followed by + * another letter or number. DMI_MATCH however does do partial +@@ -1337,11 +1343,35 @@ static const struct dmi_system_id i8042_ + }, + { + .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "PB51RF"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "PB71RD"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "PC70DR"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) ++ }, ++ { ++ .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "PCX0DX_GN20"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) ++ }, + /* See comment on TUXEDO InfinityBook S17 Gen6 / Clevo NS70MU above */ + { + .matches = { diff --git a/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch new file mode 100644 index 0000000000..24b6e2aa66 --- /dev/null +++ b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch @@ -0,0 +1,125 @@ +From d85862ccca452eeb19329e9f4f9a6ce1d1e53561 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Sat, 22 Feb 2025 00:01:25 +0100 +Subject: Input: i8042 - swap old quirk combination with new quirk for more devices + +From: Werner Sembach + +commit d85862ccca452eeb19329e9f4f9a6ce1d1e53561 upstream. + +Some older Clevo barebones have problems like no or laggy keyboard after +resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE +quirk. + +We could not activly retest these devices because we no longer have them in +our archive, but based on the other old Clevo barebones we tested where the +new quirk had the same or a better behaviour I think it would be good to +apply it on these too. + +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://lore.kernel.org/r/20250221230137.70292-4-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 31 ++++++++++--------------------- + 1 file changed, 10 insertions(+), 21 deletions(-) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1157,9 +1157,7 @@ static const struct dmi_system_id i8042_ + }, + /* + * A lot of modern Clevo barebones have touchpad and/or keyboard issues +- * after suspend fixable with nomux + reset + noloop + nopnp. Luckily, +- * none of them have an external PS/2 port so this can safely be set for +- * all of them. ++ * after suspend fixable with the forcenorestore quirk. + * Clevo barebones come with board_vendor and/or system_vendor set to + * either the very generic string "Notebook" and/or a different value + * for each individual reseller. The only somewhat universal way to +@@ -1175,22 +1173,19 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "LAPQC71B"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "N140CU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "N141CU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1250,8 +1245,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1268,16 +1262,14 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65xH"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* +@@ -1288,8 +1280,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65_P67H"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* +@@ -1300,8 +1291,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RP"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* +@@ -1323,8 +1313,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P67xRP"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { diff --git a/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch new file mode 100644 index 0000000000..84333fefb1 --- /dev/null +++ b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch @@ -0,0 +1,47 @@ +From 729d163232971672d0f41b93c02092fb91f0e758 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Sat, 22 Feb 2025 00:01:22 +0100 +Subject: Input: i8042 - swap old quirk combination with new quirk for NHxxRZQ + +From: Werner Sembach + +commit 729d163232971672d0f41b93c02092fb91f0e758 upstream. + +Some older Clevo barebones have problems like no or laggy keyboard after +resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE +quirk. + +With the old i8042 quirks this devices keyboard is sometimes laggy after +resume. With the new quirk this issue doesn't happen. + +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://lore.kernel.org/r/20250221230137.70292-1-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1209,18 +1209,10 @@ static const struct dmi_system_id i8042_ + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { +- /* +- * Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS makes +- * the keyboard very laggy for ~5 seconds after boot and +- * sometimes also after resume. +- * However both are required for the keyboard to not fail +- * completely sometimes after boot or resume. +- */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NHxxRZQ"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { diff --git a/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch new file mode 100644 index 0000000000..d8158cb71a --- /dev/null +++ b/queue-6.13/input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch @@ -0,0 +1,147 @@ +From 75ee4ebebbbe8dc4b55ba37f388924fa96bf1564 Mon Sep 17 00:00:00 2001 +From: Werner Sembach +Date: Sat, 22 Feb 2025 00:01:24 +0100 +Subject: Input: i8042 - swap old quirk combination with new quirk for several devices + +From: Werner Sembach + +commit 75ee4ebebbbe8dc4b55ba37f388924fa96bf1564 upstream. + +Some older Clevo barebones have problems like no or laggy keyboard after +resume or boot which can be fixed with the SERIO_QUIRK_FORCENORESTORE +quirk. + +While the old quirk combination did not show negative effects on these +devices specifically, the new quirk works just as well and seems more +stable in general. + +Cc: stable@vger.kernel.org +Signed-off-by: Werner Sembach +Link: https://lore.kernel.org/r/20250221230137.70292-3-wse@tuxedocomputers.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-acpipnpio.h | 40 +++++++++++----------------------- + 1 file changed, 14 insertions(+), 26 deletions(-) + +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -1080,16 +1080,14 @@ static const struct dmi_system_id i8042_ + DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* Mivvy M310 */ +@@ -1171,8 +1169,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "LAPQC71A"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1205,8 +1202,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1218,8 +1214,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + /* + * At least one modern Clevo barebone has the touchpad connected both +@@ -1235,17 +1230,15 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NS50MU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | +- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | +- SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_NOAUX | ++ SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NS50_70MU"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | +- SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | +- SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_NOAUX | ++ SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1319,8 +1312,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65_67RS"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* +@@ -1338,8 +1330,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PB50_70DFx,DDx"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1363,8 +1354,7 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { +@@ -1383,15 +1373,13 @@ static const struct dmi_system_id i8042_ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X170SM"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X170KM-G"), + }, +- .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | +- SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) ++ .driver_data = (void *)(SERIO_QUIRK_FORCENORESTORE) + }, + { + /* diff --git a/queue-6.13/input-iqs7222-preserve-system-status-register.patch b/queue-6.13/input-iqs7222-preserve-system-status-register.patch new file mode 100644 index 0000000000..3795c9db5c --- /dev/null +++ b/queue-6.13/input-iqs7222-preserve-system-status-register.patch @@ -0,0 +1,262 @@ +From a2add513311b48cc924a699a8174db2c61ed5e8a Mon Sep 17 00:00:00 2001 +From: Jeff LaBundy +Date: Sun, 9 Mar 2025 20:29:59 -0500 +Subject: Input: iqs7222 - preserve system status register + +From: Jeff LaBundy + +commit a2add513311b48cc924a699a8174db2c61ed5e8a upstream. + +Some register groups reserve a byte at the end of their continuous +address space. Depending on the variant of silicon, this field may +share the same memory space as the lower byte of the system status +register (0x10). + +In these cases, caching the reserved byte and writing it later may +effectively reset the device depending on what happened in between +the read and write operations. + +Solve this problem by avoiding any access to this last byte within +offending register groups. This method replaces a workaround which +attempted to write the reserved byte with up-to-date contents, but +left a small window in which updates by the device could have been +clobbered. + +Now that the driver does not touch these reserved bytes, the order +in which the device's registers are written no longer matters, and +they can be written in their natural order. The new method is also +much more generic, and can be more easily extended to new variants +of silicon with different register maps. + +As part of this change, the register read and write functions must +be gently updated to support byte access instead of word access. + +Fixes: 2e70ef525b73 ("Input: iqs7222 - acknowledge reset before writing registers") +Signed-off-by: Jeff LaBundy +Link: https://lore.kernel.org/r/Z85Alw+d9EHKXx2e@nixie71 +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/iqs7222.c | 50 ++++++++++++++++++------------------------- + 1 file changed, 22 insertions(+), 28 deletions(-) + +--- a/drivers/input/misc/iqs7222.c ++++ b/drivers/input/misc/iqs7222.c +@@ -100,11 +100,11 @@ enum iqs7222_reg_key_id { + + enum iqs7222_reg_grp_id { + IQS7222_REG_GRP_STAT, +- IQS7222_REG_GRP_FILT, + IQS7222_REG_GRP_CYCLE, + IQS7222_REG_GRP_GLBL, + IQS7222_REG_GRP_BTN, + IQS7222_REG_GRP_CHAN, ++ IQS7222_REG_GRP_FILT, + IQS7222_REG_GRP_SLDR, + IQS7222_REG_GRP_TPAD, + IQS7222_REG_GRP_GPIO, +@@ -286,6 +286,7 @@ static const struct iqs7222_event_desc i + + struct iqs7222_reg_grp_desc { + u16 base; ++ u16 val_len; + int num_row; + int num_col; + }; +@@ -342,6 +343,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAC00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -400,6 +402,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAC00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -454,6 +457,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xC400, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -496,6 +500,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xC400, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -543,6 +548,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAA00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -600,6 +606,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAA00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -656,6 +663,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAE00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -712,6 +720,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAE00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -768,6 +777,7 @@ static const struct iqs7222_dev_desc iqs + }, + [IQS7222_REG_GRP_FILT] = { + .base = 0xAE00, ++ .val_len = 3, + .num_row = 1, + .num_col = 2, + }, +@@ -1604,7 +1614,7 @@ static int iqs7222_force_comms(struct iq + } + + static int iqs7222_read_burst(struct iqs7222_private *iqs7222, +- u16 reg, void *val, u16 num_val) ++ u16 reg, void *val, u16 val_len) + { + u8 reg_buf[sizeof(__be16)]; + int ret, i; +@@ -1619,7 +1629,7 @@ static int iqs7222_read_burst(struct iqs + { + .addr = client->addr, + .flags = I2C_M_RD, +- .len = num_val * sizeof(__le16), ++ .len = val_len, + .buf = (u8 *)val, + }, + }; +@@ -1675,7 +1685,7 @@ static int iqs7222_read_word(struct iqs7 + __le16 val_buf; + int error; + +- error = iqs7222_read_burst(iqs7222, reg, &val_buf, 1); ++ error = iqs7222_read_burst(iqs7222, reg, &val_buf, sizeof(val_buf)); + if (error) + return error; + +@@ -1685,10 +1695,9 @@ static int iqs7222_read_word(struct iqs7 + } + + static int iqs7222_write_burst(struct iqs7222_private *iqs7222, +- u16 reg, const void *val, u16 num_val) ++ u16 reg, const void *val, u16 val_len) + { + int reg_len = reg > U8_MAX ? sizeof(reg) : sizeof(u8); +- int val_len = num_val * sizeof(__le16); + int msg_len = reg_len + val_len; + int ret, i; + struct i2c_client *client = iqs7222->client; +@@ -1747,7 +1756,7 @@ static int iqs7222_write_word(struct iqs + { + __le16 val_buf = cpu_to_le16(val); + +- return iqs7222_write_burst(iqs7222, reg, &val_buf, 1); ++ return iqs7222_write_burst(iqs7222, reg, &val_buf, sizeof(val_buf)); + } + + static int iqs7222_ati_trigger(struct iqs7222_private *iqs7222) +@@ -1831,30 +1840,14 @@ static int iqs7222_dev_init(struct iqs72 + + /* + * Acknowledge reset before writing any registers in case the device +- * suffers a spurious reset during initialization. Because this step +- * may change the reserved fields of the second filter beta register, +- * its cache must be updated. +- * +- * Writing the second filter beta register, in turn, may clobber the +- * system status register. As such, the filter beta register pair is +- * written first to protect against this hazard. ++ * suffers a spurious reset during initialization. + */ + if (dir == WRITE) { +- u16 reg = dev_desc->reg_grps[IQS7222_REG_GRP_FILT].base + 1; +- u16 filt_setup; +- + error = iqs7222_write_word(iqs7222, IQS7222_SYS_SETUP, + iqs7222->sys_setup[0] | + IQS7222_SYS_SETUP_ACK_RESET); + if (error) + return error; +- +- error = iqs7222_read_word(iqs7222, reg, &filt_setup); +- if (error) +- return error; +- +- iqs7222->filt_setup[1] &= GENMASK(7, 0); +- iqs7222->filt_setup[1] |= (filt_setup & ~GENMASK(7, 0)); + } + + /* +@@ -1883,6 +1876,7 @@ static int iqs7222_dev_init(struct iqs72 + int num_col = dev_desc->reg_grps[i].num_col; + u16 reg = dev_desc->reg_grps[i].base; + __le16 *val_buf; ++ u16 val_len = dev_desc->reg_grps[i].val_len ? : num_col * sizeof(*val_buf); + u16 *val; + + if (!num_col) +@@ -1900,7 +1894,7 @@ static int iqs7222_dev_init(struct iqs72 + switch (dir) { + case READ: + error = iqs7222_read_burst(iqs7222, reg, +- val_buf, num_col); ++ val_buf, val_len); + for (k = 0; k < num_col; k++) + val[k] = le16_to_cpu(val_buf[k]); + break; +@@ -1909,7 +1903,7 @@ static int iqs7222_dev_init(struct iqs72 + for (k = 0; k < num_col; k++) + val_buf[k] = cpu_to_le16(val[k]); + error = iqs7222_write_burst(iqs7222, reg, +- val_buf, num_col); ++ val_buf, val_len); + break; + + default: +@@ -1962,7 +1956,7 @@ static int iqs7222_dev_info(struct iqs72 + int error, i; + + error = iqs7222_read_burst(iqs7222, IQS7222_PROD_NUM, dev_id, +- ARRAY_SIZE(dev_id)); ++ sizeof(dev_id)); + if (error) + return error; + +@@ -2915,7 +2909,7 @@ static int iqs7222_report(struct iqs7222 + __le16 status[IQS7222_MAX_COLS_STAT]; + + error = iqs7222_read_burst(iqs7222, IQS7222_SYS_STATUS, status, +- num_stat); ++ num_stat * sizeof(*status)); + if (error) + return error; + diff --git a/queue-6.13/input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch b/queue-6.13/input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch new file mode 100644 index 0000000000..95ffe45652 --- /dev/null +++ b/queue-6.13/input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch @@ -0,0 +1,60 @@ +From 36e093c8dcc585d0a9e79a005f721f01f3365eba Mon Sep 17 00:00:00 2001 +From: Nilton Perim Neto +Date: Mon, 3 Feb 2025 07:13:09 -0800 +Subject: Input: xpad - add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE controllers + +From: Nilton Perim Neto + +commit 36e093c8dcc585d0a9e79a005f721f01f3365eba upstream. + +Add 8BitDo SN30 Pro, Hyperkin X91 and Gamesir G7 SE to the list of +recognized controllers, and update vendor comments to match. + +Signed-off-by: Nilton Perim Neto +Link: https://lore.kernel.org/r/20250122214814.102311-2-niltonperimneto@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -376,8 +376,10 @@ static const struct xpad_device { + { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, ++ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, + { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, ++ { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, +@@ -389,6 +391,7 @@ static const struct xpad_device { + { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, + { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE }, + { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, ++ { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, + { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } +@@ -528,12 +531,12 @@ static const struct usb_device_id xpad_t + XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */ + XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */ + XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */ +- XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ ++ XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ + XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */ +- XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller */ +- XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Pro 2 Wired Controller for Xbox */ +- XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke Xbox One pad */ +- XPAD_XBOX360_VENDOR(0x2f24), /* GameSir controllers */ ++ XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */ ++ XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */ ++ XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */ ++ XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */ + XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */ + XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ + XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */ diff --git a/queue-6.13/input-xpad-add-multiple-supported-devices.patch b/queue-6.13/input-xpad-add-multiple-supported-devices.patch new file mode 100644 index 0000000000..593e73a4d2 --- /dev/null +++ b/queue-6.13/input-xpad-add-multiple-supported-devices.patch @@ -0,0 +1,134 @@ +From 3492321e2e60ddfe91aa438bb9ac209016f48f7a Mon Sep 17 00:00:00 2001 +From: Pavel Rojtberg +Date: Mon, 3 Feb 2025 07:22:27 -0800 +Subject: Input: xpad - add multiple supported devices + +From: Pavel Rojtberg + +commit 3492321e2e60ddfe91aa438bb9ac209016f48f7a upstream. + +This is based on multiple commits at https://github.com/paroj/xpad +that had bouncing email addresses and were not signed off. + +Signed-off-by: Pavel Rojtberg +Link: https://lore.kernel.org/r/20250123175404.23254-1-rojtberg@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -140,6 +140,7 @@ static const struct xpad_device { + { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, ++ { 0x044f, 0xd01e, "ThrustMaster, Inc. ESWAP X 2 ELDEN RING EDITION", 0, XTYPE_XBOXONE }, + { 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 }, + { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX }, +@@ -177,6 +178,7 @@ static const struct xpad_device { + { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, + { 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX }, + { 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 }, ++ { 0x0738, 0x4503, "Mad Catz Racing Wheel", 0, XTYPE_XBOXONE }, + { 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX }, + { 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX }, + { 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX }, +@@ -238,6 +240,7 @@ static const struct xpad_device { + { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, ++ { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", XTYPE_XBOXONE }, + { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE }, +@@ -276,12 +279,15 @@ static const struct xpad_device { + { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x0f0d, 0x00dc, "HORIPAD FPS for Nintendo Switch", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, ++ { 0x0f0d, 0x0151, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE }, ++ { 0x0f0d, 0x0152, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE }, + { 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX }, + { 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX }, + { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX }, + { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX }, + { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, + { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, ++ { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE }, + { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, + { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 }, + { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 }, +@@ -366,6 +372,7 @@ static const struct xpad_device { + { 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE }, + { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE }, ++ { 0x24c6, 0x581a, "ThrustMaster XB1 Classic Controller", 0, XTYPE_XBOXONE }, + { 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, +@@ -376,10 +383,12 @@ static const struct xpad_device { + { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, +- { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 }, ++ { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, ++ { 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 }, + { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE }, ++ { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SELECT_BUTTON, XTYPE_XBOXONE }, + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, +@@ -387,12 +396,16 @@ static const struct xpad_device { + { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, ++ { 0x3285, 0x0603, "Nacon Pro Compact controller for Xbox", 0, XTYPE_XBOXONE }, + { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, ++ { 0x3285, 0x0614, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, + { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, ++ { 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 }, + { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE }, + { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, + { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, ++ { 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, + { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } + }; +@@ -491,6 +504,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x03f0), /* HP HyperX Xbox 360 controllers */ + XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */ + XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */ ++ XPAD_XBOXONE_VENDOR(0x044f), /* Thrustmaster Xbox One controllers */ + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */ + XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */ + XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */ +@@ -537,11 +551,13 @@ static const struct usb_device_id xpad_t + XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */ + XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */ + XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */ ++ XPAD_XBOXONE_VENDOR(0x2e95), /* SCUF Gaming Controller */ + XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */ + XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ + XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */ + XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */ + XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */ ++ XPAD_XBOX360_VENDOR(0x413d), /* Black Shark Green Ghost Controller */ + { } + }; + +@@ -694,7 +710,9 @@ static const struct xboxone_init_packet + XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init), + XBOXONE_INIT_PKT(0x045e, 0x0b00, extra_input_packet_init), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_led_on), ++ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_led_on), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_auth), ++ XBOXONE_INIT_PKT(0x20d6, 0xa01a, xboxone_pdp_auth), + XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), + XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), + XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), diff --git a/queue-6.13/input-xpad-add-support-for-tecno-pocket-go.patch b/queue-6.13/input-xpad-add-support-for-tecno-pocket-go.patch new file mode 100644 index 0000000000..e2121fe371 --- /dev/null +++ b/queue-6.13/input-xpad-add-support-for-tecno-pocket-go.patch @@ -0,0 +1,42 @@ +From 95a54a96f657fd069d2a9922b6c2d293a72a001f Mon Sep 17 00:00:00 2001 +From: Antheas Kapenekakis +Date: Mon, 24 Feb 2025 23:00:29 -0800 +Subject: Input: xpad - add support for TECNO Pocket Go + +From: Antheas Kapenekakis + +commit 95a54a96f657fd069d2a9922b6c2d293a72a001f upstream. + +TECNO Pocket Go is a kickstarter handheld by manufacturer TECNO Mobile. +It poses a unique feature: it does not have a display. Instead, the +handheld is essentially a pc in a controller. As customary, it has an +xpad endpoint, a keyboard endpoint, and a vendor endpoint for its +vendor software. + +Signed-off-by: Antheas Kapenekakis +Link: https://lore.kernel.org/r/20250222170010.188761-3-lkml@antheas.dev +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -382,6 +382,7 @@ static const struct xpad_device { + { 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 }, + { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, + { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, ++ { 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 }, +@@ -548,6 +549,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */ + XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */ + XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */ ++ XPAD_XBOX360_VENDOR(0x2993), /* TECNO Mobile */ + XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */ + XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */ + XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */ diff --git a/queue-6.13/input-xpad-add-support-for-zotac-gaming-zone.patch b/queue-6.13/input-xpad-add-support-for-zotac-gaming-zone.patch new file mode 100644 index 0000000000..1f70ced738 --- /dev/null +++ b/queue-6.13/input-xpad-add-support-for-zotac-gaming-zone.patch @@ -0,0 +1,41 @@ +From 709329c48214ad2acf12eed1b5c0eb798e40a64c Mon Sep 17 00:00:00 2001 +From: Antheas Kapenekakis +Date: Mon, 24 Feb 2025 22:59:34 -0800 +Subject: Input: xpad - add support for ZOTAC Gaming Zone + +From: Antheas Kapenekakis + +commit 709329c48214ad2acf12eed1b5c0eb798e40a64c upstream. + +ZOTAC Gaming Zone is ZOTAC's 2024 handheld release. As it is common +with these handhelds, it uses a hybrid USB device with an xpad +endpoint, a keyboard endpoint, and a vendor-specific endpoint for +RGB control et al. + +Signed-off-by: Antheas Kapenekakis +Link: https://lore.kernel.org/r/20250222170010.188761-2-lkml@antheas.dev +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -349,6 +349,7 @@ static const struct xpad_device { + { 0x1bad, 0xfa01, "MadCatz GamePad", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, ++ { 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 }, + { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 }, +@@ -538,6 +539,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ + XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ ++ XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */ diff --git a/queue-6.13/input-xpad-rename-qh-controller-to-legion-go-s.patch b/queue-6.13/input-xpad-rename-qh-controller-to-legion-go-s.patch new file mode 100644 index 0000000000..f12dbe040f --- /dev/null +++ b/queue-6.13/input-xpad-rename-qh-controller-to-legion-go-s.patch @@ -0,0 +1,44 @@ +From 659a7614dd72e2835ac0b220c2fa68fabd8d1df9 Mon Sep 17 00:00:00 2001 +From: Antheas Kapenekakis +Date: Mon, 24 Feb 2025 23:01:55 -0800 +Subject: Input: xpad - rename QH controller to Legion Go S + +From: Antheas Kapenekakis + +commit 659a7614dd72e2835ac0b220c2fa68fabd8d1df9 upstream. + +The QH controller is actually the controller of the Legion Go S, with +the manufacturer string wch.cn and product name Legion Go S in its +USB descriptor. A cursory lookup of the VID reveals the same. + +Therefore, rename the xpad entries to match. + +Signed-off-by: Antheas Kapenekakis +Link: https://lore.kernel.org/r/20250222170010.188761-4-lkml@antheas.dev +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -312,7 +312,7 @@ static const struct xpad_device { + { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, + { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, +- { 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 }, ++ { 0x1a86, 0xe310, "Legion Go S", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -538,7 +538,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ + XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */ + XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ +- XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */ ++ XPAD_XBOX360_VENDOR(0x1a86), /* Nanjing Qinheng Microelectronics (WCH) */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ + XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ diff --git a/queue-6.13/ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch b/queue-6.13/ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch new file mode 100644 index 0000000000..88775ea823 --- /dev/null +++ b/queue-6.13/ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch @@ -0,0 +1,175 @@ +From bb39ed47065455604729404729d9116868638d31 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Wed, 5 Mar 2025 21:21:43 +0900 +Subject: ksmbd: fix use-after-free in ksmbd_free_work_struct + +From: Namjae Jeon + +commit bb39ed47065455604729404729d9116868638d31 upstream. + +->interim_entry of ksmbd_work could be deleted after oplock is freed. +We don't need to manage it with linked list. The interim request could be +immediately sent whenever a oplock break wait is needed. + +Cc: stable@vger.kernel.org +Reported-by: Norbert Szetei +Tested-by: Norbert Szetei +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/ksmbd_work.c | 3 --- + fs/smb/server/ksmbd_work.h | 1 - + fs/smb/server/oplock.c | 37 +++++++++++++++---------------------- + fs/smb/server/oplock.h | 1 - + 4 files changed, 15 insertions(+), 27 deletions(-) + +--- a/fs/smb/server/ksmbd_work.c ++++ b/fs/smb/server/ksmbd_work.c +@@ -26,7 +26,6 @@ struct ksmbd_work *ksmbd_alloc_work_stru + INIT_LIST_HEAD(&work->request_entry); + INIT_LIST_HEAD(&work->async_request_entry); + INIT_LIST_HEAD(&work->fp_entry); +- INIT_LIST_HEAD(&work->interim_entry); + INIT_LIST_HEAD(&work->aux_read_list); + work->iov_alloc_cnt = 4; + work->iov = kcalloc(work->iov_alloc_cnt, sizeof(struct kvec), +@@ -56,8 +55,6 @@ void ksmbd_free_work_struct(struct ksmbd + kfree(work->tr_buf); + kvfree(work->request_buf); + kfree(work->iov); +- if (!list_empty(&work->interim_entry)) +- list_del(&work->interim_entry); + + if (work->async_id) + ksmbd_release_id(&work->conn->async_ida, work->async_id); +--- a/fs/smb/server/ksmbd_work.h ++++ b/fs/smb/server/ksmbd_work.h +@@ -89,7 +89,6 @@ struct ksmbd_work { + /* List head at conn->async_requests */ + struct list_head async_request_entry; + struct list_head fp_entry; +- struct list_head interim_entry; + }; + + /** +--- a/fs/smb/server/oplock.c ++++ b/fs/smb/server/oplock.c +@@ -46,7 +46,6 @@ static struct oplock_info *alloc_opinfo( + opinfo->fid = id; + opinfo->Tid = Tid; + INIT_LIST_HEAD(&opinfo->op_entry); +- INIT_LIST_HEAD(&opinfo->interim_list); + init_waitqueue_head(&opinfo->oplock_q); + init_waitqueue_head(&opinfo->oplock_brk); + atomic_set(&opinfo->refcount, 1); +@@ -803,7 +802,6 @@ out: + static int smb2_lease_break_noti(struct oplock_info *opinfo) + { + struct ksmbd_conn *conn = opinfo->conn; +- struct list_head *tmp, *t; + struct ksmbd_work *work; + struct lease_break_info *br_info; + struct lease *lease = opinfo->o_lease; +@@ -831,16 +829,6 @@ static int smb2_lease_break_noti(struct + work->sess = opinfo->sess; + + if (opinfo->op_state == OPLOCK_ACK_WAIT) { +- list_for_each_safe(tmp, t, &opinfo->interim_list) { +- struct ksmbd_work *in_work; +- +- in_work = list_entry(tmp, struct ksmbd_work, +- interim_entry); +- setup_async_work(in_work, NULL, NULL); +- smb2_send_interim_resp(in_work, STATUS_PENDING); +- list_del_init(&in_work->interim_entry); +- release_async_work(in_work); +- } + INIT_WORK(&work->work, __smb2_lease_break_noti); + ksmbd_queue_work(work); + wait_for_break_ack(opinfo); +@@ -871,7 +859,8 @@ static void wait_lease_breaking(struct o + } + } + +-static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level) ++static int oplock_break(struct oplock_info *brk_opinfo, int req_op_level, ++ struct ksmbd_work *in_work) + { + int err = 0; + +@@ -914,9 +903,15 @@ static int oplock_break(struct oplock_in + } + + if (lease->state & (SMB2_LEASE_WRITE_CACHING_LE | +- SMB2_LEASE_HANDLE_CACHING_LE)) ++ SMB2_LEASE_HANDLE_CACHING_LE)) { ++ if (in_work) { ++ setup_async_work(in_work, NULL, NULL); ++ smb2_send_interim_resp(in_work, STATUS_PENDING); ++ release_async_work(in_work); ++ } ++ + brk_opinfo->op_state = OPLOCK_ACK_WAIT; +- else ++ } else + atomic_dec(&brk_opinfo->breaking_cnt); + } else { + err = oplock_break_pending(brk_opinfo, req_op_level); +@@ -1116,7 +1111,7 @@ void smb_send_parent_lease_break_noti(st + if (ksmbd_conn_releasing(opinfo->conn)) + continue; + +- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); ++ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); + opinfo_put(opinfo); + } + } +@@ -1152,7 +1147,7 @@ void smb_lazy_parent_lease_break_close(s + + if (ksmbd_conn_releasing(opinfo->conn)) + continue; +- oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); ++ oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); + opinfo_put(opinfo); + } + } +@@ -1252,8 +1247,7 @@ int smb_grant_oplock(struct ksmbd_work * + goto op_break_not_needed; + } + +- list_add(&work->interim_entry, &prev_opinfo->interim_list); +- err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II); ++ err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II, work); + opinfo_put(prev_opinfo); + if (err == -ENOENT) + goto set_lev; +@@ -1322,8 +1316,7 @@ static void smb_break_all_write_oplock(s + } + + brk_opinfo->open_trunc = is_trunc; +- list_add(&work->interim_entry, &brk_opinfo->interim_list); +- oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II); ++ oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II, work); + opinfo_put(brk_opinfo); + } + +@@ -1386,7 +1379,7 @@ void smb_break_all_levII_oplock(struct k + SMB2_LEASE_KEY_SIZE)) + goto next; + brk_op->open_trunc = is_trunc; +- oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); ++ oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE, NULL); + next: + opinfo_put(brk_op); + rcu_read_lock(); +--- a/fs/smb/server/oplock.h ++++ b/fs/smb/server/oplock.h +@@ -67,7 +67,6 @@ struct oplock_info { + bool is_lease; + bool open_trunc; /* truncate on open */ + struct lease *o_lease; +- struct list_head interim_list; + struct list_head op_entry; + struct list_head lease_entry; + wait_queue_head_t oplock_q; /* Other server threads */ diff --git a/queue-6.13/ksmbd-prevent-connection-release-during-oplock-break-notification.patch b/queue-6.13/ksmbd-prevent-connection-release-during-oplock-break-notification.patch new file mode 100644 index 0000000000..de7194d85a --- /dev/null +++ b/queue-6.13/ksmbd-prevent-connection-release-during-oplock-break-notification.patch @@ -0,0 +1,146 @@ +From 3aa660c059240e0c795217182cf7df32909dd917 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Thu, 6 Mar 2025 14:14:58 +0900 +Subject: ksmbd: prevent connection release during oplock break notification + +From: Namjae Jeon + +commit 3aa660c059240e0c795217182cf7df32909dd917 upstream. + +ksmbd_work could be freed when after connection release. +Increment r_count of ksmbd_conn to indicate that requests +are not finished yet and to not release the connection. + +Cc: stable@vger.kernel.org +Reported-by: Norbert Szetei +Tested-by: Norbert Szetei +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/connection.c | 20 ++++++++++++++++++++ + fs/smb/server/connection.h | 2 ++ + fs/smb/server/oplock.c | 6 ++++++ + fs/smb/server/server.c | 14 ++------------ + 4 files changed, 30 insertions(+), 12 deletions(-) + +--- a/fs/smb/server/connection.c ++++ b/fs/smb/server/connection.c +@@ -433,6 +433,26 @@ void ksmbd_conn_init_server_callbacks(st + default_conn_ops.terminate_fn = ops->terminate_fn; + } + ++void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn) ++{ ++ atomic_inc(&conn->r_count); ++} ++ ++void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn) ++{ ++ /* ++ * Checking waitqueue to dropping pending requests on ++ * disconnection. waitqueue_active is safe because it ++ * uses atomic operation for condition. ++ */ ++ atomic_inc(&conn->refcnt); ++ if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) ++ wake_up(&conn->r_count_q); ++ ++ if (atomic_dec_and_test(&conn->refcnt)) ++ kfree(conn); ++} ++ + int ksmbd_conn_transport_init(void) + { + int ret; +--- a/fs/smb/server/connection.h ++++ b/fs/smb/server/connection.h +@@ -168,6 +168,8 @@ int ksmbd_conn_transport_init(void); + void ksmbd_conn_transport_destroy(void); + void ksmbd_conn_lock(struct ksmbd_conn *conn); + void ksmbd_conn_unlock(struct ksmbd_conn *conn); ++void ksmbd_conn_r_count_inc(struct ksmbd_conn *conn); ++void ksmbd_conn_r_count_dec(struct ksmbd_conn *conn); + + /* + * WARNING +--- a/fs/smb/server/oplock.c ++++ b/fs/smb/server/oplock.c +@@ -634,6 +634,7 @@ static void __smb2_oplock_break_noti(str + { + struct smb2_oplock_break *rsp = NULL; + struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); ++ struct ksmbd_conn *conn = work->conn; + struct oplock_break_info *br_info = work->request_buf; + struct smb2_hdr *rsp_hdr; + struct ksmbd_file *fp; +@@ -689,6 +690,7 @@ static void __smb2_oplock_break_noti(str + + out: + ksmbd_free_work_struct(work); ++ ksmbd_conn_r_count_dec(conn); + } + + /** +@@ -723,6 +725,7 @@ static int smb2_oplock_break_noti(struct + work->sess = opinfo->sess; + + if (opinfo->op_state == OPLOCK_ACK_WAIT) { ++ ksmbd_conn_r_count_inc(conn); + INIT_WORK(&work->work, __smb2_oplock_break_noti); + ksmbd_queue_work(work); + +@@ -744,6 +747,7 @@ static void __smb2_lease_break_noti(stru + { + struct smb2_lease_break *rsp = NULL; + struct ksmbd_work *work = container_of(wk, struct ksmbd_work, work); ++ struct ksmbd_conn *conn = work->conn; + struct lease_break_info *br_info = work->request_buf; + struct smb2_hdr *rsp_hdr; + +@@ -790,6 +794,7 @@ static void __smb2_lease_break_noti(stru + + out: + ksmbd_free_work_struct(work); ++ ksmbd_conn_r_count_dec(conn); + } + + /** +@@ -829,6 +834,7 @@ static int smb2_lease_break_noti(struct + work->sess = opinfo->sess; + + if (opinfo->op_state == OPLOCK_ACK_WAIT) { ++ ksmbd_conn_r_count_inc(conn); + INIT_WORK(&work->work, __smb2_lease_break_noti); + ksmbd_queue_work(work); + wait_for_break_ack(opinfo); +--- a/fs/smb/server/server.c ++++ b/fs/smb/server/server.c +@@ -270,17 +270,7 @@ static void handle_ksmbd_work(struct wor + + ksmbd_conn_try_dequeue_request(work); + ksmbd_free_work_struct(work); +- /* +- * Checking waitqueue to dropping pending requests on +- * disconnection. waitqueue_active is safe because it +- * uses atomic operation for condition. +- */ +- atomic_inc(&conn->refcnt); +- if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) +- wake_up(&conn->r_count_q); +- +- if (atomic_dec_and_test(&conn->refcnt)) +- kfree(conn); ++ ksmbd_conn_r_count_dec(conn); + } + + /** +@@ -310,7 +300,7 @@ static int queue_ksmbd_work(struct ksmbd + conn->request_buf = NULL; + + ksmbd_conn_enqueue_request(work); +- atomic_inc(&conn->r_count); ++ ksmbd_conn_r_count_inc(conn); + /* update activity on connection */ + conn->last_active = jiffies; + INIT_WORK(&work->work, handle_ksmbd_work); diff --git a/queue-6.13/net-mana-cleanup-mana-struct-after-debugfs_remove.patch b/queue-6.13/net-mana-cleanup-mana-struct-after-debugfs_remove.patch new file mode 100644 index 0000000000..c48a65e22c --- /dev/null +++ b/queue-6.13/net-mana-cleanup-mana-struct-after-debugfs_remove.patch @@ -0,0 +1,207 @@ +From 3e64bb2ae7d9f2b3a8259d4d6b86ed1984d5460a Mon Sep 17 00:00:00 2001 +From: Shradha Gupta +Date: Tue, 11 Mar 2025 03:17:40 -0700 +Subject: net: mana: cleanup mana struct after debugfs_remove() + +From: Shradha Gupta + +commit 3e64bb2ae7d9f2b3a8259d4d6b86ed1984d5460a upstream. + +When on a MANA VM hibernation is triggered, as part of hibernate_snapshot(), +mana_gd_suspend() and mana_gd_resume() are called. If during this +mana_gd_resume(), a failure occurs with HWC creation, mana_port_debugfs +pointer does not get reinitialized and ends up pointing to older, +cleaned-up dentry. +Further in the hibernation path, as part of power_down(), mana_gd_shutdown() +is triggered. This call, unaware of the failures in resume, tries to cleanup +the already cleaned up mana_port_debugfs value and hits the following bug: + +[ 191.359296] mana 7870:00:00.0: Shutdown was called +[ 191.359918] BUG: kernel NULL pointer dereference, address: 0000000000000098 +[ 191.360584] #PF: supervisor write access in kernel mode +[ 191.361125] #PF: error_code(0x0002) - not-present page +[ 191.361727] PGD 1080ea067 P4D 0 +[ 191.362172] Oops: Oops: 0002 [#1] SMP NOPTI +[ 191.362606] CPU: 11 UID: 0 PID: 1674 Comm: bash Not tainted 6.14.0-rc5+ #2 +[ 191.363292] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 +[ 191.364124] RIP: 0010:down_write+0x19/0x50 +[ 191.364537] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb e8 de cd ff ff 31 c0 ba 01 00 00 00 48 0f b1 13 75 16 65 48 8b 05 88 24 4c 6a 48 89 43 08 48 8b 5d +[ 191.365867] RSP: 0000:ff45fbe0c1c037b8 EFLAGS: 00010246 +[ 191.366350] RAX: 0000000000000000 RBX: 0000000000000098 RCX: ffffff8100000000 +[ 191.366951] RDX: 0000000000000001 RSI: 0000000000000064 RDI: 0000000000000098 +[ 191.367600] RBP: ff45fbe0c1c037c0 R08: 0000000000000000 R09: 0000000000000001 +[ 191.368225] R10: ff45fbe0d2b01000 R11: 0000000000000008 R12: 0000000000000000 +[ 191.368874] R13: 000000000000000b R14: ff43dc27509d67c0 R15: 0000000000000020 +[ 191.369549] FS: 00007dbc5001e740(0000) GS:ff43dc663f380000(0000) knlGS:0000000000000000 +[ 191.370213] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 191.370830] CR2: 0000000000000098 CR3: 0000000168e8e002 CR4: 0000000000b73ef0 +[ 191.371557] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 191.372192] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 +[ 191.372906] Call Trace: +[ 191.373262] +[ 191.373621] ? show_regs+0x64/0x70 +[ 191.374040] ? __die+0x24/0x70 +[ 191.374468] ? page_fault_oops+0x290/0x5b0 +[ 191.374875] ? do_user_addr_fault+0x448/0x800 +[ 191.375357] ? exc_page_fault+0x7a/0x160 +[ 191.375971] ? asm_exc_page_fault+0x27/0x30 +[ 191.376416] ? down_write+0x19/0x50 +[ 191.376832] ? down_write+0x12/0x50 +[ 191.377232] simple_recursive_removal+0x4a/0x2a0 +[ 191.377679] ? __pfx_remove_one+0x10/0x10 +[ 191.378088] debugfs_remove+0x44/0x70 +[ 191.378530] mana_detach+0x17c/0x4f0 +[ 191.378950] ? __flush_work+0x1e2/0x3b0 +[ 191.379362] ? __cond_resched+0x1a/0x50 +[ 191.379787] mana_remove+0xf2/0x1a0 +[ 191.380193] mana_gd_shutdown+0x3b/0x70 +[ 191.380642] pci_device_shutdown+0x3a/0x80 +[ 191.381063] device_shutdown+0x13e/0x230 +[ 191.381480] kernel_power_off+0x35/0x80 +[ 191.381890] hibernate+0x3c6/0x470 +[ 191.382312] state_store+0xcb/0xd0 +[ 191.382734] kobj_attr_store+0x12/0x30 +[ 191.383211] sysfs_kf_write+0x3e/0x50 +[ 191.383640] kernfs_fop_write_iter+0x140/0x1d0 +[ 191.384106] vfs_write+0x271/0x440 +[ 191.384521] ksys_write+0x72/0xf0 +[ 191.384924] __x64_sys_write+0x19/0x20 +[ 191.385313] x64_sys_call+0x2b0/0x20b0 +[ 191.385736] do_syscall_64+0x79/0x150 +[ 191.386146] ? __mod_memcg_lruvec_state+0xe7/0x240 +[ 191.386676] ? __lruvec_stat_mod_folio+0x79/0xb0 +[ 191.387124] ? __pfx_lru_add+0x10/0x10 +[ 191.387515] ? queued_spin_unlock+0x9/0x10 +[ 191.387937] ? do_anonymous_page+0x33c/0xa00 +[ 191.388374] ? __handle_mm_fault+0xcf3/0x1210 +[ 191.388805] ? __count_memcg_events+0xbe/0x180 +[ 191.389235] ? handle_mm_fault+0xae/0x300 +[ 191.389588] ? do_user_addr_fault+0x559/0x800 +[ 191.390027] ? irqentry_exit_to_user_mode+0x43/0x230 +[ 191.390525] ? irqentry_exit+0x1d/0x30 +[ 191.390879] ? exc_page_fault+0x86/0x160 +[ 191.391235] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ 191.391745] RIP: 0033:0x7dbc4ff1c574 +[ 191.392111] Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 +[ 191.393412] RSP: 002b:00007ffd95a23ab8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 +[ 191.393990] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007dbc4ff1c574 +[ 191.394594] RDX: 0000000000000005 RSI: 00005a6eeadb0ce0 RDI: 0000000000000001 +[ 191.395215] RBP: 00007ffd95a23ae0 R08: 00007dbc50003b20 R09: 0000000000000000 +[ 191.395805] R10: 0000000000000001 R11: 0000000000000202 R12: 0000000000000005 +[ 191.396404] R13: 00005a6eeadb0ce0 R14: 00007dbc500045c0 R15: 00007dbc50001ee0 +[ 191.396987] + +To fix this, we explicitly set such mana debugfs variables to NULL after +debugfs_remove() is called. + +Fixes: 6607c17c6c5e ("net: mana: Enable debugfs files for MANA device") +Cc: stable@vger.kernel.org +Signed-off-by: Shradha Gupta +Reviewed-by: Haiyang Zhang +Reviewed-by: Michal Kubiak +Link: https://patch.msgid.link/1741688260-28922-1-git-send-email-shradhagupta@linux.microsoft.