From: Sasha Levin Date: Sun, 7 Apr 2024 20:11:06 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v5.15.154~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ea78042b0918ee51021236b1c1485dd391d534e6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/9p-fix-read-write-debug-statements-to-report-server-.patch b/queue-6.6/9p-fix-read-write-debug-statements-to-report-server-.patch new file mode 100644 index 00000000000..3ee3a57bc33 --- /dev/null +++ b/queue-6.6/9p-fix-read-write-debug-statements-to-report-server-.patch @@ -0,0 +1,69 @@ +From 3fd640c01db9d01669c5184ae4bd572315f873c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 12:39:03 +0900 +Subject: 9p: Fix read/write debug statements to report server reply + +From: Dominique Martinet + +[ Upstream commit be3193e58ec210b2a72fb1134c2a0695088a911d ] + +Previous conversion to iov missed these debug statements which would now +always print the requested size instead of the actual server reply. + +Write also added a loop in a much older commit but we didn't report +these, while reads do report each iteration -- it's more coherent to +keep reporting all requests to server so move that at the same time. + +Fixes: 7f02464739da ("9p: convert to advancing variant of iov_iter_get_pages_alloc()") +Signed-off-by: Dominique Martinet +Message-ID: <20240109-9p-rw-trace-v1-1-327178114257@codewreck.org> +Signed-off-by: Sasha Levin +--- + net/9p/client.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/9p/client.c b/net/9p/client.c +index e265a0ca6bddd..f7e90b4769bba 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -1583,7 +1583,7 @@ p9_client_read_once(struct p9_fid *fid, u64 offset, struct iov_iter *to, + received = rsize; + } + +- p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", count); ++ p9_debug(P9_DEBUG_9P, "<<< RREAD count %d\n", received); + + if (non_zc) { + int n = copy_to_iter(dataptr, received, to); +@@ -1609,9 +1609,6 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) + int total = 0; + *err = 0; + +- p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %zd\n", +- fid->fid, offset, iov_iter_count(from)); +- + while (iov_iter_count(from)) { + int count = iov_iter_count(from); + int rsize = fid->iounit; +@@ -1623,6 +1620,9 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) + if (count < rsize) + rsize = count; + ++ p9_debug(P9_DEBUG_9P, ">>> TWRITE fid %d offset %llu count %d (/%d)\n", ++ fid->fid, offset, rsize, count); ++ + /* Don't bother zerocopy for small IO (< 1024) */ + if (clnt->trans_mod->zc_request && rsize > 1024) { + req = p9_client_zc_rpc(clnt, P9_TWRITE, NULL, from, 0, +@@ -1650,7 +1650,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err) + written = rsize; + } + +- p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count); ++ p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", written); + + p9_req_put(clnt, req); + iov_iter_revert(from, count - written - iov_iter_count(from)); +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-cs35l56-add-acpi-device-match-tables.patch b/queue-6.6/alsa-hda-cs35l56-add-acpi-device-match-tables.patch new file mode 100644 index 00000000000..85da2a94aa6 --- /dev/null +++ b/queue-6.6/alsa-hda-cs35l56-add-acpi-device-match-tables.patch @@ -0,0 +1,78 @@ +From 683a8077f54a254142f693f8c2a2de25cbbad260 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 12:13:55 +0000 +Subject: ALSA: hda: cs35l56: Add ACPI device match tables + +From: Simon Trimmer + +[ Upstream commit 2d0401ee38d43ab0e4cdd02dfc9d402befb2b5c8 ] + +Adding the ACPI HIDs to the match table triggers the cs35l56-hda modules +to be loaded on boot so that Serial Multi Instantiate can add the +devices to the bus and begin the driver init sequence. + +Signed-off-by: Simon Trimmer +Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier") +Message-ID: <20240328121355.18972-1-simont@opensource.cirrus.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda_i2c.c | 13 +++++++++++-- + sound/pci/hda/cs35l56_hda_spi.c | 13 +++++++++++-- + 2 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/sound/pci/hda/cs35l56_hda_i2c.c b/sound/pci/hda/cs35l56_hda_i2c.c +index 757a4d193e0fb..c31f60b0421e5 100644 +--- a/sound/pci/hda/cs35l56_hda_i2c.c ++++ b/sound/pci/hda/cs35l56_hda_i2c.c +@@ -49,10 +49,19 @@ static const struct i2c_device_id cs35l56_hda_i2c_id[] = { + {} + }; + ++static const struct acpi_device_id cs35l56_acpi_hda_match[] = { ++ { "CSC3554", 0 }, ++ { "CSC3556", 0 }, ++ { "CSC3557", 0 }, ++ {} ++}; ++MODULE_DEVICE_TABLE(acpi, cs35l56_acpi_hda_match); ++ + static struct i2c_driver cs35l56_hda_i2c_driver = { + .driver = { +- .name = "cs35l56-hda", +- .pm = &cs35l56_hda_pm_ops, ++ .name = "cs35l56-hda", ++ .acpi_match_table = cs35l56_acpi_hda_match, ++ .pm = &cs35l56_hda_pm_ops, + }, + .id_table = cs35l56_hda_i2c_id, + .probe = cs35l56_hda_i2c_probe, +diff --git a/sound/pci/hda/cs35l56_hda_spi.c b/sound/pci/hda/cs35l56_hda_spi.c +index 756aec342eab7..52c9e04b3c55f 100644 +--- a/sound/pci/hda/cs35l56_hda_spi.c ++++ b/sound/pci/hda/cs35l56_hda_spi.c +@@ -49,10 +49,19 @@ static const struct spi_device_id cs35l56_hda_spi_id[] = { + {} + }; + ++static const struct acpi_device_id cs35l56_acpi_hda_match[] = { ++ { "CSC3554", 0 }, ++ { "CSC3556", 0 }, ++ { "CSC3557", 0 }, ++ {} ++}; ++MODULE_DEVICE_TABLE(acpi, cs35l56_acpi_hda_match); ++ + static struct spi_driver cs35l56_hda_spi_driver = { + .driver = { +- .name = "cs35l56-hda", +- .pm = &cs35l56_hda_pm_ops, ++ .name = "cs35l56-hda", ++ .acpi_match_table = cs35l56_acpi_hda_match, ++ .pm = &cs35l56_hda_pm_ops, + }, + .id_table = cs35l56_hda_spi_id, + .probe = cs35l56_hda_spi_probe, +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-acp-fix-for-acp_init-function-error-handlin.patch b/queue-6.6/asoc-amd-acp-fix-for-acp_init-function-error-handlin.patch new file mode 100644 index 00000000000..aa0d29976b2 --- /dev/null +++ b/queue-6.6/asoc-amd-acp-fix-for-acp_init-function-error-handlin.patch @@ -0,0 +1,40 @@ +From ccbdea83babe2e0a83cdcaeb97f55426f7b4f1d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 11:08:12 +0530 +Subject: ASoC: amd: acp: fix for acp_init function error handling + +From: Vijendar Mukunda + +[ Upstream commit 2c603a4947a1247102ccb008d5eb6f37a4043c98 ] + +If acp_init() fails, acp pci driver probe should return error. +Add acp_init() function return value check logic. + +Fixes: e61b415515d3 ("ASoC: amd: acp: refactor the acp init and de-init sequence") +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20240329053815.2373979-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-pci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c +index a32c14a109b77..223238f662f83 100644 +--- a/sound/soc/amd/acp/acp-pci.c ++++ b/sound/soc/amd/acp/acp-pci.c +@@ -107,7 +107,10 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id + goto unregister_dmic_dev; + } + +- acp_init(chip); ++ ret = acp_init(chip); ++ if (ret) ++ goto unregister_dmic_dev; ++ + res = devm_kcalloc(&pci->dev, num_res, sizeof(struct resource), GFP_KERNEL); + if (!res) { + ret = -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/asoc-ops-fix-wraparound-for-mask-in-snd_soc_get_vols.patch b/queue-6.6/asoc-ops-fix-wraparound-for-mask-in-snd_soc_get_vols.patch new file mode 100644 index 00000000000..05e14ce9c44 --- /dev/null +++ b/queue-6.6/asoc-ops-fix-wraparound-for-mask-in-snd_soc_get_vols.patch @@ -0,0 +1,42 @@ +From 86bfec7f7a4082cd9402e307b6f88fee56183493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 18:01:31 -0700 +Subject: ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw + +From: Stephen Lee + +[ Upstream commit fc563aa900659a850e2ada4af26b9d7a3de6c591 ] + +In snd_soc_info_volsw(), mask is generated by figuring out the index of +the most significant bit set in max and converting the index to a +bitmask through bit shift 1. Unintended wraparound occurs when max is an +integer value with msb bit set. Since the bit shift value 1 is treated +as an integer type, the left shift operation will wraparound and set +mask to 0 instead of all 1's. In order to fix this, we type cast 1 as +`1ULL` to prevent the wraparound. + +Fixes: 7077148fb50a ("ASoC: core: Split ops out of soc-core.c") +Signed-off-by: Stephen Lee +Link: https://msgid.link/r/20240326010131.6211-1-slee08177@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index 2d25748ca7066..b27e89ff6a167 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -263,7 +263,7 @@ int snd_soc_get_volsw(struct snd_kcontrol *kcontrol, + int max = mc->max; + int min = mc->min; + int sign_bit = mc->sign_bit; +- unsigned int mask = (1 << fls(max)) - 1; ++ unsigned int mask = (1ULL << fls(max)) - 1; + unsigned int invert = mc->invert; + int val; + int ret; +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt5682-sdw-fix-locking-sequence.patch b/queue-6.6/asoc-rt5682-sdw-fix-locking-sequence.patch new file mode 100644 index 00000000000..0875d77d6ab --- /dev/null +++ b/queue-6.6/asoc-rt5682-sdw-fix-locking-sequence.patch @@ -0,0 +1,45 @@ +From 4cf017e6a4d994d4a99ed66d6cecf540535c6ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 17:18:12 -0500 +Subject: ASoC: rt5682-sdw: fix locking sequence + +From: Pierre-Louis Bossart + +[ Upstream commit 310a5caa4e861616a27a83c3e8bda17d65026fa8 ] + +The disable_irq_lock protects the 'disable_irq' value, we need to lock +before testing it. + +Fixes: 02fb23d72720 ("ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Chao Song +Link: https://msgid.link/r/20240325221817.206465-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index e67c2e19cb1a7..1fdbef5fd6cba 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -763,12 +763,12 @@ static int __maybe_unused rt5682_dev_resume(struct device *dev) + return 0; + + if (!slave->unattach_request) { ++ mutex_lock(&rt5682->disable_irq_lock); + if (rt5682->disable_irq == true) { +- mutex_lock(&rt5682->disable_irq_lock); + sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); + rt5682->disable_irq = false; +- mutex_unlock(&rt5682->disable_irq_lock); + } ++ mutex_unlock(&rt5682->disable_irq_lock); + goto regmap_sync; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt711-sdca-fix-locking-sequence.patch b/queue-6.6/asoc-rt711-sdca-fix-locking-sequence.patch new file mode 100644 index 00000000000..903c0ecc790 --- /dev/null +++ b/queue-6.6/asoc-rt711-sdca-fix-locking-sequence.patch @@ -0,0 +1,46 @@ +From 48456d696677e33992639c208b964f99231eb5bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 17:18:13 -0500 +Subject: ASoC: rt711-sdca: fix locking sequence + +From: Pierre-Louis Bossart + +[ Upstream commit ee287771644394d071e6a331951ee8079b64f9a7 ] + +The disable_irq_lock protects the 'disable_irq' value, we need to lock +before testing it. + +Fixes: 23adeb7056ac ("ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Chao Song +Link: https://msgid.link/r/20240325221817.206465-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdca-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt711-sdca-sdw.c b/sound/soc/codecs/rt711-sdca-sdw.c +index 935e597022d32..b8471b2d8f4f1 100644 +--- a/sound/soc/codecs/rt711-sdca-sdw.c ++++ b/sound/soc/codecs/rt711-sdca-sdw.c +@@ -438,13 +438,13 @@ static int __maybe_unused rt711_sdca_dev_resume(struct device *dev) + return 0; + + if (!slave->unattach_request) { ++ mutex_lock(&rt711->disable_irq_lock); + if (rt711->disable_irq == true) { +- mutex_lock(&rt711->disable_irq_lock); + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0); + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); + rt711->disable_irq = false; +- mutex_unlock(&rt711->disable_irq_lock); + } ++ mutex_unlock(&rt711->disable_irq_lock); + goto regmap_sync; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt711-sdw-fix-locking-sequence.patch b/queue-6.6/asoc-rt711-sdw-fix-locking-sequence.patch new file mode 100644 index 00000000000..b9d157f3ba3 --- /dev/null +++ b/queue-6.6/asoc-rt711-sdw-fix-locking-sequence.patch @@ -0,0 +1,45 @@ +From 10f70959e2f3b4cb550f5b7eda4a4e2b28cdcf51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 17:18:14 -0500 +Subject: ASoC: rt711-sdw: fix locking sequence + +From: Pierre-Louis Bossart + +[ Upstream commit aae86cfd8790bcc7693a5a0894df58de5cb5128c ] + +The disable_irq_lock protects the 'disable_irq' value, we need to lock +before testing it. + +Fixes: b69de265bd0e ("ASoC: rt711: fix for JD event handling in ClockStop Mode0") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Chao Song +Link: https://msgid.link/r/20240325221817.206465-4-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt711-sdw.c b/sound/soc/codecs/rt711-sdw.c +index 3f5773310ae8c..988451f24a756 100644 +--- a/sound/soc/codecs/rt711-sdw.c ++++ b/sound/soc/codecs/rt711-sdw.c +@@ -536,12 +536,12 @@ static int __maybe_unused rt711_dev_resume(struct device *dev) + return 0; + + if (!slave->unattach_request) { ++ mutex_lock(&rt711->disable_irq_lock); + if (rt711->disable_irq == true) { +- mutex_lock(&rt711->disable_irq_lock); + sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); + rt711->disable_irq = false; +- mutex_unlock(&rt711->disable_irq_lock); + } ++ mutex_unlock(&rt711->disable_irq_lock); + goto regmap_sync; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt712-sdca-sdw-fix-locking-sequence.patch b/queue-6.6/asoc-rt712-sdca-sdw-fix-locking-sequence.patch new file mode 100644 index 00000000000..376d27f4212 --- /dev/null +++ b/queue-6.6/asoc-rt712-sdca-sdw-fix-locking-sequence.patch @@ -0,0 +1,47 @@ +From 4b19b25e033276fc8cce2ae32a0ff6f160e52580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 17:18:15 -0500 +Subject: ASoC: rt712-sdca-sdw: fix locking sequence + +From: Pierre-Louis Bossart + +[ Upstream commit c8b2e5c1b959d100990e4f0cbad38e7d047bb97c ] + +The disable_irq_lock protects the 'disable_irq' value, we need to lock +before testing it. + +Fixes: 7a8735c1551e ("ASoC: rt712-sdca: fix for JD event handling in ClockStop Mode0") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Chao Song +Link: https://msgid.link/r/20240325221817.206465-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt712-sdca-sdw.