From: Sasha Levin Date: Mon, 18 Mar 2024 22:55:56 +0000 (-0400) Subject: Fixes for 6.7 X-Git-Tag: v6.8.2~100 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ea5dfbc9de04a38d5262c3a246ac5028a3495a7d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.7 Signed-off-by: Sasha Levin --- diff --git a/queue-6.7/alsa-hda-cs35l41-overwrite-cs35l41-configuration-for.patch b/queue-6.7/alsa-hda-cs35l41-overwrite-cs35l41-configuration-for.patch new file mode 100644 index 00000000000..2cca9a17f13 --- /dev/null +++ b/queue-6.7/alsa-hda-cs35l41-overwrite-cs35l41-configuration-for.patch @@ -0,0 +1,44 @@ +From 6c837550040a55d2ef22ce266a7420ec7181321c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 16:01:54 +0000 +Subject: ALSA: hda: cs35l41: Overwrite CS35L41 configuration for ASUS UM5302LA + +From: Stefan Binding + +[ Upstream commit b603d95692e47dc6f5f733e93c3841dc0c01e624 ] + +Whilst this laptop contains _DSD inside the BIOS, there is an error in +this configuration. Override the _DSD in the BIOS with the correct +configuration for this laptop. + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20240301160154.158398-4-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l41_hda_property.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index 6cf4c02f9effd..5a5f4b499fd94 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -83,6 +83,7 @@ static const struct cs35l41_config cs35l41_config_table[] = { + { "104317F3", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431863", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "104318D3", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "10431A83", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431C9F", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "10431CAF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "10431CCF", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, +@@ -420,6 +421,7 @@ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CSC3551", "104317F3", generic_dsd_config }, + { "CSC3551", "10431863", generic_dsd_config }, + { "CSC3551", "104318D3", generic_dsd_config }, ++ { "CSC3551", "10431A83", generic_dsd_config }, + { "CSC3551", "10431C9F", generic_dsd_config }, + { "CSC3551", "10431CAF", generic_dsd_config }, + { "CSC3551", "10431CCF", generic_dsd_config }, +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-realtek-add-quirks-for-lenovo-thinkbook-16p.patch b/queue-6.7/alsa-hda-realtek-add-quirks-for-lenovo-thinkbook-16p.patch new file mode 100644 index 00000000000..4cc3d445400 --- /dev/null +++ b/queue-6.7/alsa-hda-realtek-add-quirks-for-lenovo-thinkbook-16p.patch @@ -0,0 +1,38 @@ +From ebeec8bfb4d78b9300fb892dc5f177eed097637b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 16:01:53 +0000 +Subject: ALSA: hda/realtek: Add quirks for Lenovo Thinkbook 16P laptops + +From: Stefan Binding + +[ Upstream commit 6214e24cae9b10a7c1572f99552610a24614fffe ] + +These models use 2 CS35L41 amps with HDA using I2C. +Both models have _DSD support inside cs35l41_hda_property.c. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218437 + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20240301160154.158398-3-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ebde2ea8fa812..baf550b5a7c49 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10289,6 +10289,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3886, "Y780 VECO DUAL", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38a7, "Y780P AMD YG dual", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38a8, "Y780P AMD VECO dual", ALC287_FIXUP_TAS2781_I2C), ++ SND_PCI_QUIRK(0x17aa, 0x38a9, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x38ab, "Thinkbook 16P", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x38b4, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x38b5, "Legion Slim 7 16IRH8", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x38b6, "Legion Slim 7 16APH8", ALC287_FIXUP_CS35L41_I2C_2), +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch b/queue-6.7/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch new file mode 100644 index 00000000000..10905f80ecb --- /dev/null +++ b/queue-6.7/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch @@ -0,0 +1,35 @@ +From 46dbba6b4378141e96181446d7bf5b7c688f7a07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 14:54:34 +0800 +Subject: ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port + +From: Kailang Yang + +[ Upstream commit b34bf65838f7c6e785f62681605a538b73c2808c ] + +It had pop noise from Headphone port when system reboot state. +If NID 58h Index 0x0 to fill default value, it will reduce pop noise. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/r/7493e207919a4fb3a0599324fd010e3e@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index eb45e5c3db8c6..ebde2ea8fa812 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3684,6 +3684,7 @@ static void alc285_hp_init(struct hda_codec *codec) + int i, val; + int coef38, coef0d, coef36; + ++ alc_write_coefex_idx(codec, 0x58, 0x00, 0x1888); /* write default value */ + alc_update_coef_idx(codec, 0x4a, 1<<15, 1<<15); /* Reset HP JD */ + coef38 = alc_read_coef_idx(codec, 0x38); /* Amp control */ + coef0d = alc_read_coef_idx(codec, 0x0d); /* Digital Misc control */ +-- +2.43.0 + diff --git a/queue-6.7/alsa-hda-realtek-cs35l41-add-internal-speaker-suppor.patch b/queue-6.7/alsa-hda-realtek-cs35l41-add-internal-speaker-suppor.patch new file mode 100644 index 00000000000..301c8ceb643 --- /dev/null +++ b/queue-6.7/alsa-hda-realtek-cs35l41-add-internal-speaker-suppor.patch @@ -0,0 +1,46 @@ +From a4e4aaa60d28cceb1a96230e08fb07169bf7b48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 00:38:31 +0100 +Subject: ALSA: hda/realtek: cs35l41: Add internal speaker support for ASUS + UM3402 with missing DSD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jean-Loïc Charroud + +[ Upstream commit 706c1fa1ab09f11a131fc4d699ce4c0224b1cb2d ] + +Add the values for the missing DSD properties to the cs35l41 config table. + +Signed-off-by: Jean-Loïc Charroud +Link: https://lore.kernel.org/r/1435594585.650325975.1707867511062.JavaMail.zimbra@free.fr +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l41_hda_property.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c +index d74cf11eef1ea..6cf4c02f9effd 100644 +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -91,6 +91,7 @@ static const struct cs35l41_config cs35l41_config_table[] = { + { "10431D1F", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431DA2", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, + { "10431E02", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "10431E12", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, + { "10431EE2", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, + { "10431F12", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, +@@ -427,6 +428,7 @@ static const struct cs35l41_prop_model cs35l41_prop_model_table[] = { + { "CSC3551", "10431D1F", generic_dsd_config }, + { "CSC3551", "10431DA2", generic_dsd_config }, + { "CSC3551", "10431E02", generic_dsd_config }, ++ { "CSC3551", "10431E12", generic_dsd_config }, + { "CSC3551", "10431EE2", generic_dsd_config }, + { "CSC3551", "10431F12", generic_dsd_config }, + { "CSC3551", "10431F1F", generic_dsd_config }, +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-fix-dtc-interrupt_map-warnings.patch b/queue-6.7/arm-dts-fix-dtc-interrupt_map-warnings.patch new file mode 100644 index 00000000000..d3f7d85ef37 --- /dev/null +++ b/queue-6.7/arm-dts-fix-dtc-interrupt_map-warnings.patch @@ -0,0 +1,72 @@ +From 5a27aea2d167511878c13c0351393759ac67a167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:28 -0600 +Subject: arm: dts: Fix dtc interrupt_map warnings + +From: Rob Herring + +[ Upstream commit f02b0f0dc26fbb77fe47b6e47cc5c211f0432c37 ] + +The dtc interrupt_map warning is off because its dependency, +interrupt_provider, is off by default. Fix all the warnings so it can be +enabled. + +Signed-off-by: Rob Herring +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-4-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts | 2 ++ + .../boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts | 2 ++ + arch/arm/boot/dts/qcom/qcom-sdx55.dtsi | 8 ++++---- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts +index 4d70f6afd13ab..6d5e69035f94d 100644 +--- a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts ++++ b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts +@@ -60,6 +60,8 @@ pci@c0000000 { + * We have slots (IDSEL) 1 and 2 with one assigned IRQ + * each handling all IRQs. + */ ++ #interrupt-cells = <1>; ++ interrupt-map-mask = <0xf800 0 0 7>; + interrupt-map = + /* IDSEL 1 */ + <0x0800 0 0 1 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 1 is irq 11 */ +diff --git a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts +index 9ec0169bacf8c..5f4c849915db7 100644 +--- a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts ++++ b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts +@@ -89,6 +89,8 @@ pci@c0000000 { + * The slots have Ethernet, Ethernet, NEC and MPCI. + * The IDSELs are 11, 12, 13, 14. + */ ++ #interrupt-cells = <1>; ++ interrupt-map-mask = <0xf800 0 0 7>; + interrupt-map = + /* IDSEL 11 - Ethernet A */ + <0x5800 0 0 1 &gpio0 4 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 11 is irq 4 */ +diff --git a/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi +index a976370264fcf..fb6764b2dcde8 100644 +--- a/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi +@@ -345,10 +345,10 @@ pcie_rc: pcie@1c00000 { + "msi8"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 0 0 141 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 0 0 142 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 0 0 143 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 0 0 144 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 141 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 142 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 143 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 144 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_PCIE_PIPE_CLK>, + <&gcc GCC_PCIE_AUX_CLK>, +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-fix-dtc-interrupt_provider-warnings.patch b/queue-6.7/arm-dts-fix-dtc-interrupt_provider-warnings.patch new file mode 100644 index 00000000000..51b5c17f405 --- /dev/null +++ b/queue-6.7/arm-dts-fix-dtc-interrupt_provider-warnings.patch @@ -0,0 +1,754 @@ +From 31c8d3460ea8743bacf4574df637e7098fe9901b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:26 -0600 +Subject: arm: dts: Fix dtc interrupt_provider warnings + +From: Rob Herring + +[ Upstream commit 96fd598e9c34cfa68402a4da3020c9236cfacf35 ] + +The dtc interrupt_provider warning is off by default. Fix all the warnings +so it can be enabled. + +Signed-off-by: Rob Herring +Reviewed-by: Andrew Jeffery +Reviewed-by: Alexandre Torgue +Acked-by: Florian Fainelli #Broadcom +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-2-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/amazon/alpine.dtsi | 1 - + arch/arm/boot/dts/aspeed/aspeed-g4.dtsi | 14 -------------- + arch/arm/boot/dts/aspeed/aspeed-g5.dtsi | 15 +-------------- + arch/arm/boot/dts/aspeed/aspeed-g6.dtsi | 18 ++---------------- + arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi | 3 +++ + arch/arm/boot/dts/broadcom/bcm-hr2.dtsi | 1 + + arch/arm/boot/dts/broadcom/bcm-nsp.dtsi | 2 ++ + arch/arm/boot/dts/marvell/kirkwood-l-50.dts | 2 ++ + arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi | 2 ++ + .../boot/dts/nvidia/tegra30-apalis-v1.1.dtsi | 1 - + arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi | 1 - + arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts | 3 --- + arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi | 2 +- + arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi | 1 - + .../dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi | 1 + + .../nxp/imx/imx6qdl-phytec-phycore-som.dtsi | 1 + + arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts | 1 + + .../boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts | 1 + + arch/arm/boot/dts/st/stm32429i-eval.dts | 1 - + arch/arm/boot/dts/st/stm32mp157c-dk2.dts | 1 - + .../boot/dts/ti/omap/am5729-beagleboneai.dts | 1 - + 24 files changed, 18 insertions(+), 58 deletions(-) + +diff --git a/arch/arm/boot/dts/amazon/alpine.dtsi b/arch/arm/boot/dts/amazon/alpine.dtsi +index ff68dfb4eb787..90bd12feac010 100644 +--- a/arch/arm/boot/dts/amazon/alpine.dtsi ++++ b/arch/arm/boot/dts/amazon/alpine.dtsi +@@ -167,7 +167,6 @@ pcie@fbc00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <96>; + al,msi-num-spis = <64>; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi +index 530491ae5eb26..857cb26ed6d7e 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi +@@ -466,7 +466,6 @@ i2c_ic: interrupt-controller@0 { + i2c0: i2c-bus@40 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x40 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -482,7 +481,6 @@ i2c0: i2c-bus@40 { + i2c1: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x80 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -498,7 +496,6 @@ i2c1: i2c-bus@80 { + i2c2: i2c-bus@c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0xc0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -515,7 +512,6 @@ i2c2: i2c-bus@c0 { + i2c3: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x100 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -532,7 +528,6 @@ i2c3: i2c-bus@100 { + i2c4: i2c-bus@140 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x140 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -549,7 +544,6 @@ i2c4: i2c-bus@140 { + i2c5: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x180 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -566,7 +560,6 @@ i2c5: i2c-bus@180 { + i2c6: i2c-bus@1c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x1c0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -583,7 +576,6 @@ i2c6: i2c-bus@1c0 { + i2c7: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x300 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -600,7 +592,6 @@ i2c7: i2c-bus@300 { + i2c8: i2c-bus@340 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x340 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -617,7 +608,6 @@ i2c8: i2c-bus@340 { + i2c9: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x380 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -634,7 +624,6 @@ i2c9: i2c-bus@380 { + i2c10: i2c-bus@3c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x3c0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -651,7 +640,6 @@ i2c10: i2c-bus@3c0 { + i2c11: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x400 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -668,7 +656,6 @@ i2c11: i2c-bus@400 { + i2c12: i2c-bus@440 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x440 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -685,7 +672,6 @@ i2c12: i2c-bus@440 { + i2c13: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x480 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi +index 04f98d1dbb97c..e6f3cf3c721e5 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi +@@ -363,6 +363,7 @@ sgpio: sgpio@1e780200 { + interrupts = <40>; + reg = <0x1e780200 0x0100>; + clocks = <&syscon ASPEED_CLK_APB>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -594,7 +595,6 @@ i2c_ic: interrupt-controller@0 { + i2c0: i2c-bus@40 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x40 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -610,7 +610,6 @@ i2c0: i2c-bus@40 { + i2c1: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x80 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -626,7 +625,6 @@ i2c1: i2c-bus@80 { + i2c2: i2c-bus@c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0xc0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -643,7 +641,6 @@ i2c2: i2c-bus@c0 { + i2c3: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x100 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -660,7 +657,6 @@ i2c3: i2c-bus@100 { + i2c4: i2c-bus@140 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x140 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -677,7 +673,6 @@ i2c4: i2c-bus@140 { + i2c5: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x180 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -694,7 +689,6 @@ i2c5: i2c-bus@180 { + i2c6: i2c-bus@1c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x1c0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -711,7 +705,6 @@ i2c6: i2c-bus@1c0 { + i2c7: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x300 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -728,7 +721,6 @@ i2c7: i2c-bus@300 { + i2c8: i2c-bus@340 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x340 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -745,7 +737,6 @@ i2c8: i2c-bus@340 { + i2c9: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x380 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -762,7 +753,6 @@ i2c9: i2c-bus@380 { + i2c10: i2c-bus@3c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x3c0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -779,7 +769,6 @@ i2c10: i2c-bus@3c0 { + i2c11: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x400 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -796,7 +785,6 @@ i2c11: i2c-bus@400 { + i2c12: i2c-bus@440 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x440 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -813,7 +801,6 @@ i2c12: i2c-bus@440 { + i2c13: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x480 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +index c4d1faade8be3..29f94696d8b18 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +@@ -474,6 +474,7 @@ sgpiom0: sgpiom@1e780500 { + reg = <0x1e780500 0x100>; + interrupts = ; + clocks = <&syscon ASPEED_CLK_APB2>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -488,6 +489,7 @@ sgpiom1: sgpiom@1e780600 { + reg = <0x1e780600 0x100>; + interrupts = ; + clocks = <&syscon ASPEED_CLK_APB2>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -902,7 +904,6 @@ &i2c { + i2c0: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x80 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -917,7 +918,6 @@ i2c0: i2c-bus@80 { + i2c1: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x100 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -932,7 +932,6 @@ i2c1: i2c-bus@100 { + i2c2: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x180 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -947,7 +946,6 @@ i2c2: i2c-bus@180 { + i2c3: i2c-bus@200 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x200 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -962,7 +960,6 @@ i2c3: i2c-bus@200 { + i2c4: i2c-bus@280 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x280 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -977,7 +974,6 @@ i2c4: i2c-bus@280 { + i2c5: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x300 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -992,7 +988,6 @@ i2c5: i2c-bus@300 { + i2c6: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x380 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1007,7 +1002,6 @@ i2c6: i2c-bus@380 { + i2c7: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x400 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1022,7 +1016,6 @@ i2c7: i2c-bus@400 { + i2c8: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x480 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1037,7 +1030,6 @@ i2c8: i2c-bus@480 { + i2c9: i2c-bus@500 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x500 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1052,7 +1044,6 @@ i2c9: i2c-bus@500 { + i2c10: i2c-bus@580 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x580 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1067,7 +1058,6 @@ i2c10: i2c-bus@580 { + i2c11: i2c-bus@600 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x600 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1082,7 +1072,6 @@ i2c11: i2c-bus@600 { + i2c12: i2c-bus@680 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x680 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1097,7 +1086,6 @@ i2c12: i2c-bus@680 { + i2c13: i2c-bus@700 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x700 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1112,7 +1100,6 @@ i2c13: i2c-bus@700 { + i2c14: i2c-bus@780 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x780 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1127,7 +1114,6 @@ i2c14: i2c-bus@780 { + i2c15: i2c-bus@800 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x800 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +diff --git a/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi b/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi +index f9f79ed825181..07ca0d993c9fd 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi +@@ -167,6 +167,7 @@ gpio_crmu: gpio@3024800 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&mailbox>; + interrupts = <0>; + }; +@@ -247,6 +248,7 @@ gpio_ccm: gpio@1800a000 { + gpio-controller; + interrupts = ; + interrupt-controller; ++ #interrupt-cells = <2>; + }; + + i2c1: i2c@1800b000 { +@@ -518,6 +520,7 @@ gpio_asiu: gpio@180a5000 { + gpio-controller; + + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinctrl 0 42 1>, + <&pinctrl 1 44 3>, +diff --git a/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi b/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi +index 788a6806191a3..75545b10ef2fa 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi +@@ -200,6 +200,7 @@ gpiob: gpio@30000 { + gpio-controller; + ngpios = <4>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi b/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi +index 9d20ba3b1ffb1..6a4482c931674 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi +@@ -180,6 +180,7 @@ gpioa: gpio@20 { + gpio-controller; + ngpios = <32>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinctrl 0 0 32>; + }; +@@ -352,6 +353,7 @@ gpiob: gpio@30000 { + gpio-controller; + ngpios = <4>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm/boot/dts/marvell/kirkwood-l-50.dts b/arch/arm/boot/dts/marvell/kirkwood-l-50.dts +index dffb9f84e67c5..c841eb8e7fb1d 100644 +--- a/arch/arm/boot/dts/marvell/kirkwood-l-50.dts ++++ b/arch/arm/boot/dts/marvell/kirkwood-l-50.dts +@@ -65,6 +65,7 @@ i2c@11000 { + gpio2: gpio-expander@20 { + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + compatible = "semtech,sx1505q"; + reg = <0x20>; + +@@ -79,6 +80,7 @@ gpio2: gpio-expander@20 { + gpio3: gpio-expander@21 { + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + compatible = "semtech,sx1505q"; + reg = <0x21>; + +diff --git a/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi b/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi +index fd671c7a1e5d6..6e1f0f164cb4f 100644 +--- a/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi ++++ b/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi +@@ -120,6 +120,7 @@ gpio0: gpio@0 { + interrupts = <2 IRQ_TYPE_LEVEL_HIGH>, + <3 IRQ_TYPE_LEVEL_HIGH>, + <4 IRQ_TYPE_LEVEL_HIGH>; ++ #interrupt-cells = <2>; + interrupt-controller; + }; + +@@ -128,6 +129,7 @@ gpio1: gpio@1 { + gpio-controller; + #gpio-cells = <2>; + interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; ++ #interrupt-cells = <2>; + interrupt-controller; + }; + +diff --git a/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi b/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi +index 1640763fd4af2..ff0d684622f74 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi +@@ -997,7 +997,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi b/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi +index 3b6fad273cabf..d38f1dd38a906 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi +@@ -980,7 +980,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi b/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi +index 4eb526fe9c558..81c8a5fd92cce 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi +@@ -861,7 +861,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts b/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts +index db8c332df6a1d..cad112e054758 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts +@@ -227,7 +227,6 @@ bridge@1,0 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + bridge@2,1 { + compatible = "pci10b5,8605"; +@@ -235,7 +234,6 @@ bridge@2,1 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + /* Intel Corporation I210 Gigabit Network Connection */ + ethernet@3,0 { +@@ -250,7 +248,6 @@ bridge@2,2 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + /* Intel Corporation I210 Gigabit Network Connection */ + switch_nic: ethernet@4,0 { +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi +index 99f4f6ac71d4a..c1ae7c47b4422 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi +@@ -245,6 +245,7 @@ pca9539: pca9539@74 { + reg = <0x74>; + gpio-controller; + #gpio-cells = <2>; ++ #interrupt-cells = <2>; + interrupt-controller; + interrupt-parent = <&gpio2>; + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; +@@ -390,7 +391,6 @@ pci_root: root@0,0 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + }; + }; + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi +index 4cc965277c521..dcb4f6a32f809 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi +@@ -619,7 +619,6 @@ stmpe811@41 { + blocks = <0x5>; + id = <0>; + interrupts = <10 IRQ_TYPE_LEVEL_LOW>; +- interrupt-controller; + interrupt-parent = <&gpio4>; + irq-trigger = <0x1>; + pinctrl-names = "default"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi +index 11d9c7a2dacb1..6cc4d6fd5f28b 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi +@@ -543,7 +543,6 @@ stmpe811@41 { + blocks = <0x5>; + interrupts = <20 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&gpio6>; +- interrupt-controller; + id = <0>; + irq-trigger = <0x1>; + pinctrl-names = "default"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi +index a63e73adc1fc5..42b2ba23aefc9 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi +@@ -225,7 +225,6 @@ da9063: pmic@58 { + pinctrl-0 = <&pinctrl_pmic>; + interrupt-parent = <&gpio2>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; +- interrupt-controller; + + onkey { + compatible = "dlg,da9063-onkey"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi +index 113974520d544..c0c47adc5866e 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi +@@ -124,6 +124,7 @@ pmic@58 { + reg = <0x58>; + interrupt-parent = <&gpio2>; + interrupts = <9 IRQ_TYPE_LEVEL_LOW>; /* active-low GPIO2_9 */ ++ #interrupt-cells = <2>; + interrupt-controller; + + regulators { +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi +index 86b4269e0e011..85e278eb20161 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi +@@ -100,6 +100,7 @@ pmic: pmic@58 { + interrupt-parent = <&gpio1>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + gpio-controller; + #gpio-cells = <2>; + +diff --git a/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts b/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts +index 12361fcbe24af..1b965652291bf 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts +@@ -63,6 +63,7 @@ pca9554: io-expander@25 { + gpio-controller; + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + reg = <0x25>; + }; + +diff --git a/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts b/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts +index 16b4e06c4efad..a248b8a453421 100644 +--- a/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts ++++ b/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts +@@ -338,6 +338,7 @@ gpio6: io-expander@22 { + reg = <0x22>; + gpio-controller; + #gpio-cells = <2>; ++ #interrupt-cells = <2>; + interrupt-controller; + interrupt-parent = <&gpio3>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; +diff --git a/arch/arm/boot/dts/st/stm32429i-eval.dts b/arch/arm/boot/dts/st/stm32429i-eval.dts +index 576235ec3c516..afa417b34b25f 100644 +--- a/arch/arm/boot/dts/st/stm32429i-eval.dts ++++ b/arch/arm/boot/dts/st/stm32429i-eval.dts +@@ -222,7 +222,6 @@ stmpe1600: stmpe1600@42 { + reg = <0x42>; + interrupts = <8 3>; + interrupt-parent = <&gpioi>; +- interrupt-controller; + wakeup-source; + + stmpegpio: stmpe_gpio { +diff --git a/arch/arm/boot/dts/st/stm32mp157c-dk2.dts b/arch/arm/boot/dts/st/stm32mp157c-dk2.dts +index 510cca5acb79c..7a701f7ef0c70 100644 +--- a/arch/arm/boot/dts/st/stm32mp157c-dk2.dts ++++ b/arch/arm/boot/dts/st/stm32mp157c-dk2.dts +@@ -64,7 +64,6 @@ touchscreen@38 { + reg = <0x38>; + interrupts = <2 2>; + interrupt-parent = <&gpiof>; +- interrupt-controller; + touchscreen-size-x = <480>; + touchscreen-size-y = <800>; + status = "okay"; +diff --git a/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts b/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts +index 9a234dc1431d1..5b240769d300e 100644 +--- a/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts ++++ b/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts +@@ -415,7 +415,6 @@ stmpe811@41 { + reg = <0x41>; + interrupts = <30 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&gpio2>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch b/queue-6.7/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch new file mode 100644 index 00000000000..31ff0504f1c --- /dev/null +++ b/queue-6.7/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch @@ -0,0 +1,132 @@ +From 2661344981df5e0cf7c38a657ada7e656729cd67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 15:57:42 +0100 +Subject: ARM: dts: renesas: rcar-gen2: Add missing #interrupt-cells to DA9063 + nodes + +From: Geert Uytterhoeven + +[ Upstream commit 8c987693dc2d292d777f1be63cb35233049ae25e ] + +make dtbs_check W=2: + + arch/arm/boot/dts/renesas/r8a7790-lager.dts:444.11-458.5: Warning (interrupt_provider): /i2c-mux4/pmic@58: Missing '#interrupt-cells' in interrupt provider + ... + +Fix this by adding the missing #interrupt-cells properties. + +Reported-by: Rob Herring +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/a351e503ea97fb1af68395843f513925ff1bdf26.1707922460.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7790-lager.dts | 1 + + arch/arm/boot/dts/renesas/r8a7790-stout.dts | 1 + + arch/arm/boot/dts/renesas/r8a7791-koelsch.dts | 1 + + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 1 + + arch/arm/boot/dts/renesas/r8a7792-blanche.dts | 1 + + arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 + + arch/arm/boot/dts/renesas/r8a7794-alt.dts | 1 + + arch/arm/boot/dts/renesas/r8a7794-silk.dts | 1 + + 8 files changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/renesas/r8a7790-lager.dts b/arch/arm/boot/dts/renesas/r8a7790-lager.dts +index 4d666ad8b114b..b17a9f9307e59 100644 +--- a/arch/arm/boot/dts/renesas/r8a7790-lager.dts ++++ b/arch/arm/boot/dts/renesas/r8a7790-lager.dts +@@ -432,6 +432,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7790-stout.dts b/arch/arm/boot/dts/renesas/r8a7790-stout.dts +index fe14727eefe1e..25956661a8754 100644 +--- a/arch/arm/boot/dts/renesas/r8a7790-stout.dts ++++ b/arch/arm/boot/dts/renesas/r8a7790-stout.dts +@@ -332,6 +332,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +diff --git a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts +index 545515b41ea3f..ec01cc8595161 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts +@@ -795,6 +795,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index ec0a20d5130d6..fcc9a2313e1df 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -389,6 +389,7 @@ pmic@5a { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + watchdog { + compatible = "dlg,da9063-watchdog"; +diff --git a/arch/arm/boot/dts/renesas/r8a7792-blanche.dts b/arch/arm/boot/dts/renesas/r8a7792-blanche.dts +index e793134f32a30..af16f251849c6 100644 +--- a/arch/arm/boot/dts/renesas/r8a7792-blanche.dts ++++ b/arch/arm/boot/dts/renesas/r8a7792-blanche.dts +@@ -332,6 +332,7 @@ pmic@58 { + interrupt-parent = <&irqc>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7793-gose.dts b/arch/arm/boot/dts/renesas/r8a7793-gose.dts +index 79b537b246426..9358fc7d0e9f6 100644 +--- a/arch/arm/boot/dts/renesas/r8a7793-gose.dts ++++ b/arch/arm/boot/dts/renesas/r8a7793-gose.dts +@@ -735,6 +735,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7794-alt.dts b/arch/arm/boot/dts/renesas/r8a7794-alt.dts +index 08df031bc27c9..73ec4d3541541 100644 +--- a/arch/arm/boot/dts/renesas/r8a7794-alt.dts ++++ b/arch/arm/boot/dts/renesas/r8a7794-alt.dts +@@ -453,6 +453,7 @@ pmic@58 { + interrupt-parent = <&gpio3>; + interrupts = <31 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7794-silk.dts b/arch/arm/boot/dts/renesas/r8a7794-silk.dts +index b7af1befa126b..b825f2e25dd06 100644 +--- a/arch/arm/boot/dts/renesas/r8a7794-silk.dts ++++ b/arch/arm/boot/dts/renesas/r8a7794-silk.dts +@@ -424,6 +424,7 @@ pmic@58 { + interrupt-parent = <&gpio3>; + interrupts = <31 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +-- +2.43.0 + diff --git a/queue-6.7/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch b/queue-6.7/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch new file mode 100644 index 00000000000..a26de4f9bba --- /dev/null +++ b/queue-6.7/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch @@ -0,0 +1,99 @@ +From 7c7aacbb9f68dbca21b745fe9b58afff22dce38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 12:32:02 +0100 +Subject: ARM: dts: rockchip: Drop interrupts property from pwm-rockchip nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit f98643d8daf3443e3b414a82d0cb3d745f8c8bbc ] + +The binding doesn't define interrupts and adding such a definition was +refused because it's unclear how they should ever be used and the +relevant registers are outside the PWM range. So drop them fixing +several dtbs_check warnings like: + + arch/arm/boot/dts/rockchip/rv1108-elgin-r1.dtb: pwm@10280030: 'interrupts' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/pwm/pwm-rockchip.yaml# + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240129113205.2453029-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rv1108.dtsi | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rv1108.dtsi b/arch/arm/boot/dts/rockchip/rv1108.dtsi +index abf3006f0a842..f3291f3bbc6fd 100644 +--- a/arch/arm/boot/dts/rockchip/rv1108.dtsi ++++ b/arch/arm/boot/dts/rockchip/rv1108.dtsi +@@ -196,7 +196,6 @@ spi: spi@10270000 { + pwm4: pwm@10280000 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280000 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -208,7 +207,6 @@ pwm4: pwm@10280000 { + pwm5: pwm@10280010 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280010 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -220,7 +218,6 @@ pwm5: pwm@10280010 { + pwm6: pwm@10280020 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280020 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -232,7 +229,6 @@ pwm6: pwm@10280020 { + pwm7: pwm@10280030 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280030 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -386,7 +382,6 @@ i2c0: i2c@20000000 { + pwm0: pwm@20040000 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040000 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -398,7 +393,6 @@ pwm0: pwm@20040000 { + pwm1: pwm@20040010 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040010 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -410,7 +404,6 @@ pwm1: pwm@20040010 { + pwm2: pwm@20040020 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040020 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -422,7 +415,6 @@ pwm2: pwm@20040020 { + pwm3: pwm@20040030 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040030 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-fix-dtc-interrupt_provider-warnings.patch b/queue-6.7/arm64-dts-fix-dtc-interrupt_provider-warnings.patch new file mode 100644 index 00000000000..0f5da745e93 --- /dev/null +++ b/queue-6.7/arm64-dts-fix-dtc-interrupt_provider-warnings.patch @@ -0,0 +1,168 @@ +From 2015cd9745a5ccced552ce12580ae4fa837b24c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:27 -0600 +Subject: arm64: dts: Fix dtc interrupt_provider warnings + +From: Rob Herring + +[ Upstream commit 91adecf911e5df78ea3e8f866e69db2c33416a5c ] + +The dtc interrupt_provider warning is off by default. Fix all the warnings +so it can be enabled. + +Signed-off-by: Rob Herring +Reviewed-By: AngeloGioacchino Del Regno # +Reviewed-by: Geert Uytterhoeven +Acked-by: Geert Uytterhoeven +Acked-by: Florian Fainelli #Broadcom +Acked-by: Chanho Min +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-3-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amazon/alpine-v2.dtsi | 1 - + arch/arm64/boot/dts/amazon/alpine-v3.dtsi | 1 - + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 1 + + arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 1 + + arch/arm64/boot/dts/lg/lg1312.dtsi | 1 - + arch/arm64/boot/dts/lg/lg1313.dtsi | 1 - + arch/arm64/boot/dts/marvell/armada-ap80x.dtsi | 1 - + arch/arm64/boot/dts/mediatek/mt8195-demo.dts | 1 + + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 4 ++++ + 9 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +index dccbba6e7f98e..dbf2dce8d1d68 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +@@ -145,7 +145,6 @@ pci@fbc00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <160>; + al,msi-num-spis = <160>; +diff --git a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +index 39481d7fd7d4d..3ea178acdddfe 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +@@ -355,7 +355,6 @@ pcie@fbd00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <336>; + al,msi-num-spis = <959>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 9dcd25ec2c041..896d1f33b5b61 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -586,6 +586,7 @@ gpio_g: gpio@660a0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +index f049687d6b96d..d8516ec0dae74 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +@@ -450,6 +450,7 @@ gpio_hsls: gpio@d0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinmux 0 0 16>, + <&pinmux 16 71 2>, +diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi +index 48ec4ebec0a83..b864ffa74ea8b 100644 +--- a/arch/arm64/boot/dts/lg/lg1312.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi +@@ -126,7 +126,6 @@ eth0: ethernet@c1b00000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi +index 3869460aa5dcb..996fb39bb50c1 100644 +--- a/arch/arm64/boot/dts/lg/lg1313.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi +@@ -126,7 +126,6 @@ eth0: ethernet@c3700000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +index 2c920e22cec2b..7ec7c789d87ef 100644 +--- a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +@@ -138,7 +138,6 @@ pmu { + + odmi: odmi@300000 { + compatible = "marvell,odmi-controller"; +- interrupt-controller; + msi-controller; + marvell,odmi-frames = <4>; + reg = <0x300000 0x4000>, +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +index 69c7f3954ae59..4127cb84eba41 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +@@ -128,6 +128,7 @@ mt6360: pmic@34 { + compatible = "mediatek,mt6360"; + reg = <0x34>; + interrupt-controller; ++ #interrupt-cells = <1>; + interrupts-extended = <&pio 101 IRQ_TYPE_EDGE_FALLING>; + interrupt-names = "IRQB"; + +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 3885ef3454ff6..50de17e4fb3f2 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -234,6 +234,7 @@ gpio_exp_74: gpio@74 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <8 IRQ_TYPE_EDGE_FALLING>; + +@@ -294,6 +295,7 @@ gpio_exp_75: gpio@75 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <4 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -314,6 +316,7 @@ gpio_exp_76: gpio@76 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio7>; + interrupts = <3 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -324,6 +327,7 @@ gpio_exp_77: gpio@77 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio5>; + interrupts = <9 IRQ_TYPE_EDGE_FALLING>; + }; +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch b/queue-6.7/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch new file mode 100644 index 00000000000..162b71f5711 --- /dev/null +++ b/queue-6.7/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch @@ -0,0 +1,86 @@ +From 751675a7ab7338cf2393f2a1f719e26baf65f65a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:29 -0600 +Subject: arm64: dts: qcom: Fix interrupt-map cell sizes + +From: Rob Herring + +[ Upstream commit 704dccec0d490f2ad06f3f16ebed254d81906c3a ] + +The PCI node interrupt-map properties have the wrong size as #address-cells +in the interrupt parent are not accounted for. + +The dtc interrupt_map check catches this, but the warning is off because +its dependency, interrupt_provider, is off by default. + +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-5-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 8 ++++---- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 16 ++++++++-------- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index 0b1330b521df4..cf4e501c84bcc 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -759,10 +759,10 @@ pcie0: pci@20000000 { + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 0 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 0 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 0 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 0 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 2f275c84e5665..b33145b756ebe 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -806,13 +806,13 @@ pcie1: pci@10000000 { + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 142 ++ interrupt-map = <0 0 0 1 &intc 0 0 142 + IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 143 ++ <0 0 0 2 &intc 0 0 143 + IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 144 ++ <0 0 0 3 &intc 0 0 144 + IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 145 ++ <0 0 0 4 &intc 0 0 145 + IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE1_AXI_CLK>, +@@ -868,13 +868,13 @@ pcie0: pci@20000000 { + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 ++ interrupt-map = <0 0 0 1 &intc 0 0 75 + IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 ++ <0 0 0 2 &intc 0 0 78 + IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 ++ <0 0 0 3 &intc 0 0 79 + IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 ++ <0 0 0 4 &intc 0 0 83 + IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, +-- +2.43.0 + diff --git a/queue-6.7/arm64-dts-rockchip-mark-system-power-controller-on-r.patch b/queue-6.7/arm64-dts-rockchip-mark-system-power-controller-on-r.patch new file mode 100644 index 00000000000..b47994a6f2b --- /dev/null +++ b/queue-6.7/arm64-dts-rockchip-mark-system-power-controller-on-r.patch @@ -0,0 +1,35 @@ +From 4018984dc0f916358d716cb60ac2291e3e6ca973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 20:14:48 +0100 +Subject: arm64: dts: rockchip: mark system power controller on rk3588-evb1 + +From: Sebastian Reichel + +[ Upstream commit fc4657971be31ae679e2bbeee2fb8e93a7a063eb ] + +Mark the primary PMIC as system-power-controller, so that the +system properly shuts down on poweroff. + +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20240117191555.86138-1-sebastian.reichel@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts +index b9d789d57862c..bbbe00bcd14e7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts +@@ -351,6 +351,7 @@ pmic@0 { + <&rk806_dvs2_null>, <&rk806_dvs3_null>; + pinctrl-names = "default"; + spi-max-frequency = <1000000>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +-- +2.43.0 + diff --git a/queue-6.7/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch b/queue-6.7/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch new file mode 100644 index 00000000000..fb17acaedc9 --- /dev/null +++ b/queue-6.7/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch @@ -0,0 +1,99 @@ +From 441d21bdc8daecd301aefbb48acac4041b20d6a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 18:24:38 +0000 +Subject: arm64/sve: Lower the maximum allocation for the SVE ptrace regset + +From: Mark Brown + +[ Upstream commit 2813926261e436d33bc74486b51cce60b76edf78 ] + +Doug Anderson observed that ChromeOS crashes are being reported which +include failing allocations of order 7 during core dumps due to ptrace +allocating storage for regsets: + + chrome: page allocation failure: order:7, + mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), + nodemask=(null),cpuset=urgent,mems_allowed=0 + ... + regset_get_alloc+0x1c/0x28 + elf_core_dump+0x3d8/0xd8c + do_coredump+0xeb8/0x1378 + +with further investigation showing that this is: + + [ 66.957385] DOUG: Allocating 279584 bytes + +which is the maximum size of the SVE regset. As Doug observes it is not +entirely surprising that such a large allocation of contiguous memory might +fail on a long running system. + +The SVE regset is currently sized to hold SVE registers with a VQ of +SVE_VQ_MAX which is 512, substantially more than the architectural maximum +of 16 which we might see even in a system emulating the limits of the +architecture. Since we don't expose the size we tell the regset core +externally let's define ARCH_SVE_VQ_MAX with the actual architectural +maximum and use that for the regset, we'll still overallocate most of the +time but much less so which will be helpful even if the core is fixed to +not require contiguous allocations. + +Specify ARCH_SVE_VQ_MAX in terms of the maximum value that can be written +into ZCR_ELx.LEN (where this is set in the hardware). For consistency +update the maximum SME vector length to be specified in the same style +while we are at it. + +We could also teach the ptrace core about runtime discoverable regset sizes +but that would be a more invasive change and this is being observed in +practical systems. + +Reported-by: Doug Anderson +Signed-off-by: Mark Brown +Tested-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240213-arm64-sve-ptrace-regset-size-v2-1-c7600ca74b9b@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/fpsimd.h | 12 ++++++------ + arch/arm64/kernel/ptrace.c | 3 ++- + 2 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h +index 7780d343ef080..b67b89c54e1c8 100644 +--- a/arch/arm64/include/asm/fpsimd.h ++++ b/arch/arm64/include/asm/fpsimd.h +@@ -62,13 +62,13 @@ static inline void cpacr_restore(unsigned long cpacr) + * When we defined the maximum SVE vector length we defined the ABI so + * that the maximum vector length included all the reserved for future + * expansion bits in ZCR rather than those just currently defined by +- * the architecture. While SME follows a similar pattern the fact that +- * it includes a square matrix means that any allocations that attempt +- * to cover the maximum potential vector length (such as happen with +- * the regset used for ptrace) end up being extremely large. Define +- * the much lower actual limit for use in such situations. ++ * the architecture. Using this length to allocate worst size buffers ++ * results in excessively large allocations, and this effect is even ++ * more pronounced for SME due to ZA. Define more suitable VLs for ++ * these situations. + */ +-#define SME_VQ_MAX 16 ++#define ARCH_SVE_VQ_MAX ((ZCR_ELx_LEN_MASK >> ZCR_ELx_LEN_SHIFT) + 1) ++#define SME_VQ_MAX ((SMCR_ELx_LEN_MASK >> SMCR_ELx_LEN_SHIFT) + 1) + + struct task_struct; + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index b3f64144b5cd9..c94c0f8c9a737 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1499,7 +1499,8 @@ static const struct user_regset aarch64_regsets[] = { + #ifdef CONFIG_ARM64_SVE + [REGSET_SVE] = { /* Scalable Vector Extension */ + .core_note_type = NT_ARM_SVE, +- .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), ++ .n = DIV_ROUND_UP(SVE_PT_SIZE(ARCH_SVE_VQ_MAX, ++ SVE_PT_REGS_SVE), + SVE_VQ_BYTES), + .size = SVE_VQ_BYTES, + .align = SVE_VQ_BYTES, +-- +2.43.0 + diff --git a/queue-6.7/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch b/queue-6.7/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch new file mode 100644 index 00000000000..2fa9a232855 --- /dev/null +++ b/queue-6.7/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch @@ -0,0 +1,35 @@ +From 8f24978a0c1c091f354f6f902df7332389776ea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 11:08:12 +0100 +Subject: arm64: tegra: Set the correct PHY mode for MGBE + +From: Thierry Reding + +[ Upstream commit 4c892121d43bc2b45896ca207b54f39a8fa6b852 ] + +The PHY is configured in 10GBASE-R, so make sure to reflect that in DT. + +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +index ea13c4a7027c4..81a82933e3500 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +@@ -175,7 +175,7 @@ ethernet@6800000 { + status = "okay"; + + phy-handle = <&mgbe0_phy>; +- phy-mode = "usxgmii"; ++ phy-mode = "10gbase-r"; + + mdio { + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.7/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch b/queue-6.7/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch new file mode 100644 index 00000000000..4feb0fbbdc0 --- /dev/null +++ b/queue-6.7/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch @@ -0,0 +1,42 @@ +From fb30a08ea25e0d6368b00beefd1108b7281db962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:09:23 +0530 +Subject: ASoC: amd: yc: Add HP Pavilion Aero Laptop 13-be2xxx(8BD6) into DMI + quirk table + +From: Al Raj Hassain + +[ Upstream commit b3a51137607cee7c814cd3a75d96f78b9ee1dc1f ] + +The HP Pavilion Aero Laptop 13-be2xxx(8BD6) requires a quirk entry for its internal microphone to function. + +Signed-off-by: Al Raj Hassain +Reviewed-by: Mario Limonciello +Link: https://msgid.link/r/20240304103924.13673-1-alrajhassain@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index abb9589b8477c..90360f8b3e81b 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -416,6 +416,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8B2F"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8BD6"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch b/queue-6.7/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch new file mode 100644 index 00000000000..e078c4187d8 --- /dev/null +++ b/queue-6.7/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch @@ -0,0 +1,42 @@ +From f752f95a81b5675e2a9a4238d090291100d90648 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 21:44:50 +0800 +Subject: ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table + +From: Johnny Hsieh + +[ Upstream commit 50ee641643dd0f46702e9a99354398196e1734c2 ] + +This patch adds Lenovo 21J0 (ThinkBook 16 G5+ ARP) to the DMI quirks table +to enable internal microphone array. + +Cc: linux-sound@vger.kernel.org +Signed-off-by: Johnny Hsieh +Link: https://msgid.link/r/TYSPR04MB8429D62DFDB6727866ECF1DEC55A2@TYSPR04MB8429.apcprd04.prod.outlook.