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/microsoft/mana/gdma_main.c | 11 ++++++++++- + drivers/net/ethernet/microsoft/mana/mana_en.c | 10 ++++++---- + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c +index be95336ce089..11457b6296cc 100644 +--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c ++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c +@@ -1547,6 +1547,7 @@ unmap_bar: + * adapter-MTU file and apc->mana_pci_debugfs folder. + */ + debugfs_remove_recursive(gc->mana_pci_debugfs); ++ gc->mana_pci_debugfs = NULL; + pci_iounmap(pdev, bar0_va); + free_gc: + pci_set_drvdata(pdev, NULL); +@@ -1569,6 +1570,8 @@ static void mana_gd_remove(struct pci_dev *pdev) + + debugfs_remove_recursive(gc->mana_pci_debugfs); + ++ gc->mana_pci_debugfs = NULL; ++ + pci_iounmap(pdev, gc->bar0_va); + + vfree(gc); +@@ -1622,6 +1625,8 @@ static void mana_gd_shutdown(struct pci_dev *pdev) + + debugfs_remove_recursive(gc->mana_pci_debugfs); + ++ gc->mana_pci_debugfs = NULL; ++ + pci_disable_device(pdev); + } + +@@ -1648,8 +1653,10 @@ static int __init mana_driver_init(void) + mana_debugfs_root = debugfs_create_dir("mana", NULL); + + err = pci_register_driver(&mana_driver); +- if (err) ++ if (err) { + debugfs_remove(mana_debugfs_root); ++ mana_debugfs_root = NULL; ++ } + + return err; + } +@@ -1659,6 +1666,8 @@ static void __exit mana_driver_exit(void) + pci_unregister_driver(&mana_driver); + + debugfs_remove(mana_debugfs_root); ++ ++ mana_debugfs_root = NULL; + } + + module_init(mana_driver_init); +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index aa1e47233fe5..ae76ecc7a5d3 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -738,12 +738,11 @@ static const struct net_device_ops mana_devops = { + static void mana_cleanup_port_context(struct mana_port_context *apc) + { + /* +- * at this point all dir/files under the vport directory +- * are already cleaned up. +- * We are sure the apc->mana_port_debugfs remove will not +- * cause any freed memory access issues ++ * make sure subsequent cleanup attempts don't end up removing already ++ * cleaned dentry pointer + */ + debugfs_remove(apc->mana_port_debugfs); ++ apc->mana_port_debugfs = NULL; + kfree(apc->rxqs); + apc->rxqs = NULL; + } +@@ -1254,6 +1253,7 @@ static void mana_destroy_eq(struct mana_context *ac) + return; + + debugfs_remove_recursive(ac->mana_eqs_debugfs); ++ ac->mana_eqs_debugfs = NULL; + + for (i = 0; i < gc->max_num_queues; i++) { + eq = ac->eqs[i].eq; +@@ -1914,6 +1914,7 @@ static void mana_destroy_txq(struct mana_port_context *apc) + + for (i = 0; i < apc->num_queues; i++) { + debugfs_remove_recursive(apc->tx_qp[i].mana_tx_debugfs); ++ apc->tx_qp[i].mana_tx_debugfs = NULL; + + napi = &apc->tx_qp[i].tx_cq.napi; + if (apc->tx_qp[i].txq.napi_initialized) { +@@ -2099,6 +2100,7 @@ static void mana_destroy_rxq(struct mana_port_context *apc, + return; + + debugfs_remove_recursive(rxq->mana_rx_debugfs); ++ rxq->mana_rx_debugfs = NULL; + + napi = &rxq->rx_cq.napi; + +-- +2.48.1 + diff --git a/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch b/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch new file mode 100644 index 0000000000..9126158886 --- /dev/null +++ b/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch @@ -0,0 +1,102 @@ +From a07364b394697d2e0baffeb517f41385259aa484 Mon Sep 17 00:00:00 2001 +From: Andrei Botila +Date: Tue, 4 Mar 2025 18:06:13 +0200 +Subject: net: phy: nxp-c45-tja11xx: add TJA112X PHY configuration errata + +From: Andrei Botila + +commit a07364b394697d2e0baffeb517f41385259aa484 upstream. + +The most recent sillicon versions of TJA1120 and TJA1121 can achieve +full silicon performance by putting the PHY in managed mode. + +It is necessary to apply these PHY writes before link gets established. +Application of this fix is required after restart of device and wakeup +from sleep. + +Cc: stable@vger.kernel.org +Fixes: f1fe5dff2b8a ("net: phy: nxp-c45-tja11xx: add TJA1120 support") +Signed-off-by: Andrei Botila +Reviewed-by: Andrew Lunn +Link: https://patch.msgid.link/20250304160619.181046-2-andrei.botila@oss.nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/nxp-c45-tja11xx.c | 52 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 52 insertions(+) + +--- a/drivers/net/phy/nxp-c45-tja11xx.c ++++ b/drivers/net/phy/nxp-c45-tja11xx.c +@@ -22,6 +22,11 @@ + #define PHY_ID_TJA_1103 0x001BB010 + #define PHY_ID_TJA_1120 0x001BB031 + ++#define VEND1_DEVICE_ID3 0x0004 ++#define TJA1120_DEV_ID3_SILICON_VERSION GENMASK(15, 12) ++#define TJA1120_DEV_ID3_SAMPLE_TYPE GENMASK(11, 8) ++#define DEVICE_ID3_SAMPLE_TYPE_R 0x9 ++ + #define VEND1_DEVICE_CONTROL 0x0040 + #define DEVICE_CONTROL_RESET BIT(15) + #define DEVICE_CONTROL_CONFIG_GLOBAL_EN BIT(14) +@@ -1593,6 +1598,50 @@ static int nxp_c45_set_phy_mode(struct p + return 0; + } + ++/* Errata: ES_TJA1120 and ES_TJA1121 Rev. 1.0 — 28 November 2024 Section 3.1 */ ++static void nxp_c45_tja1120_errata(struct phy_device *phydev) ++{ ++ int silicon_version, sample_type; ++ bool macsec_ability; ++ int phy_abilities; ++ int ret = 0; ++ ++ ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_DEVICE_ID3); ++ if (ret < 0) ++ return; ++ ++ sample_type = FIELD_GET(TJA1120_DEV_ID3_SAMPLE_TYPE, ret); ++ if (sample_type != DEVICE_ID3_SAMPLE_TYPE_R) ++ return; ++ ++ silicon_version = FIELD_GET(TJA1120_DEV_ID3_SILICON_VERSION, ret); ++ ++ phy_abilities = phy_read_mmd(phydev, MDIO_MMD_VEND1, ++ VEND1_PORT_ABILITIES); ++ macsec_ability = !!(phy_abilities & MACSEC_ABILITY); ++ if ((!macsec_ability && silicon_version == 2) || ++ (macsec_ability && silicon_version == 1)) { ++ /* TJA1120/TJA1121 PHY configuration errata workaround. ++ * Apply PHY writes sequence before link up. ++ */ ++ if (!macsec_ability) { ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 0x4b95); ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 0xf3cd); ++ } else { ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 0x89c7); ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 0x0893); ++ } ++ ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x0476, 0x58a0); ++ ++ phy_write_mmd(phydev, MDIO_MMD_PMAPMD, 0x8921, 0xa3a); ++ phy_write_mmd(phydev, MDIO_MMD_PMAPMD, 0x89F1, 0x16c1); ++ ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 0x0); ++ phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 0x0); ++ } ++} ++ + static int nxp_c45_config_init(struct phy_device *phydev) + { + int ret; +@@ -1609,6 +1658,9 @@ static int nxp_c45_config_init(struct ph + phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 1); + phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 2); + ++ if (phy_id_compare(phydev->phy_id, PHY_ID_TJA_1120, GENMASK(31, 4))) ++ nxp_c45_tja1120_errata(phydev); ++ + phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, VEND1_PHY_CONFIG, + PHY_CONFIG_AUTO); + diff --git a/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch b/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch new file mode 100644 index 0000000000..cd5d81a990 --- /dev/null +++ b/queue-6.13/net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch @@ -0,0 +1,78 @@ +From 48939523843e4813e78920f54937944a8787134b Mon Sep 17 00:00:00 2001 +From: Andrei Botila +Date: Tue, 4 Mar 2025 18:06:14 +0200 +Subject: net: phy: nxp-c45-tja11xx: add TJA112XB SGMII PCS restart errata + +From: Andrei Botila + +commit 48939523843e4813e78920f54937944a8787134b upstream. + +TJA1120B/TJA1121B can achieve a stable operation of SGMII after +a startup event by putting the SGMII PCS into power down mode and +restart afterwards. + +It is necessary to put the SGMII PCS into power down mode and back up. + +Cc: stable@vger.kernel.org +Fixes: f1fe5dff2b8a ("net: phy: nxp-c45-tja11xx: add TJA1120 support") +Signed-off-by: Andrei Botila +Link: https://patch.msgid.link/20250304160619.181046-3-andrei.botila@oss.nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/nxp-c45-tja11xx.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/nxp-c45-tja11xx.c ++++ b/drivers/net/phy/nxp-c45-tja11xx.c +@@ -114,6 +114,9 @@ + #define MII_BASIC_CONFIG_RMII 0x5 + #define MII_BASIC_CONFIG_MII 0x4 + ++#define VEND1_SGMII_BASIC_CONTROL 0xB000 ++#define SGMII_LPM BIT(11) ++ + #define VEND1_SYMBOL_ERROR_CNT_XTD 0x8351 + #define EXTENDED_CNT_EN BIT(15) + #define VEND1_MONITOR_STATUS 0xAC80 +@@ -1598,11 +1601,11 @@ static int nxp_c45_set_phy_mode(struct p + return 0; + } + +-/* Errata: ES_TJA1120 and ES_TJA1121 Rev. 1.0 — 28 November 2024 Section 3.1 */ ++/* Errata: ES_TJA1120 and ES_TJA1121 Rev. 1.0 — 28 November 2024 Section 3.1 & 3.2 */ + static void nxp_c45_tja1120_errata(struct phy_device *phydev) + { ++ bool macsec_ability, sgmii_ability; + int silicon_version, sample_type; +- bool macsec_ability; + int phy_abilities; + int ret = 0; + +@@ -1619,6 +1622,7 @@ static void nxp_c45_tja1120_errata(struc + phy_abilities = phy_read_mmd(phydev, MDIO_MMD_VEND1, + VEND1_PORT_ABILITIES); + macsec_ability = !!(phy_abilities & MACSEC_ABILITY); ++ sgmii_ability = !!(phy_abilities & SGMII_ABILITY); + if ((!macsec_ability && silicon_version == 2) || + (macsec_ability && silicon_version == 1)) { + /* TJA1120/TJA1121 PHY configuration errata workaround. +@@ -1639,6 +1643,18 @@ static void nxp_c45_tja1120_errata(struc + + phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F8, 0x0); + phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x01F9, 0x0); ++ ++ if (sgmii_ability) { ++ /* TJA1120B/TJA1121B SGMII PCS restart errata workaround. ++ * Put SGMII PCS into power down mode and back up. ++ */ ++ phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, ++ VEND1_SGMII_BASIC_CONTROL, ++ SGMII_LPM); ++ phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, ++ VEND1_SGMII_BASIC_CONTROL, ++ SGMII_LPM); ++ } + } + } + diff --git a/queue-6.13/netmem-prevent-tx-of-unreadable-skbs.patch b/queue-6.13/netmem-prevent-tx-of-unreadable-skbs.patch new file mode 100644 index 0000000000..897ad1417a --- /dev/null +++ b/queue-6.13/netmem-prevent-tx-of-unreadable-skbs.patch @@ -0,0 +1,51 @@ +From f3600c867c99a2cc8038680ecf211089c50e7971 Mon Sep 17 00:00:00 2001 +From: Mina Almasry +Date: Thu, 6 Mar 2025 21:55:20 +0000 +Subject: netmem: prevent TX of unreadable skbs + +From: Mina Almasry + +commit f3600c867c99a2cc8038680ecf211089c50e7971 upstream. + +Currently on stable trees we have support for netmem/devmem RX but not +TX. It is not safe to forward/redirect an RX unreadable netmem packet +into the device's TX path, as the device may call dma-mapping APIs on +dma addrs that should not be passed to it. + +Fix this by preventing the xmit of unreadable skbs. + +Tested by configuring tc redirect: + +sudo tc qdisc add dev eth1 ingress +sudo tc filter add dev eth1 ingress protocol ip prio 1 flower ip_proto \ + tcp src_ip 192.168.1.12 action mirred egress redirect dev eth1 + +Before, I see unreadable skbs in the driver's TX path passed to dma +mapping APIs. + +After, I don't see unreadable skbs in the driver's TX path passed to dma +mapping APIs. + +Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") +Suggested-by: Jakub Kicinski +Cc: stable@vger.kernel.org +Signed-off-by: Mina Almasry +Link: https://patch.msgid.link/20250306215520.1415465-1-almasrymina@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3725,6 +3725,9 @@ static struct sk_buff *validate_xmit_skb + { + netdev_features_t features; + ++ if (!skb_frags_readable(skb)) ++ goto out_kfree_skb; ++ + features = netif_skb_features(skb); + skb = validate_xmit_vlan(skb, features); + if (unlikely(!skb)) diff --git a/queue-6.13/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch b/queue-6.13/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch new file mode 100644 index 0000000000..37b933128d --- /dev/null +++ b/queue-6.13/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch @@ -0,0 +1,51 @@ +From d2b9d97e89c79c95f8b517e4fa43fd100f936acc Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Fri, 7 Mar 2025 17:49:52 +0800 +Subject: qlcnic: fix memory leak issues in qlcnic_sriov_common.c + +From: Haoxiang Li + +commit d2b9d97e89c79c95f8b517e4fa43fd100f936acc upstream. + +Add qlcnic_sriov_free_vlans() in qlcnic_sriov_alloc_vlans() if +any sriov_vlans fails to be allocated. +Add qlcnic_sriov_free_vlans() to free the memory allocated by +qlcnic_sriov_alloc_vlans() if "sriov->allowed_vlans" fails to +be allocated. + +Fixes: 91b7282b613d ("qlcnic: Support VLAN id config.") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20250307094952.14874-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_m + + num_vlans = sriov->num_allowed_vlans; + sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL); +- if (!sriov->allowed_vlans) ++ if (!sriov->allowed_vlans) { ++ qlcnic_sriov_free_vlans(adapter); + return -ENOMEM; ++ } + + vlans = (u16 *)&cmd->rsp.arg[3]; + for (i = 0; i < num_vlans; i++) +@@ -2167,8 +2169,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcn + vf = &sriov->vf_info[i]; + vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, + sizeof(*vf->sriov_vlans), GFP_KERNEL); +- if (!vf->sriov_vlans) ++ if (!vf->sriov_vlans) { ++ qlcnic_sriov_free_vlans(adapter); + return -ENOMEM; ++ } + } + + return 0; diff --git a/queue-6.13/rust-alloc-satisfy-posix-alignment-requirement.patch b/queue-6.13/rust-alloc-satisfy-posix-alignment-requirement.patch new file mode 100644 index 0000000000..6c8d0fb5c5 --- /dev/null +++ b/queue-6.13/rust-alloc-satisfy-posix-alignment-requirement.patch @@ -0,0 +1,59 @@ +From ff64846bee0e7e3e7bc9363ebad3bab42dd27e24 Mon Sep 17 00:00:00 2001 +From: Tamir Duberstein +Date: Thu, 13 Feb 2025 06:34:18 -0500 +Subject: rust: alloc: satisfy POSIX alignment requirement + +From: Tamir Duberstein + +commit ff64846bee0e7e3e7bc9363ebad3bab42dd27e24 upstream. + +ISO C's `aligned_alloc` is partially implementation-defined; on some +systems it inherits stricter requirements from POSIX's `posix_memalign`. + +This causes the call added in commit dd09538fb409 ("rust: alloc: +implement `Cmalloc` in module allocator_test") to fail on macOS because +it doesn't meet the requirements of `posix_memalign`. + +Adjust the call to meet the POSIX requirement and add a comment. This +fixes failures in `make rusttest` on macOS. + +Acked-by: Danilo Krummrich +Cc: stable@vger.kernel.org +Fixes: dd09538fb409 ("rust: alloc: implement `Cmalloc` in module allocator_test") +Signed-off-by: Tamir Duberstein +Reviewed-by: Gary Guo +Link: https://lore.kernel.org/r/20250213-aligned-alloc-v7-1-d2a2d0be164b@gmail.com +[ Added Cc: stable. - Miguel ] +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/alloc/allocator_test.rs | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/rust/kernel/alloc/allocator_test.rs ++++ b/rust/kernel/alloc/allocator_test.rs +@@ -62,6 +62,24 @@ unsafe impl Allocator for Cmalloc { + )); + } + ++ // ISO C (ISO/IEC 9899:2011) defines `aligned_alloc`: ++ // ++ // > The value of alignment shall be a valid alignment supported by the implementation ++ // [...]. ++ // ++ // As an example of the "supported by the implementation" requirement, POSIX.1-2001 (IEEE ++ // 1003.1-2001) defines `posix_memalign`: ++ // ++ // > The value of alignment shall be a power of two multiple of sizeof (void *). ++ // ++ // and POSIX-based implementations of `aligned_alloc` inherit this requirement. At the time ++ // of writing, this is known to be the case on macOS (but not in glibc). ++ // ++ // Satisfy the stricter requirement to avoid spurious test failures on some platforms. ++ let min_align = core::mem::size_of::<*const crate::ffi::c_void>(); ++ let layout = layout.align_to(min_align).map_err(|_| AllocError)?; ++ let layout = layout.pad_to_align(); ++ + // SAFETY: Returns either NULL or a pointer to a memory allocation that satisfies or + // exceeds the given size and alignment requirements. + let dst = unsafe { libc_aligned_alloc(layout.align(), layout.size()) } as *mut u8; diff --git a/queue-6.13/rust-disallow-btf-generation-with-rust-lto.patch b/queue-6.13/rust-disallow-btf-generation-with-rust-lto.patch new file mode 100644 index 0000000000..c78986491c --- /dev/null +++ b/queue-6.13/rust-disallow-btf-generation-with-rust-lto.patch @@ -0,0 +1,37 @@ +From 5daa0c35a1f0e7a6c3b8ba9cb721e7d1ace6e619 Mon Sep 17 00:00:00 2001 +From: Matthew Maurer +Date: Wed, 8 Jan 2025 23:35:08 +0000 +Subject: rust: Disallow BTF generation with Rust + LTO + +From: Matthew Maurer + +commit 5daa0c35a1f0e7a6c3b8ba9cb721e7d1ace6e619 upstream. + +The kernel cannot currently self-parse BTF containing Rust debug +information. pahole uses the language of the CU to determine whether to +filter out debug information when generating the BTF. When LTO is +enabled, Rust code can cross CU boundaries, resulting in Rust debug +information in CUs labeled as C. This results in a system which cannot +parse its own BTF. + +Signed-off-by: Matthew Maurer +Cc: stable@vger.kernel.org +Fixes: c1177979af9c ("btf, scripts: Exclude Rust CUs with pahole") +Link: https://lore.kernel.org/r/20250108-rust-btf-lto-incompat-v1-1-60243ff6d820@google.com +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + init/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1959,7 +1959,7 @@ config RUST + depends on !MODVERSIONS + depends on !GCC_PLUGIN_RANDSTRUCT + depends on !RANDSTRUCT +- depends on !DEBUG_INFO_BTF || PAHOLE_HAS_LANG_EXCLUDE ++ depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO) + depends on !CFI_CLANG || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC + select CFI_ICALL_NORMALIZE_INTEGERS if CFI_CLANG + depends on !CALL_PADDING || RUSTC_VERSION >= 108100 diff --git a/queue-6.13/rust-init-fix-zeroable-implementation-for-option-nonnull-t-and-option-kbox-t.patch b/queue-6.13/rust-init-fix-zeroable-implementation-for-option-nonnull-t-and-option-kbox-t.patch new file mode 100644 index 0000000000..e49f0c92e1 --- /dev/null +++ b/queue-6.13/rust-init-fix-zeroable-implementation-for-option-nonnull-t-and-option-kbox-t.patch @@ -0,0 +1,54 @@ +From df27cef153603b18a7d094b53cc3d5264ff32797 Mon Sep 17 00:00:00 2001 +From: Benno Lossin +Date: Wed, 5 Mar 2025 13:29:01 +0000 +Subject: rust: init: fix `Zeroable` implementation for `Option>` and `Option>` + +From: Benno Lossin + +commit df27cef153603b18a7d094b53cc3d5264ff32797 upstream. + +According to [1], `NonNull` and `#[repr(transparent)]` wrapper types +such as our custom `KBox` have the null pointer optimization only if +`T: Sized`. Thus remove the `Zeroable` implementation for the unsized +case. + +Link: https://doc.rust-lang.org/stable/std/option/index.html#representation [1] +Reported-by: Alice Ryhl +Closes: https://lore.kernel.org/rust-for-linux/CAH5fLghL+qzrD8KiCF1V3vf2YcC6aWySzkmaE2Zzrnh1gKj-hw@mail.gmail.com/ +Cc: stable@vger.kernel.org # v6.12+ (a custom patch will be needed for 6.6.y) +Fixes: 38cde0bd7b67 ("rust: init: add `Zeroable` trait and `init::zeroed` function") +Signed-off-by: Benno Lossin +Reviewed-by: Alice Ryhl +Reviewed-by: Andreas Hindborg +Link: https://lore.kernel.org/r/20250305132836.2145476-1-benno.lossin@proton.me +[ Added Closes tag and moved up the Reported-by one. - Miguel ] +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/init.rs | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/rust/kernel/init.rs ++++ b/rust/kernel/init.rs +@@ -1400,17 +1400,14 @@ impl_zeroable! { + // SAFETY: `T: Zeroable` and `UnsafeCell` is `repr(transparent)`. + {} UnsafeCell, + +- // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee). ++ // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee: ++ // https://doc.rust-lang.org/stable/std/option/index.html#representation). + Option, Option, Option, Option, + Option, Option, + Option, Option, Option, Option, + Option, Option, +- +- // SAFETY: All zeros is equivalent to `None` (option layout optimization guarantee). +- // +- // In this case we are allowed to use `T: ?Sized`, since all zeros is the `None` variant. +- {} Option>, +- {} Option>, ++ {} Option>, ++ {} Option>, + + // SAFETY: `null` pointer is valid. + // diff --git a/queue-6.13/rust-lockdep-remove-support-for-dynamically-allocated-lockclasskeys.patch b/queue-6.13/rust-lockdep-remove-support-for-dynamically-allocated-lockclasskeys.patch new file mode 100644 index 0000000000..29b0c5a3f9 --- /dev/null +++ b/queue-6.13/rust-lockdep-remove-support-for-dynamically-allocated-lockclasskeys.patch @@ -0,0 +1,61 @@ +From 966944f3711665db13e214fef6d02982c49bb972 Mon Sep 17 00:00:00 2001 +From: Mitchell Levy +Date: Fri, 7 Mar 2025 15:27:00 -0800 +Subject: rust: lockdep: Remove support for dynamically allocated LockClassKeys + +From: Mitchell Levy + +commit 966944f3711665db13e214fef6d02982c49bb972 upstream. + +Currently, dynamically allocated LockCLassKeys can be used from the Rust +side without having them registered. This is a soundness issue, so +remove them. + +Fixes: 6ea5aa08857a ("rust: sync: introduce `LockClassKey`") +Suggested-by: Alice Ryhl +Signed-off-by: Mitchell Levy +Signed-off-by: Boqun Feng +Signed-off-by: Ingo Molnar +Reviewed-by: Benno Lossin +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250307232717.1759087-11-boqun.feng@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + rust/kernel/sync.rs | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +--- a/rust/kernel/sync.rs ++++ b/rust/kernel/sync.rs +@@ -29,28 +29,20 @@ pub struct LockClassKey(Opaque Self { +- Self(Opaque::uninit()) +- } +- + pub(crate) fn as_ptr(&self) -> *mut bindings::lock_class_key { + self.0.get() + } + } + +-impl Default for LockClassKey { +- fn default() -> Self { +- Self::new() +- } +-} +- + /// Defines a new static lock class and returns a pointer to it. + #[doc(hidden)] + #[macro_export] + macro_rules! static_lock_class { + () => {{ +- static CLASS: $crate::sync::LockClassKey = $crate::sync::LockClassKey::new(); ++ static CLASS: $crate::sync::LockClassKey = ++ // SAFETY: lockdep expects uninitialized memory when it's handed a statically allocated ++ // lock_class_key ++ unsafe { ::core::mem::MaybeUninit::uninit().assume_init() }; + &CLASS + }}; + } diff --git a/queue-6.13/rust-remove-leftover-mentions-of-the-alloc-crate.patch b/queue-6.13/rust-remove-leftover-mentions-of-the-alloc-crate.patch new file mode 100644 index 0000000000..da1155eac6 --- /dev/null +++ b/queue-6.13/rust-remove-leftover-mentions-of-the-alloc-crate.patch @@ -0,0 +1,62 @@ +From 374908a15af4cd60862ebc51a6e012ace2212c76 Mon Sep 17 00:00:00 2001 +From: Miguel Ojeda +Date: Mon, 3 Mar 2025 18:10:30 +0100 +Subject: rust: remove leftover mentions of the `alloc` crate + +From: Miguel Ojeda + +commit 374908a15af4cd60862ebc51a6e012ace2212c76 upstream. + +In commit 392e34b6bc22 ("kbuild: rust: remove the `alloc` crate and +`GlobalAlloc`") we stopped using the upstream `alloc` crate. + +Thus remove a few leftover mentions treewide. + +Cc: stable@vger.kernel.org # Also to 6.12.y after the `alloc` backport lands +Fixes: 392e34b6bc22 ("kbuild: rust: remove the `alloc` crate and `GlobalAlloc`") +Reviewed-by: Danilo Krummrich +Reviewed-by: Andreas Hindborg +Link: https://lore.kernel.org/r/20250303171030.1081134-1-ojeda@kernel.org +Signed-off-by: Miguel Ojeda +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/rust/quick-start.rst | 2 +- + rust/kernel/lib.rs | 2 +- + scripts/rustdoc_test_gen.rs | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +--- a/Documentation/rust/quick-start.rst ++++ b/Documentation/rust/quick-start.rst +@@ -145,7 +145,7 @@ Rust standard library source + **************************** + + The Rust standard library source is required because the build system will +-cross-compile ``core`` and ``alloc``. ++cross-compile ``core``. + + If ``rustup`` is being used, run:: + +--- a/rust/kernel/lib.rs ++++ b/rust/kernel/lib.rs +@@ -6,7 +6,7 @@ + //! usage by Rust code in the kernel and is shared by all of them. + //! + //! In other words, all the rest of the Rust code in the kernel (e.g. kernel +-//! modules written in Rust) depends on [`core`], [`alloc`] and this crate. ++//! modules written in Rust) depends on [`core`] and this crate. + //! + //! If you need a kernel C API that is not ported or wrapped yet here, then + //! do so first instead of bypassing this crate. +--- a/scripts/rustdoc_test_gen.rs ++++ b/scripts/rustdoc_test_gen.rs +@@ -15,8 +15,8 @@ + //! - Test code should be able to define functions and call them, without having to carry + //! the context. + //! +-//! - Later on, we may want to be able to test non-kernel code (e.g. `core`, `alloc` or +-//! third-party crates) which likely use the standard library `assert*!