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt712-sdca-sdw.c b/sound/soc/codecs/rt712-sdca-sdw.c +index 6b644a89c5890..ba877432cea61 100644 +--- a/sound/soc/codecs/rt712-sdca-sdw.c ++++ b/sound/soc/codecs/rt712-sdca-sdw.c +@@ -438,13 +438,14 @@ static int __maybe_unused rt712_sdca_dev_resume(struct device *dev) + return 0; + + if (!slave->unattach_request) { ++ mutex_lock(&rt712->disable_irq_lock); + if (rt712->disable_irq == true) { +- mutex_lock(&rt712->disable_irq_lock); ++ + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0); + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); + rt712->disable_irq = false; +- mutex_unlock(&rt712->disable_irq_lock); + } ++ mutex_unlock(&rt712->disable_irq_lock); + goto regmap_sync; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt722-sdca-sdw-fix-locking-sequence.patch b/queue-6.6/asoc-rt722-sdca-sdw-fix-locking-sequence.patch new file mode 100644 index 00000000000..c449bdd1b6f --- /dev/null +++ b/queue-6.6/asoc-rt722-sdca-sdw-fix-locking-sequence.patch @@ -0,0 +1,46 @@ +From 9203eaf81f462bfdd22e77a24ccd8c353f07f6fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 17:18:16 -0500 +Subject: ASoC: rt722-sdca-sdw: fix locking sequence + +From: Pierre-Louis Bossart + +[ Upstream commit adb354bbc231b23d3a05163ce35c1d598512ff64 ] + +The disable_irq_lock protects the 'disable_irq' value, we need to lock +before testing it. + +Fixes: a0b7c59ac1a9 ("ASoC: rt722-sdca: fix for JD event handling in ClockStop Mode0") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Chao Song +Link: https://msgid.link/r/20240325221817.206465-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c +index a38ec58622145..43a4e79e56966 100644 +--- a/sound/soc/codecs/rt722-sdca-sdw.c ++++ b/sound/soc/codecs/rt722-sdca-sdw.c +@@ -464,13 +464,13 @@ static int __maybe_unused rt722_sdca_dev_resume(struct device *dev) + return 0; + + if (!slave->unattach_request) { ++ mutex_lock(&rt722->disable_irq_lock); + if (rt722->disable_irq == true) { +- mutex_lock(&rt722->disable_irq_lock); + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_6); + sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); + rt722->disable_irq = false; +- mutex_unlock(&rt722->disable_irq_lock); + } ++ mutex_unlock(&rt722->disable_irq_lock); + goto regmap_sync; + } + +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-amd-fix-for-false-dsp-interrupts.patch b/queue-6.6/asoc-sof-amd-fix-for-false-dsp-interrupts.patch new file mode 100644 index 00000000000..c3f6f3a0f5d --- /dev/null +++ b/queue-6.6/asoc-sof-amd-fix-for-false-dsp-interrupts.patch @@ -0,0 +1,55 @@ +From 9befac1d38b6c7745f0be5cb3a0b32a8da771ae8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 09:47:13 +0530 +Subject: ASoC: SOF: amd: fix for false dsp interrupts + +From: Vijendar Mukunda + +[ Upstream commit b9846a386734e73a1414950ebfd50f04919f5e24 ] + +Before ACP firmware loading, DSP interrupts are not expected. +Sometimes after reboot, it's observed that before ACP firmware is loaded +false DSP interrupt is reported. +Registering the interrupt handler before acp initialization causing false +interrupts sometimes on reboot as ACP reset is not applied. +Correct the sequence by invoking acp initialization sequence prior to +registering interrupt handler. + +Fixes: 738a2b5e2cc9 ("ASoC: SOF: amd: Add IPC support for ACP IP block") +Signed-off-by: Vijendar Mukunda +Link: https://msgid.link/r/20240404041717.430545-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 4c54ce212de6a..cc006d7038d97 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -522,6 +522,10 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev) + goto unregister_dev; + } + ++ ret = acp_init(sdev); ++ if (ret < 0) ++ goto free_smn_dev; ++ + sdev->ipc_irq = pci->irq; + ret = request_threaded_irq(sdev->ipc_irq, acp_irq_handler, acp_irq_thread, + IRQF_SHARED, "AudioDSP", sdev); +@@ -531,10 +535,6 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev) + goto free_smn_dev; + } + +- ret = acp_init(sdev); +- if (ret < 0) +- goto free_ipc_irq; +- + sdev->dsp_box.offset = 0; + sdev->dsp_box.size = BOX_SIZE_512; + +-- +2.43.0 + diff --git a/queue-6.6/asoc-tas2781-mark-dvc_tlv-with-__maybe_unused.patch b/queue-6.6/asoc-tas2781-mark-dvc_tlv-with-__maybe_unused.patch new file mode 100644 index 00000000000..1662b2b4acb --- /dev/null +++ b/queue-6.6/asoc-tas2781-mark-dvc_tlv-with-__maybe_unused.patch @@ -0,0 +1,45 @@ +From 0221e56c87e6e6da9a7362f5758e60e39831401b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 23:47:37 +0100 +Subject: ASoC: tas2781: mark dvc_tlv with __maybe_unused + +From: Gergo Koteles + +[ Upstream commit 831ec5e3538e989c7995137b5c5c661991a09504 ] + +Since we put dvc_tlv static variable to a header file it's copied to +each module that includes the header. But not all of them are actually +used it. + +Fix this W=1 build warning: + +include/sound/tas2781-tlv.h:18:35: warning: 'dvc_tlv' defined but not +used [-Wunused-const-variable=] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202403290354.v0StnRpc-lkp@intel.com/ +Fixes: ae065d0ce9e3 ("ALSA: hda/tas2781: remove digital gain kcontrol") +Signed-off-by: Gergo Koteles +Message-ID: <0e461545a2a6e9b6152985143e50526322e5f76b.1711665731.git.soyer@irl.hu> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/tas2781-tlv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/sound/tas2781-tlv.h b/include/sound/tas2781-tlv.h +index 4038dd421150a..1dc59005d241f 100644 +--- a/include/sound/tas2781-tlv.h ++++ b/include/sound/tas2781-tlv.h +@@ -15,7 +15,7 @@ + #ifndef __TAS2781_TLV_H__ + #define __TAS2781_TLV_H__ + +-static const DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0); ++static const __maybe_unused DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0); + static const DECLARE_TLV_DB_SCALE(amp_vol_tlv, 1100, 50, 0); + + #endif +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm_adsp-fix-missing-mutex_lock-in-wm_adsp_write.patch b/queue-6.6/asoc-wm_adsp-fix-missing-mutex_lock-in-wm_adsp_write.patch new file mode 100644 index 00000000000..79cff562b4a --- /dev/null +++ b/queue-6.6/asoc-wm_adsp-fix-missing-mutex_lock-in-wm_adsp_write.patch @@ -0,0 +1,47 @@ +From 12908a3081c979fc2655db7d1112f8d0e63354de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:02:27 +0000 +Subject: ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() + +From: Richard Fitzgerald + +[ Upstream commit f193957b0fbbba397c8bddedf158b3bf7e4850fc ] + +wm_adsp_write_ctl() must hold the pwr_lock mutex when calling +cs_dsp_get_ctl(). + +This was previously partially fixed by commit 781118bc2fc1 +("ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()") +but this only put locking around the call to cs_dsp_coeff_write_ctrl(), +missing the call to cs_dsp_get_ctl(). + +Signed-off-by: Richard Fitzgerald +Fixes: 781118bc2fc1 ("ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()") +Link: https://msgid.link/r/20240307110227.41421-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 72b90a7ee4b68..b9c20e29fe63e 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -683,11 +683,12 @@ static void wm_adsp_control_remove(struct cs_dsp_coeff_ctl *cs_ctl) + int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type, + unsigned int alg, void *buf, size_t len) + { +- struct cs_dsp_coeff_ctl *cs_ctl = cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg); ++ struct cs_dsp_coeff_ctl *cs_ctl; + struct wm_coeff_ctl *ctl; + int ret; + + mutex_lock(&dsp->cs_dsp.pwr_lock); ++ cs_ctl = cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg); + ret = cs_dsp_coeff_write_ctrl(cs_ctl, 0, buf, len); + mutex_unlock(&dsp->cs_dsp.pwr_lock); + +-- +2.43.0 + diff --git a/queue-6.6/ata-sata_mv-fix-pci-device-id-table-declaration-comp.patch b/queue-6.6/ata-sata_mv-fix-pci-device-id-table-declaration-comp.patch new file mode 100644 index 00000000000..09b6c9be649 --- /dev/null +++ b/queue-6.6/ata-sata_mv-fix-pci-device-id-table-declaration-comp.patch @@ -0,0 +1,124 @@ +From f956324c2bbcc3afc8271dec28ddffbce936d9a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:06:48 +0200 +Subject: ata: sata_mv: Fix PCI device ID table declaration compilation warning + +From: Arnd Bergmann + +[ Upstream commit 3137b83a90646917c90951d66489db466b4ae106 ] + +Building with W=1 shows a warning for an unused variable when CONFIG_PCI +is diabled: + +drivers/ata/sata_mv.c:790:35: error: unused variable 'mv_pci_tbl' [-Werror,-Wunused-const-variable] +static const struct pci_device_id mv_pci_tbl[] = { + +Move the table into the same block that containsn the pci_driver +definition. + +Fixes: 7bb3c5290ca0 ("sata_mv: Remove PCI dependency") +Signed-off-by: Arnd Bergmann +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_mv.c | 63 +++++++++++++++++++++---------------------- + 1 file changed, 31 insertions(+), 32 deletions(-) + +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index 45e48d653c60b..80a45e11fb5b6 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -787,37 +787,6 @@ static const struct ata_port_info mv_port_info[] = { + }, + }; + +-static const struct pci_device_id mv_pci_tbl[] = { +- { PCI_VDEVICE(MARVELL, 0x5040), chip_504x }, +- { PCI_VDEVICE(MARVELL, 0x5041), chip_504x }, +- { PCI_VDEVICE(MARVELL, 0x5080), chip_5080 }, +- { PCI_VDEVICE(MARVELL, 0x5081), chip_508x }, +- /* RocketRAID 1720/174x have different identifiers */ +- { PCI_VDEVICE(TTI, 0x1720), chip_6042 }, +- { PCI_VDEVICE(TTI, 0x1740), chip_6042 }, +- { PCI_VDEVICE(TTI, 0x1742), chip_6042 }, +- +- { PCI_VDEVICE(MARVELL, 0x6040), chip_604x }, +- { PCI_VDEVICE(MARVELL, 0x6041), chip_604x }, +- { PCI_VDEVICE(MARVELL, 0x6042), chip_6042 }, +- { PCI_VDEVICE(MARVELL, 0x6080), chip_608x }, +- { PCI_VDEVICE(MARVELL, 0x6081), chip_608x }, +- +- { PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x }, +- +- /* Adaptec 1430SA */ +- { PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 }, +- +- /* Marvell 7042 support */ +- { PCI_VDEVICE(MARVELL, 0x7042), chip_7042 }, +- +- /* Highpoint RocketRAID PCIe series */ +- { PCI_VDEVICE(TTI, 0x2300), chip_7042 }, +- { PCI_VDEVICE(TTI, 0x2310), chip_7042 }, +- +- { } /* terminate list */ +-}; +- + static const struct mv_hw_ops mv5xxx_ops = { + .phy_errata = mv5_phy_errata, + .enable_leds = mv5_enable_leds, +@@ -4300,6 +4269,36 @@ static int mv_pci_init_one(struct pci_dev *pdev, + static int mv_pci_device_resume(struct pci_dev *pdev); + #endif + ++static const struct pci_device_id mv_pci_tbl[] = { ++ { PCI_VDEVICE(MARVELL, 0x5040), chip_504x }, ++ { PCI_VDEVICE(MARVELL, 0x5041), chip_504x }, ++ { PCI_VDEVICE(MARVELL, 0x5080), chip_5080 }, ++ { PCI_VDEVICE(MARVELL, 0x5081), chip_508x }, ++ /* RocketRAID 1720/174x have different identifiers */ ++ { PCI_VDEVICE(TTI, 0x1720), chip_6042 }, ++ { PCI_VDEVICE(TTI, 0x1740), chip_6042 }, ++ { PCI_VDEVICE(TTI, 0x1742), chip_6042 }, ++ ++ { PCI_VDEVICE(MARVELL, 0x6040), chip_604x }, ++ { PCI_VDEVICE(MARVELL, 0x6041), chip_604x }, ++ { PCI_VDEVICE(MARVELL, 0x6042), chip_6042 }, ++ { PCI_VDEVICE(MARVELL, 0x6080), chip_608x }, ++ { PCI_VDEVICE(MARVELL, 0x6081), chip_608x }, ++ ++ { PCI_VDEVICE(ADAPTEC2, 0x0241), chip_604x }, ++ ++ /* Adaptec 1430SA */ ++ { PCI_VDEVICE(ADAPTEC2, 0x0243), chip_7042 }, ++ ++ /* Marvell 7042 support */ ++ { PCI_VDEVICE(MARVELL, 0x7042), chip_7042 }, ++ ++ /* Highpoint RocketRAID PCIe series */ ++ { PCI_VDEVICE(TTI, 0x2300), chip_7042 }, ++ { PCI_VDEVICE(TTI, 0x2310), chip_7042 }, ++ ++ { } /* terminate list */ ++}; + + static struct pci_driver mv_pci_driver = { + .name = DRV_NAME, +@@ -4312,6 +4311,7 @@ static struct pci_driver mv_pci_driver = { + #endif + + }; ++MODULE_DEVICE_TABLE(pci, mv_pci_tbl); + + /** + * mv_print_info - Dump key info to kernel log for perusal. +@@ -4484,7 +4484,6 @@ static void __exit mv_exit(void) + MODULE_AUTHOR("Brett Russ"); + MODULE_DESCRIPTION("SCSI low-level driver for Marvell SATA controllers"); + MODULE_LICENSE("GPL v2"); +-MODULE_DEVICE_TABLE(pci, mv_pci_tbl); + MODULE_VERSION(DRV_VERSION); + MODULE_ALIAS("platform:" DRV_NAME); + +-- +2.43.0 + diff --git a/queue-6.6/ata-sata_sx4-fix-pdc20621_get_from_dimm-on-64-bit.patch b/queue-6.6/ata-sata_sx4-fix-pdc20621_get_from_dimm-on-64-bit.patch new file mode 100644 index 00000000000..35bca93a14b --- /dev/null +++ b/queue-6.6/ata-sata_sx4-fix-pdc20621_get_from_dimm-on-64-bit.patch @@ -0,0 +1,71 @@ +From f011e9d384e282927704b1249e857b3c87f6bcb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 15:53:37 +0100 +Subject: ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit + +From: Arnd Bergmann + +[ Upstream commit 52f80bb181a9a1530ade30bc18991900bbb9697f ] + +gcc warns about a memcpy() with overlapping pointers because of an +incorrect size calculation: + +In file included from include/linux/string.h:369, + from drivers/ata/sata_sx4.c:66: +In function 'memcpy_fromio', + inlined from 'pdc20621_get_from_dimm.constprop' at drivers/ata/sata_sx4.c:962:2: +include/linux/fortify-string.h:97:33: error: '__builtin_memcpy' accessing 4294934464 bytes at offsets 0 and [16, 16400] overlaps 6442385281 bytes at offset -2147450817 [-Werror=restrict] + 97 | #define __underlying_memcpy __builtin_memcpy + | ^ +include/linux/fortify-string.h:620:9: note: in expansion of macro '__underlying_memcpy' + 620 | __underlying_##op(p, q, __fortify_size); \ + | ^~~~~~~~~~~~~ +include/linux/fortify-string.h:665:26: note: in expansion of macro '__fortify_memcpy_chk' + 665 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ + | ^~~~~~~~~~~~~~~~~~~~ +include/asm-generic/io.h:1184:9: note: in expansion of macro 'memcpy' + 1184 | memcpy(buffer, __io_virt(addr), size); + | ^~~~~~ + +The problem here is the overflow of an unsigned 32-bit number to a +negative that gets converted into a signed 'long', keeping a large +positive number. + +Replace the complex calculation with a more readable min() variant +that avoids the warning. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Arnd Bergmann +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_sx4.