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index cc231185d72c3..5587198751daa 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J0"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch b/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch new file mode 100644 index 00000000000..3bbf09e6abc --- /dev/null +++ b/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch @@ -0,0 +1,41 @@ +From 9337e6bba1a164cd098e12808fc9d1a15b763dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:39:14 +0800 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 + +From: Jiawei Wang + +[ Upstream commit ed00a6945dc32462c2d3744a3518d2316da66fcc ] + +Like many other models, the Lenovo 21J2 (ThinkBook 16 G5+ APO) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Jiawei Wang +Link: https://msgid.link/r/20240228073914.232204-2-me@jwang.link +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 5587198751daa..abb9589b8477c 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J2"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch b/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch new file mode 100644 index 00000000000..b65ffe9f021 --- /dev/null +++ b/queue-6.7/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch @@ -0,0 +1,44 @@ +From b1dbecce3a769e52c841fbb13d21e0464c8bfd2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:36:38 +0200 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Attila Tőkés + +[ Upstream commit f7fe85b229bc30cb5dc95b4e9015a601c9e3a8cd ] + +Like many other models, the Lenovo 82UU (Yoga Slim 7 Pro 14ARH7) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Attila Tőkés +Link: https://msgid.link/r/20240210193638.144028-1-attitokes@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 80ad60d485ea0..cc231185d72c3 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -234,6 +234,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82UG"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "82UU"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch b/queue-6.7/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch new file mode 100644 index 00000000000..ee9f2f35efb --- /dev/null +++ b/queue-6.7/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch @@ -0,0 +1,39 @@ +From 0eae2b3bd82066fcd0c6e0b76dfecb91f86143e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 11:38:49 +0000 +Subject: ASoC: cs42l43: Handle error from devm_pm_runtime_enable + +From: Charles Keepax + +[ Upstream commit d1722057477a3786b8c0d60c28fc281f6ecf1cc3 ] + +As devm_pm_runtime_enable can fail due to memory allocations, it is +best to handle the error. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20240206113850.719888-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l43.c b/sound/soc/codecs/cs42l43.c +index d62c9f26c6325..5009cf64124ed 100644 +--- a/sound/soc/codecs/cs42l43.c ++++ b/sound/soc/codecs/cs42l43.c +@@ -2175,7 +2175,10 @@ static int cs42l43_codec_probe(struct platform_device *pdev) + pm_runtime_use_autosuspend(priv->dev); + pm_runtime_set_active(priv->dev); + pm_runtime_get_noresume(priv->dev); +- devm_pm_runtime_enable(priv->dev); ++ ++ ret = devm_pm_runtime_enable(priv->dev); ++ if (ret) ++ goto err_pm; + + for (i = 0; i < ARRAY_SIZE(cs42l43_irqs); i++) { + ret = cs42l43_request_irq(priv, dom, cs42l43_irqs[i].name, +-- +2.43.0 + diff --git a/queue-6.7/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch b/queue-6.7/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch new file mode 100644 index 00000000000..f0aa5147709 --- /dev/null +++ b/queue-6.7/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch @@ -0,0 +1,52 @@ +From af160fb2aa93fe7c09aa0299179ea83c359f130b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:28:41 +0000 +Subject: ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 + tablet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alban Boyé + +[ Upstream commit f8b0127aca8c60826e7354e504a12d4a46b1c3bb ] + +The bios version can differ depending if it is a dual-boot variant of the tablet. +Therefore another DMI match is required. + +Signed-off-by: Alban Boyé +Reviewed-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240228192807.15130-1-alban.boye@protonmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 42466b4b1ca45..a290f498ba823 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -685,6 +685,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Chuwi Vi8 dual-boot (CWI506) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "i86"), ++ /* The above are too generic, also match BIOS info */ ++ DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + /* Chuwi Vi10 (CWI505) */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch b/queue-6.7/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch new file mode 100644 index 00000000000..45156f71fe5 --- /dev/null +++ b/queue-6.7/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch @@ -0,0 +1,63 @@ +From af77932f9166f484086c8c0607d32f98a1db785f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 22:27:35 +0100 +Subject: ASoC: rt5645: Make LattePanda board DMI match more precise + +From: Hans de Goede + +[ Upstream commit 551539a8606e28cb2a130f8ef3e9834235b456c4 ] + +The DMI strings used for the LattePanda board DMI quirks are very generic. + +Using the dmidecode database from https://linux-hardware.org/ shows +that the chosen DMI strings also match the following 2 laptops +which also have a rt5645 codec: + +Insignia NS-P11W7100 https://linux-hardware.org/?computer=E092FFF8BA04 +Insignia NS-P10W8100 https://linux-hardware.org/?computer=AFB6C0BF7934 + +All 4 hw revisions of the LattePanda board have "S70CR" in their BIOS +version DMI strings: + +DF-BI-7-S70CR100-* +DF-BI-7-S70CR110-* +DF-BI-7-S70CR200-* +LP-BS-7-S70CR700-* + +See e.g. https://linux-hardware.org/?computer=D98250A817C0 + +Add a partial (non exact) DMI match on this string to make the LattePanda +board DMI match more precise to avoid false-positive matches. + +Signed-off-by: Hans de Goede +Link: https://msgid.link/r/20240211212736.179605-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index ea08b7cfc31da..e0da151508309 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3829,6 +3829,16 @@ static const struct dmi_system_id dmi_platform_data[] = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), + DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"), ++ /* ++ * Above strings are too generic, LattePanda BIOS versions for ++ * all 4 hw revisions are: ++ * DF-BI-7-S70CR100-* ++ * DF-BI-7-S70CR110-* ++ * DF-BI-7-S70CR200-* ++ * LP-BS-7-S70CR700-* ++ * Do a partial match for S70CR to avoid false positive matches. ++ */ ++ DMI_MATCH(DMI_BIOS_VERSION, "S70CR"), + }, + .driver_data = (void *)&lattepanda_board_platform_data, + }, +-- +2.43.0 + diff --git a/queue-6.7/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch b/queue-6.7/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch new file mode 100644 index 00000000000..06bd7e573ce --- /dev/null +++ b/queue-6.7/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch @@ -0,0 +1,69 @@ +From 7b290cee6e005cde7a8171b9b434df76fe4ebe5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:52:33 +0200 +Subject: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system + suspend + +From: Peter Ujfalusi + +[ Upstream commit c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 ] + +When the system is suspended while audio is active, the +sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during +suspend the DSP is turned off, streams will be re-started after resume. + +If the firmware crashes during while audio is running (or when we reset +the stream before suspend) then the sof_ipc4_set_multi_pipeline_state() +will fail with IPC error and the state change is interrupted. +This will cause misalignment between the kernel and firmware state on next +DSP boot resulting errors returned by firmware for IPC messages, eventually +failing the audio resume. +On stream close the errors are ignored so the kernel state will be +corrected on the next DSP boot, so the second boot after the DSP panic. + +If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free() then +state parameter is SOF_IPC4_PIPE_RESET and only in this case. + +Treat a forced pipeline reset similarly to how we treat a pcm_free by +ignoring error on state sending to allow the kernel's state to be +consistent with the state the firmware will have after the next boot. + +Link: https://github.com/thesofproject/sof/issues/8721 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Link: https://msgid.link/r/20240213115233.15716-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-pcm.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c +index 39039a647cca3..ea70c0d7cf75a 100644 +--- a/sound/soc/sof/ipc4-pcm.c ++++ b/sound/soc/sof/ipc4-pcm.c +@@ -413,7 +413,18 @@ static int sof_ipc4_trigger_pipelines(struct snd_soc_component *component, + ret = sof_ipc4_set_multi_pipeline_state(sdev, state, trigger_list); + if (ret < 0) { + dev_err(sdev->dev, "failed to set final state %d for all pipelines\n", state); +- goto free; ++ /* ++ * workaround: if the firmware is crashed while setting the ++ * pipelines to reset state we must ignore the error code and ++ * reset it to 0. ++ * Since the firmware is crashed we will not send IPC messages ++ * and we are going to see errors printed, but the state of the ++ * widgets will be correct for the next boot. ++ */ ++ if (sdev->fw_state != SOF_FW_CRASHED || state != SOF_IPC4_PIPE_RESET) ++ goto free; ++ ++ ret = 0; + } + + /* update RUNNING/RESET state for all pipelines that were just triggered */ +-- +2.43.0 + diff --git a/queue-6.7/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch b/queue-6.7/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch new file mode 100644 index 00000000000..d9e13d08e63 --- /dev/null +++ b/queue-6.7/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch @@ -0,0 +1,76 @@ +From 61d633852d9ebee552b654a4e39ec1e49a5d8153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:36 +0000 +Subject: ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode + +From: Stuart Henderson + +[ Upstream commit 6fa849e4d78b880e878138bf238e4fd2bac3c4fa ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-2-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 6d7bb696b1356..2256cc0a37ebd 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2229,6 +2229,9 @@ SND_SOC_DAPM_PGA_E("HPOUT", SND_SOC_NOPM, 0, 0, NULL, 0, hp_event, + + SND_SOC_DAPM_OUTPUT("HPOUTL"), + SND_SOC_DAPM_OUTPUT("HPOUTR"), ++ ++SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), ++SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + }; + + static const struct snd_soc_dapm_widget wm8962_dapm_spk_mono_widgets[] = { +@@ -2236,7 +2239,6 @@ SND_SOC_DAPM_MIXER("Speaker Mixer", WM8962_MIXER_ENABLES, 1, 0, + spkmixl, ARRAY_SIZE(spkmixl)), + SND_SOC_DAPM_MUX_E("Speaker PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), +-SND_SOC_DAPM_PGA("Speaker Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + SND_SOC_DAPM_OUTPUT("SPKOUT"), + }; + +@@ -2251,9 +2253,6 @@ SND_SOC_DAPM_MUX_E("SPKOUTL PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + SND_SOC_DAPM_MUX_E("SPKOUTR PGA", WM8962_PWR_MGMT_2, 3, 0, &spkoutr_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), + +-SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), +-SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), +- + SND_SOC_DAPM_OUTPUT("SPKOUTL"), + SND_SOC_DAPM_OUTPUT("SPKOUTR"), + }; +@@ -2366,12 +2365,18 @@ static const struct snd_soc_dapm_route wm8962_spk_mono_intercon[] = { + { "Speaker PGA", "Mixer", "Speaker Mixer" }, + { "Speaker PGA", "DAC", "DACL" }, + +- { "Speaker Output", NULL, "Speaker PGA" }, +- { "Speaker Output", NULL, "SYSCLK" }, +- { "Speaker Output", NULL, "TOCLK" }, +- { "Speaker Output", NULL, "TEMP_SPK" }, ++ { "SPKOUTL Output", NULL, "Speaker PGA" }, ++ { "SPKOUTL Output", NULL, "SYSCLK" }, ++ { "SPKOUTL Output", NULL, "TOCLK" }, ++ { "SPKOUTL Output", NULL, "TEMP_SPK" }, ++ ++ { "SPKOUTR Output", NULL, "Speaker PGA" }, ++ { "SPKOUTR Output", NULL, "SYSCLK" }, ++ { "SPKOUTR Output", NULL, "TOCLK" }, ++ { "SPKOUTR Output", NULL, "TEMP_SPK" }, + +- { "SPKOUT", NULL, "Speaker Output" }, ++ { "SPKOUT", NULL, "SPKOUTL Output" }, ++ { "SPKOUT", NULL, "SPKOUTR Output" }, + }; + + static const struct snd_soc_dapm_route wm8962_spk_stereo_intercon[] = { +-- +2.43.0 + diff --git a/queue-6.7/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch b/queue-6.7/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch new file mode 100644 index 00000000000..6118762502a --- /dev/null +++ b/queue-6.7/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch @@ -0,0 +1,37 @@ +From d948978e2e834c54e14c4c63986ac1d2cc079fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:35 +0000 +Subject: ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC + +From: Stuart Henderson + +[ Upstream commit 03c7874106ca5032a312626b927b1c35f07b1f35 ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-1-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index fb90ae6a8a344..6d7bb696b1356 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2914,8 +2914,12 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + switch (fll_id) { + case WM8962_FLL_MCLK: + case WM8962_FLL_BCLK: ++ fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ break; + case WM8962_FLL_OSC: + fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ snd_soc_component_update_bits(component, WM8962_PLL2, ++ WM8962_OSC_ENA, WM8962_OSC_ENA); + break; + case WM8962_FLL_INT: + snd_soc_component_update_bits(component, WM8962_FLL_CONTROL_1, +-- +2.43.0 + diff --git a/queue-6.7/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch b/queue-6.7/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch new file mode 100644 index 00000000000..679603ca227 --- /dev/null +++ b/queue-6.7/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch @@ -0,0 +1,36 @@ +From 27741bea8fe67c7f405f59c3c3eb6fd89784f7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:39 +0000 +Subject: ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll + +From: Stuart Henderson + +[ Upstream commit 96e202f8c52ac49452f83317cf3b34cd1ad81e18 ] + +Use source instead of ret, which seems to be unrelated and will always +be zero. + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-5-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 2256cc0a37ebd..7c6ed29831285 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2933,7 +2933,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + WM8962_FLL_FRC_NCO, WM8962_FLL_FRC_NCO); + break; + default: +- dev_err(component->dev, "Unknown FLL source %d\n", ret); ++ dev_err(component->dev, "Unknown FLL source %d\n", source); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.7/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch b/queue-6.7/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch new file mode 100644 index 00000000000..80e6e498fee --- /dev/null +++ b/queue-6.7/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch @@ -0,0 +1,65 @@ +From 9cd288b965e9d0f1d3a19c252363c1159f2bd627 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:04:17 -0600 +Subject: block: sed-opal: handle empty atoms when parsing response + +From: Greg Joyce + +[ Upstream commit 5429c8de56f6b2bd8f537df3a1e04e67b9c04282 ] + +The SED Opal response parsing function response_parse() does not +handle the case of an empty atom in the response. This causes +the entry count to be too high and the response fails to be +parsed. Recognizing, but ignoring, empty atoms allows response +handling to succeed. + +Signed-off-by: Greg Joyce +Link: https://lore.kernel.org/r/20240216210417.3526064-2-gjoyce@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/opal_proto.h | 1 + + block/sed-opal.c | 6 +++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/block/opal_proto.h b/block/opal_proto.h +index dec7ce3a3edb7..d247a457bf6e3 100644 +--- a/block/opal_proto.h ++++ b/block/opal_proto.h +@@ -71,6 +71,7 @@ enum opal_response_token { + #define SHORT_ATOM_BYTE 0xBF + #define MEDIUM_ATOM_BYTE 0xDF + #define LONG_ATOM_BYTE 0xE3 ++#define EMPTY_ATOM_BYTE 0xFF + + #define OPAL_INVAL_PARAM 12 + #define OPAL_MANUFACTURED_INACTIVE 0x08 +diff --git a/block/sed-opal.c b/block/sed-opal.c +index 3d9e9cd250bd5..fa4dba5d85319 100644 +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -1056,16 +1056,20 @@ static int response_parse(const u8 *buf, size_t length, + token_length = response_parse_medium(iter, pos); + else if (pos[0] <= LONG_ATOM_BYTE) /* long atom */ + token_length = response_parse_long(iter, pos); ++ else if (pos[0] == EMPTY_ATOM_BYTE) /* empty atom */ ++ token_length = 1; + else /* TOKEN */ + token_length = response_parse_token(iter, pos); + + if (token_length < 0) + return token_length; + ++ if (pos[0] != EMPTY_ATOM_BYTE) ++ num_entries++; ++ + pos += token_length; + total -= token_length; + iter++; +- num_entries++; + } + + resp->num = num_entries; +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch b/queue-6.7/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch new file mode 100644 index 00000000000..d4b0c153cf0 --- /dev/null +++ b/queue-6.7/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch @@ -0,0 +1,51 @@ +From 53f117ea645c8da28ae0867845f43ac64e3d9efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 17:59:55 +0100 +Subject: Bluetooth: mgmt: Fix limited discoverable off timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +[ Upstream commit 0bd1fb586235224048c726922db048d1bce6354a ] + +LIMITED_DISCOVERABLE flag is not reset from Class of Device and +advertisement on limited discoverable timeout. This prevents to pass PTS +test GAP/DISC/LIMM/BV-02-C + +Calling set_discoverable_sync as when the limited discovery is set +correctly update the Class of Device and advertisement. + +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 9dd815b6603fe..2448a154a4069 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -1045,6 +1045,8 @@ static void rpa_expired(struct work_struct *work) + hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); + } + ++static int set_discoverable_sync(struct hci_dev *hdev, void *data); ++ + static void discov_off(struct work_struct *work) + { + struct hci_dev *hdev = container_of(work, struct hci_dev, +@@ -1063,7 +1065,7 @@ static void discov_off(struct work_struct *work) + hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); + hdev->discov_timeout = 0; + +- hci_update_discoverable(hdev); ++ hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); + + mgmt_new_settings(hdev); + +-- +2.43.0 + diff --git a/queue-6.7/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch b/queue-6.7/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch new file mode 100644 index 00000000000..8b2e9c19ef0 --- /dev/null +++ b/queue-6.7/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch @@ -0,0 +1,58 @@ +From 0fa72f8010533f3e5c60767cef7e7723800daa51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 17:10:43 +0800 +Subject: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security + +From: Yuxuan Hu <20373622@buaa.edu.cn> + +[ Upstream commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 ] + +During our fuzz testing of the connection and disconnection process at the +RFCOMM layer, we discovered this bug. By comparing the packets from a +normal connection and disconnection process with the testcase that +triggered a KASAN report. We analyzed the cause of this bug as follows: + +1. In the packets captured during a normal connection, the host sends a +`Read Encryption Key Size` type of `HCI_CMD` packet +(Command Opcode: 0x1408) to the controller to inquire the length of +encryption key.After receiving this packet, the controller immediately +replies with a Command Completepacket (Event Code: 0x0e) to return the +Encryption Key Size. + +2. In our fuzz test case, the timing of the controller's response to this +packet was delayed to an unexpected point: after the RFCOMM and L2CAP +layers had disconnected but before the HCI layer had disconnected. + +3. After receiving the Encryption Key Size Response at the time described +in point 2, the host still called the rfcomm_check_security function. +However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` +had already been released, and when the function executed +`return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, +specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. + +To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling +rfcomm_recv_frame in rfcomm_process_rx. + +Signed-off-by: Yuxuan Hu <20373622@buaa.edu.cn> +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c +index 053ef8f25fae4..1d34d84970332 100644 +--- a/net/bluetooth/rfcomm/core.c ++++ b/net/bluetooth/rfcomm/core.c +@@ -1941,7 +1941,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) + /* Get data directly from socket receive queue without copying it. */ + while ((skb = skb_dequeue(&sk->sk_receive_queue))) { + skb_orphan(skb); +- if (!skb_linearize(skb)) { ++ if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { + s = rfcomm_recv_frame(s, skb); + if (!s) + break; +-- +2.43.0 + diff --git a/queue-6.7/bpf-fix-warning-for-bpf_cpumask-in-verifier.patch b/queue-6.7/bpf-fix-warning-for-bpf_cpumask-in-verifier.patch new file mode 100644 index 00000000000..e6df246ce3d --- /dev/null +++ b/queue-6.7/bpf-fix-warning-for-bpf_cpumask-in-verifier.patch @@ -0,0 +1,44 @@ +From cbf8b74453876d7c67be0f806e2bb93265900549 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Feb 2024 15:31:15 +0530 +Subject: bpf: Fix warning for bpf_cpumask in verifier + +From: Hari Bathini + +[ Upstream commit 11f522256e9043b0fcd2f994278645d3e201d20c ] + +Compiling with CONFIG_BPF_SYSCALL & !CONFIG_BPF_JIT throws the below +warning: + + "WARN: resolve_btfids: unresolved symbol bpf_cpumask" + +Fix it by adding the appropriate #ifdef. + +Signed-off-by: Hari Bathini +Signed-off-by: Andrii Nakryiko +Acked-by: Jiri Olsa +Acked-by: Stanislav Fomichev +Acked-by: David Vernet +Link: https://lore.kernel.org/bpf/20240208100115.602172-1-hbathini@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 9698e93d48c6e..890d4c4bf9972 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5445,7 +5445,9 @@ BTF_ID(struct, prog_test_ref_kfunc) + #ifdef CONFIG_CGROUPS + BTF_ID(struct, cgroup) + #endif ++#ifdef CONFIG_BPF_JIT + BTF_ID(struct, bpf_cpumask) ++#endif + BTF_ID(struct, task_struct) + BTF_SET_END(rcu_protected_types) + +-- +2.43.0 + diff --git a/queue-6.7/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch b/queue-6.7/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch new file mode 100644 index 00000000000..f25e7cfd8dd --- /dev/null +++ b/queue-6.7/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch @@ -0,0 +1,104 @@ +From 0554c9647639ca314a4a17b77d7673bb0cd81b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 20:10:07 +0000 +Subject: btrfs: fix data race at btrfs_use_block_rsv() when accessing block + reserve + +From: Filipe Manana + +[ Upstream commit c7bb26b847e5b97814f522686068c5628e2b3646 ] + +At btrfs_use_block_rsv() we read the size of a block reserve without +locking its spinlock, which makes KCSAN complain because the size of a +block reserve is always updated while holding its spinlock. The report +from KCSAN is the following: + + [653.313148] BUG: KCSAN: data-race in btrfs_update_delayed_refs_rsv [btrfs] / btrfs_use_block_rsv [btrfs] + + [653.314755] read to 0x000000017f5871b8 of 8 bytes by task 7519 on cpu 0: + [653.314779] btrfs_use_block_rsv+0xe4/0x2f8 [btrfs] + [653.315606] btrfs_alloc_tree_block+0xdc/0x998 [btrfs] + [653.316421] btrfs_force_cow_block+0x220/0xe38 [btrfs] + [653.317242] btrfs_cow_block+0x1ac/0x568 [btrfs] + [653.318060] btrfs_search_slot+0xda2/0x19b8 [btrfs] + [653.318879] btrfs_del_csums+0x1dc/0x798 [btrfs] + [653.319702] __btrfs_free_extent.isra.0+0xc24/0x2028 [btrfs] + [653.320538] __btrfs_run_delayed_refs+0xd3c/0x2390 [btrfs] + [653.321340] btrfs_run_delayed_refs+0xae/0x290 [btrfs] + [653.322140] flush_space+0x5e4/0x718 [btrfs] + [653.322958] btrfs_preempt_reclaim_metadata_space+0x102/0x2f8 [btrfs] + [653.323781] process_one_work+0x3b6/0x838 + [653.323800] worker_thread+0x75e/0xb10 + [653.323817] kthread+0x21a/0x230 + [653.323836] __ret_from_fork+0x6c/0xb8 + [653.323855] ret_from_fork+0xa/0x30 + + [653.323887] write to 0x000000017f5871b8 of 8 bytes by task 576 on cpu 3: + [653.323906] btrfs_update_delayed_refs_rsv+0x1a4/0x250 [btrfs] + [653.324699] btrfs_add_delayed_data_ref+0x468/0x6d8 [btrfs] + [653.325494] btrfs_free_extent+0x76/0x120 [btrfs] + [653.326280] __btrfs_mod_ref+0x6a8/0x6b8 [btrfs] + [653.327064] btrfs_dec_ref+0x50/0x70 [btrfs] + [653.327849] walk_up_proc+0x236/0xa50 [btrfs] + [653.328633] walk_up_tree+0x21c/0x448 [btrfs] + [653.329418] btrfs_drop_snapshot+0x802/0x1328 [btrfs] + [653.330205] btrfs_clean_one_deleted_snapshot+0x184/0x238 [btrfs] + [653.330995] cleaner_kthread+0x2b0/0x2f0 [btrfs] + [653.331781] kthread+0x21a/0x230 + [653.331800] __ret_from_fork+0x6c/0xb8 + [653.331818] ret_from_fork+0xa/0x30 + +So add a helper to get the size of a block reserve while holding the lock. +Reading the field while holding the lock instead of using the data_race() +annotation is used in order to prevent load tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.c | 2 +- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/block-rsv.c b/fs/btrfs/block-rsv.c +index ceb5f586a2d55..1043a8142351b 100644 +--- a/fs/btrfs/block-rsv.c ++++ b/fs/btrfs/block-rsv.c +@@ -494,7 +494,7 @@ struct btrfs_block_rsv *btrfs_use_block_rsv(struct btrfs_trans_handle *trans, + + block_rsv = get_block_rsv(trans, root); + +- if (unlikely(block_rsv->size == 0)) ++ if (unlikely(btrfs_block_rsv_size(block_rsv) == 0)) + goto try_reserve; + again: + ret = btrfs_block_rsv_use_bytes(block_rsv, blocksize); +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index fb440a074700a..43a9a6b5a79f4 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -117,4 +117,20 @@ static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) + return ret; + } + ++/* ++ * Get the size of a block reserve in a context where getting a stale value is ++ * acceptable, instead of accessing it directly and trigger data race warning ++ * from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_size(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->size; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +-- +2.43.0 + diff --git a/queue-6.7/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch b/queue-6.7/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch new file mode 100644 index 00000000000..79c26903198 --- /dev/null +++ b/queue-6.7/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch @@ -0,0 +1,164 @@ +From 19c1888b50dcaa269c807863adcc372e40777cf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 19:41:23 +0000 +Subject: btrfs: fix data races when accessing the reserved amount of block + reserves + +From: Filipe Manana + +[ Upstream commit e06cc89475eddc1f3a7a4d471524256152c68166 ] + +At space_info.c we have several places where we access the ->reserved +field of a block reserve without taking the block reserve's spinlock +first, which makes KCSAN warn about a data race since that field is +always updated while holding