` macros. ++//! - Later on, we may want to be able to test non-kernel code (e.g. `core` or third-party ++//! crates) which likely use the standard library `assert*!` macros. + //! + //! For this reason, instead of the passed context, `kunit_get_current_test()` is used instead + //! (i.e. `current->kunit_test`). diff --git a/queue-6.13/series b/queue-6.13/series index cf5c2c15d9..3fd10431d1 100644 --- a/queue-6.13/series +++ b/queue-6.13/series @@ -155,3 +155,58 @@ drm-nouveau-do-not-override-forced-connector-status.patch net-handle-napi_schedule-calls-from-non-interrupt.patch block-fix-kmem_cache-of-name-bio-108-already-exists.patch vhost-return-task-creation-error-instead-of-null.patch +input-goodix-berlin-fix-vddio-regulator-references.patch +input-ads7846-fix-gpiod-allocation.patch +input-iqs7222-preserve-system-status-register.patch +input-xpad-add-8bitdo-sn30-pro-hyperkin-x91-and-gamesir-g7-se-controllers.patch +input-xpad-add-multiple-supported-devices.patch +input-xpad-add-support-for-zotac-gaming-zone.patch +input-xpad-add-support-for-tecno-pocket-go.patch +input-xpad-rename-qh-controller-to-legion-go-s.patch +input-i8042-swap-old-quirk-combination-with-new-quirk-for-nhxxrzq.patch +input-i8042-add-required-quirks-for-missing-old-boardnames.patch +input-i8042-swap-old-quirk-combination-with-new-quirk-for-several-devices.patch +input-i8042-swap-old-quirk-combination-with-new-quirk-for-more-devices.patch +usb-typec-tcpm-fix-state-transition-for-snk_wait_capabilities-state-in-run_state_machine.patch +usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch +usb-serial-option-add-telit-cinterion-fe990b-compositions.patch +usb-serial-option-fix-telit-cinterion-fe990a-name.patch +usb-serial-option-match-on-interface-class-for-telit-fn990b.patch +rust-lockdep-remove-support-for-dynamically-allocated-lockclasskeys.patch +rust-remove-leftover-mentions-of-the-alloc-crate.patch +rust-alloc-satisfy-posix-alignment-requirement.patch +rust-disallow-btf-generation-with-rust-lto.patch +rust-init-fix-zeroable-implementation-for-option-nonnull-t-and-option-kbox-t.patch +x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch +spi-microchip-core-prevent-rx-overflows-when-transmit-size-fifo-size.patch +drm-i915-cdclk-do-cdclk-post-plane-programming-later.patch +drm-panic-use-div_ceil-to-clean-clippy-warning.patch +drm-panic-fix-overindented-list-items-in-documentation.patch +drm-atomic-filter-out-redundant-dpms-calls.patch +drm-dp_mst-fix-locking-when-skipping-csn-before-topology-probing.patch +drm-amdgpu-null-check-bo-s-backing-store-when-determining-gfx12-pte-flags.patch +drm-amd-amdkfd-evict-all-queues-even-hws-remove-queue-failed.patch +drm-amdgpu-vce2-fix-ip-block-reference.patch +drm-amdgpu-display-allow-dcc-for-video-formats-on-gfx12.patch +drm-amd-display-disable-unneeded-hpd-interrupts-during-dm_init.patch +drm-amd-display-fix-default-brightness.patch +drm-amd-display-fix-missing-.is_two_pixels_per_container.patch +drm-amd-display-restore-correct-backlight-brightness-after-a-gpu-reset.patch +drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch +drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch +ksmbd-fix-use-after-free-in-ksmbd_free_work_struct.patch +ksmbd-prevent-connection-release-during-oplock-break-notification.patch +clk-samsung-update-pll-locktime-for-pll142xx-used-on-fsd-platform.patch +clk-samsung-gs101-fix-synchronous-external-abort-in-samsung_clk_save.patch +asoc-tegra-fix-adx-s24_le-audio-format.patch +asoc-intel-sof_sdw-fix-unlikely-uninitialized-variable-use-in-create_sdw_dailinks.patch +asoc-amd-yc-support-mic-on-another-lenovo-thinkpad-e16-gen-2-model.patch +netmem-prevent-tx-of-unreadable-skbs.patch +dm-flakey-fix-memory-corruption-in-optional-corrupt_bio_byte-feature.patch +arm64-mm-populate-vmemmap-at-the-page-level-if-not-section-aligned.patch +fix-mmu-notifiers-for-range-based-invalidates.patch +qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch +smb-client-fix-regression-with-guest-option.patch +net-mana-cleanup-mana-struct-after-debugfs_remove.patch +net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch +net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch diff --git a/queue-6.13/smb-client-fix-regression-with-guest-option.patch b/queue-6.13/smb-client-fix-regression-with-guest-option.patch new file mode 100644 index 0000000000..3370e2c42e --- /dev/null +++ b/queue-6.13/smb-client-fix-regression-with-guest-option.patch @@ -0,0 +1,50 @@ +From fc99045effa81fdf509c2a97cbb7e6e8f2fd4443 Mon Sep 17 00:00:00 2001 +From: Paulo Alcantara +Date: Wed, 12 Mar 2025 10:51:31 -0300 +Subject: smb: client: fix regression with guest option + +From: Paulo Alcantara + +commit fc99045effa81fdf509c2a97cbb7e6e8f2fd4443 upstream. + +When mounting a CIFS share with 'guest' mount option, mount.cifs(8) +will set empty password= and password2= options. Currently we only +handle empty strings from user= and password= options, so the mount +will fail with + + cifs: Bad value for 'password2' + +Fix this by handling empty string from password2= option as well. + +Link: https://bbs.archlinux.org/viewtopic.php?id=303927 +Reported-by: Adam Williamson +Closes: https://lore.kernel.org/r/83c00b5fea81c07f6897a5dd3ef50fd3b290f56c.camel@redhat.com +Fixes: 35f834265e0d ("smb3: fix broken reconnect when password changing on the server by allowing password rotation") +Cc: stable@vger.kernel.org +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/fs_context.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/smb/client/fs_context.c ++++ b/fs/smb/client/fs_context.c +@@ -170,6 +170,7 @@ const struct fs_parameter_spec smb3_fs_p + fsparam_string("username", Opt_user), + fsparam_string("pass", Opt_pass), + fsparam_string("password", Opt_pass), ++ fsparam_string("pass2", Opt_pass2), + fsparam_string("password2", Opt_pass2), + fsparam_string("ip", Opt_ip), + fsparam_string("addr", Opt_ip), +@@ -1071,6 +1072,9 @@ static int smb3_fs_context_parse_param(s + } else if (!strcmp("user", param->key) || !strcmp("username", param->key)) { + skip_parsing = true; + opt = Opt_user; ++ } else if (!strcmp("pass2", param->key) || !strcmp("password2", param->key)) { ++ skip_parsing = true; ++ opt = Opt_pass2; + } + } + diff --git a/queue-6.13/spi-microchip-core-prevent-rx-overflows-when-transmit-size-fifo-size.patch b/queue-6.13/spi-microchip-core-prevent-rx-overflows-when-transmit-size-fifo-size.patch new file mode 100644 index 0000000000..3ef1ddbf4f --- /dev/null +++ b/queue-6.13/spi-microchip-core-prevent-rx-overflows-when-transmit-size-fifo-size.patch @@ -0,0 +1,114 @@ +From 91cf42c63f2d8a9c1bcdfe923218e079b32e1a69 Mon Sep 17 00:00:00 2001 +From: Conor Dooley +Date: Mon, 3 Mar 2025 10:47:40 +0000 +Subject: spi: microchip-core: prevent RX overflows when transmit size > FIFO size + +From: Conor Dooley + +commit 91cf42c63f2d8a9c1bcdfe923218e079b32e1a69 upstream. + +When the size of a transfer exceeds the size of the FIFO (32 bytes), RX +overflows will be generated and receive data will be corrupted and +warnings will be produced. For example, here's an error generated by a +transfer of 36 bytes: + + spi_master spi0: mchp_corespi_interrupt: RX OVERFLOW: rxlen: 4, txlen: 0 + +The driver is currently split between handling receiving in the +interrupt handler, and sending outside of it. Move all handling out of +the interrupt handling, and explicitly link the number of bytes read of +of the RX FIFO to the number written into the TX one. This both resolves +the overflow problems as well as simplifying the flow of the driver. + +CC: stable@vger.kernel.org +Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") +Signed-off-by: Conor Dooley +Link: https://patch.msgid.link/20250303-veal-snooper-712c1dfad336@wendy +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-microchip-core.c | 41 +++++++++++++++++---------------------- + 1 file changed, 18 insertions(+), 23 deletions(-) + +--- a/drivers/spi/spi-microchip-core.c ++++ b/drivers/spi/spi-microchip-core.c +@@ -70,8 +70,7 @@ + #define INT_RX_CHANNEL_OVERFLOW BIT(2) + #define INT_TX_CHANNEL_UNDERRUN BIT(3) + +-#define INT_ENABLE_MASK (CONTROL_RX_DATA_INT | CONTROL_TX_DATA_INT | \ +- CONTROL_RX_OVER_INT | CONTROL_TX_UNDER_INT) ++#define INT_ENABLE_MASK (CONTROL_RX_OVER_INT | CONTROL_TX_UNDER_INT) + + #define REG_CONTROL (0x00) + #define REG_FRAME_SIZE (0x04) +@@ -133,10 +132,15 @@ static inline void mchp_corespi_disable( + mchp_corespi_write(spi, REG_CONTROL, control); + } + +-static inline void mchp_corespi_read_fifo(struct mchp_corespi *spi) ++static inline void mchp_corespi_read_fifo(struct mchp_corespi *spi, int fifo_max) + { +- while (spi->rx_len >= spi->n_bytes && !(mchp_corespi_read(spi, REG_STATUS) & STATUS_RXFIFO_EMPTY)) { +- u32 data = mchp_corespi_read(spi, REG_RX_DATA); ++ for (int i = 0; i < fifo_max; i++) { ++ u32 data; ++ ++ while (mchp_corespi_read(spi, REG_STATUS) & STATUS_RXFIFO_EMPTY) ++ ; ++ ++ data = mchp_corespi_read(spi, REG_RX_DATA); + + spi->rx_len -= spi->n_bytes; + +@@ -211,11 +215,10 @@ static inline void mchp_corespi_set_xfer + mchp_corespi_write(spi, REG_FRAMESUP, len); + } + +-static inline void mchp_corespi_write_fifo(struct mchp_corespi *spi) ++static inline void mchp_corespi_write_fifo(struct mchp_corespi *spi, int fifo_max) + { +- int fifo_max, i = 0; ++ int i = 0; + +- fifo_max = DIV_ROUND_UP(min(spi->tx_len, FIFO_DEPTH), spi->n_bytes); + mchp_corespi_set_xfer_size(spi, fifo_max); + + while ((i < fifo_max) && !