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c +index b51d7a9d0d90c..a482741eb181f 100644 +--- a/drivers/ata/sata_sx4.c ++++ b/drivers/ata/sata_sx4.c +@@ -957,8 +957,7 @@ static void pdc20621_get_from_dimm(struct ata_host *host, void *psource, + + offset -= (idx * window_size); + idx++; +- dist = ((long) (window_size - (offset + size))) >= 0 ? size : +- (long) (window_size - offset); ++ dist = min(size, window_size - offset); + memcpy_fromio(psource, dimm_mmio + offset / 4, dist); + + psource += dist; +@@ -1005,8 +1004,7 @@ static void pdc20621_put_to_dimm(struct ata_host *host, void *psource, + readl(mmio + PDC_DIMM_WINDOW_CTLR); + offset -= (idx * window_size); + idx++; +- dist = ((long)(s32)(window_size - (offset + size))) >= 0 ? size : +- (long) (window_size - offset); ++ dist = min(size, window_size - offset); + memcpy_toio(dimm_mmio + offset / 4, psource, dist); + writel(0x01, mmio + PDC_GENERAL_CTLR); + readl(mmio + PDC_GENERAL_CTLR); +-- +2.43.0 + diff --git a/queue-6.6/cifs-fix-caching-to-try-to-do-open-o_wronly-as-rdwr-.patch b/queue-6.6/cifs-fix-caching-to-try-to-do-open-o_wronly-as-rdwr-.patch new file mode 100644 index 00000000000..a6f5a6e8c7b --- /dev/null +++ b/queue-6.6/cifs-fix-caching-to-try-to-do-open-o_wronly-as-rdwr-.patch @@ -0,0 +1,251 @@ +From ced4ea8bf72fa926e265aeb27070ec1ddbda96f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 10:11:35 +0100 +Subject: cifs: Fix caching to try to do open O_WRONLY as rdwr on server + +From: David Howells + +[ Upstream commit e9e62243a3e2322cf639f653a0b0a88a76446ce7 ] + +When we're engaged in local caching of a cifs filesystem, we cannot perform +caching of a partially written cache granule unless we can read the rest of +the granule. This can result in unexpected access errors being reported to +the user. + +Fix this by the following: if a file is opened O_WRONLY locally, but the +mount was given the "-o fsc" flag, try first opening the remote file with +GENERIC_READ|GENERIC_WRITE and if that returns -EACCES, try dropping the +GENERIC_READ and doing the open again. If that last succeeds, invalidate +the cache for that file as for O_DIRECT. + +Fixes: 70431bfd825d ("cifs: Support fscache indexing rewrite") +Signed-off-by: David Howells +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/dir.c | 15 +++++++++++++ + fs/smb/client/file.c | 48 ++++++++++++++++++++++++++++++++--------- + fs/smb/client/fscache.h | 6 ++++++ + 3 files changed, 59 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/client/dir.c b/fs/smb/client/dir.c +index 580a27a3a7e62..855468a32904e 100644 +--- a/fs/smb/client/dir.c ++++ b/fs/smb/client/dir.c +@@ -189,6 +189,7 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + int disposition; + struct TCP_Server_Info *server = tcon->ses->server; + struct cifs_open_parms oparms; ++ int rdwr_for_fscache = 0; + + *oplock = 0; + if (tcon->ses->server->oplocks) +@@ -200,6 +201,10 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + return PTR_ERR(full_path); + } + ++ /* If we're caching, we need to be able to fill in around partial writes. */ ++ if (cifs_fscache_enabled(inode) && (oflags & O_ACCMODE) == O_WRONLY) ++ rdwr_for_fscache = 1; ++ + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + if (tcon->unix_ext && cap_unix(tcon->ses) && !tcon->broken_posix_open && + (CIFS_UNIX_POSIX_PATH_OPS_CAP & +@@ -276,6 +281,8 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + desired_access |= GENERIC_READ; /* is this too little? */ + if (OPEN_FMODE(oflags) & FMODE_WRITE) + desired_access |= GENERIC_WRITE; ++ if (rdwr_for_fscache == 1) ++ desired_access |= GENERIC_READ; + + disposition = FILE_OVERWRITE_IF; + if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) +@@ -304,6 +311,7 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + if (!tcon->unix_ext && (mode & S_IWUGO) == 0) + create_options |= CREATE_OPTION_READONLY; + ++retry_open: + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, +@@ -317,8 +325,15 @@ static int cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned + rc = server->ops->open(xid, &oparms, oplock, buf); + if (rc) { + cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc); ++ if (rc == -EACCES && rdwr_for_fscache == 1) { ++ desired_access &= ~GENERIC_READ; ++ rdwr_for_fscache = 2; ++ goto retry_open; ++ } + goto out; + } ++ if (rdwr_for_fscache == 2) ++ cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE); + + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + /* +diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c +index c711d5eb2987e..606972a95465b 100644 +--- a/fs/smb/client/file.c ++++ b/fs/smb/client/file.c +@@ -206,12 +206,12 @@ cifs_mark_open_files_invalid(struct cifs_tcon *tcon) + */ + } + +-static inline int cifs_convert_flags(unsigned int flags) ++static inline int cifs_convert_flags(unsigned int flags, int rdwr_for_fscache) + { + if ((flags & O_ACCMODE) == O_RDONLY) + return GENERIC_READ; + else if ((flags & O_ACCMODE) == O_WRONLY) +- return GENERIC_WRITE; ++ return rdwr_for_fscache == 1 ? (GENERIC_READ | GENERIC_WRITE) : GENERIC_WRITE; + else if ((flags & O_ACCMODE) == O_RDWR) { + /* GENERIC_ALL is too much permission to request + can cause unnecessary access denied on create */ +@@ -348,11 +348,16 @@ static int cifs_nt_open(const char *full_path, struct inode *inode, struct cifs_ + int create_options = CREATE_NOT_DIR; + struct TCP_Server_Info *server = tcon->ses->server; + struct cifs_open_parms oparms; ++ int rdwr_for_fscache = 0; + + if (!server->ops->open) + return -ENOSYS; + +- desired_access = cifs_convert_flags(f_flags); ++ /* If we're caching, we need to be able to fill in around partial writes. */ ++ if (cifs_fscache_enabled(inode) && (f_flags & O_ACCMODE) == O_WRONLY) ++ rdwr_for_fscache = 1; ++ ++ desired_access = cifs_convert_flags(f_flags, rdwr_for_fscache); + + /********************************************************************* + * open flag mapping table: +@@ -389,6 +394,7 @@ static int cifs_nt_open(const char *full_path, struct inode *inode, struct cifs_ + if (f_flags & O_DIRECT) + create_options |= CREATE_NO_BUFFER; + ++retry_open: + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, +@@ -400,8 +406,16 @@ static int cifs_nt_open(const char *full_path, struct inode *inode, struct cifs_ + }; + + rc = server->ops->open(xid, &oparms, oplock, buf); +- if (rc) ++ if (rc) { ++ if (rc == -EACCES && rdwr_for_fscache == 1) { ++ desired_access = cifs_convert_flags(f_flags, 0); ++ rdwr_for_fscache = 2; ++ goto retry_open; ++ } + return rc; ++ } ++ if (rdwr_for_fscache == 2) ++ cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE); + + /* TODO: Add support for calling posix query info but with passing in fid */ + if (tcon->unix_ext) +@@ -834,11 +848,11 @@ int cifs_open(struct inode *inode, struct file *file) + use_cache: + fscache_use_cookie(cifs_inode_cookie(file_inode(file)), + file->f_mode & FMODE_WRITE); +- if (file->f_flags & O_DIRECT && +- (!((file->f_flags & O_ACCMODE) != O_RDONLY) || +- file->f_flags & O_APPEND)) +- cifs_invalidate_cache(file_inode(file), +- FSCACHE_INVAL_DIO_WRITE); ++ if (!