the spinlock. + +The reports from KCSAN are like the following: + + [117.193526] BUG: KCSAN: data-race in btrfs_block_rsv_release [btrfs] / need_preemptive_reclaim [btrfs] + + [117.195148] read to 0x000000017f587190 of 8 bytes by task 6303 on cpu 3: + [117.195172] need_preemptive_reclaim+0x222/0x2f0 [btrfs] + [117.195992] __reserve_bytes+0xbb0/0xdc8 [btrfs] + [117.196807] btrfs_reserve_metadata_bytes+0x4c/0x120 [btrfs] + [117.197620] btrfs_block_rsv_add+0x78/0xa8 [btrfs] + [117.198434] btrfs_delayed_update_inode+0x154/0x368 [btrfs] + [117.199300] btrfs_update_inode+0x108/0x1c8 [btrfs] + [117.200122] btrfs_dirty_inode+0xb4/0x140 [btrfs] + [117.200937] btrfs_update_time+0x8c/0xb0 [btrfs] + [117.201754] touch_atime+0x16c/0x1e0 + [117.201789] filemap_read+0x674/0x728 + [117.201823] btrfs_file_read_iter+0xf8/0x410 [btrfs] + [117.202653] vfs_read+0x2b6/0x498 + [117.203454] ksys_read+0xa2/0x150 + [117.203473] __s390x_sys_read+0x68/0x88 + [117.203495] do_syscall+0x1c6/0x210 + [117.203517] __do_syscall+0xc8/0xf0 + [117.203539] system_call+0x70/0x98 + + [117.203579] write to 0x000000017f587190 of 8 bytes by task 11 on cpu 0: + [117.203604] btrfs_block_rsv_release+0x2e8/0x578 [btrfs] + [117.204432] btrfs_delayed_inode_release_metadata+0x7c/0x1d0 [btrfs] + [117.205259] __btrfs_update_delayed_inode+0x37c/0x5e0 [btrfs] + [117.206093] btrfs_async_run_delayed_root+0x356/0x498 [btrfs] + [117.206917] btrfs_work_helper+0x160/0x7a0 [btrfs] + [117.207738] process_one_work+0x3b6/0x838 + [117.207768] worker_thread+0x75e/0xb10 + [117.207797] kthread+0x21a/0x230 + [117.207830] __ret_from_fork+0x6c/0xb8 + [117.207861] ret_from_fork+0xa/0x30 + +So add a helper to get the reserved amount of a block reserve while +holding the lock. The value may be not be up to date anymore when used by +need_preemptive_reclaim() and btrfs_preempt_reclaim_metadata_space(), but +that's ok since the worst it can do is cause more reclaim work do be done +sooner rather than later. Reading the field while holding the lock instead +of using the data_race() annotation is used in order to prevent load +tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + fs/btrfs/space-info.c | 26 +++++++++++++------------- + 2 files changed, 29 insertions(+), 13 deletions(-) + +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index b0bd12b8652f4..fb440a074700a 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -101,4 +101,20 @@ static inline bool btrfs_block_rsv_full(const struct btrfs_block_rsv *rsv) + return data_race(rsv->full); + } + ++/* ++ * Get the reserved mount of a block reserve in a context where getting a stale ++ * value is acceptable, instead of accessing it directly and trigger data race ++ * warning from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->reserved; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index 571bb13587d5e..3b54eb5834746 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -856,7 +856,7 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, + static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + struct btrfs_space_info *space_info) + { +- u64 global_rsv_size = fs_info->global_block_rsv.reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(&fs_info->global_block_rsv); + u64 ordered, delalloc; + u64 thresh; + u64 used; +@@ -956,8 +956,8 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + ordered = percpu_counter_read_positive(&fs_info->ordered_bytes) >> 1; + delalloc = percpu_counter_read_positive(&fs_info->delalloc_bytes); + if (ordered >= delalloc) +- used += fs_info->delayed_refs_rsv.reserved + +- fs_info->delayed_block_rsv.reserved; ++ used += btrfs_block_rsv_reserved(&fs_info->delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(&fs_info->delayed_block_rsv); + else + used += space_info->bytes_may_use - global_rsv_size; + +@@ -1173,7 +1173,7 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + enum btrfs_flush_state flush; + u64 delalloc_size = 0; + u64 to_reclaim, block_rsv_size; +- u64 global_rsv_size = global_rsv->reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(global_rsv); + + loops++; + +@@ -1185,9 +1185,9 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + * assume it's tied up in delalloc reservations. + */ + block_rsv_size = global_rsv_size + +- delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved + +- trans_rsv->reserved; ++ btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(trans_rsv); + if (block_rsv_size < space_info->bytes_may_use) + delalloc_size = space_info->bytes_may_use - block_rsv_size; + +@@ -1207,16 +1207,16 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + to_reclaim = delalloc_size; + flush = FLUSH_DELALLOC; + } else if (space_info->bytes_pinned > +- (delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved)) { ++ (btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv))) { + to_reclaim = space_info->bytes_pinned; + flush = COMMIT_TRANS; +- } else if (delayed_block_rsv->reserved > +- delayed_refs_rsv->reserved) { +- to_reclaim = delayed_block_rsv->reserved; ++ } else if (btrfs_block_rsv_reserved(delayed_block_rsv) > ++ btrfs_block_rsv_reserved(delayed_refs_rsv)) { ++ to_reclaim = btrfs_block_rsv_reserved(delayed_block_rsv); + flush = FLUSH_DELAYED_ITEMS_NR; + } else { +- to_reclaim = delayed_refs_rsv->reserved; ++ to_reclaim = btrfs_block_rsv_reserved(delayed_refs_rsv); + flush = FLUSH_DELAYED_REFS_NR; + } + +-- +2.43.0 + diff --git a/queue-6.7/btrfs-zoned-don-t-skip-block-group-profile-checks-on.patch b/queue-6.7/btrfs-zoned-don-t-skip-block-group-profile-checks-on.patch new file mode 100644 index 00000000000..4ecbf8be6d1 --- /dev/null +++ b/queue-6.7/btrfs-zoned-don-t-skip-block-group-profile-checks-on.patch @@ -0,0 +1,56 @@ +From 16f7392bb59801f1a876304ac9c05a26ea248286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 11:59:52 +0100 +Subject: btrfs: zoned: don't skip block group profile checks on conventional + zones + +From: Johannes Thumshirn + +[ Upstream commit 5906333cc4af7b3fdb8cfff1cb3e8e579bd13174 ] + +On a zoned filesystem with conventional zones, we're skipping the block +group profile checks for the conventional zones. + +This allows converting a zoned filesystem's data block groups to RAID when +all of the zones backing the chunk are on conventional zones. But this +will lead to problems, once we're trying to allocate chunks backed by +sequential zones. + +So also check for conventional zones when loading a block group's profile +on them. + +Reported-by: HAN Yuwei +Link: https://lore.kernel.org/all/1ACD2E3643008A17+da260584-2c7f-432a-9e22-9d390aae84cc@bupt.moe/#t +Reviewed-by: Boris Burkov +Reviewed-by: Naohiro Aota +Signed-off-by: Johannes Thumshirn +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/zoned.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index 3779e76a15d64..524532f992746 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -1661,6 +1661,15 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) + } + + out: ++ /* Reject non SINGLE data profiles without RST */ ++ if ((map->type & BTRFS_BLOCK_GROUP_DATA) && ++ (map->type & BTRFS_BLOCK_GROUP_PROFILE_MASK) && ++ !fs_info->stripe_root) { ++ btrfs_err(fs_info, "zoned: data %s needs raid-stripe-tree", ++ btrfs_bg_type_to_raid_name(map->type)); ++ return -EINVAL; ++ } ++ + if (cache->alloc_offset > cache->zone_capacity) { + btrfs_err(fs_info, + "zoned: invalid write pointer %llu (larger than zone capacity %llu) in block group %llu", +-- +2.43.0 + diff --git a/queue-6.7/ceph-add-ceph_cap_unlink_work-to-fire-check_caps-imm.patch b/queue-6.7/ceph-add-ceph_cap_unlink_work-to-fire-check_caps-imm.patch new file mode 100644 index 00000000000..fc1df5fe36a --- /dev/null +++ b/queue-6.7/ceph-add-ceph_cap_unlink_work-to-fire-check_caps-imm.patch @@ -0,0 +1,168 @@ +From 1150cca9c1417e8068026bccb4cb78219a0063f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Sep 2023 10:29:16 +0800 +Subject: ceph: add ceph_cap_unlink_work to fire check_caps() immediately + +From: Xiubo Li + +[ Upstream commit dbc347ef7f0c53aa4a5383238a804d7ebbb0b5ca ] + +When unlinking a file the check caps could be delayed for more than +5 seconds, but in MDS side it maybe waiting for the clients to +release caps. + +This will use the cap_wq work queue and a dedicated list to help +fire the check_caps() and dirty buffer flushing immediately. + +Link: https://tracker.ceph.com/issues/50223 +Signed-off-by: Xiubo Li +Reviewed-by: Milind Changire +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 17 +++++++++++++++- + fs/ceph/mds_client.c | 48 ++++++++++++++++++++++++++++++++++++++++++++ + fs/ceph/mds_client.h | 5 +++++ + 3 files changed, 69 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index bce3a840f15c2..7fb4aae974124 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -4772,7 +4772,22 @@ int ceph_drop_caps_for_unlink(struct inode *inode) + if (__ceph_caps_dirty(ci)) { + struct ceph_mds_client *mdsc = + ceph_inode_to_fs_client(inode)->mdsc; +- __cap_delay_requeue_front(mdsc, ci); ++ ++ doutc(mdsc->fsc->client, "%p %llx.%llx\n", inode, ++ ceph_vinop(inode)); ++ spin_lock(&mdsc->cap_unlink_delay_lock); ++ ci->i_ceph_flags |= CEPH_I_FLUSH; ++ if (!list_empty(&ci->i_cap_delay_list)) ++ list_del_init(&ci->i_cap_delay_list); ++ list_add_tail(&ci->i_cap_delay_list, ++ &mdsc->cap_unlink_delay_list); ++ spin_unlock(&mdsc->cap_unlink_delay_lock); ++ ++ /* ++ * Fire the work immediately, because the MDS maybe ++ * waiting for caps release. ++ */ ++ ceph_queue_cap_unlink_work(mdsc); + } + } + spin_unlock(&ci->i_ceph_lock); +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index 2eb66dd7d01b2..950360b07536b 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -2470,6 +2470,50 @@ void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr) + } + } + ++void ceph_queue_cap_unlink_work(struct ceph_mds_client *mdsc) ++{ ++ struct ceph_client *cl = mdsc->fsc->client; ++ if (mdsc->stopping) ++ return; ++ ++ if (queue_work(mdsc->fsc->cap_wq, &mdsc->cap_unlink_work)) { ++ doutc(cl, "caps unlink work queued\n"); ++ } else { ++ doutc(cl, "failed to queue caps unlink work\n"); ++ } ++} ++ ++static void ceph_cap_unlink_work(struct work_struct *work) ++{ ++ struct ceph_mds_client *mdsc = ++ container_of(work, struct ceph_mds_client, cap_unlink_work); ++ struct ceph_client *cl = mdsc->fsc->client; ++ ++ doutc(cl, "begin\n"); ++ spin_lock(&mdsc->cap_unlink_delay_lock); ++ while (!list_empty(&mdsc->cap_unlink_delay_list)) { ++ struct ceph_inode_info *ci; ++ struct inode *inode; ++ ++ ci = list_first_entry(&mdsc->cap_unlink_delay_list, ++ struct ceph_inode_info, ++ i_cap_delay_list); ++ list_del_init(&ci->i_cap_delay_list); ++ ++ inode = igrab(&ci->netfs.inode); ++ if (inode) { ++ spin_unlock(&mdsc->cap_unlink_delay_lock); ++ doutc(cl, "on %p %llx.%llx\n", inode, ++ ceph_vinop(inode)); ++ ceph_check_caps(ci, CHECK_CAPS_FLUSH); ++ iput(inode); ++ spin_lock(&mdsc->cap_unlink_delay_lock); ++ } ++ } ++ spin_unlock(&mdsc->cap_unlink_delay_lock); ++ doutc(cl, "done\n"); ++} ++ + /* + * requests + */ +@@ -5345,6 +5389,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) + INIT_LIST_HEAD(&mdsc->cap_delay_list); + INIT_LIST_HEAD(&mdsc->cap_wait_list); + spin_lock_init(&mdsc->cap_delay_lock); ++ INIT_LIST_HEAD(&mdsc->cap_unlink_delay_list); ++ spin_lock_init(&mdsc->cap_unlink_delay_lock); + INIT_LIST_HEAD(&mdsc->snap_flush_list); + spin_lock_init(&mdsc->snap_flush_lock); + mdsc->last_cap_flush_tid = 1; +@@ -5353,6 +5399,7 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) + spin_lock_init(&mdsc->cap_dirty_lock); + init_waitqueue_head(&mdsc->cap_flushing_wq); + INIT_WORK(&mdsc->cap_reclaim_work, ceph_cap_reclaim_work); ++ INIT_WORK(&mdsc->cap_unlink_work, ceph_cap_unlink_work); + err = ceph_metric_init(&mdsc->metric); + if (err) + goto err_mdsmap; +@@ -5626,6 +5673,7 @@ void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc) + ceph_cleanup_global_and_empty_realms(mdsc); + + cancel_work_sync(&mdsc->cap_reclaim_work); ++ cancel_work_sync(&mdsc->cap_unlink_work); + cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */ + + doutc(cl, "done\n"); +diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h +index 40560af388272..03f8ff00874f7 100644 +--- a/fs/ceph/mds_client.h ++++ b/fs/ceph/mds_client.h +@@ -462,6 +462,8 @@ struct ceph_mds_client { + unsigned long last_renew_caps; /* last time we renewed our caps */ + struct list_head cap_delay_list; /* caps with delayed release */ + spinlock_t cap_delay_lock; /* protects cap_delay_list */ ++ struct list_head cap_unlink_delay_list; /* caps with delayed release for unlink */ ++ spinlock_t cap_unlink_delay_lock; /* protects cap_unlink_delay_list */ + struct list_head snap_flush_list; /* cap_snaps ready to flush */ + spinlock_t snap_flush_lock; + +@@ -475,6 +477,8 @@ struct ceph_mds_client { + struct work_struct cap_reclaim_work; + atomic_t cap_reclaim_pending; + ++ struct work_struct cap_unlink_work; ++ + /* + * Cap reservations + * +@@ -574,6 +578,7 @@ extern void ceph_flush_cap_releases(struct ceph_mds_client *mdsc, + struct ceph_mds_session *session); + extern void ceph_queue_cap_reclaim_work(struct ceph_mds_client *mdsc); + extern void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr); ++extern void ceph_queue_cap_unlink_work(struct ceph_mds_client *mdsc); + extern int ceph_iterate_session_caps(struct ceph_mds_session *session, + int (*cb)(struct inode *, int mds, void *), + void *arg); +-- +2.43.0 + diff --git a/queue-6.7/ceph-always-queue-a-writeback-when-revoking-the-fb-c.patch b/queue-6.7/ceph-always-queue-a-writeback-when-revoking-the-fb-c.patch new file mode 100644 index 00000000000..046db7d09e8 --- /dev/null +++ b/queue-6.7/ceph-always-queue-a-writeback-when-revoking-the-fb-c.patch @@ -0,0 +1,92 @@ +From bcc9e80c3c72481ce0b995523bf4ac6ce32948e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Sep 2023 16:18:34 +0800 +Subject: ceph: always queue a writeback when revoking the Fb caps + +From: Xiubo Li + +[ Upstream commit 902d6d013f75b68f31d208c6f3ff9cdca82648a7 ] + +In case there is 'Fw' dirty caps and 'CHECK_CAPS_FLUSH' is set we +will always ignore queue a writeback. Queue a writeback is very +important because it will block kclient flushing the snapcaps to +MDS and which will block MDS waiting for revoking the 'Fb' caps. + +Link: https://tracker.ceph.com/issues/50223 +Signed-off-by: Xiubo Li +Reviewed-by: Milind Changire +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 48 ++++++++++++++++++++++++------------------------ + 1 file changed, 24 insertions(+), 24 deletions(-) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index ad1f46c66fbff..bce3a840f15c2 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -2156,6 +2156,30 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags) + ceph_cap_string(cap->implemented), + ceph_cap_string(revoking)); + ++ /* completed revocation? going down and there are no caps? */ ++ if (revoking) { ++ if ((revoking & cap_used) == 0) { ++ doutc(cl, "completed revocation of %s\n", ++ ceph_cap_string(cap->implemented & ~cap->issued)); ++ goto ack; ++ } ++ ++ /* ++ * If the "i_wrbuffer_ref" was increased by mmap or generic ++ * cache write just before the ceph_check_caps() is called, ++ * the Fb capability revoking will fail this time. Then we ++ * must wait for the BDI's delayed work to flush the dirty ++ * pages and to release the "i_wrbuffer_ref", which will cost ++ * at most 5 seconds. That means the MDS needs to wait at ++ * most 5 seconds to finished the Fb capability's revocation. ++ * ++ * Let's queue a writeback for it. ++ */ ++ if (S_ISREG(inode->i_mode) && ci->i_wrbuffer_ref && ++ (revoking & CEPH_CAP_FILE_BUFFER)) ++ queue_writeback = true; ++ } ++ + if (cap == ci->i_auth_cap && + (cap->issued & CEPH_CAP_FILE_WR)) { + /* request larger max_size from MDS? */ +@@ -2183,30 +2207,6 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags) + } + } + +- /* completed revocation? going down and there are no caps? */ +- if (revoking) { +- if ((revoking & cap_used) == 0) { +- doutc(cl, "completed revocation of %s\n", +- ceph_cap_string(cap->implemented & ~cap->issued)); +- goto ack; +- } +- +- /* +- * If the "i_wrbuffer_ref" was increased by mmap or generic +- * cache write just before the ceph_check_caps() is called, +- * the Fb capability revoking will fail this time. Then we +- * must wait for the BDI's delayed work to flush the dirty +- * pages and to release the "i_wrbuffer_ref", which will cost +- * at most 5 seconds. That means the MDS needs to wait at +- * most 5 seconds to finished the Fb capability's revocation. +- * +- * Let's queue a writeback for it. +- */ +- if (S_ISREG(inode->i_mode) && ci->i_wrbuffer_ref && +- (revoking & CEPH_CAP_FILE_BUFFER)) +- queue_writeback = true; +- } +- + /* want more caps from mds? */ + if (want & ~cap->mds_wanted) { + if (want & ~(cap->mds_wanted | cap->issued)) +-- +2.43.0 + diff --git a/queue-6.7/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch b/queue-6.7/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch new file mode 100644 index 00000000000..9ce3d2a9e76 --- /dev/null +++ b/queue-6.7/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch @@ -0,0 +1,115 @@ +From b420376092ef8a3f86c6da0b50457885703a5646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 13:59:31 -0800 +Subject: cxl/region: Allow out of order assembly of autodiscovered regions + +From: Alison Schofield + +[ Upstream commit cb66b1d60c283bb340a2fc19deff7de8acea74b1 ] + +Autodiscovered regions can fail to assemble if they are not discovered +in HPA decode order. The user will see failure messages like: + +[] cxl region0: endpoint5: HPA order violation region1 +[] cxl region0: endpoint5: failed to allocate region reference + +The check that is causing the failure helps the CXL driver enforce +a CXL spec mandate that decoders be committed in HPA order. The +check is needless for autodiscovered regions since their decoders +are already programmed. Trying to enforce order in the assembly of +these regions is useless because they are assembled once all their +member endpoints arrive, and there is no guarantee on the order in +which endpoints are discovered during probe. + +Keep the existing check, but for autodiscovered regions, allow the +out of order assembly after a sanity check that the lesser numbered +decoder has the lesser HPA starting address. + +Signed-off-by: Alison Schofield +Tested-by: Wonjae Lee +Link: https://lore.kernel.org/r/3dec69ee97524ab229a20c6739272c3000b18408.1706736863.git.alison.schofield@intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/region.c | 48 +++++++++++++++++++++++++++++++-------- + 1 file changed, 38 insertions(+), 10 deletions(-) + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 764998fe03edc..8f0a2507ddecf 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -757,8 +757,31 @@ cxl_region_find_decoder(struct cxl_port *port, + return to_cxl_decoder(dev); + } + +-static struct cxl_region_ref *alloc_region_ref(struct cxl_port *port, +- struct cxl_region *cxlr) ++static bool auto_order_ok(struct cxl_port *port, struct cxl_region *cxlr_iter, ++ struct cxl_decoder *cxld) ++{ ++ struct cxl_region_ref *rr = cxl_rr_load(port, cxlr_iter); ++ struct cxl_decoder *cxld_iter = rr->decoder; ++ ++ /* ++ * Allow the out of order assembly of auto-discovered regions. ++ * Per CXL Spec 3.1 8.2.4.20.12 software must commit decoders ++ * in HPA order. Confirm that the decoder with the lesser HPA ++ * starting address has the lesser id. ++ */ ++ dev_dbg(&cxld->dev, "check for HPA violation %s:%d < %s:%d\n", ++ dev_name(&cxld->dev), cxld->id, ++ dev_name(&cxld_iter->dev), cxld_iter->id); ++ ++ if (cxld_iter->id > cxld->id) ++ return true; ++ ++ return false; ++} ++ ++static struct cxl_region_ref * ++alloc_region_ref(struct cxl_port *port, struct cxl_region *cxlr, ++ struct cxl_endpoint_decoder *cxled) + { + struct cxl_region_params *p = &cxlr->params; + struct cxl_region_ref *cxl_rr, *iter; +@@ -768,16 +791,21 @@ static struct cxl_region_ref *alloc_region_ref(struct cxl_port *port, + xa_for_each(&port->regions, index, iter) { + struct cxl_region_params *ip = &iter->region->params; + +- if (!ip->res) ++ if (!ip->res || ip->res->start < p->res->start) + continue; + +- if (ip->res->start > p->res->start) { +- dev_dbg(&cxlr->dev, +- "%s: HPA order violation %s:%pr vs %pr\n", +- dev_name(&port->dev), +- dev_name(&iter->region->dev), ip->res, p->res); +- return ERR_PTR(-EBUSY); ++ if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) { ++ struct cxl_decoder *cxld; ++ ++ cxld = cxl_region_find_decoder(port, cxled, cxlr); ++ if (auto_order_ok(port, iter->region, cxld)) ++ continue; + } ++ dev_dbg(&cxlr->dev, "%s: HPA order violation %s:%pr vs %pr\n", ++ dev_name(&port->dev), ++ dev_name(&iter->region->dev), ip->res, p->res); ++ ++ return ERR_PTR(-EBUSY); + } + + cxl_rr = kzalloc(sizeof(*cxl_rr), GFP_KERNEL); +@@ -954,7 +982,7 @@ static int cxl_port_attach_region(struct cxl_port *port, + nr_targets_inc = true; + } + } else { +- cxl_rr = alloc_region_ref(port, cxlr); ++ cxl_rr = alloc_region_ref(port, cxlr, cxled); + if (IS_ERR(cxl_rr)) { + dev_dbg(&cxlr->dev, + "%s: failed to allocate region reference\n", +-- +2.43.0 + diff --git a/queue-6.7/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch b/queue-6.7/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch new file mode 100644 index 00000000000..652009e007d --- /dev/null +++ b/queue-6.7/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch @@ -0,0 +1,65 @@ +From b955b0c00f16117f6829a65f416bf263f67b6563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 13:59:30 -0800 +Subject: cxl/region: Handle endpoint decoders in cxl_region_find_decoder() + +From: Alison Schofield + +[ Upstream commit 453a7fde8031a5192ed2f9646ad048c1a5e930dc ] + +In preparation for adding a new caller of cxl_region_find_decoders() +teach it to find a decoder from a cxl_endpoint_decoder structure. + +Combining switch and endpoint decoder lookup in one function prevents +code duplication in call sites. + +Update the existing caller. + +Signed-off-by: Alison Schofield +Tested-by: Wonjae Lee +Link: https://lore.kernel.org/r/79ae6d72978ef9f3ceec9722e1cb793820553c8e.1706736863.git.alison.schofield@intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/region.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 7bb656237fa0c..764998fe03edc 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -729,12 +729,17 @@ static int match_auto_decoder(struct device *dev, void *data) + return 0; + } + +-static struct cxl_decoder *cxl_region_find_decoder(struct cxl_port *port, +- struct cxl_region *cxlr) ++static struct cxl_decoder * ++cxl_region_find_decoder(struct cxl_port *port, ++ struct cxl_endpoint_decoder *cxled, ++ struct cxl_region *cxlr) + { + struct device *dev; + int id = 0; + ++ if (port == cxled_to_port(cxled)) ++ return &cxled->cxld; ++ + if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) + dev = device_find_child(&port->dev, &cxlr->params, + match_auto_decoder); +@@ -852,10 +857,7 @@ static int cxl_rr_alloc_decoder(struct cxl_port *port, struct cxl_region *cxlr, + { + struct cxl_decoder *cxld; + +- if (port == cxled_to_port(cxled)) +- cxld = &cxled->cxld; +- else +- cxld = cxl_region_find_decoder(port, cxlr); ++ cxld = cxl_region_find_decoder(port, cxled, cxlr); + if (!cxld) { + dev_dbg(&cxlr->dev, "%s: no decoder available\n", + dev_name(&port->dev)); +-- +2.43.0 + diff --git a/queue-6.7/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch b/queue-6.7/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch new file mode 100644 index 00000000000..15ad8a64ff7 --- /dev/null +++ b/queue-6.7/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch @@ -0,0 +1,71 @@ +From cd786f8debe865b168e35b2ce0ae1723e3b04ba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 19:11:51 +0100 +Subject: dm-verity, dm-crypt: align "struct bvec_iter" correctly + +From: Mikulas Patocka + +[ Upstream commit 787f1b2800464aa277236a66eb3c279535edd460 ] + +"struct bvec_iter" is defined with the __packed attribute, so it is +aligned on a single byte. On X86 (and on other architectures that support +unaligned addresses in hardware), "struct bvec_iter" is accessed using the +8-byte and 4-byte memory instructions, however these instructions are less +efficient if they operate on unaligned addresses. + +(on RISC machines that don't have unaligned access in hardware, GCC +generates byte-by-byte accesses that are very inefficient - see [1]) + +This commit reorders the entries in "struct dm_verity_io" and "struct +convert_context", so that "struct bvec_iter" is aligned on 8 bytes. + +[1] https://lore.kernel.org/all/ZcLuWUNRZadJr0tQ@fedora/T/ + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 4 ++-- + drivers/md/dm-verity.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 4ab4e8dcfd3e2..35f50193959e0 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -53,11 +53,11 @@ + struct convert_context { + struct completion restart; + struct bio *bio_in; +- struct bio *bio_out; + struct bvec_iter iter_in; ++ struct bio *bio_out; + struct bvec_iter iter_out; +- u64 cc_sector; + atomic_t cc_pending; ++ u64 cc_sector; + union { + struct skcipher_request *req; + struct aead_request *req_aead; +diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h +index 4620a98c99561..db93a91169d5e 100644 +--- a/drivers/md/dm-verity.h ++++ b/drivers/md/dm-verity.h +@@ -80,12 +80,12 @@ struct dm_verity_io { + /* original value of bio->bi_end_io */ + bio_end_io_t *orig_bi_end_io; + ++ struct bvec_iter iter; ++ + sector_t block; + unsigned int n_blocks; + bool in_tasklet; + +- struct bvec_iter iter; +- + struct work_struct work; + + char *recheck_buffer; +-- +2.43.0 + diff --git a/queue-6.7/drm-amd-display-fix-input-states-translation-error-f.patch b/queue-6.7/drm-amd-display-fix-input-states-translation-error-f.patch new file mode 100644 index 00000000000..565b0ec7d03 --- /dev/null +++ b/queue-6.7/drm-amd-display-fix-input-states-translation-error-f.patch @@ -0,0 +1,58 @@ +From 1e261a67cb688ca268e64355ddfde3e996e2b0d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 11:40:20 -0500 +Subject: drm/amd/display: fix input states translation error for dcn35 & + dcn351 + +From: Swapnil Patel + +[ Upstream commit 27a6c49394b1a203beeb94752c9a1d6318f24ddf ] + +[Why] +Currently there is an error while translating input clock sates into +output clock states. The highest fclk setting from output sates is +being dropped because of this error. + +[How] +For dcn35 and dcn351, make output_states equal to input states. + +Reviewed-by: Charlene Liu +Acked-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Swapnil Patel +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dml2/dml2_translation_helper.