(mchp_corespi_read(spi, REG_STATUS) & STATUS_TXFIFO_FULL)) { +@@ -413,19 +416,6 @@ static irqreturn_t mchp_corespi_interrup + if (intfield == 0) + return IRQ_NONE; + +- if (intfield & INT_TXDONE) +- mchp_corespi_write(spi, REG_INT_CLEAR, INT_TXDONE); +- +- if (intfield & INT_RXRDY) { +- mchp_corespi_write(spi, REG_INT_CLEAR, INT_RXRDY); +- +- if (spi->rx_len) +- mchp_corespi_read_fifo(spi); +- } +- +- if (!spi->rx_len && !spi->tx_len) +- finalise = true; +- + if (intfield & INT_RX_CHANNEL_OVERFLOW) { + mchp_corespi_write(spi, REG_INT_CLEAR, INT_RX_CHANNEL_OVERFLOW); + finalise = true; +@@ -512,9 +502,14 @@ static int mchp_corespi_transfer_one(str + + mchp_corespi_write(spi, REG_SLAVE_SELECT, spi->pending_slave_select); + +- while (spi->tx_len) +- mchp_corespi_write_fifo(spi); ++ while (spi->tx_len) { ++ int fifo_max = DIV_ROUND_UP(min(spi->tx_len, FIFO_DEPTH), spi->n_bytes); ++ ++ mchp_corespi_write_fifo(spi, fifo_max); ++ mchp_corespi_read_fifo(spi, fifo_max); ++ } + ++ spi_finalize_current_transfer(host); + return 1; + } + diff --git a/queue-6.13/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch b/queue-6.13/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch new file mode 100644 index 0000000000..20d3e2c0a6 --- /dev/null +++ b/queue-6.13/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch @@ -0,0 +1,88 @@ +From 18e0885bd2ca738407036434418a26a58394a60e Mon Sep 17 00:00:00 2001 +From: Boon Khai Ng +Date: Wed, 12 Mar 2025 11:05:44 +0800 +Subject: USB: serial: ftdi_sio: add support for Altera USB Blaster 3 + +From: Boon Khai Ng + +commit 18e0885bd2ca738407036434418a26a58394a60e upstream. + +The Altera USB Blaster 3, available as both a cable and an on-board +solution, is primarily used for programming and debugging FPGAs. + +It interfaces with host software such as Quartus Programmer, +System Console, SignalTap, and Nios Debugger. The device utilizes +either an FT2232 or FT4232 chip. + +Enabling the support for various configurations of the on-board +USB Blaster 3 by including the appropriate VID/PID pairs, +allowing it to function as a serial device via ftdi_sio. + +Note that this check-in does not include support for the +cable solution, as it does not support UART functionality. +The supported configurations are determined by the +hardware design and include: + +1) PID 0x6022, FT2232, 1 JTAG port (Port A) + Port B as UART +2) PID 0x6025, FT4232, 1 JTAG port (Port A) + Port C as UART +3) PID 0x6026, FT4232, 1 JTAG port (Port A) + Port C, D as UART +4) PID 0x6029, FT4232, 1 JTAG port (Port B) + Port C as UART +5) PID 0x602a, FT4232, 1 JTAG port (Port B) + Port C, D as UART +6) PID 0x602c, FT4232, 1 JTAG port (Port A) + Port B as UART +7) PID 0x602d, FT4232, 1 JTAG port (Port A) + Port B, C as UART +8) PID 0x602e, FT4232, 1 JTAG port (Port A) + Port B, C, D as UART + +These configurations allow for flexibility in how the USB Blaster 3 is +used, depending on the specific needs of the hardware design. + +Signed-off-by: Boon Khai Ng +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 14 ++++++++++++++ + drivers/usb/serial/ftdi_sio_ids.h | 13 +++++++++++++ + 2 files changed, 27 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1079,6 +1079,20 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + /* GMC devices */ + { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, ++ /* Altera USB Blaster 3 */ ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1612,3 +1612,16 @@ + */ + #define GMC_VID 0x1cd7 + #define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */ ++ ++/* ++ * Altera USB Blaster 3 (http://www.altera.com). ++ */ ++#define ALTERA_VID 0x09fb ++#define ALTERA_UB3_6022_PID 0x6022 ++#define ALTERA_UB3_6025_PID 0x6025 ++#define ALTERA_UB3_6026_PID 0x6026 ++#define ALTERA_UB3_6029_PID 0x6029 ++#define ALTERA_UB3_602A_PID 0x602a ++#define ALTERA_UB3_602C_PID 0x602c ++#define ALTERA_UB3_602D_PID 0x602d ++#define ALTERA_UB3_602E_PID 0x602e diff --git a/queue-6.13/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch b/queue-6.13/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch new file mode 100644 index 0000000000..c451fa3657 --- /dev/null +++ b/queue-6.13/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch @@ -0,0 +1,209 @@ +From 4981bb50392b7515b765da28cf8768ce624c2670 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Tue, 4 Mar 2025 10:19:38 +0100 +Subject: USB: serial: option: add Telit Cinterion FE990B compositions + +From: Fabio Porcedda + +commit 4981bb50392b7515b765da28cf8768ce624c2670 upstream. + +Add the following Telit Cinterion FE990B40 compositions: + +0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b1 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b2 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b3 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Reviewed-by: Daniele Palmas +[ johan: use USB_DEVICE_AND_INTERFACE_INFO() and sort by protocol ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1388,6 +1388,22 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ ++ .driver_info = NCTRL(5) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ diff --git a/queue-6.13/usb-serial-option-fix-telit-cinterion-fe990a-name.patch b/queue-6.13/usb-serial-option-fix-telit-cinterion-fe990a-name.patch new file mode 100644 index 0000000000..9329dcc1cd --- /dev/null +++ b/queue-6.13/usb-serial-option-fix-telit-cinterion-fe990a-name.patch @@ -0,0 +1,40 @@ +From 6232f0d8e100a26275bbd773fc56a60af2c95322 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Tue, 4 Mar 2025 10:19:39 +0100 +Subject: USB: serial: option: fix Telit Cinterion FE990A name + +From: Fabio Porcedda + +commit 6232f0d8e100a26275bbd773fc56a60af2c95322 upstream. + +The correct name for FE990 is FE990A so use it in order to avoid +confusion with FE990B. + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1368,13 +1368,13 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ + .driver_info = RSVD(0) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ + .driver_info = NCTRL(0) | RSVD(1) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, diff --git a/queue-6.13/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch b/queue-6.13/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch new file mode 100644 index 0000000000..9ffdf5cc2f --- /dev/null +++ b/queue-6.13/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch @@ -0,0 +1,63 @@ +From 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 6 Mar 2025 11:44:41 +0100 +Subject: USB: serial: option: match on interface class for Telit FN990B + +From: Johan Hovold + +commit 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 upstream. + +The device id entries for Telit FN990B ended up matching only on the +interface protocol. While this works, the protocol is qualified by the +interface class (and subclass) which should have been included. + +Switch to matching using USB_DEVICE_AND_INTERFACE_INFO() while keeping +the entries sorted also by protocol for consistency. + +Link: https://lore.kernel.org/20250227110655.3647028-2-fabio.porcedda@gmail.com/ +Cc: Fabio Porcedda +Cc: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1410,22 +1410,22 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ + .driver_info = NCTRL(5) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ + .driver_info = NCTRL(6) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */ + .driver_info = NCTRL(6) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */ + .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-6.13/usb-typec-tcpm-fix-state-transition-for-snk_wait_capabilities-state-in-run_state_machine.patch b/queue-6.13/usb-typec-tcpm-fix-state-transition-for-snk_wait_capabilities-state-in-run_state_machine.patch new file mode 100644 index 0000000000..258681fcc7 --- /dev/null +++ b/queue-6.13/usb-typec-tcpm-fix-state-transition-for-snk_wait_capabilities-state-in-run_state_machine.patch @@ -0,0 +1,52 @@ +From f2865c6300d75a9f187dd7918d248e010970fd44 Mon Sep 17 00:00:00 2001 +From: Amit Sunil Dhamne +Date: Mon, 10 Mar 2025 19:19:07 -0700 +Subject: usb: typec: tcpm: fix state transition for SNK_WAIT_CAPABILITIES state in run_state_machine() + +From: Amit Sunil Dhamne + +commit f2865c6300d75a9f187dd7918d248e010970fd44 upstream. + +A subtle error got introduced while manually fixing merge conflict in +tcpm.c for commit 85c4efbe6088 ("Merge v6.12-rc6 into usb-next"). As a +result of this error, the next state is unconditionally set to +SNK_WAIT_CAPABILITIES_TIMEOUT while handling SNK_WAIT_CAPABILITIES state +in run_state_machine(...). + +Fix this by setting new state of TCPM state machine to `upcoming_state` +(that is set to different values based on conditions). + +Cc: stable@vger.kernel.org +Fixes: 85c4efbe60888 ("Merge v6.12-rc6 into usb-next") +Signed-off-by: Amit Sunil Dhamne +Reviewed-by: Badhri Jagan Sridharan +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250310-fix-snk-wait-timeout-v6-14-rc6-v1-1-5db14475798f@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -5067,16 +5067,16 @@ static void run_state_machine(struct tcp + */ + if (port->vbus_never_low) { + port->vbus_never_low = false; +- tcpm_set_state(port, SNK_SOFT_RESET, +- port->timings.sink_wait_cap_time); ++ upcoming_state = SNK_SOFT_RESET; + } else { + if (!port->self_powered) + upcoming_state = SNK_WAIT_CAPABILITIES_TIMEOUT; + else + upcoming_state = hard_reset_state(port); +- tcpm_set_state(port, SNK_WAIT_CAPABILITIES_TIMEOUT, +- port->timings.sink_wait_cap_time); + } ++ ++ tcpm_set_state(port, upcoming_state, ++ port->timings.sink_wait_cap_time); + break; + case SNK_WAIT_CAPABILITIES_TIMEOUT: + /* diff --git a/queue-6.13/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch b/queue-6.13/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch new file mode 100644 index 0000000000..df55f0fd93 --- /dev/null +++ b/queue-6.13/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch @@ -0,0 +1,74 @@ +From e3e89178a9f4a80092578af3ff3c8478f9187d59 Mon Sep 17 00:00:00 2001 +From: Florent Revest +Date: Mon, 10 Mar 2025 15:42:43 +0100 +Subject: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes + +From: Florent Revest + +commit e3e89178a9f4a80092578af3ff3c8478f9187d59 upstream. + +Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their +CPU masks and unconditionally accesses per-CPU data for the first CPU of each +mask. + +According to Documentation/admin-guide/mm/numaperf.rst: + + "Some memory may share the same node as a CPU, and others are provided as + memory only nodes." + +Therefore, some node CPU masks may be empty and wouldn't have a "first CPU". + +On a machine with far memory (and therefore CPU-less NUMA nodes): +- cpumask_of_node(nid) is 0 +- cpumask_first(0) is CONFIG_NR_CPUS +- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an + index that is 1 out of bounds + +This does not have any security implications since flashing microcode is +a privileged operation but I believe this has reliability implications by +potentially corrupting memory while flashing a microcode update. + +When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes +a microcode update. I get the following splat: + + UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y + index 512 is out of range for type 'unsigned long[512]' + [...] + Call Trace: + dump_stack + __ubsan_handle_out_of_bounds + load_microcode_amd + request_microcode_amd + reload_store + kernfs_fop_write_iter + vfs_write + ksys_write + do_syscall_64 + entry_SYSCALL_64_after_hwframe + +Change the loop to go over only NUMA nodes which have CPUs before determining +whether the first CPU on the respective node needs microcode update. + + [ bp: Massage commit message, fix typo. ] + +Fixes: 7ff6edf4fef3 ("x86/microcode/AMD: Fix mixed steppings support") +Signed-off-by: Florent Revest +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250310144243.861978-1-revest@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -1075,7 +1075,7 @@ static enum ucode_state load_microcode_a + if (ret != UCODE_OK) + return ret; + +- for_each_node(nid) { ++ for_each_node_with_cpus(nid) { + cpu = cpumask_first(cpumask_of_node(nid)); + c = &cpu_data(cpu); +