(file->f_flags & O_DIRECT)) ++ goto out; ++ if ((file->f_flags & (O_ACCMODE | O_APPEND)) == O_RDONLY) ++ goto out; ++ cifs_invalidate_cache(file_inode(file), FSCACHE_INVAL_DIO_WRITE); + + out: + free_dentry_path(page); +@@ -903,6 +917,7 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + int disposition = FILE_OPEN; + int create_options = CREATE_NOT_DIR; + struct cifs_open_parms oparms; ++ int rdwr_for_fscache = 0; + + xid = get_xid(); + mutex_lock(&cfile->fh_mutex); +@@ -966,7 +981,11 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + } + #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ + +- desired_access = cifs_convert_flags(cfile->f_flags); ++ /* If we're caching, we need to be able to fill in around partial writes. */ ++ if (cifs_fscache_enabled(inode) && (cfile->f_flags & O_ACCMODE) == O_WRONLY) ++ rdwr_for_fscache = 1; ++ ++ desired_access = cifs_convert_flags(cfile->f_flags, rdwr_for_fscache); + + /* O_SYNC also has bit for O_DSYNC so following check picks up either */ + if (cfile->f_flags & O_SYNC) +@@ -978,6 +997,7 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + ++retry_open: + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, +@@ -1003,6 +1023,11 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + /* indicate that we need to relock the file */ + oparms.reconnect = true; + } ++ if (rc == -EACCES && rdwr_for_fscache == 1) { ++ desired_access = cifs_convert_flags(cfile->f_flags, 0); ++ rdwr_for_fscache = 2; ++ goto retry_open; ++ } + + if (rc) { + mutex_unlock(&cfile->fh_mutex); +@@ -1011,6 +1036,9 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) + goto reopen_error_exit; + } + ++ if (rdwr_for_fscache == 2) ++ cifs_invalidate_cache(inode, FSCACHE_INVAL_DIO_WRITE); ++ + #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY + reopen_success: + #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */ +diff --git a/fs/smb/client/fscache.h b/fs/smb/client/fscache.h +index a3d73720914f8..1f2ea9f5cc9a8 100644 +--- a/fs/smb/client/fscache.h ++++ b/fs/smb/client/fscache.h +@@ -109,6 +109,11 @@ static inline void cifs_readahead_to_fscache(struct inode *inode, + __cifs_readahead_to_fscache(inode, pos, len); + } + ++static inline bool cifs_fscache_enabled(struct inode *inode) ++{ ++ return fscache_cookie_enabled(cifs_inode_cookie(inode)); ++} ++ + #else /* CONFIG_CIFS_FSCACHE */ + static inline + void cifs_fscache_fill_coherency(struct inode *inode, +@@ -124,6 +129,7 @@ static inline void cifs_fscache_release_inode_cookie(struct inode *inode) {} + static inline void cifs_fscache_unuse_inode_cookie(struct inode *inode, bool update) {} + static inline struct fscache_cookie *cifs_inode_cookie(struct inode *inode) { return NULL; } + static inline void cifs_invalidate_cache(struct inode *inode, unsigned int flags) {} ++static inline bool cifs_fscache_enabled(struct inode *inode) { return false; } + + static inline int cifs_fscache_query_occupancy(struct inode *inode, + pgoff_t first, unsigned int nr_pages, +-- +2.43.0 + diff --git a/queue-6.6/drivers-perf-riscv-disable-perf_sample_branch_-while.patch b/queue-6.6/drivers-perf-riscv-disable-perf_sample_branch_-while.patch new file mode 100644 index 00000000000..1086aa71fd9 --- /dev/null +++ b/queue-6.6/drivers-perf-riscv-disable-perf_sample_branch_-while.patch @@ -0,0 +1,45 @@ +From d71a39d2ed9c2646aff2590b4f7591aa24957f58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 01:20:53 +0000 +Subject: drivers/perf: riscv: Disable PERF_SAMPLE_BRANCH_* while not supported + +From: Pu Lehui + +[ Upstream commit ea6873118493019474abbf57d5a800da365734df ] + +RISC-V perf driver does not yet support branch sampling. Although the +specification is in the works [0], it is best to disable such events +until support is available, otherwise we will get unexpected results. +Due to this reason, two riscv bpf testcases get_branch_snapshot and +perf_branches/perf_branches_hw fail. + +Link: https://github.com/riscv/riscv-control-transfer-records [0] +Fixes: f5bfa23f576f ("RISC-V: Add a perf core library for pmu drivers") +Signed-off-by: Pu Lehui +Reviewed-by: Atish Patra +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20240312012053.1178140-1-pulehui@huaweicloud.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + drivers/perf/riscv_pmu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/perf/riscv_pmu.c b/drivers/perf/riscv_pmu.c +index c78a6fd6c57f6..b4efdddb2ad91 100644 +--- a/drivers/perf/riscv_pmu.c ++++ b/drivers/perf/riscv_pmu.c +@@ -313,6 +313,10 @@ static int riscv_pmu_event_init(struct perf_event *event) + u64 event_config = 0; + uint64_t cmask; + ++ /* driver does not support branch stack sampling */ ++ if (has_branch_stack(event)) ++ return -EOPNOTSUPP; ++ + hwc->flags = 0; + mapped_event = rvpmu->event_map(event, &event_config); + if (mapped_event < 0) { +-- +2.43.0 + diff --git a/queue-6.6/drm-panfrost-fix-power-transition-timeout-warnings.patch b/queue-6.6/drm-panfrost-fix-power-transition-timeout-warnings.patch new file mode 100644 index 00000000000..e416feb0559 --- /dev/null +++ b/queue-6.6/drm-panfrost-fix-power-transition-timeout-warnings.patch @@ -0,0 +1,66 @@ +From 69ee0ff547654816a752e8a07be05ace19a0f90a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 16:45:25 +0000 +Subject: drm/panfrost: fix power transition timeout warnings + +From: Christian Hewitt + +[ Upstream commit 2bd02f5a0bac4bb13e0da18652dc75ba0e4958ec ] + +Increase the timeout value to prevent system logs on Amlogic boards flooding +with power transition warnings: + +[ 13.047638] panfrost ffe40000.gpu: shader power transition timeout +[ 13.048674] panfrost ffe40000.gpu: l2 power transition timeout +[ 13.937324] panfrost ffe40000.gpu: shader power transition timeout +[ 13.938351] panfrost ffe40000.gpu: l2 power transition timeout +... +[39829.506904] panfrost ffe40000.gpu: shader power transition timeout +[39829.507938] panfrost ffe40000.gpu: l2 power transition timeout +[39949.508369] panfrost ffe40000.gpu: shader power transition timeout +[39949.509405] panfrost ffe40000.gpu: l2 power transition timeout + +The 2000 value has been found through trial and error testing with devices +using G52 and G31 GPUs. + +Fixes: 22aa1a209018 ("drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()") +Signed-off-by: Christian Hewitt +Reviewed-by: Steven Price +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20240322164525.2617508-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index eca45b83e4e67..c067ff550692a 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -387,19 +387,19 @@ void panfrost_gpu_power_off(struct panfrost_device *pfdev) + + gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present); + ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO, +- val, !val, 1, 1000); ++ val, !val, 1, 2000); + if (ret) + dev_err(pfdev->dev, "shader power transition timeout"); + + gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present); + ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO, +- val, !val, 1, 1000); ++ val, !val, 1, 2000); + if (ret) + dev_err(pfdev->dev, "tiler power transition timeout"); + + gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present); + ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO, +- val, !val, 0, 1000); ++ val, !val, 0, 2000); + if (ret) + dev_err(pfdev->dev, "l2 