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +index 2c379be19aa84..16452dae4acac 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +@@ -398,7 +398,6 @@ void dml2_init_soc_states(struct dml2_context *dml2, const struct dc *in_dc, + /* Copy clocks tables entries, if available */ + if (dml2->config.bbox_overrides.clks_table.num_states) { + p->in_states->num_states = dml2->config.bbox_overrides.clks_table.num_states; +- + for (i = 0; i < dml2->config.bbox_overrides.clks_table.num_entries_per_clk.num_dcfclk_levels; i++) { + p->in_states->state_array[i].dcfclk_mhz = dml2->config.bbox_overrides.clks_table.clk_entries[i].dcfclk_mhz; + } +@@ -437,6 +436,14 @@ void dml2_init_soc_states(struct dml2_context *dml2, const struct dc *in_dc, + } + + dml2_policy_build_synthetic_soc_states(s, p); ++ if (dml2->v20.dml_core_ctx.project == dml_project_dcn35 || ++ dml2->v20.dml_core_ctx.project == dml_project_dcn351) { ++ // Override last out_state with data from last in_state ++ // This will ensure that out_state contains max fclk ++ memcpy(&p->out_states->state_array[p->out_states->num_states - 1], ++ &p->in_states->state_array[p->in_states->num_states - 1], ++ sizeof(struct soc_state_bounding_box_st)); ++ } + } + + void dml2_translate_ip_params(const struct dc *in, struct ip_params_st *out) +-- +2.43.0 + diff --git a/queue-6.7/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch b/queue-6.7/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch new file mode 100644 index 00000000000..1d4b2be6e4e --- /dev/null +++ b/queue-6.7/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch @@ -0,0 +1,90 @@ +From 96204c8dee8d93ceedb6ad3b8e785eac7a037666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 20:56:59 +0800 +Subject: drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series + +From: Prike Liang + +[ Upstream commit c671ec01311b4744b377f98b0b4c6d033fe569b3 ] + +Currently, GPU resets can now be performed successfully on the Raven +series. While GPU reset is required for the S3 suspend abort case. +So now can enable gpu reset for S3 abort cases on the Raven series. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 45 +++++++++++++++++------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 9b5af3f1383a7..f9ba1803046d9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -574,11 +574,34 @@ soc15_asic_reset_method(struct amdgpu_device *adev) + return AMD_RESET_METHOD_MODE1; + } + ++static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) ++{ ++ u32 sol_reg; ++ ++ sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); ++ ++ /* Will reset for the following suspend abort cases. ++ * 1) Only reset limit on APU side, dGPU hasn't checked yet. ++ * 2) S3 suspend abort and TOS already launched. ++ */ ++ if (adev->flags & AMD_IS_APU && adev->in_s3 && ++ !adev->suspend_complete && ++ sol_reg) ++ return true; ++ ++ return false; ++} ++ + static int soc15_asic_reset(struct amdgpu_device *adev) + { + /* original raven doesn't have full asic reset */ +- if ((adev->apu_flags & AMD_APU_IS_RAVEN) || +- (adev->apu_flags & AMD_APU_IS_RAVEN2)) ++ /* On the latest Raven, the GPU reset can be performed ++ * successfully. So now, temporarily enable it for the ++ * S3 suspend abort case. ++ */ ++ if (((adev->apu_flags & AMD_APU_IS_RAVEN) || ++ (adev->apu_flags & AMD_APU_IS_RAVEN2)) && ++ !soc15_need_reset_on_resume(adev)) + return 0; + + switch (soc15_asic_reset_method(adev)) { +@@ -1297,24 +1320,6 @@ static int soc15_common_suspend(void *handle) + return soc15_common_hw_fini(adev); + } + +-static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) +-{ +- u32 sol_reg; +- +- sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); +- +- /* Will reset for the following suspend abort cases. +- * 1) Only reset limit on APU side, dGPU hasn't checked yet. +- * 2) S3 suspend abort and TOS already launched. +- */ +- if (adev->flags & AMD_IS_APU && adev->in_s3 && +- !adev->suspend_complete && +- sol_reg) +- return true; +- +- return false; +-} +- + static int soc15_common_resume(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +-- +2.43.0 + diff --git a/queue-6.7/drm-buddy-check-range-allocation-matches-alignment.patch b/queue-6.7/drm-buddy-check-range-allocation-matches-alignment.patch new file mode 100644 index 00000000000..ad0e058afaf --- /dev/null +++ b/queue-6.7/drm-buddy-check-range-allocation-matches-alignment.patch @@ -0,0 +1,50 @@ +From c80477a8f7f846b7692c1dbc47aba60f7a612feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 12:18:53 +0000 +Subject: drm/buddy: check range allocation matches alignment +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +[ Upstream commit 2986314aa811c8a23aeb292edd30315495d54966 ] + +Likely not a big deal for real users, but for consistency we should +respect the min_page_size here. Main issue is that bias allocations +turns into normal range allocation if the range and size matches +exactly, and in the next patch we want to add some unit tests for this +part of the api. + +Signed-off-by: Matthew Auld +Cc: Arunpravin Paneer Selvam +Cc: Christian König +Reviewed-by: Arunpravin Paneer Selvam +Link: https://patchwork.freedesktop.org/patch/msgid/20240219121851.25774-5-matthew.auld@intel.com +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_buddy.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_buddy.c b/drivers/gpu/drm/drm_buddy.c +index f3a6ac908f815..5ebdd6f8f36e6 100644 +--- a/drivers/gpu/drm/drm_buddy.c ++++ b/drivers/gpu/drm/drm_buddy.c +@@ -771,8 +771,12 @@ int drm_buddy_alloc_blocks(struct drm_buddy *mm, + return -EINVAL; + + /* Actual range allocation */ +- if (start + size == end) ++ if (start + size == end) { ++ if (!IS_ALIGNED(start | end, min_block_size)) ++ return -EINVAL; ++ + return __drm_buddy_alloc_range(mm, start, size, NULL, blocks); ++ } + + original_size = size; + original_min_size = min_block_size; +-- +2.43.0 + diff --git a/queue-6.7/drm-ttm-tests-depend-on-uml-compile_test.patch b/queue-6.7/drm-ttm-tests-depend-on-uml-compile_test.patch new file mode 100644 index 00000000000..a93a446139a --- /dev/null +++ b/queue-6.7/drm-ttm-tests-depend-on-uml-compile_test.patch @@ -0,0 +1,50 @@ +From c0638dfb93a3f196bcef38285192bef77ae537ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 08:18:59 +0100 +Subject: drm/ttm/tests: depend on UML || COMPILE_TEST +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 9d3f8a723c7950e56e0b95ab84b572caee29e065 ] + +At least the device test requires that no other driver using TTM is +loaded. So make those unit tests depend on UML || COMPILE_TEST to +prevent people from trying them on bare metal. + +Signed-off-by: Christian König +Acked-by: Alex Deucher +Link: https://lore.kernel.org/all/20240219230116.77b8ad68@yea/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 3eee8636f847a..9b079f3a1b811 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -198,7 +198,7 @@ config DRM_TTM + config DRM_TTM_KUNIT_TEST + tristate "KUnit tests for TTM" if !KUNIT_ALL_TESTS + default n +- depends on DRM && KUNIT && MMU ++ depends on DRM && KUNIT && MMU && (UML || COMPILE_TEST) + select DRM_TTM + select DRM_EXPORT_FOR_TESTS if m + select DRM_KUNIT_TEST_HELPERS +@@ -206,7 +206,8 @@ config DRM_TTM_KUNIT_TEST + help + Enables unit tests for TTM, a GPU memory manager subsystem used + to manage memory buffers. This option is mostly useful for kernel +- developers. ++ developers. It depends on (UML || COMPILE_TEST) since no other driver ++ which uses TTM can be loaded while running the tests. + + If in doubt, say "N". + +-- +2.43.0 + diff --git a/queue-6.7/firewire-core-use-long-bus-reset-on-gap-count-error.patch b/queue-6.7/firewire-core-use-long-bus-reset-on-gap-count-error.patch new file mode 100644 index 00000000000..ab578026dc7 --- /dev/null +++ b/queue-6.7/firewire-core-use-long-bus-reset-on-gap-count-error.patch @@ -0,0 +1,65 @@ +From 9afaa8ebfb0fe4efaa08699884e7331821917b40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 22:17:37 +0900 +Subject: firewire: core: use long bus reset on gap count error + +From: Takashi Sakamoto + +[ Upstream commit d0b06dc48fb15902d7da09c5c0861e7f042a9381 ] + +When resetting the bus after a gap count error, use a long rather than +short bus reset. + +IEEE 1394-1995 uses only long bus resets. IEEE 1394a adds the option of +short bus resets. When video or audio transmission is in progress and a +device is hot-plugged elsewhere on the bus, the resulting bus reset can +cause video frame drops or audio dropouts. Short bus resets reduce or +eliminate this problem. Accordingly, short bus resets are almost always +preferred. + +However, on a mixed 1394/1394a bus, a short bus reset can trigger an +immediate additional bus reset. This double bus reset can be interpreted +differently by different nodes on the bus, resulting in an inconsistent gap +count after the bus reset. An inconsistent gap count will cause another bus +reset, leading to a neverending bus reset loop. This only happens for some +bus topologies, not for all mixed 1394/1394a buses. + +By instead sending a long bus reset after a gap count inconsistency, we +avoid the doubled bus reset, restoring the bus to normal operation. + +Signed-off-by: Adam Goldman +Link: https://sourceforge.net/p/linux1394/mailman/message/58741624/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/core-card.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c +index 8aaa7fcb2630d..401a77e3b5fa8 100644 +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -500,7 +500,19 @@ static void bm_work(struct work_struct *work) + fw_notice(card, "phy config: new root=%x, gap_count=%d\n", + new_root_id, gap_count); + fw_send_phy_config(card, new_root_id, generation, gap_count); +- reset_bus(card, true); ++ /* ++ * Where possible, use a short bus reset to minimize ++ * disruption to isochronous transfers. But in the event ++ * of a gap count inconsistency, use a long bus reset. ++ * ++ * As noted in 1394a 8.4.6.2, nodes on a mixed 1394/1394a bus ++ * may set different gap counts after a bus reset. On a mixed ++ * 1394/1394a bus, a short bus reset can get doubled. Some ++ * nodes may treat the double reset as one bus reset and others ++ * may treat it as two, causing a gap count inconsistency ++ * again. Using a long bus reset prevents this. ++ */ ++ reset_bus(card, card->gap_count != 0); + /* Will allocate broadcast channel after the reset. */ + goto out; + } +-- +2.43.0 + diff --git a/queue-6.7/gen_compile_commands-fix-invalid-escape-sequence-war.patch b/queue-6.7/gen_compile_commands-fix-invalid-escape-sequence-war.patch new file mode 100644 index 00000000000..ec9c157eff0 --- /dev/null +++ b/queue-6.7/gen_compile_commands-fix-invalid-escape-sequence-war.patch @@ -0,0 +1,36 @@ +From 45a2825491e99fa034bbbb6a518b1f09ddc64178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:23:05 -0600 +Subject: gen_compile_commands: fix invalid escape sequence warning + +From: Andrew Ballance + +[ Upstream commit dae4a0171e25884787da32823b3081b4c2acebb2 ] + +With python 3.12, '\#' results in this warning + SyntaxWarning: invalid escape sequence '\#' + +Signed-off-by: Andrew Ballance +Reviewed-by: Justin Stitt +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/clang-tools/gen_compile_commands.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/clang-tools/gen_compile_commands.py b/scripts/clang-tools/gen_compile_commands.py +index 5dea4479240bc..e4fb686dfaa9f 100755 +--- a/scripts/clang-tools/gen_compile_commands.py ++++ b/scripts/clang-tools/gen_compile_commands.py +@@ -170,7 +170,7 @@ def process_line(root_directory, command_prefix, file_path): + # escape the pound sign '#', either as '\#' or '$(pound)' (depending on the + # kernel version). The compile_commands.json file is not interepreted + # by Make, so this code replaces the escaped version with '#'. +- prefix = command_prefix.replace('\#', '#').replace('$(pound)', '#') ++ prefix = command_prefix.replace(r'\#', '#').replace('$(pound)', '#') + + # Return the canonical path, eliminating any symbolic links encountered in the path. + abs_path = os.path.realpath(os.path.join(root_directory, file_path)) +-- +2.43.0 + diff --git a/queue-6.7/hid-logitech-hidpp-do-not-flood-kernel-log.patch b/queue-6.7/hid-logitech-hidpp-do-not-flood-kernel-log.patch new file mode 100644 index 00000000000..909a550f48b --- /dev/null +++ b/queue-6.7/hid-logitech-hidpp-do-not-flood-kernel-log.patch @@ -0,0 +1,71 @@ +From 1269736fafb51379faf1323ea43d3ce1da039aae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 17:49:31 +0100 +Subject: HID: logitech-hidpp: Do not flood kernel log + +From: Oleksandr Natalenko + +[ Upstream commit 411a20db905b44e18cc9129b745f1d5deba4eae5 ] + +Since commit 680ee411a98e ("HID: logitech-hidpp: Fix connect event race") +the following messages appear in the kernel log from time to time: + +logitech-hidpp-device 0003:046D:408A.0005: HID++ 4.5 device connected. +logitech-hidpp-device 0003:046D:408A.0005: HID++ 4.5 device connected. +logitech-hidpp-device 0003:046D:4051.0006: Disconnected +logitech-hidpp-device 0003:046D:408A.0005: Disconnected + +As discussed, print the first per-device "device connected" message +at info level, demoting subsequent messages to debug level. Also, +demote the "Disconnected message" to debug level unconditionally. + +Link: https://lore.kernel.org/lkml/3277085.44csPzL39Z@natalenko.name/ +Signed-off-by: Oleksandr Natalenko +Reviewed-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 6ef0c88e3e60a..d2f3f234f29de 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -203,6 +203,8 @@ struct hidpp_device { + struct hidpp_scroll_counter vertical_wheel_counter; + + u8 wireless_feature_index; ++ ++ bool connected_once; + }; + + /* HID++ 1.0 error codes */ +@@ -988,8 +990,13 @@ static int hidpp_root_get_protocol_version(struct hidpp_device *hidpp) + hidpp->protocol_minor = response.rap.params[1]; + + print_version: +- hid_info(hidpp->hid_dev, "HID++ %u.%u device connected.\n", +- hidpp->protocol_major, hidpp->protocol_minor); ++ if (!hidpp->connected_once) { ++ hid_info(hidpp->hid_dev, "HID++ %u.%u device connected.\n", ++ hidpp->protocol_major, hidpp->protocol_minor); ++ hidpp->connected_once = true; ++ } else ++ hid_dbg(hidpp->hid_dev, "HID++ %u.%u device connected.\n", ++ hidpp->protocol_major, hidpp->protocol_minor); + return 0; + } + +@@ -4184,7 +4191,7 @@ static void hidpp_connect_event(struct work_struct *work) + /* Get device version to check if it is connected */ + ret = hidpp_root_get_protocol_version(hidpp); + if (ret) { +- hid_info(hidpp->hid_dev, "Disconnected\n"); ++ hid_dbg(hidpp->hid_dev, "Disconnected\n"); + if (hidpp->battery.ps) { + hidpp->battery.online = false; + hidpp->battery.status = POWER_SUPPLY_STATUS_UNKNOWN; +-- +2.43.0 + diff --git a/queue-6.7/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch b/queue-6.7/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch new file mode 100644 index 00000000000..16f757c8701 --- /dev/null +++ b/queue-6.7/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch @@ -0,0 +1,40 @@ +From d22ceaf2a93842e76838a995b53324b75764eaec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 19:04:29 +0000 +Subject: HID: multitouch: Add required quirk for Synaptics 0xcddc device + +From: Manuel Fombuena + +[ Upstream commit 1741a8269e1c51fa08d4bfdf34667387a6eb10ec ] + +Add support for the pointing stick (Accupoint) and 2 mouse buttons. + +Present on some Toshiba/dynabook Portege X30 and X40 laptops. + +It should close https://bugzilla.kernel.org/show_bug.cgi?id=205817 + +Signed-off-by: Manuel Fombuena +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index fd5b0637dad68..3e91e4d6ba6fa 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2151,6 +2151,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xcd7e) }, + ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_SYNAPTICS, 0xcddc) }, ++ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xce08) }, +-- +2.43.0 + diff --git a/queue-6.7/input-gpio_keys_polled-suppress-deferred-probe-error.patch b/queue-6.7/input-gpio_keys_polled-suppress-deferred-probe-error.patch new file mode 100644 index 00000000000..5b859d2ed48 --- /dev/null +++ b/queue-6.7/input-gpio_keys_polled-suppress-deferred-probe-error.patch @@ -0,0 +1,55 @@ +From 5bccf0e15119bdf28e406d16e2c3bc1bb2ac2ce4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:10:42 +0100 +Subject: Input: gpio_keys_polled - suppress deferred probe error for gpio +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 963465a33141d0d52338e77f80fe543d2c9dc053 ] + +On a PC Engines APU our admins are faced with: + + $ dmesg | grep -c "gpio-keys-polled gpio-keys-polled: unable to claim gpio 0, err=-517" + 261 + +Such a message always appears when e.g. a new USB device is plugged in. + +Suppress this message which considerably clutters the kernel log for +EPROBE_DEFER (i.e. -517). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240305101042.10953-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/gpio_keys_polled.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/keyboard/gpio_keys_polled.c b/drivers/input/keyboard/gpio_keys_polled.c +index ba00ecfbd343b..b41fd1240f431 100644 +--- a/drivers/input/keyboard/gpio_keys_polled.c ++++ b/drivers/input/keyboard/gpio_keys_polled.c +@@ -315,12 +315,10 @@ static int gpio_keys_polled_probe(struct platform_device *pdev) + + error = devm_gpio_request_one(dev, button->gpio, + flags, button->desc ? : DRV_NAME); +- if (error) { +- dev_err(dev, +- "unable to claim gpio %u, err=%d\n", +- button->gpio, error); +- return error; +- } ++ if (error) ++ return dev_err_probe(dev, error, ++ "unable to claim gpio %u\n", ++ button->gpio); + + bdata->gpiod = gpio_to_desc(button->gpio); + if (!bdata->gpiod) { +-- +2.43.0 + diff --git a/queue-6.7/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch b/queue-6.7/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch new file mode 100644 index 00000000000..e645e4116d0 --- /dev/null +++ b/queue-6.7/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch @@ -0,0 +1,140 @@ +From c687dd1252dc22f829e02c8f4181d484f13b171b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 08:54:01 +0100 +Subject: media: rkisp1: Fix IRQ handling due to shared interrupts + +From: Tomi Valkeinen + +[ Upstream commit ffb635bb398fc07cb38f8a7b4a82cbe5f412f08e ] + +The driver requests the interrupts as IRQF_SHARED, so the interrupt +handlers can be called at any time. If such a call happens while the ISP +is powered down, the SoC will hang as the driver tries to access the +ISP registers. + +This can be reproduced even without the platform sharing the IRQ line: +Enable CONFIG_DEBUG_SHIRQ and unload the driver, and the board will +hang. + +Fix this by adding a new field, 'irqs_enabled', which is used to bail +out from the interrupt handler when the ISP is not operational. + +Link: https://lore.kernel.org/r/20231218-rkisp-shirq-fix-v1-2-173007628248@ideasonboard.com + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-common.h | 2 ++ + .../platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-dev.c | 22 +++++++++++++++++++ + .../platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++ + 5 files changed, 33 insertions(+) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +index c6d7e01c89494..3752b702e270b 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +@@ -725,6 +725,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx) + unsigned int i; + u32 status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +index 2d7f06281c390..a4e272adc1ad0 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +@@ -449,6 +449,7 @@ struct rkisp1_debug { + * @debug: debug params to be exposed on debugfs + * @info: version-specific ISP information + * @irqs: IRQ line numbers ++ * @irqs_enabled: the hardware is enabled and can cause interrupts + */ + struct rkisp1_device { + void __iomem *base_addr; +@@ -470,6 +471,7 @@ struct rkisp1_device { + struct rkisp1_debug debug; + const struct rkisp1_info *info; + int irqs[RKISP1_NUM_IRQS]; ++ bool irqs_enabled; + }; + + /* +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +index 702adee83322b..7320c1c72e688 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +@@ -196,6 +196,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 val, status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +index acc559652d6eb..73cf08a740118 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -305,6 +305,24 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev) + { + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + ++ rkisp1->irqs_enabled = false; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ ++ /* ++ * Wait until any running IRQ handler has returned. The IRQ handler ++ * may get called even after this (as it's a shared interrupt line) ++ * but the 'irqs_enabled' flag will make the handler return immediately. ++ */ ++ for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) { ++ if (rkisp1->irqs[il] == -1) ++ continue; ++ ++ /* Skip if the irq line is the same as previous */ ++ if (il == 0 || rkisp1->irqs[il - 1] != rkisp1->irqs[il]) ++ synchronize_irq(rkisp1->irqs[il]); ++ } ++ + clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks); + return pinctrl_pm_select_sleep_state(dev); + } +@@ -321,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev) + if (ret) + return ret; + ++ rkisp1->irqs_enabled = true; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ + return 0; + } + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +index 5fbc47bda6831..caffea6a46186 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +@@ -971,6 +971,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 status, isp_err; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS); + if (!status) + return IRQ_NONE; +-- +2.43.0 + diff --git a/queue-6.7/mips-clear-cause.bd-in-instruction_pointer_set.patch b/queue-6.7/mips-clear-cause.bd-in-instruction_pointer_set.patch new file mode 100644 index 00000000000..e0a8f7895e5 --- /dev/null +++ b/queue-6.7/mips-clear-cause.bd-in-instruction_pointer_set.patch @@ -0,0 +1,39 @@ +From dd8c28cf1da2e94f61430fd135b482feed49e443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 12:30:27 +0000 +Subject: MIPS: Clear Cause.BD in instruction_pointer_set + +From: Jiaxun Yang + +[ Upstream commit 9d6e21ddf20293b3880ae55b9d14de91c5891c59 ] + +Clear Cause.BD after we use instruction_pointer_set to override +EPC. + +This can prevent exception_epc check against instruction code at +new return address. +It won't be considered as "in delay slot" after epc being overridden +anyway. + +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/ptrace.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h +index 701a233583c2c..d14d0e37ad02d 100644 +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -60,6 +60,7 @@ static inline void instruction_pointer_set(struct pt_regs *regs, + unsigned long val) + { + regs->cp0_epc = val; ++ regs->cp0_cause &= ~CAUSEF_BD; + } + + /* Query offset/name of register from its name/offset */ +-- +2.43.0 + diff --git a/queue-6.7/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch b/queue-6.7/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch new file mode 100644 index 00000000000..c62d2a07a93 --- /dev/null +++ b/queue-6.7/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch @@ -0,0 +1,46 @@ +From b3487f486ef5d980e0b2e787c2da7cc62baf0955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 17:32:40 +0100 +Subject: net/iucv: fix the allocation size of iucv_path_table array + +From: Alexander Gordeev + +[ Upstream commit b4ea9b6a18ebf7f9f3a7a60f82e925186978cfcf ] + +iucv_path_table is a dynamically allocated array of pointers to +struct iucv_path items. Yet, its size is calculated as if it was +an array of struct iucv_path items. + +Signed-off-by: Alexander Gordeev +Reviewed-by: Alexandra Winter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/iucv/iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index 0ed6e34d6edd1..ce33adb65afb0 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -156,7 +156,7 @@ static char iucv_error_pathid[16] = "INVALID PATHID"; + static LIST_HEAD(iucv_handler_list); + + /* +- * iucv_path_table: an array of iucv_path structures. ++ * iucv_path_table: array of pointers to iucv_path structures. + */ + static struct iucv_path **iucv_path_table; + static unsigned long iucv_max_pathid; +@@ -544,7 +544,7 @@ static int iucv_enable(void) + + cpus_read_lock(); + rc = -ENOMEM; +- alloc_size = iucv_max_pathid * sizeof(struct iucv_path); ++ alloc_size = iucv_max_pathid * sizeof(*iucv_path_table); + iucv_path_table = kzalloc(alloc_size, GFP_KERNEL); + if (!iucv_path_table) + goto out; +-- +2.43.0 + diff --git a/queue-6.7/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch b/queue-6.7/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch new file mode 100644 index 00000000000..ebe193479b3 --- /dev/null +++ b/queue-6.7/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch @@ -0,0 +1,40 @@ +From bfb7bc824e44bbfb010abbb3e7e62f85eef63520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 06:33:32 +0100 +Subject: net: smsc95xx: add support for SYS TEC USB-SPEmodule1 + +From: Andre Werner + +[ Upstream commit 45532b21dc2a692444b6ad5f71c253cca53e8103 ] + +This patch adds support for the SYS TEC USB-SPEmodule1 10Base-T1L +ethernet device to the existing smsc95xx driver by adding the new +USB VID/PID pair. + +Signed-off-by: Andre Werner +Link: https://lore.kernel.org/r/20240219053413.4732-1-andre.werner@systec-electronic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index a530f20ee2575..2fa46baa589e5 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -2104,6 +2104,11 @@ static const struct usb_device_id products[] = { + USB_DEVICE(0x0424, 0x9E08), + .driver_info = (unsigned long) &smsc95xx_info, + }, ++ { ++ /* SYSTEC USB-SPEmodule1 10BASE-T1L Ethernet Device */ ++ USB_DEVICE(0x0878, 0x1400), ++ .driver_info = (unsigned long)&smsc95xx_info, ++ }, + { + /* Microchip's EVB-LAN8670-USB 10BASE-T1S Ethernet Device */ + USB_DEVICE(0x184F, 0x0051), +-- +2.43.0 + diff --git a/queue-6.7/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch b/queue-6.7/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch new file mode 100644 index 00000000000..baa1d41b90a --- /dev/null +++ b/queue-6.7/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch @@ -0,0 +1,42 @@ +From 811dffcd91648d6228dafe93e4c23685d0f7f344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 23:43:14 +0100 +Subject: parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check + +From: Max Kellermann + +[ Upstream commit 250f5402e636a5cec9e0e95df252c3d54307210f ] + +Fixes a bug revealed by -Wmissing-prototypes when +CONFIG_FUNCTION_GRAPH_TRACER is enabled but not CONFIG_DYNAMIC_FTRACE: + + arch/parisc/kernel/ftrace.c:82:5: error: no previous prototype for 'ftrace_enable_ftrace_graph_caller' [-Werror=missing-prototypes] + 82 | int ftrace_enable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + arch/parisc/kernel/ftrace.c:88:5: error: no previous prototype for 'ftrace_disable_ftrace_graph_caller' [-Werror=missing-prototypes] + 88 | int ftrace_disable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Max Kellermann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/ftrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c +index d1defb9ede70c..621a4b386ae4f 100644 +--- a/arch/parisc/kernel/ftrace.c ++++ b/arch/parisc/kernel/ftrace.c +@@ -78,7 +78,7 @@ asmlinkage void notrace __hot ftrace_function_trampoline(unsigned long parent, + #endif + } + +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER ++#if defined(CONFIG_DYNAMIC_FTRACE) && defined(CONFIG_FUNCTION_GRAPH_TRACER) + int ftrace_enable_ftrace_graph_caller(void) + { + static_key_enable(&ftrace_graph_enable.key); +-- +2.43.0 + diff --git a/queue-6.7/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch b/queue-6.7/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch new file mode 100644 index 00000000000..0c42bb7fdc1 --- /dev/null +++ b/queue-6.7/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch @@ -0,0 +1,54 @@ +From 038c530a5e64516362ffeb7dbdf24b7b79a3adbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 17:11:09 +0000 +Subject: perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect + child count) + +From: Ilkka Koskinen + +[ Upstream commit 50572064ec7109b00eef8880e905f55861c8b3de ] + +AmpereOneX mesh implementation has a bug in HN-P nodes that makes them +report incorrect child count. The failing crosspoints report 8 children +while they only have two. + +When the driver tries to access the inexistent child nodes, it believes it +has reached an invalid node type and probing fails. The workaround is to +ignore those incorrect child nodes and continue normally. + +Signed-off-by: Ilkka Koskinen +[ rm: rewrote simpler generalised version ] +Tested-by: Ilkka Koskinen +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/ce4b1442135fe03d0de41859b04b268c88c854a3.1707498577.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index c584165b13bab..7e3aa7e2345fa 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -2305,6 +2305,17 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + dev_dbg(cmn->dev, "ignoring external node %llx\n", reg); + continue; + } ++ /* ++ * AmpereOneX erratum AC04_MESH_1 makes some XPs report a bogus ++ * child count larger than the number of valid child pointers. ++ * A child offset of 0 can only occur on CMN-600; otherwise it ++ * would imply the root node being its own grandchild, which ++ * we can safely dismiss in general. ++ */ ++ if (reg == 0 && cmn->part != PART_CMN600) { ++ dev_dbg(cmn->dev, "bogus child pointer?\n"); ++ continue; ++ } + + arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn); + +-- +2.43.0 + diff --git a/queue-6.7/perf-cxl-fix-cpmu-filter-value-mask-length.patch b/queue-6.7/perf-cxl-fix-cpmu-filter-value-mask-length.patch new file mode 100644 index 00000000000..359d761ecdf --- /dev/null +++ b/queue-6.7/perf-cxl-fix-cpmu-filter-value-mask-length.patch @@ -0,0 +1,59 @@ +From 610d98d9024b8d899e61e55f3d19610bf04db198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 10:45:22 +0900 +Subject: perf: CXL: fix CPMU filter value mask length + +From: Hojin Nam + +[ Upstream commit 802379b8f9e169293e9ba7089e5f1a6340e2e7a3 ] + +CPMU filter value is described as 4B length in CXL r3.0 8.2.7.2.2. +However, it is used as 2B length in code and comments. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Hojin Nam +Link: https://lore.kernel.org/r/20240216014522.32321-1-hj96.nam@samsung.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index bc0d414a6aff9..308c9969642e1 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -59,7 +59,7 @@ + #define CXL_PMU_COUNTER_CFG_EVENT_GRP_ID_IDX_MSK GENMASK_ULL(63, 59) + + #define CXL_PMU_FILTER_CFG_REG(n, f) (0x400 + 4 * ((f) + (n) * 8)) +-#define CXL_PMU_FILTER_CFG_VALUE_MSK GENMASK(15, 0) ++#define CXL_PMU_FILTER_CFG_VALUE_MSK GENMASK(31, 0) + + #define CXL_PMU_COUNTER_REG(n) (0xc00 + 8 * (n)) + +@@ -314,9 +314,9 @@ static bool cxl_pmu_config1_get_edge(struct perf_event *event) + } + + /* +- * CPMU specification allows for 8 filters, each with a 16 bit value... +- * So we need to find 8x16bits to store it in. +- * As the value used for disable is 0xffff, a separate enable switch ++ * CPMU specification allows for 8 filters, each with a 32 bit value... ++ * So we need to find 8x32bits to store it in. ++ * As the value used for disable is 0xffff_ffff, a separate enable switch + * is needed. + */ + +@@ -642,7 +642,7 @@ static void cxl_pmu_event_start(struct perf_event *event, int flags) + if (cxl_pmu_config1_hdm_filter_en(event)) + cfg = cxl_pmu_config2_get_hdm_decoder(event); + else +- cfg = GENMASK(15, 0); /* No filtering if 0xFFFF_FFFF */ ++ cfg = GENMASK(31, 0); /* No filtering if 0xFFFF_FFFF */ + writeq(cfg, base + CXL_PMU_FILTER_CFG_REG(hwc->idx, 0)); + } + +-- +2.43.0 + diff --git a/queue-6.7/perf-riscv-fix-panic-on-pmu-overflow-handler.patch b/queue-6.7/perf-riscv-fix-panic-on-pmu-overflow-handler.patch new file mode 100644 index 00000000000..2e3a8f7e0a6 --- /dev/null +++ b/queue-6.7/perf-riscv-fix-panic-on-pmu-overflow-handler.patch @@ -0,0 +1,94 @@ +From 0507c7021ac2df7d37c1aa4ba3797d6a783c5097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:54:25 +0800 +Subject: perf: RISCV: Fix panic on pmu overflow handler + +From: Fei Wu + +[ Upstream commit 34b567868777e9fd39ec5333969728a7f0cf179c ] + +(1 << idx) of int is not desired when setting bits in unsigned long +overflowed_ctrs, use BIT() instead. This panic happens when running +'perf record -e branches' on sophgo sg2042. + +[ 273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 +[ 273.320851] Oops [#1] +[ 273.323179] Modules linked in: +[ 273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3+ #9 +[ 273.332521] Hardware name: Sophgo Mango (DT) +[ 273.336878] epc : riscv_pmu_ctr_get_width_mask+0x8/0x62 +[ 273.342291] ra : pmu_sbi_ovf_handler+0x2e0/0x34e +[ 273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0 +[ 273.354454] gp : ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978 +[ 273.361815] t1 : 0000000000504d55 t2 : ffffffff8016cd8c s0 : fffffff6e3692a70 +[ 273.369180] s1 : 0000000000000020 a0 : 0000000000000000 a1 : 00001a8e81800000 +[ 273.376540] a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015 +[ 273.383901] a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a +[ 273.391327] s2 : 000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0 +[ 273.398773] s5 : 0000000000504d55 s6 : ffffffd905069800 s7 : ffffffff821fe210 +[ 273.406139] s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10: ffffffd903f29098 +[ 273.413660] s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca +[ 273.421022] t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8 +[ 273.426437] status: 0000000200000100 badaddr: 0000000000000098 cause: 000000000000000d +[ 273.434512] [] riscv_pmu_ctr_get_width_mask+0x8/0x62 +[ 273.441169] [] handle_percpu_devid_irq+0x98/0x1ee +[ 273.447562] [] generic_handle_domain_irq+0x28/0x36 +[ 273.454151] [] riscv_intc_irq+0x36/0x4e +[ 273.459659] [] handle_riscv_irq+0x4a/0x74 +[ 273.465442] [] do_irq+0x62/0x92 +[ 273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783 +[ 273.477921] ---[ end trace 0000000000000000 ]--- +[ 273.482630] Kernel panic - not syncing: Fatal exception in interrupt + +Reviewed-by: Alexandre Ghiti +Reviewed-by: Atish Patra +Signed-off-by: Fei Wu +Link: https://lore.kernel.org/r/20240228115425.2613856-1-fei2.wu@intel.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + drivers/perf/riscv_pmu_sbi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c +index 16acd4dcdb96c..452aab49db1e8 100644 +--- a/drivers/perf/riscv_pmu_sbi.c ++++ b/drivers/perf/riscv_pmu_sbi.c +@@ -512,7 +512,7 @@ static void pmu_sbi_set_scounteren(void *arg) + + if (event->hw.idx != -1) + csr_write(CSR_SCOUNTEREN, +- csr_read(CSR_SCOUNTEREN) | (1 << pmu_sbi_csr_index(event))); ++ csr_read(CSR_SCOUNTEREN) | BIT(pmu_sbi_csr_index(event))); + } + + static void pmu_sbi_reset_scounteren(void *arg) +@@ -521,7 +521,7 @@ static void pmu_sbi_reset_scounteren(void *arg) + + if (event->hw.idx != -1) + csr_write(CSR_SCOUNTEREN, +- csr_read(CSR_SCOUNTEREN) & ~(1 << pmu_sbi_csr_index(event))); ++ csr_read(CSR_SCOUNTEREN) & ~BIT(pmu_sbi_csr_index(event))); + } + + static void pmu_sbi_ctr_start(struct perf_event *event, u64 ival) +@@ -731,14 +731,14 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev) + /* compute hardware counter index */ + hidx = info->csr - CSR_CYCLE; + /* check if the corresponding bit is set in sscountovf */ +- if (!(overflow & (1 << hidx))) ++ if (!(overflow & BIT(hidx))) + continue; + + /* + * Keep a track of overflowed counters so that they can be started + * with updated initial value. + */ +- overflowed_ctrs |= 1 << lidx; ++ overflowed_ctrs |= BIT(lidx); + hw_evt = &event->hw; + riscv_pmu_event_update(event); + perf_sample_data_init(&data, 0, hw_evt->last_period); +-- +2.43.0 + diff --git a/queue-6.7/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch b/queue-6.7/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch new file mode 100644 index 00000000000..0018e0cba4f --- /dev/null +++ b/queue-6.7/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch @@ -0,0 +1,47 @@ +From 0f915c6368b7be81ecdfbf6a753984a7980860ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 21:17:21 +0100 +Subject: platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name + +From: Hans de Goede + +[ Upstream commit 8215ca518164d35f10c0b5545c8bb80f538638b8 ] + +The Acer B1 750 tablet used a Novatek NVT-ts touchscreen, +not a Goodix touchscreen. + +Rename acer_b1_750_goodix_gpios to acer_b1_750_nvt_ts_gpios +to correctly reflect this. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240216201721.239791-5-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/x86-android-tablets/other.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/x86-android-tablets/other.c b/drivers/platform/x86/x86-android-tablets/other.c +index bc6bbf7ec6ea1..278402dcb808c 100644 +--- a/drivers/platform/x86/x86-android-tablets/other.c ++++ b/drivers/platform/x86/x86-android-tablets/other.c +@@ -68,7 +68,7 @@ static const struct x86_i2c_client_info acer_b1_750_i2c_clients[] __initconst = + }, + }; + +-static struct gpiod_lookup_table acer_b1_750_goodix_gpios = { ++static struct gpiod_lookup_table acer_b1_750_nvt_ts_gpios = { + .dev_id = "i2c-NVT-ts", + .table = { + GPIO_LOOKUP("INT33FC:01", 26, "reset", GPIO_ACTIVE_LOW), +@@ -77,7 +77,7 @@ static struct gpiod_lookup_table acer_b1_750_goodix_gpios = { + }; + + static struct gpiod_lookup_table * const acer_b1_750_gpios[] = { +- &acer_b1_750_goodix_gpios, ++ &acer_b1_750_nvt_ts_gpios, + &int3496_reference_gpios, + NULL + }; +-- +2.43.0 + diff --git a/queue-6.7/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch b/queue-6.7/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch new file mode 100644 index 00000000000..7d99beaa2e6 --- /dev/null +++ b/queue-6.7/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch @@ -0,0 +1,131 @@ +From e65803fc9e8fe8e9434fba803520b5c202672977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:11 +0200 +Subject: RDMA/mlx5: Fix fortify source warning while accessing Eth segment + +From: Leon Romanovsky + +[ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] + + ------------[ cut here ]------------ + memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) + WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy + [last unloaded: mlx_compat(OE)] + CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu + Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 + RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 + RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 + RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 + R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 + FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? show_regs+0x72/0x90 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? __warn+0x8d/0x160 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? report_bug+0x1bb/0x1d0 + ? handle_bug+0x46/0x90 + ? exc_invalid_op+0x19/0x80 + ? asm_exc_invalid_op+0x1b/0x20 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] + ipoib_send+0x2ec/0x770 [ib_ipoib] + ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] + dev_hard_start_xmit+0x8e/0x1e0 + ? validate_xmit_skb_list+0x4d/0x80 + sch_direct_xmit+0x116/0x3a0 + __dev_xmit_skb+0x1fd/0x580 + __dev_queue_xmit+0x284/0x6b0 + ? _raw_spin_unlock_irq+0xe/0x50 + ? __flush_work.isra.0+0x20d/0x370 + ? push_pseudo_header+0x17/0x40 [ib_ipoib] + neigh_connected_output+0xcd/0x110 + ip_finish_output2+0x179/0x480 + ? __smp_call_single_queue+0x61/0xa0 + __ip_finish_output+0xc3/0x190 + ip_finish_output+0x2e/0xf0 + ip_output+0x78/0x110 + ? __pfx_ip_finish_output+0x10/0x10 + ip_local_out+0x64/0x70 + __ip_queue_xmit+0x18a/0x460 + ip_queue_xmit+0x15/0x30 + __tcp_transmit_skb+0x914/0x9c0 + tcp_write_xmit+0x334/0x8d0 + tcp_push_one+0x3c/0x60 + tcp_sendmsg_locked+0x2e1/0xac0 + tcp_sendmsg+0x2d/0x50 + inet_sendmsg+0x43/0x90 + sock_sendmsg+0x68/0x80 + sock_write_iter+0x93/0x100 + vfs_write+0x326/0x3c0 + ksys_write+0xbd/0xf0 + ? do_syscall_64+0x69/0x90 + __x64_sys_write+0x19/0x30 + do_syscall_64+0x59/0x90 + ? do_user_addr_fault+0x1d0/0x640 + ? exit_to_user_mode_prepare+0x3b/0xd0 + ? irqentry_exit_to_user_mode+0x9/0x20 + ? irqentry_exit+0x43/0x50 + ? exc_page_fault+0x92/0x1b0 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + RIP: 0033:0x7fc03ad14a37 + Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 + RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 + RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 + RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 + R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 + + ---[ end trace 0000000000000000 ]--- + +Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/wr.c | 2 +- + include/linux/mlx5/qp.h | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c +index df1d1b0a3ef72..9947feb7fb8a0 100644 +--- a/drivers/infiniband/hw/mlx5/wr.c ++++ b/drivers/infiniband/hw/mlx5/wr.c +@@ -78,7 +78,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, + */ + copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, + left); +- memcpy(eseg->inline_hdr.start, pdata, copysz); ++ memcpy(eseg->inline_hdr.data, pdata, copysz); + stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - + sizeof(eseg->inline_hdr.start) + copysz, 16); + *size += stride / 16; +diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h +index bd53cf4be7bdc..f0e55bf3ec8b5 100644 +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -269,7 +269,10 @@ struct mlx5_wqe_eth_seg { + union { + struct { + __be16 sz; +- u8 start[2]; ++ union { ++ u8 start[2]; ++ DECLARE_FLEX_ARRAY(u8, data); ++ }; + } inline_hdr; + struct { + __be16 type; +-- +2.43.0 + diff --git a/queue-6.7/rdma-mlx5-relax-devx-access-upon-modify-commands.patch b/queue-6.7/rdma-mlx5-relax-devx-access-upon-modify-commands.patch new file mode 100644 index 00000000000..66b74fe0d7f --- /dev/null +++ b/queue-6.7/rdma-mlx5-relax-devx-access-upon-modify-commands.patch @@ -0,0 +1,47 @@ +From 15a733a1b0461f9b9893962bc63ed7abc4e79fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:13 +0200 +Subject: RDMA/mlx5: Relax DEVX access upon modify commands + +From: Yishai Hadas + +[ Upstream commit be551ee1574280ef8afbf7c271212ac3e38933ef ] + +Relax DEVX access upon modify commands to be UVERBS_ACCESS_READ. + +The kernel doesn't need to protect what firmware protects, or what +causes no damage to anyone but the user. + +As firmware needs to protect itself from parallel access to the same +object, don't block parallel modify/query commands on the same object in +the kernel side. + +This change will allow user space application to run parallel updates to +different entries in the same bulk object. + +Tested-by: Tamar Mashiah +Signed-off-by: Yishai Hadas +Reviewed-by: Michael Guralnik +Link: https://lore.kernel.org/r/7407d5ed35dc427c1097699e12b49c01e1073406.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 8ba53edf23119..6e19974ecf6e7 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -2949,7 +2949,7 @@ DECLARE_UVERBS_NAMED_METHOD( + MLX5_IB_METHOD_DEVX_OBJ_MODIFY, + UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_MODIFY_HANDLE, + UVERBS_IDR_ANY_OBJECT, +- UVERBS_ACCESS_WRITE, ++ UVERBS_ACCESS_READ, + UA_MANDATORY), + UVERBS_ATTR_PTR_IN( + MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN, +-- +2.43.0 + diff --git a/queue-6.7/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch b/queue-6.7/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch new file mode 100644 index 00000000000..f87f6044de3 --- /dev/null +++ b/queue-6.7/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch @@ -0,0 +1,146 @@ +From b944babb3cc54d9c0b072c520b6e9cf6b82fa9fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 16:58:17 +0000 +Subject: regmap: kunit: Ensure that changed bytes are actually different + +From: Mark Brown + +[ Upstream commit 2f0dbb24f78a333433a2b875c0b76bf55c119cd4 ] + +During the cache sync test we verify that values we expect to have been +written only to the cache do not appear in the hardware. This works most +of the time but since we randomly generate both the original and new values +there is a low probability that these values may actually be the same. +Wrap get_random_bytes() to ensure that the values are different, there +are other tests which should have similar verification that we actually +changed something. + +While we're at it refactor the test to use three changed values rather +than attempting to use one of them twice, that just complicates checking +that our new values are actually new. + +We use random generation to try to avoid data dependencies in the tests. + +Reported-by: Guenter Roeck +Reviewed-by: Guenter Roeck +Tested-by: Guenter Roeck +Signed-off-by: Mark Brown +Link: https://msgid.link/r/20240211-regmap-kunit-random-change-v3-1-e387a9ea4468@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-kunit.c | 54 +++++++++++++++++++++--------- + 1 file changed, 38 insertions(+), 16 deletions(-) + +diff --git a/drivers/base/regmap/regmap-kunit.c b/drivers/base/regmap/regmap-kunit.c +index e14cc03a17f6c..4c9e38ead5c56 100644 +--- a/drivers/base/regmap/regmap-kunit.c ++++ b/drivers/base/regmap/regmap-kunit.c +@@ -9,6 +9,23 @@ + + #define BLOCK_TEST_SIZE 12 + ++static void get_changed_bytes(void *orig, void *new, size_t size) ++{ ++ char *o = orig; ++ char *n = new; ++ int i; ++ ++ get_random_bytes(new, size); ++ ++ /* ++ * This could be nicer and more efficient but we shouldn't ++ * super care. ++ */ ++ for (i = 0; i < size; i++) ++ while (n[i] == o[i]) ++ get_random_bytes(&n[i], 1); ++} ++ + static const struct regmap_config test_regmap_config = { + .max_register = BLOCK_TEST_SIZE, + .reg_stride = 1, +@@ -1192,7 +1209,7 @@ static void raw_sync(struct kunit *test) + struct regmap *map; + struct regmap_config config; + struct regmap_ram_data *data; +- u16 val[2]; ++ u16 val[3]; + u16 *hw_buf; + unsigned int rval; + int i; +@@ -1206,17 +1223,13 @@ static void raw_sync(struct kunit *test) + + hw_buf = (u16 *)data->vals; + +- get_random_bytes(&val, sizeof(val)); ++ get_changed_bytes(&hw_buf[2], &val[0], sizeof(val)); + + /* Do a regular write and a raw write in cache only mode */ + regcache_cache_only(map, true); +- KUNIT_EXPECT_EQ(test, 0, regmap_raw_write(map, 2, val, sizeof(val))); +- if (config.val_format_endian == REGMAP_ENDIAN_BIG) +- KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 6, +- be16_to_cpu(val[0]))); +- else +- KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 6, +- le16_to_cpu(val[0]))); ++ KUNIT_EXPECT_EQ(test, 0, regmap_raw_write(map, 2, val, ++ sizeof(u16) * 2)); ++ KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 4, val[2])); + + /* We should read back the new values, and defaults for the rest */ + for (i = 0; i < config.max_register + 1; i++) { +@@ -1225,24 +1238,34 @@ static void raw_sync(struct kunit *test) + switch (i) { + case 2: + case 3: +- case 6: + if (config.val_format_endian == REGMAP_ENDIAN_BIG) { + KUNIT_EXPECT_EQ(test, rval, +- be16_to_cpu(val[i % 2])); ++ be16_to_cpu(val[i - 2])); + } else { + KUNIT_EXPECT_EQ(test, rval, +- le16_to_cpu(val[i % 2])); ++ le16_to_cpu(val[i - 2])); + } + break; ++ case 4: ++ KUNIT_EXPECT_EQ(test, rval, val[i - 2]); ++ break; + default: + KUNIT_EXPECT_EQ(test, config.reg_defaults[i].def, rval); + break; + } + } ++ ++ /* ++ * The value written via _write() was translated by the core, ++ * translate the original copy for comparison purposes. ++ */ ++ if (config.val_format_endian == REGMAP_ENDIAN_BIG) ++ val[2] = cpu_to_be16(val[2]); ++ else ++ val[2] = cpu_to_le16(val[2]); + + /* The values should not appear in the "hardware" */ +- KUNIT_EXPECT_MEMNEQ(test, &hw_buf[2], val, sizeof(val)); +- KUNIT_EXPECT_MEMNEQ(test, &hw_buf[6], val, sizeof(u16)); ++ KUNIT_EXPECT_MEMNEQ(test, &hw_buf[2], &val[0], sizeof(val)); + + for (i = 0; i < config.max_register + 1; i++) + data->written[i] = false; +@@ -1253,8 +1276,7 @@ static void raw_sync(struct kunit *test) + KUNIT_EXPECT_EQ(test, 0, regcache_sync(map)); + + /* The values should now appear in the "hardware" */ +- KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], val, sizeof(val)); +- KUNIT_EXPECT_MEMEQ(test, &hw_buf[6], val, sizeof(u16)); ++ KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], &val[0], sizeof(val)); + + regmap_exit(map); + } +-- +2.43.0 + diff --git a/queue-6.7/regulator-max5970-fix-regulator-child-node-name.patch b/queue-6.7/regulator-max5970-fix-regulator-child-node-name.patch new file mode 100644 index 00000000000..f9d728ad8a0 --- /dev/null +++ b/queue-6.7/regulator-max5970-fix-regulator-child-node-name.patch @@ -0,0 +1,49 @@ +From 0c70d964ac4f49d18073d0778712d06f46d50aec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 20:28:00 +0530 +Subject: regulator: max5970: Fix regulator child node name + +From: Naresh Solanki + +[ Upstream commit e5d40e9afd84cec01cdbbbfe62d52f89959ab3ee ] + +Update regulator child node name to lower case i.e., sw0 & sw1 as +descibed in max5970 dt binding. + +Signed-off-by: Naresh Solanki +Link: https://msgid.link/r/20240213145801.2564518-1-naresh.solanki@9elements.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max5970-regulator.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/max5970-regulator.c b/drivers/regulator/max5970-regulator.c +index 830a1c4cd7057..8bbcd983a74aa 100644 +--- a/drivers/regulator/max5970-regulator.c ++++ b/drivers/regulator/max5970-regulator.c +@@ -29,8 +29,8 @@ struct max5970_regulator { + }; + + enum max597x_regulator_id { +- MAX597X_SW0, +- MAX597X_SW1, ++ MAX597X_sw0, ++ MAX597X_sw1, + }; + + static int max5970_read_adc(struct regmap *regmap, int reg, long *val) +@@ -378,8 +378,8 @@ static int max597x_dt_parse(struct device_node *np, + } + + static const struct regulator_desc regulators[] = { +- MAX597X_SWITCH(SW0, MAX5970_REG_CHXEN, 0, "vss1"), +- MAX597X_SWITCH(SW1, MAX5970_REG_CHXEN, 1, "vss2"), ++ MAX597X_SWITCH(sw0, MAX5970_REG_CHXEN, 0, "vss1"), ++ MAX597X_SWITCH(sw1, MAX5970_REG_CHXEN, 1, "vss2"), + }; + + static int max597x_regmap_read_clear(struct regmap *map, unsigned int reg, +-- +2.43.0 + diff --git a/queue-6.7/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch b/queue-6.7/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch new file mode 100644 index 00000000000..96362143859 --- /dev/null +++ b/queue-6.7/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch @@ -0,0 +1,36 @@ +From 26e8f8e470f54709191cfdcaa1354b63829f96fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:45:40 +0000 +Subject: riscv: dts: sifive: add missing #interrupt-cells to pmic + +From: Conor Dooley + +[ Upstream commit ce6b6d1513965f500a05f3facf223fa01fd74920 ] + +At W=2 dtc complains: +hifive-unmatched-a00.dts:120.10-238.4: Warning (interrupt_provider): /soc/i2c@10030000/pmic@58: Missing '#interrupt-cells' in interrupt provider + +Add the missing property. + +Reviewed-by: Samuel Holland +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +index 07387f9c135ca..72b87b08ab444 100644 +--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts ++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +@@ -123,6 +123,7 @@ pmic@58 { + interrupt-parent = <&gpio>; + interrupts = <1 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +-- +2.43.0 + diff --git a/queue-6.7/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch b/queue-6.7/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch new file mode 100644 index 00000000000..e0f6b25beca --- /dev/null +++ b/queue-6.7/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch @@ -0,0 +1,44 @@ +From 17688a1438266a810488ab8aea0ce6d8c228c9c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 12:47:24 +0530 +Subject: scsi: mpt3sas: Prevent sending diag_reset when the controller is + ready + +From: Ranjan Kumar + +[ Upstream commit ee0017c3ed8a8abfa4d40e42f908fb38c31e7515 ] + +If the driver detects that the controller is not ready before sending the +first IOC facts command, it will wait for a maximum of 10 seconds for it to +become ready. However, even if the controller becomes ready within 10 +seconds, the driver will still issue a diagnostic reset. + +Modify the driver to avoid sending a diag reset if the controller becomes +ready within the 10-second wait time. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20240221071724.14986-1-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index a75f670bf5519..aa29e250cf15f 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7387,7 +7387,9 @@ _base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout) + return -EFAULT; + } + +- issue_diag_reset: ++ return 0; ++ ++issue_diag_reset: + rc = _base_diag_reset(ioc); + return rc; + } +-- +2.43.0 + diff --git a/queue-6.7/selftests-mptcp-explicitly-trigger-the-listener-diag.patch b/queue-6.7/selftests-mptcp-explicitly-trigger-the-listener-diag.patch new file mode 100644 index 00000000000..66073149379 --- /dev/null +++ b/queue-6.7/selftests-mptcp-explicitly-trigger-the-listener-diag.patch @@ -0,0 +1,89 @@ +From 02dc7e7327bc1a3551665745a40029cf96d6a8e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 17:14:20 +0100 +Subject: selftests: mptcp: explicitly trigger the listener diag code-path + +From: Paolo Abeni + +[ Upstream commit b4b51d36bbaa3ddb93b3e1ca3a1ef0aa629d6521 ] + +The mptcp diag interface already experienced a few locking bugs +that lockdep and appropriate coverage have detected in advance. + +Let's add a test-case triggering the relevant code path, to prevent +similar issues in the future. + +Be careful to cope with very slow environments. + +Note that we don't need an explicit timeout on the mptcp_connect +subprocess to cope with eventual bug/hang-up as the final cleanup +terminating the child processes will take care of that. + +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-10-162e87e48497@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/diag.sh | 30 ++++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/mptcp/diag.sh b/tools/testing/selftests/net/mptcp/diag.sh +index 4d8c59be1b30c..ff9a4f45f852f 100755 +--- a/tools/testing/selftests/net/mptcp/diag.sh ++++ b/tools/testing/selftests/net/mptcp/diag.sh +@@ -20,7 +20,7 @@ flush_pids() + + ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGUSR1 &>/dev/null + +- for _ in $(seq 10); do ++ for _ in $(seq $((timeout_poll * 10))); do + [ -z "$(ip netns pids "${ns}")" ] && break + sleep 0.1 + done +@@ -91,6 +91,15 @@ chk_msk_nr() + __chk_msk_nr "grep -c token:" "$@" + } + ++chk_listener_nr() ++{ ++ local expected=$1 ++ local msg="$2" ++ ++ __chk_nr "ss -inmlHMON $ns | wc -l" "$expected" "$msg - mptcp" 0 ++ __chk_nr "ss -inmlHtON $ns | wc -l" "$expected" "$msg - subflows" ++} ++ + wait_msk_nr() + { + local condition="grep -c token:" +@@ -306,5 +315,24 @@ flush_pids + chk_msk_inuse 0 "many->0" + chk_msk_cestab 0 "many->0" + ++chk_listener_nr 0 "no listener sockets" ++NR_SERVERS=100 ++for I in $(seq 1 $NR_SERVERS); do ++ ip netns exec $ns ./mptcp_connect -p $((I + 20001)) \ ++ -t ${timeout_poll} -l 0.0.0.0 >/dev/null 2>&1 & ++done ++ ++for I in $(seq 1 $NR_SERVERS); do ++ mptcp_lib_wait_local_port_listen $ns $((I + 20001)) ++done ++ ++chk_listener_nr $NR_SERVERS "many listener sockets" ++ ++# graceful termination ++for I in $(seq 1 $NR_SERVERS); do ++ echo a | ip netns exec $ns ./mptcp_connect -p $((I + 20001)) 127.0.0.1 >/dev/null 2>&1 & ++done ++flush_pids ++ + mptcp_lib_result_print_all_tap + exit $ret +-- +2.43.0 + diff --git a/queue-6.7/selftests-openvswitch-add-validation-for-the-recursi.patch b/queue-6.7/selftests-openvswitch-add-validation-for-the-recursi.patch new file mode 100644 index 00000000000..66eebd272eb --- /dev/null +++ b/queue-6.7/selftests-openvswitch-add-validation-for-the-recursi.patch @@ -0,0 +1,201 @@ +From c40e781d7ba5ddfa73527aa57040cb251cf574d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:24:16 -0500 +Subject: selftests: openvswitch: Add validation for the recursion test + +From: Aaron Conole + +[ Upstream commit bd128f62c365504e1268dc09fcccdfb1f091e93a ] + +Add a test case into the netlink checks that will show the number of +nested action recursions won't exceed 16. Going to 17 on a small +clone call isn't enough to exhaust the stack on (most) systems, so +it should be safe to run even on systems that don't have the fix +applied. + +Signed-off-by: Aaron Conole +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240207132416.1488485-3-aconole@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../selftests/net/openvswitch/openvswitch.sh | 13 ++++ + .../selftests/net/openvswitch/ovs-dpctl.py | 71 +++++++++++++++---- + 2 files changed, 69 insertions(+), 15 deletions(-) + +diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh +index f8499d4c87f3f..36e40256ab92a 100755 +--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh ++++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh +@@ -502,7 +502,20 @@ test_netlink_checks () { + wc -l) == 2 ] || \ + return 1 + ++ info "Checking clone depth" + ERR_MSG="Flow actions may not be safe on all matching packets" ++ PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") ++ ovs_add_flow "test_netlink_checks" nv0 \ ++ 'in_port(1),eth(),eth_type(0x800),ipv4()' \ ++ 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ ++ >/dev/null 2>&1 && return 1 ++ POST_TEST=$(dmesg | grep -c "${ERR_MSG}") ++ ++ if [ "$PRE_TEST" == "$POST_TEST" ]; then ++ info "failed - clone depth too large" ++ return 1 ++ fi ++ + PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") + ovs_add_flow "test_netlink_checks" nv0 \ + 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ +diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +index b97e621face95..5e0e539a323d5 100644 +--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py ++++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +@@ -299,7 +299,7 @@ class ovsactions(nla): + ("OVS_ACTION_ATTR_PUSH_NSH", "none"), + ("OVS_ACTION_ATTR_POP_NSH", "flag"), + ("OVS_ACTION_ATTR_METER", "none"), +- ("OVS_ACTION_ATTR_CLONE", "none"), ++ ("OVS_ACTION_ATTR_CLONE", "recursive"), + ("OVS_ACTION_ATTR_CHECK_PKT_LEN", "none"), + ("OVS_ACTION_ATTR_ADD_MPLS", "none"), + ("OVS_ACTION_ATTR_DEC_TTL", "none"), +@@ -465,29 +465,42 @@ class ovsactions(nla): + print_str += "pop_mpls" + else: + datum = self.get_attr(field[0]) +- print_str += datum.dpstr(more) ++ if field[0] == "OVS_ACTION_ATTR_CLONE": ++ print_str += "clone(" ++ print_str += datum.dpstr(more) ++ print_str += ")" ++ else: ++ print_str += datum.dpstr(more) + + return print_str + + def parse(self, actstr): ++ totallen = len(actstr) + while len(actstr) != 0: + parsed = False ++ parencount = 0 + if actstr.startswith("drop"): + # If no reason is provided, the implicit drop is used (i.e no + # action). If some reason is given, an explicit action is used. +- actstr, reason = parse_extract_field( +- actstr, +- "drop(", +- "([0-9]+)", +- lambda x: int(x, 0), +- False, +- None, +- ) ++ reason = None ++ if actstr.startswith("drop("): ++ parencount += 1 ++ ++ actstr, reason = parse_extract_field( ++ actstr, ++ "drop(", ++ "([0-9]+)", ++ lambda x: int(x, 0), ++ False, ++ None, ++ ) ++ + if reason is not None: + self["attrs"].append(["OVS_ACTION_ATTR_DROP", reason]) + parsed = True + else: +- return ++ actstr = actstr[len("drop"): ] ++ return (totallen - len(actstr)) + + elif parse_starts_block(actstr, "^(\d+)", False, True): + actstr, output = parse_extract_field( +@@ -504,6 +517,7 @@ class ovsactions(nla): + False, + 0, + ) ++ parencount += 1 + self["attrs"].append(["OVS_ACTION_ATTR_RECIRC", recircid]) + parsed = True + +@@ -516,12 +530,22 @@ class ovsactions(nla): + + for flat_act in parse_flat_map: + if parse_starts_block(actstr, flat_act[0], False): +- actstr += len(flat_act[0]) ++ actstr = actstr[len(flat_act[0]):] + self["attrs"].append([flat_act[1]]) + actstr = actstr[strspn(actstr, ", ") :] + parsed = True + +- if parse_starts_block(actstr, "ct(", False): ++ if parse_starts_block(actstr, "clone(", False): ++ parencount += 1 ++ subacts = ovsactions() ++ actstr = actstr[len("clone("):] ++ parsedLen = subacts.parse(actstr) ++ lst = [] ++ self["attrs"].append(("OVS_ACTION_ATTR_CLONE", subacts)) ++ actstr = actstr[parsedLen:] ++ parsed = True ++ elif parse_starts_block(actstr, "ct(", False): ++ parencount += 1 + actstr = actstr[len("ct(") :] + ctact = ovsactions.ctact() + +@@ -553,6 +577,7 @@ class ovsactions(nla): + natact = ovsactions.ctact.natattr() + + if actstr.startswith("("): ++ parencount += 1 + t = None + actstr = actstr[1:] + if actstr.startswith("src"): +@@ -607,15 +632,29 @@ class ovsactions(nla): + actstr = actstr[strspn(actstr, ", ") :] + + ctact["attrs"].append(["OVS_CT_ATTR_NAT", natact]) +- actstr = actstr[strspn(actstr, ",) ") :] ++ actstr = actstr[strspn(actstr, ", ") :] + + self["attrs"].append(["OVS_ACTION_ATTR_CT", ctact]) + parsed = True + +- actstr = actstr[strspn(actstr, "), ") :] ++ actstr = actstr[strspn(actstr, ", ") :] ++ while parencount > 0: ++ parencount -= 1 ++ actstr = actstr[strspn(actstr, " "):] ++ if len(actstr) and actstr[0] != ")": ++ raise ValueError("Action str: '%s' unbalanced" % actstr) ++ actstr = actstr[1:] ++ ++ if len(actstr) and actstr[0] == ")": ++ return (totallen - len(actstr)) ++ ++ actstr = actstr[strspn(actstr, ", ") :] ++ + if not parsed: + raise ValueError("Action str: '%s' not supported" % actstr) + ++ return (totallen - len(actstr)) ++ + + class ovskey(nla): + nla_flags = NLA_F_NESTED +@@ -2111,6 +2150,8 @@ def main(argv): + ovsflow = OvsFlow() + ndb = NDB() + ++ sys.setrecursionlimit(100000) ++ + if hasattr(args, "showdp"): + found = False + for iface in ndb.interfaces: +-- +2.43.0 + diff --git a/queue-6.7/selftests-tls-use-exact-comparison-in-recv_partial.patch b/queue-6.7/selftests-tls-use-exact-comparison-in-recv_partial.patch new file mode 100644 index 00000000000..324b5e3a1c7 --- /dev/null +++ b/queue-6.7/selftests-tls-use-exact-comparison-in-recv_partial.patch @@ -0,0 +1,44 @@ +From e2a686209161da6a0f5f9522e61faa5620b4c9c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 17:18:23 -0800 +Subject: selftests: tls: use exact comparison in recv_partial + +From: Jakub Kicinski + +[ Upstream commit 49d821064c44cb5ffdf272905236012ea9ce50e3 ] + +This exact case was fail for async crypto and we weren't +catching it. + +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/tls.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 464853a7f9829..ad993ab3ac181 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -988,12 +988,12 @@ TEST_F(tls, recv_partial) + + memset(recv_mem, 0, sizeof(recv_mem)); + EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_first), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first), ++ MSG_WAITALL), strlen(test_str_first)); + EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0); + memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_second), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second), ++ MSG_WAITALL), strlen(test_str_second)); + EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)), + 0); + } +-- +2.43.0 + diff --git a/queue-6.7/series b/queue-6.7/series index 82d86f23690..109b2aed86f 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -2,3 +2,80 @@ platform-x86-p2sb-on-goldmont-only-cache-p2sb-and-sp.patch io_uring-unix-drop-usage-of-io_uring-socket.patch io_uring-drop-any-code-related-to-scm_rights.patch soc-qcom-pmic_glink_altmode-fix-drm-bridge-use-after.patch +media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch +hid-logitech-hidpp-do-not-flood-kernel-log.patch +asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch +wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch +perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch +selftests-openvswitch-add-validation-for-the-recursi.patch +selftests-tls-use-exact-comparison-in-recv_partial.patch +asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch +spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch +regmap-kunit-ensure-that-changed-bytes-are-actually-.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch +x86-xen-add-some-null-pointer-checking-to-smp.c.patch +mips-clear-cause.bd-in-instruction_pointer_set.patch +ceph-always-queue-a-writeback-when-revoking-the-fb-c.patch +ceph-add-ceph_cap_unlink_work-to-fire-check_caps-imm.patch +hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch +asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch +alsa-hda-realtek-cs35l41-add-internal-speaker-suppor.patch +gen_compile_commands-fix-invalid-escape-sequence-war.patch +arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch +soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch +arm64-dts-rockchip-mark-system-power-controller-on-r.patch +rdma-mlx5-fix-fortify-source-warning-while-accessing.patch +rdma-mlx5-relax-devx-access-upon-modify-commands.patch +arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch +bpf-fix-warning-for-bpf_cpumask-in-verifier.patch +riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch +x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch +x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch +net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch +parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch +block-sed-opal-handle-empty-atoms-when-parsing-respo.patch +cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch +cxl-region-allow-out-of-order-assembly-of-autodiscov.patch +perf-cxl-fix-cpmu-filter-value-mask-length.patch +platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch +dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch +arm-dts-fix-dtc-interrupt_provider-warnings.patch +arm64-dts-fix-dtc-interrupt_provider-warnings.patch +arm-dts-fix-dtc-interrupt_map-warnings.patch +arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch +arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch +drm-amd-display-fix-input-states-translation-error-f.patch +regulator-max5970-fix-regulator-child-node-name.patch +wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch +wifi-iwlwifi-mvm-fix-the-txf-mapping-for-bz-devices.patch +btrfs-zoned-don-t-skip-block-group-profile-checks-on.patch +btrfs-fix-data-races-when-accessing-the-reserved-amo.patch +btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch +spi-cadence-qspi-put-runtime-in-runtime-pm-hooks-nam.patch +spi-cadence-qspi-add-system-wide-suspend-and-resume-.patch +net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch +wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch +drm-ttm-tests-depend-on-uml-compile_test.patch +asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch +scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch +selftests-mptcp-explicitly-trigger-the-listener-diag.patch +alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch +drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch +drm-buddy-check-range-allocation-matches-alignment.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch +bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch +bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch +firewire-core-use-long-bus-reset-on-gap-count-error.patch +perf-riscv-fix-panic-on-pmu-overflow-handler.patch +arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch +asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch +x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch +alsa-hda-realtek-add-quirks-for-lenovo-thinkbook-16p.patch +alsa-hda-cs35l41-overwrite-cs35l41-configuration-for.patch +asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch +xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch +xfrm-set-skb-control-buffer-based-on-packet-offload-.patch +input-gpio_keys_polled-suppress-deferred-probe-error.patch +asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch +asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch +asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch diff --git a/queue-6.7/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch b/queue-6.7/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch new file mode 100644 index 00000000000..073fe500adb --- /dev/null +++ b/queue-6.7/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch @@ -0,0 +1,33 @@ +From 1fe591d9a5de15cb519845451361491dbae45b4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 16:04:14 +0100 +Subject: soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt + +From: Geert Uytterhoeven + +[ Upstream commit 6dd9a236042e305d7b69ee92db7347bf5943e7d3 ] + +The symbol's prompt should be a one-line description, instead of just +duplicating the symbol name. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/soc/microchip/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/microchip/Kconfig b/drivers/soc/microchip/Kconfig +index eb656b33156ba..f19e74d342aa2 100644 +--- a/drivers/soc/microchip/Kconfig ++++ b/drivers/soc/microchip/Kconfig +@@ -1,5 +1,5 @@ + config POLARFIRE_SOC_SYS_CTRL +- tristate "POLARFIRE_SOC_SYS_CTRL" ++ tristate "Microchip PolarFire SoC (MPFS) system controller support" + depends on POLARFIRE_SOC_MAILBOX + help + This driver adds support for the PolarFire SoC (MPFS) system controller. +-- +2.43.0 + diff --git a/queue-6.7/spi-cadence-qspi-add-system-wide-suspend-and-resume-.patch b/queue-6.7/spi-cadence-qspi-add-system-wide-suspend-and-resume-.patch new file mode 100644 index 00000000000..7d5cb116e78 --- /dev/null +++ b/queue-6.7/spi-cadence-qspi-add-system-wide-suspend-and-resume-.patch @@ -0,0 +1,64 @@ +From 1d028a83511c97af5fea935cbe45f1f84d1cf0c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 11:12:32 +0100 +Subject: spi: cadence-qspi: add system-wide suspend and resume callbacks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit 078d62de433b4f4556bb676e5dd670f0d4103376 ] + +Each SPI controller is expected to call the spi_controller_suspend() and +spi_controller_resume() callbacks at system-wide suspend and resume. + +It (1) handles the kthread worker for queued controllers and (2) marks +the controller as suspended to have spi_sync() fail while the +controller is unavailable. + +Those two operations do not require the controller to be active, we do +not need to increment the runtime PM usage counter. + +Signed-off-by: Théo Lebrun +Link: https://msgid.link/r/20240222-cdns-qspi-pm-fix-v4-4-6b6af8bcbf59@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 4b2d42e54f568..1a8d03958dffb 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1949,8 +1949,24 @@ static int cqspi_runtime_resume(struct device *dev) + return 0; + } + +-static DEFINE_RUNTIME_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_runtime_suspend, +- cqspi_runtime_resume, NULL); ++static int cqspi_suspend(struct device *dev) ++{ ++ struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ ++ return spi_controller_suspend(cqspi->host); ++} ++ ++static int cqspi_resume(struct device *dev) ++{ ++ struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ ++ return spi_controller_resume(cqspi->host); ++} ++ ++static const struct dev_pm_ops cqspi_dev_pm_ops = { ++ RUNTIME_PM_OPS(cqspi_runtime_suspend, cqspi_runtime_resume, NULL) ++ SYSTEM_SLEEP_PM_OPS(cqspi_suspend, cqspi_resume) ++}; + + static const struct cqspi_driver_platdata cdns_qspi = { + .quirks = CQSPI_DISABLE_DAC_MODE, +-- +2.43.0 + diff --git a/queue-6.7/spi-cadence-qspi-put-runtime-in-runtime-pm-hooks-nam.patch b/queue-6.7/spi-cadence-qspi-put-runtime-in-runtime-pm-hooks-nam.patch new file mode 100644 index 00000000000..d98b19833a4 --- /dev/null +++ b/queue-6.7/spi-cadence-qspi-put-runtime-in-runtime-pm-hooks-nam.patch @@ -0,0 +1,65 @@ +From 3cdb3804f5115b557b48bab573dd7a076c578741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 11:12:31 +0100 +Subject: spi: cadence-qspi: put runtime in runtime PM hooks names +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit 4efa1250b59ebf47ce64a7b6b7c3e2e0a2a9d35a ] + +Follow kernel naming convention with regards to power-management +callback function names. + +The convention in the kernel is: + - prefix_suspend means the system-wide suspend callback; + - prefix_runtime_suspend means the runtime PM suspend callback. +The same applies to resume callbacks. + +Signed-off-by: Théo Lebrun +Reviewed-by: Dhruva Gole +Link: https://msgid.link/r/20240222-cdns-qspi-pm-fix-v4-3-6b6af8bcbf59@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-quadspi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c +index 731775d34d393..4b2d42e54f568 100644 +--- a/drivers/spi/spi-cadence-quadspi.c ++++ b/drivers/spi/spi-cadence-quadspi.c +@@ -1927,7 +1927,7 @@ static void cqspi_remove(struct platform_device *pdev) + pm_runtime_disable(&pdev->dev); + } + +-static int cqspi_suspend(struct device *dev) ++static int cqspi_runtime_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); + +@@ -1936,7 +1936,7 @@ static int cqspi_suspend(struct device *dev) + return 0; + } + +-static int cqspi_resume(struct device *dev) ++static int cqspi_runtime_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); + +@@ -1949,8 +1949,8 @@ static int cqspi_resume(struct device *dev) + return 0; + } + +-static DEFINE_RUNTIME_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_suspend, +- cqspi_resume, NULL); ++static DEFINE_RUNTIME_DEV_PM_OPS(cqspi_dev_pm_ops, cqspi_runtime_suspend, ++ cqspi_runtime_resume, NULL); + + static const struct cqspi_driver_platdata cdns_qspi = { + .quirks = CQSPI_DISABLE_DAC_MODE, +-- +2.43.0 + diff --git a/queue-6.7/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch b/queue-6.7/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch new file mode 100644 index 00000000000..3938f7a3b40 --- /dev/null +++ b/queue-6.7/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch @@ -0,0 +1,35 @@ +From fa3d189c6f85138ee48efeb9be3ee622c2b9d0de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 10:20:27 +0200 +Subject: spi: intel-pci: Add support for Lunar Lake-M SPI serial flash + +From: Mika Westerberg + +[ Upstream commit 8f44e3808200c1434c26ef459722f88f48b306df ] + +Add Intel Lunar Lake-M PCI ID to the driver list of supported devices. +This is the same controller found in previous generations. + +Signed-off-by: Mika Westerberg +Link: https://msgid.link/r/20240212082027.2462849-1-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index 07d20ca1164c3..4337ca51d7aa2 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -85,6 +85,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa2a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, + { }, + }; + MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); +-- +2.43.0 + diff --git a/queue-6.7/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch b/queue-6.7/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch new file mode 100644 index 00000000000..74270fdadc1 --- /dev/null +++ b/queue-6.7/wifi-iwlwifi-mvm-ensure-offloading-tid-queue-exists.patch @@ -0,0 +1,117 @@ +From 706fb68c03c726aa15cbc4ffd125f2517891cb81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 19:51:47 +0200 +Subject: wifi: iwlwifi: mvm: ensure offloading TID queue exists + +From: Benjamin Berg + +[ Upstream commit 78f65fbf421a61894c14a1b91fe2fb4437b3fe5f ] + +The resume code path assumes that the TX queue for the offloading TID +has been configured. At resume time it then tries to sync the write +pointer as it may have been updated by the firmware. + +In the unusual event that no packets have been send on TID 0, the queue +will not have been allocated and this causes a crash. Fix this by +ensuring the queue exist at suspend time. + +Signed-off-by: Benjamin Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240218194912.6632e6dc7b35.Ie6e6a7488c9c7d4529f13d48f752b5439d8ac3c4@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 9 ++++++- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 28 ++++++++++++++++++++ + drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 3 ++- + 3 files changed, 38 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index 92c45571bd691..a640860ab7acd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -1286,7 +1286,9 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw, + + mvm->net_detect = true; + } else { +- struct iwl_wowlan_config_cmd wowlan_config_cmd = {}; ++ struct iwl_wowlan_config_cmd wowlan_config_cmd = { ++ .offloading_tid = 0, ++ }; + + wowlan_config_cmd.sta_id = mvmvif->deflink.ap_sta_id; + +@@ -1298,6 +1300,11 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw, + goto out_noreset; + } + ++ ret = iwl_mvm_sta_ensure_queue( ++ mvm, ap_sta->txq[wowlan_config_cmd.offloading_tid]); ++ if (ret) ++ goto out_noreset; ++ + ret = iwl_mvm_get_wowlan_config(mvm, wowlan, &wowlan_config_cmd, + vif, mvmvif, ap_sta); + if (ret) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index bba96a9688906..9905925142279 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1502,6 +1502,34 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm, + return ret; + } + ++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, ++ struct ieee80211_txq *txq) ++{ ++ struct iwl_mvm_txq *mvmtxq = iwl_mvm_txq_from_mac80211(txq); ++ int ret = -EINVAL; ++ ++ lockdep_assert_held(&mvm->mutex); ++ ++ if (likely(test_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state)) || ++ !txq->sta) { ++ return 0; ++ } ++ ++ if (!iwl_mvm_sta_alloc_queue(mvm, txq->sta, txq->ac, txq->tid)) { ++ set_bit(IWL_MVM_TXQ_STATE_READY, &mvmtxq->state); ++ ret = 0; ++ } ++ ++ local_bh_disable(); ++ spin_lock(&mvm->add_stream_lock); ++ if (!list_empty(&mvmtxq->list)) ++ list_del_init(&mvmtxq->list); ++ spin_unlock(&mvm->add_stream_lock); ++ local_bh_enable(); ++ ++ return ret; ++} ++ + void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk) + { + struct iwl_mvm *mvm = container_of(wk, struct iwl_mvm, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +index b33a0ce096d46..3cf8a70274ce8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ + /* +- * Copyright (C) 2012-2014, 2018-2023 Intel Corporation ++ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation + * Copyright (C) 2013-2014 Intel Mobile Communications GmbH + * Copyright (C) 2015-2016 Intel Deutschland GmbH + */ +@@ -571,6 +571,7 @@ void iwl_mvm_modify_all_sta_disable_tx(struct iwl_mvm *mvm, + bool disable); + + void iwl_mvm_csa_client_absent(struct iwl_mvm *mvm, struct ieee80211_vif *vif); ++int iwl_mvm_sta_ensure_queue(struct iwl_mvm *mvm, struct ieee80211_txq *txq); + void iwl_mvm_add_new_dqa_stream_wk(struct work_struct *wk); + int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + struct iwl_mvm_int_sta *sta, u8 *addr, u32 cipher, +-- +2.43.0 + diff --git a/queue-6.7/wifi-iwlwifi-mvm-fix-the-txf-mapping-for-bz-devices.patch b/queue-6.7/wifi-iwlwifi-mvm-fix-the-txf-mapping-for-bz-devices.patch new file mode 100644 index 00000000000..2ae53dafbd8 --- /dev/null +++ b/queue-6.7/wifi-iwlwifi-mvm-fix-the-txf-mapping-for-bz-devices.patch @@ -0,0 +1,104 @@ +From 82e19c940061d0222da90435be7b68c895ce1c6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Feb 2024 19:51:50 +0200 +Subject: wifi: iwlwifi: mvm: fix the TXF mapping for BZ devices + +From: Emmanuel Grumbach + +[ Upstream commit d3433d1bb7bde449035f54b7000361ce151bad07 ] + +Those devices' fifos are numbered differently. +Because of that, we were looking at the size of the VO fifo size to +determine the size of the A-MSDU which led to a lower throughput. + +Note that for those devices the only user of the AC -> fifo mapping is +the size limitation of A-MSDU. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240218194912.da336ca2fa0a.I73e44d5fc474ebb6f275b9008950e59c012f33b2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/api/txq.h | 12 +++++++++++- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 11 +++++++++++ + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 8 ++++++-- + 3 files changed, 28 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h +index 9c69d36743846..e6c0f928a6bbf 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/txq.h +@@ -1,6 +1,6 @@ + /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ + /* +- * Copyright (C) 2005-2014, 2019-2021, 2023 Intel Corporation ++ * Copyright (C) 2005-2014, 2019-2021, 2023-2024 Intel Corporation + * Copyright (C) 2013-2015 Intel Mobile Communications GmbH + * Copyright (C) 2016-2017 Intel Deutschland GmbH + */ +@@ -66,6 +66,16 @@ enum iwl_gen2_tx_fifo { + IWL_GEN2_TRIG_TX_FIFO_VO, + }; + ++enum iwl_bz_tx_fifo { ++ IWL_BZ_EDCA_TX_FIFO_BK, ++ IWL_BZ_EDCA_TX_FIFO_BE, ++ IWL_BZ_EDCA_TX_FIFO_VI, ++ IWL_BZ_EDCA_TX_FIFO_VO, ++ IWL_BZ_TRIG_TX_FIFO_BK, ++ IWL_BZ_TRIG_TX_FIFO_BE, ++ IWL_BZ_TRIG_TX_FIFO_VI, ++ IWL_BZ_TRIG_TX_FIFO_VO, ++}; + /** + * enum iwl_tx_queue_cfg_actions - TXQ config options + * @TX_QUEUE_CFG_ENABLE_QUEUE: enable a queue +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index c4f96125cf33a..25a5a31e63c2a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -31,6 +31,17 @@ const u8 iwl_mvm_ac_to_gen2_tx_fifo[] = { + IWL_GEN2_TRIG_TX_FIFO_BK, + }; + ++const u8 iwl_mvm_ac_to_bz_tx_fifo[] = { ++ IWL_BZ_EDCA_TX_FIFO_VO, ++ IWL_BZ_EDCA_TX_FIFO_VI, ++ IWL_BZ_EDCA_TX_FIFO_BE, ++ IWL_BZ_EDCA_TX_FIFO_BK, ++ IWL_BZ_TRIG_TX_FIFO_VO, ++ IWL_BZ_TRIG_TX_FIFO_VI, ++ IWL_BZ_TRIG_TX_FIFO_BE, ++ IWL_BZ_TRIG_TX_FIFO_BK, ++}; ++ + struct iwl_mvm_mac_iface_iterator_data { + struct iwl_mvm *mvm; + struct ieee80211_vif *vif; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index f2af3e5714090..3be67f0ff74f7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -1574,12 +1574,16 @@ static inline int iwl_mvm_max_active_links(struct iwl_mvm *mvm, + + extern const u8 iwl_mvm_ac_to_tx_fifo[]; + extern const u8 iwl_mvm_ac_to_gen2_tx_fifo[]; ++extern const u8 iwl_mvm_ac_to_bz_tx_fifo[]; + + static inline u8 iwl_mvm_mac_ac_to_tx_fifo(struct iwl_mvm *mvm, + enum ieee80211_ac_numbers ac) + { +- return iwl_mvm_has_new_tx_api(mvm) ? +- iwl_mvm_ac_to_gen2_tx_fifo[ac] : iwl_mvm_ac_to_tx_fifo[ac]; ++ if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) ++ return iwl_mvm_ac_to_bz_tx_fifo[ac]; ++ if (iwl_mvm_has_new_tx_api(mvm)) ++ return iwl_mvm_ac_to_gen2_tx_fifo[ac]; ++ return iwl_mvm_ac_to_tx_fifo[ac]; + } + + struct iwl_rate_info { +-- +2.43.0 + diff --git a/queue-6.7/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch b/queue-6.7/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch new file mode 100644 index 00000000000..fa0d0d6e909 --- /dev/null +++ b/queue-6.7/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch @@ -0,0 +1,204 @@ +From e659646d9fcd2530f26b3bd09f668fd26cb24e2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 00:06:03 +0200 +Subject: wifi: iwlwifi: mvm: use correct address 3 in A-MSDU + +From: Daniel Gabay + +[ Upstream commit 2e57b77583ca34fdb6e14f253172636c52f81cf2 ] + +As described in IEEE sta 802.11-2020, table 9-30 (Address +field contents), A-MSDU address 3 should contain the BSSID +address. + +In TX_CMD we copy the MAC header from skb, and skb address 3 +holds the destination address, but it may not be identical to +the BSSID. + +Using the wrong destination address appears to work with (most) +receivers without MLO, but in MLO some devices are checking for +it carefully, perhaps as a consequence of link to MLD address +translation. + +Replace address 3 in the TX_CMD MAC header with the correct +address while retaining the skb address 3 unchanged. +This ensures that skb address 3 will be utilized later for +constructing the A-MSDU subframes. + +Note that we fill in the MLD address, but the firmware will do the +necessary translation to link address after encryption. + +Signed-off-by: Daniel Gabay +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240204235836.4583a1bf9188.I3f8e7892bdf8f86b4daa28453771a8c9817b2416@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 69 ++++++++++++++++++--- + 1 file changed, 59 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index db986bfc4dc3f..461f26d9214e4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -520,13 +520,24 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm, + } + } + ++static void iwl_mvm_copy_hdr(void *cmd, const void *hdr, int hdrlen, ++ const u8 *addr3_override) ++{ ++ struct ieee80211_hdr *out_hdr = cmd; ++ ++ memcpy(cmd, hdr, hdrlen); ++ if (addr3_override) ++ memcpy(out_hdr->addr3, addr3_override, ETH_ALEN); ++} ++ + /* + * Allocates and sets the Tx cmd the driver data pointers in the skb + */ + static struct iwl_device_tx_cmd * + iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + struct ieee80211_tx_info *info, int hdrlen, +- struct ieee80211_sta *sta, u8 sta_id) ++ struct ieee80211_sta *sta, u8 sta_id, ++ const u8 *addr3_override) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct iwl_device_tx_cmd *dev_cmd; +@@ -584,7 +595,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + cmd->len = cpu_to_le16((u16)skb->len); + + /* Copy MAC header from skb into command buffer */ +- memcpy(cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override); + + cmd->flags = cpu_to_le16(flags); + cmd->rate_n_flags = cpu_to_le32(rate_n_flags); +@@ -599,7 +610,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + cmd->len = cpu_to_le16((u16)skb->len); + + /* Copy MAC header from skb into command buffer */ +- memcpy(cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override); + + cmd->flags = cpu_to_le32(flags); + cmd->rate_n_flags = cpu_to_le32(rate_n_flags); +@@ -617,7 +628,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + iwl_mvm_set_tx_cmd_rate(mvm, tx_cmd, info, sta, hdr->frame_control); + + /* Copy MAC header from skb into command buffer */ +- memcpy(tx_cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(tx_cmd->hdr, hdr, hdrlen, addr3_override); + + out: + return dev_cmd; +@@ -820,7 +831,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) + + IWL_DEBUG_TX(mvm, "station Id %d, queue=%d\n", sta_id, queue); + +- dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id); ++ dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id, ++ NULL); + if (!dev_cmd) + return -1; + +@@ -1140,7 +1152,8 @@ static int iwl_mvm_tx_pkt_queued(struct iwl_mvm *mvm, + */ + static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, + struct ieee80211_tx_info *info, +- struct ieee80211_sta *sta) ++ struct ieee80211_sta *sta, ++ const u8 *addr3_override) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct iwl_mvm_sta *mvmsta; +@@ -1172,7 +1185,8 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, + iwl_mvm_probe_resp_set_noa(mvm, skb); + + dev_cmd = iwl_mvm_set_tx_params(mvm, skb, info, hdrlen, +- sta, mvmsta->deflink.sta_id); ++ sta, mvmsta->deflink.sta_id, ++ addr3_override); + if (!dev_cmd) + goto drop; + +@@ -1294,9 +1308,11 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct ieee80211_tx_info info; + struct sk_buff_head mpdus_skbs; ++ struct ieee80211_vif *vif; + unsigned int payload_len; + int ret; + struct sk_buff *orig_skb = skb; ++ const u8 *addr3; + + if (WARN_ON_ONCE(!mvmsta)) + return -1; +@@ -1307,26 +1323,59 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, + memcpy(&info, skb->cb, sizeof(info)); + + if (!skb_is_gso(skb)) +- return iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL); + + payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) - + tcp_hdrlen(skb) + skb->data_len; + + if (payload_len <= skb_shinfo(skb)->gso_size) +- return iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL); + + __skb_queue_head_init(&mpdus_skbs); + ++ vif = info.control.vif; ++ if (!vif) ++ return -1; ++ + ret = iwl_mvm_tx_tso(mvm, skb, &info, sta, &mpdus_skbs); + if (ret) + return ret; + + WARN_ON(skb_queue_empty(&mpdus_skbs)); + ++ /* ++ * As described in IEEE sta 802.11-2020, table 9-30 (Address ++ * field contents), A-MSDU address 3 should contain the BSSID ++ * address. ++ * Pass address 3 down to iwl_mvm_tx_mpdu() and further to set it ++ * in the command header. We need to preserve the original ++ * address 3 in the skb header to correctly create all the ++ * A-MSDU subframe headers from it. ++ */ ++ switch (vif->type) { ++ case NL80211_IFTYPE_STATION: ++ addr3 = vif->cfg.ap_addr; ++ break; ++ case NL80211_IFTYPE_AP: ++ addr3 = vif->addr; ++ break; ++ default: ++ addr3 = NULL; ++ break; ++ } ++ + while (!skb_queue_empty(&mpdus_skbs)) { ++ struct ieee80211_hdr *hdr; ++ bool amsdu; ++ + skb = __skb_dequeue(&mpdus_skbs); ++ hdr = (void *)skb->data; ++ amsdu = ieee80211_is_data_qos(hdr->frame_control) && ++ (*ieee80211_get_qos_ctl(hdr) & ++ IEEE80211_QOS_CTL_A_MSDU_PRESENT); + +- ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta, ++ amsdu ? addr3 : NULL); + if (ret) { + /* Free skbs created as part of TSO logic that have not yet been dequeued */ + __skb_queue_purge(&mpdus_skbs); +-- +2.43.0 + diff --git a/queue-6.7/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch b/queue-6.7/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch new file mode 100644 index 00000000000..4d4ad4de82b --- /dev/null +++ b/queue-6.7/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch @@ -0,0 +1,39 @@ +From d17088965d3d951fb0c55c84722ecd0ff35a92a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 15:05:35 +0100 +Subject: wifi: mac80211: only call drv_sta_rc_update for uploaded stations + +From: Felix Fietkau + +[ Upstream commit 413dafc8170fcb925fb17af8842f06af305f8e0b ] + +When a station has not been uploaded yet, receiving SMPS or channel width +notification action frames can lead to rate_control_rate_update calling +drv_sta_rc_update with uninitialized driver private data. +Fix this by adding a missing check for sta->uploaded. + +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240221140535.16102-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rate.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c +index d5ea5f5bcf3a0..9d33fd2377c88 100644 +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -119,7 +119,8 @@ void rate_control_rate_update(struct ieee80211_local *local, + rcu_read_unlock(); + } + +- drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); ++ if (sta->uploaded) ++ drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); + } + + int ieee80211_rate_control_register(const struct rate_control_ops *ops) +-- +2.43.0 + diff --git a/queue-6.7/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch b/queue-6.7/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch new file mode 100644 index 00000000000..09f4d0226d2 --- /dev/null +++ b/queue-6.7/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch @@ -0,0 +1,58 @@ +From 7300dde4127874467297d99d5c58e522e58a65ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 09:57:40 -0800 +Subject: x86/hyperv: Allow 15-bit APIC IDs for VTL platforms + +From: Saurabh Sengar + +[ Upstream commit 0d63e4c0ebc2b5c329babde44fd61d3f08db814d ] + +The current method for signaling the compatibility of a Hyper-V host +with MSIs featuring 15-bit APIC IDs relies on a synthetic cpuid leaf. +However, for higher VTLs, this leaf is not reported, due to the absence +of an IO-APIC. + +As an alternative, assume that when running at a high VTL, the host +supports 15-bit APIC IDs. This assumption is safe, as Hyper-V does not +employ any architectural MSIs at higher VTLs + +This unblocks startup of VTL2 environments with more than 256 CPUs. + +Signed-off-by: Saurabh Sengar +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1705341460-18394-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <1705341460-18394-1-git-send-email-ssengar@linux.microsoft.com> +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/hv_vtl.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c +index 96e6c51515f50..cf1b78cb2d043 100644 +--- a/arch/x86/hyperv/hv_vtl.c ++++ b/arch/x86/hyperv/hv_vtl.c +@@ -16,6 +16,11 @@ + extern struct boot_params boot_params; + static struct real_mode_header hv_vtl_real_mode_header; + ++static bool __init hv_vtl_msi_ext_dest_id(void) ++{ ++ return true; ++} ++ + void __init hv_vtl_init_platform(void) + { + pr_info("Linux runs in Hyper-V Virtual Trust Level\n"); +@@ -38,6 +43,8 @@ void __init hv_vtl_init_platform(void) + x86_platform.legacy.warm_reset = 0; + x86_platform.legacy.reserve_bios_regions = 0; + x86_platform.legacy.devices.pnpbios = 0; ++ ++ x86_init.hyper.msi_ext_dest_id = hv_vtl_msi_ext_dest_id; + } + + static inline u64 hv_vtl_system_desc_base(struct ldttss_desc *desc) +-- +2.43.0 + diff --git a/queue-6.7/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch b/queue-6.7/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch new file mode 100644 index 00000000000..573747a7ac0 --- /dev/null +++ b/queue-6.7/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch @@ -0,0 +1,100 @@ +From 268aebf4200cf3b9b7bf88880290019295d8f0c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:34 +0800 +Subject: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() + +From: Hou Tao + +[ Upstream commit 32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58 ] + +When trying to use copy_from_kernel_nofault() to read vsyscall page +through a bpf program, the following oops was reported: + + BUG: unable to handle page fault for address: ffffffffff600000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... + RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 + ...... + Call Trace: + + ? copy_from_kernel_nofault+0x6f/0x110 + bpf_probe_read_kernel+0x1d/0x50 + bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d + trace_call_bpf+0xc5/0x1c0 + perf_call_bpf_enter.isra.0+0x69/0xb0 + perf_syscall_enter+0x13e/0x200 + syscall_trace_enter+0x188/0x1c0 + do_syscall_64+0xb5/0xe0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + + ...... + ---[ end trace 0000000000000000 ]--- + +The oops is triggered when: + +1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall +page and invokes copy_from_kernel_nofault() which in turn calls +__get_user_asm(). + +2) Because the vsyscall page address is not readable from kernel space, +a page fault exception is triggered accordingly. + +3) handle_page_fault() considers the vsyscall page address as a user +space address instead of a kernel space address. This results in the +fix-up setup by bpf not being applied and a page_fault_oops() is invoked +due to SMAP. + +Considering handle_page_fault() has already considered the vsyscall page +address as a userspace address, fix the problem by disallowing vsyscall +page read for copy_from_kernel_nofault(). + +Originally-by: Thomas Gleixner +Reported-by: syzbot+72aa0161922eba61b50e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/CAG48ez06TZft=ATH1qh2c5mpS5BT8UakwNkzi6nvK5_djC-4Nw@mail.gmail.com +Reported-by: xingwei lee +Closes: https://lore.kernel.org/bpf/CABOYnLynjBoFZOf3Z4BhaZkc5hx_kHfsjiW+UWLoB=w33LvScw@mail.gmail.com +Signed-off-by: Hou Tao +Reviewed-by: Sohil Mehta +Acked-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240202103935.3154011-3-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/mm/maccess.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c +index 6993f026adec9..42115ac079cfe 100644 +--- a/arch/x86/mm/maccess.c ++++ b/arch/x86/mm/maccess.c +@@ -3,6 +3,8 @@ + #include + #include + ++#include ++ + #ifdef CONFIG_X86_64 + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + { +@@ -15,6 +17,14 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + if (vaddr < TASK_SIZE_MAX + PAGE_SIZE) + return false; + ++ /* ++ * Reading from the vsyscall page may cause an unhandled fault in ++ * certain cases. Though it is at an address above TASK_SIZE_MAX, it is ++ * usually considered as a user space address. ++ */ ++ if (is_vsyscall_vaddr(vaddr)) ++ return false; ++ + /* + * Allow everything during early boot before 'x86_virt_bits' + * is initialized. Needed for instruction decoding in early +-- +2.43.0 + diff --git a/queue-6.7/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch b/queue-6.7/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch new file mode 100644 index 00000000000..68152ce31ce --- /dev/null +++ b/queue-6.7/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch @@ -0,0 +1,71 @@ +From 0020a388641fd5832e1df289f400b44e3d942e51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:33 +0800 +Subject: x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h + +From: Hou Tao + +[ Upstream commit ee0e39a63b78849f8abbef268b13e4838569f646 ] + +Move is_vsyscall_vaddr() into asm/vsyscall.h to make it available for +copy_from_kernel_nofault_allowed() in arch/x86/mm/maccess.c. + +Reviewed-by: Sohil Mehta +Signed-off-by: Hou Tao +Link: https://lore.kernel.org/r/20240202103935.3154011-2-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/vsyscall.h | 10 ++++++++++ + arch/x86/mm/fault.c | 9 --------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h +index ab60a71a8dcb9..472f0263dbc61 100644 +--- a/arch/x86/include/asm/vsyscall.h ++++ b/arch/x86/include/asm/vsyscall.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + #ifdef CONFIG_X86_VSYSCALL_EMULATION + extern void map_vsyscall(void); +@@ -24,4 +25,13 @@ static inline bool emulate_vsyscall(unsigned long error_code, + } + #endif + ++/* ++ * The (legacy) vsyscall page is the long page in the kernel portion ++ * of the address space that has user-accessible permissions. ++ */ ++static inline bool is_vsyscall_vaddr(unsigned long vaddr) ++{ ++ return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); ++} ++ + #endif /* _ASM_X86_VSYSCALL_H */ +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 679b09cfe241c..d6375b3c633bc 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -798,15 +798,6 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code, + show_opcodes(regs, loglvl); + } + +-/* +- * The (legacy) vsyscall page is the long page in the kernel portion +- * of the address space that has user-accessible permissions. +- */ +-static bool is_vsyscall_vaddr(unsigned long vaddr) +-{ +- return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); +-} +- + static void + __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code, + unsigned long address, u32 pkey, int si_code) +-- +2.43.0 + diff --git a/queue-6.7/x86-xen-add-some-null-pointer-checking-to-smp.c.patch b/queue-6.7/x86-xen-add-some-null-pointer-checking-to-smp.c.patch new file mode 100644 index 00000000000..bbe64436151 --- /dev/null +++ b/queue-6.7/x86-xen-add-some-null-pointer-checking-to-smp.c.patch @@ -0,0 +1,79 @@ +From efcbb9d20a8823bf1c2071486e72f63cd063cc3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 17:49:48 +0800 +Subject: x86/xen: Add some null pointer checking to smp.c + +From: Kunwu Chan + +[ Upstream commit 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ +Suggested-by: Markus Elfring +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 4b0d6fff88de5..1fb9a1644d944 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) + char *resched_name, *callfunc_name, *debug_name; + + resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); ++ if (!resched_name) ++ goto fail_mem; + per_cpu(xen_resched_irq, cpu).name = resched_name; + rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, + cpu, +@@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) + per_cpu(xen_resched_irq, cpu).irq = rc; + + callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; + per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, + cpu, +@@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) + + if (!xen_fifo_events) { + debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ if (!debug_name) ++ goto fail_mem; ++ + per_cpu(xen_debug_irq, cpu).name = debug_name; + rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, + xen_debug_interrupt, +@@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) + } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; ++ + per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, + cpu, +@@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) + + return 0; + ++ fail_mem: ++ rc = -ENOMEM; + fail: + xen_smp_intr_free(cpu); + return rc; +-- +2.43.0 + diff --git a/queue-6.7/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch b/queue-6.7/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch new file mode 100644 index 00000000000..d4e156dc077 --- /dev/null +++ b/queue-6.7/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch @@ -0,0 +1,49 @@ +From 9c47c909d89fb68d17e15241b72660e1ecb11c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 12:24:08 +0000 +Subject: xfrm: fix xfrm child route lookup for packet offload + +From: Mike Yu + +[ Upstream commit d4872d70fc6feabfc8e897edad993a81096ade9f ] + +In current code, xfrm_bundle_create() always uses the matched +SA's family type to look up a xfrm child route for the skb. +The route returned by xfrm_dst_lookup() will eventually be +used in xfrm_output_resume() (skb_dst(skb)->ops->local_out()). + +If packet offload is used, the above behavior can lead to +calling ip_local_out() for an IPv6 packet or calling +ip6_local_out() for an IPv4 packet, which is likely to fail. + +This change fixes the behavior by checking if the matched SA +has packet offload enabled. If not, keep the same behavior; +if yes, use the matched SP's family type for the lookup. + +Test: verified IPv6-in-IPv4 packets on Android device with + IPsec packet offload enabled +Signed-off-by: Mike Yu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index e69d588caa0c6..9c5f2efed3333 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2694,7 +2694,9 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, + if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m) + mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]); + +- family = xfrm[i]->props.family; ++ if (xfrm[i]->xso.type != XFRM_DEV_OFFLOAD_PACKET) ++ family = xfrm[i]->props.family; ++ + oif = fl->flowi_oif ? : fl->flowi_l3mdev; + dst = xfrm_dst_lookup(xfrm[i], tos, oif, + &saddr, &daddr, family, mark); +-- +2.43.0 + diff --git a/queue-6.7/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch b/queue-6.7/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch new file mode 100644 index 00000000000..60ee952ec74 --- /dev/null +++ b/queue-6.7/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch @@ -0,0 +1,45 @@ +From 0d939489f744f41a6e27c53b3412cb83ffdbc187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 12:24:09 +0000 +Subject: xfrm: set skb control buffer based on packet offload as well + +From: Mike Yu + +[ Upstream commit 8688ab2170a5be0bc922195f7091c38b506bab2e ] + +In packet offload, packets are not encrypted in XFRM stack, so +the next network layer which the packets will be forwarded to +should depend on where the packet came from (either xfrm4_output +or xfrm6_output) rather than the matched SA's family type. + +Test: verified IPv6-in-IPv4 packets on Android device with + IPsec packet offload enabled +Signed-off-by: Mike Yu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 662c83beb345e..e5722c95b8bb3 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -704,9 +704,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + { + struct net *net = dev_net(skb_dst(skb)->dev); + struct xfrm_state *x = skb_dst(skb)->xfrm; ++ int family; + int err; + +- switch (x->outer_mode.family) { ++ family = (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) ? x->outer_mode.family ++ : skb_dst(skb)->ops->family; ++ ++ switch (family) { + case AF_INET: + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; +-- +2.43.0 +