power transition timeout"); + } +-- +2.43.0 + diff --git a/queue-6.6/drm-prime-unbreak-virtgpu-dma-buf-export.patch b/queue-6.6/drm-prime-unbreak-virtgpu-dma-buf-export.patch new file mode 100644 index 00000000000..6b8c11bb94c --- /dev/null +++ b/queue-6.6/drm-prime-unbreak-virtgpu-dma-buf-export.patch @@ -0,0 +1,46 @@ +From 8634e267618934601c87bcfcd6a3fe2fb3973d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2024 14:48:01 -0700 +Subject: drm/prime: Unbreak virtgpu dma-buf export + +From: Rob Clark + +[ Upstream commit a4ec240f6b7c21cf846d10017c3ce423a0eae92c ] + +virtgpu "vram" GEM objects do not implement obj->get_sg_table(). But +they also don't use drm_gem_map_dma_buf(). In fact they may not even +have guest visible pages. But it is perfectly fine to export and share +with other virtual devices. + +Reported-by: Dominik Behr +Fixes: 207395da5a97 ("drm/prime: reject DMA-BUF attach when get_sg_table is missing") +Signed-off-by: Rob Clark +Reviewed-by: Simon Ser +Signed-off-by: Simon Ser +Link: https://patchwork.freedesktop.org/patch/msgid/20240322214801.319975-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_prime.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c +index 7352bde299d54..03bd3c7bd0dc2 100644 +--- a/drivers/gpu/drm/drm_prime.c ++++ b/drivers/gpu/drm/drm_prime.c +@@ -582,7 +582,12 @@ int drm_gem_map_attach(struct dma_buf *dma_buf, + { + struct drm_gem_object *obj = dma_buf->priv; + +- if (!obj->funcs->get_sg_table) ++ /* ++ * drm_gem_map_dma_buf() requires obj->get_sg_table(), but drivers ++ * that implement their own ->map_dma_buf() do not. ++ */ ++ if (dma_buf->ops->map_dma_buf == drm_gem_map_dma_buf && ++ !obj->funcs->get_sg_table) + return -ENOSYS; + + return drm_gem_pin(obj); +-- +2.43.0 + diff --git a/queue-6.6/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch b/queue-6.6/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch new file mode 100644 index 00000000000..9e3e6337359 --- /dev/null +++ b/queue-6.6/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch @@ -0,0 +1,74 @@ +From d15cf81e82c6abf559bec243d5de7ae8f6ebf9f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 16:08:22 +0100 +Subject: fs/pipe: Fix lockdep false-positive in watchqueue pipe_write() + +From: Jann Horn + +[ Upstream commit 055ca83559912f2cfd91c9441427bac4caf3c74e ] + +When you try to splice between a normal pipe and a notification pipe, +get_pipe_info(..., true) fails, so splice() falls back to treating the +notification pipe like a normal pipe - so we end up in +iter_file_splice_write(), which first locks the input pipe, then calls +vfs_iter_write(), which locks the output pipe. + +Lockdep complains about that, because we're taking a pipe lock while +already holding another pipe lock. + +I think this probably (?) can't actually lead to deadlocks, since you'd +need another way to nest locking a normal pipe into locking a +watch_queue pipe, but the lockdep annotations don't make that clear. + +Bail out earlier in pipe_write() for notification pipes, before taking +the pipe lock. + +Reported-and-tested-by: +Closes: https://syzkaller.appspot.com/bug?extid=011e4ea1da6692cf881c +Fixes: c73be61cede5 ("pipe: Add general notification queue support") +Signed-off-by: Jann Horn +Link: https://lore.kernel.org/r/20231124150822.2121798-1-jannh@google.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/pipe.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/fs/pipe.c b/fs/pipe.c +index a234035cc375d..ba4376341ddd2 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -425,6 +425,18 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + bool was_empty = false; + bool wake_next_writer = false; + ++ /* ++ * Reject writing to watch queue pipes before the point where we lock ++ * the pipe. ++ * Otherwise, lockdep would be unhappy if the caller already has another ++ * pipe locked. ++ * If we had to support locking a normal pipe and a notification pipe at ++ * the same time, we could set up lockdep annotations for that, but ++ * since we don't actually need that, it's simpler to just bail here. ++ */ ++ if (pipe_has_watch_queue(pipe)) ++ return -EXDEV; ++ + /* Null write succeeds. */ + if (unlikely(total_len == 0)) + return 0; +@@ -437,11 +449,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + goto out; + } + +- if (pipe_has_watch_queue(pipe)) { +- ret = -EXDEV; +- goto out; +- } +- + /* + * If it wasn't empty we try to merge new data into + * the last buffer. +-- +2.43.0 + diff --git a/queue-6.6/nfsd-hold-a-lighter-weight-client-reference-over-cb_.patch b/queue-6.6/nfsd-hold-a-lighter-weight-client-reference-over-cb_.patch new file mode 100644 index 00000000000..fcd4e92ab47 --- /dev/null +++ b/queue-6.6/nfsd-hold-a-lighter-weight-client-reference-over-cb_.patch @@ -0,0 +1,65 @@ +From 087f54e85c2f0f44ad0049777df34351b6980d9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 13:56:18 -0400 +Subject: nfsd: hold a lighter-weight client reference over CB_RECALL_ANY + +From: Jeff Layton + +[ Upstream commit 10396f4df8b75ff6ab0aa2cd74296565466f2c8d ] + +Currently the CB_RECALL_ANY job takes a cl_rpc_users reference to the +client. While a callback job is technically an RPC that counter is +really more for client-driven RPCs, and this has the effect of +preventing the client from being unhashed until the callback completes. + +If nfsd decides to send a CB_RECALL_ANY just as the client reboots, we +can end up in a situation where the callback can't complete on the (now +dead) callback channel, but the new client can't connect because the old +client can't be unhashed. This usually manifests as a NFS4ERR_DELAY +return on the CREATE_SESSION operation. + +The job is only holding a reference to the client so it can clear a flag +after the RPC completes. Fix this by having CB_RECALL_ANY instead hold a +reference to the cl_nfsdfs.cl_ref. Typically we only take that sort of +reference when dealing with the nfsdfs info files, but it should work +appropriately here to ensure that the nfs4_client doesn't disappear. + +Fixes: 44df6f439a17 ("NFSD: add delegation reaper to react to low memory condition") +Reported-by: Vladimir Benes +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 522596060252f..c7e52d980cd75 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -2886,12 +2886,9 @@ static void + nfsd4_cb_recall_any_release(struct nfsd4_callback *cb) + { + struct nfs4_client *clp = cb->cb_clp; +- struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id); + +- spin_lock(&nn->client_lock); + clear_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags); +- put_client_renew_locked(clp); +- spin_unlock(&nn->client_lock); ++ drop_client(clp); + } + + static const struct nfsd4_callback_ops nfsd4_cb_recall_any_ops = { +@@ -6273,7 +6270,7 @@ deleg_reaper(struct nfsd_net *nn) + list_add(&clp->cl_ra_cblist, &cblist); + + /* release in nfsd4_cb_recall_any_release */ +- atomic_inc(&clp->cl_rpc_users); ++ kref_get(&clp->cl_nfsdfs.cl_ref); + set_bit(NFSD4_CLIENT_CB_RECALL_ANY, &clp->cl_flags); + clp->cl_ra_time = ktime_get_boottime_seconds(); + } +-- +2.43.0 + diff --git a/queue-6.6/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch b/queue-6.6/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch new file mode 100644 index 00000000000..7f053cf3a1a --- /dev/null +++ b/queue-6.6/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch @@ -0,0 +1,58 @@ +From d9e797cd969e8d1f752ae5848eaebaa331622171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 12:43:16 +1000 +Subject: nouveau/uvmm: fix addr/range calcs for remap operations + +From: Dave Airlie + +[ Upstream commit be141849ec00ef39935bf169c0f194ac70bf85ce ] + +dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 +was causing a remap operation like the below. + +op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 +op_remap: next: +op_remap: unmap: 0000003fffed0000 0000000000100000 0 +op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000 + +This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 +which was corrupting the pagetables and oopsing the kernel. + +Fixes the prev + unmap range calcs to use start/end and map back to addr/range. + +Signed-off-by: Dave Airlie +Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") +Cc: Danilo Krummrich +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240328024317.2041851-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouveau/nouveau_uvmm.c +index aae780e4a4aa3..2bbcdc649e862 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c +@@ -804,15 +804,15 @@ op_remap(struct drm_gpuva_op_remap *r, + struct drm_gpuva_op_unmap *u = r->unmap; + struct nouveau_uvma *uvma = uvma_from_va(u->va); + u64 addr = uvma->va.va.addr; +- u64 range = uvma->va.va.range; ++ u64 end = uvma->va.va.addr + uvma->va.va.range; + + if (r->prev) + addr = r->prev->va.addr + r->prev->va.range; + + if (r->next) +- range = r->next->va.addr - addr; ++ end = r->next->va.addr; + +- op_unmap_range(u, addr, range); ++ op_unmap_range(u, addr, end - addr); + } + + static int +-- +2.43.0 + diff --git a/queue-6.6/regmap-maple-fix-cache-corruption-in-regcache_maple_.patch b/queue-6.6/regmap-maple-fix-cache-corruption-in-regcache_maple_.patch new file mode 100644 index 00000000000..c99a1fabba9 --- /dev/null +++ b/queue-6.6/regmap-maple-fix-cache-corruption-in-regcache_maple_.patch @@ -0,0 +1,45 @@ +From 36a80e0fd2a330ce0cb25f16c52156087805b22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 11:44:06 +0000 +Subject: regmap: maple: Fix cache corruption in regcache_maple_drop() + +From: Richard Fitzgerald + +[ Upstream commit 00bb549d7d63a21532e76e4a334d7807a54d9f31 ] + +When keeping the upper end of a cache block entry, the entry[] array +must be indexed by the offset from the base register of the block, +i.e. max - mas.index. + +The code was indexing entry[] by only the register address, leading +to an out-of-bounds access that copied some part of the kernel +memory over the cache contents. + +This bug was not detected by the regmap KUnit test because it only +tests with a block of registers starting at 0, so mas.index == 0. + +Signed-off-by: Richard Fitzgerald +Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache") +Link: https://msgid.link/r/20240327114406.976986-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regcache-maple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c +index 41edd6a430eb4..c1776127a5724 100644 +--- a/drivers/base/regmap/regcache-maple.c ++++ b/drivers/base/regmap/regcache-maple.c +@@ -145,7 +145,7 @@ static int regcache_maple_drop(struct regmap *map, unsigned int min, + upper_index = max + 1; + upper_last = mas.last; + +- upper = kmemdup(&entry[max + 1], ++ upper = kmemdup(&entry[max - mas.index + 1], + ((mas.last - max) * + sizeof(unsigned long)), + map->alloc_flags); +-- +2.43.0 + diff --git a/queue-6.6/regmap-maple-fix-uninitialized-symbol-ret-warnings.patch b/queue-6.6/regmap-maple-fix-uninitialized-symbol-ret-warnings.patch new file mode 100644 index 00000000000..08ea84696e7 --- /dev/null +++ b/queue-6.6/regmap-maple-fix-uninitialized-symbol-ret-warnings.patch @@ -0,0 +1,51 @@ +From 6c9a1144a9c09a304e1155e595abdbaf91a74e69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 14:46:30 +0000 +Subject: regmap: maple: Fix uninitialized symbol 'ret' warnings + +From: Richard Fitzgerald + +[ Upstream commit eaa03486d932572dfd1c5f64f9dfebe572ad88c0 ] + +Fix warnings reported by smatch by initializing local 'ret' variable +to 0. + +drivers/base/regmap/regcache-maple.c:186 regcache_maple_drop() +error: uninitialized symbol 'ret'. +drivers/base/regmap/regcache-maple.c:290 regcache_maple_sync() +error: uninitialized symbol 'ret'. + +Signed-off-by: Richard Fitzgerald +Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache") +Link: https://lore.kernel.org/r/20240329144630.1965159-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regcache-maple.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regcache-maple.c b/drivers/base/regmap/regcache-maple.c +index c1776127a5724..55999a50ccc0b 100644 +--- a/drivers/base/regmap/regcache-maple.c ++++ b/drivers/base/regmap/regcache-maple.c +@@ -112,7 +112,7 @@ static int regcache_maple_drop(struct regmap *map, unsigned int min, + unsigned long *entry, *lower, *upper; + unsigned long lower_index, lower_last; + unsigned long upper_index, upper_last; +- int ret; ++ int ret = 0; + + lower = NULL; + upper = NULL; +@@ -244,7 +244,7 @@ static int regcache_maple_sync(struct regmap *map, unsigned int min, + unsigned long lmin = min; + unsigned long lmax = max; + unsigned int r, v, sync_start; +- int ret; ++ int ret = 0; + bool sync_needed = false; + + map->cache_bypass = true; +-- +2.43.0 + diff --git a/queue-6.6/revert-alsa-emu10k1-fix-synthesizer-sample-playback-.patch b/queue-6.6/revert-alsa-emu10k1-fix-synthesizer-sample-playback-.patch new file mode 100644 index 00000000000..f8f5a6034d1 --- /dev/null +++ b/queue-6.6/revert-alsa-emu10k1-fix-synthesizer-sample-playback-.patch @@ -0,0 +1,72 @@ +From d33487df070a4b09e933a892fbf9cb5c3e672f1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 16:58:05 +0200 +Subject: Revert "ALSA: emu10k1: fix synthesizer sample playback position and + caching" + +From: Oswald Buddenhagen + +[ Upstream commit 03f56ed4ead162551ac596c9e3076ff01f1c5836 ] + +As already anticipated in the original commit, playback was broken for +very short samples. I just didn't expect it to be an actual problem, +because we're talking about less than 1.5 milliseconds here. But clearly +such wavetable samples do actually exist. + +The problem was that for such short samples we'd set the current +position beyond the end of the loop, so we'd run off the end of the +sample and play garbage. +This is a bigger (more audible) problem than the original one, which was +that we'd start playback with garbage (whatever was still in the cache), +which would be mostly masked by the note's attack phase. + +So revert to the old behavior for now. We'll subsequently fix it +properly with a bigger patch series. +Note that this isn't a full revert - the dead code is not re-introduced, +because that would be silly. + +Fixes: df335e9a8bcb ("ALSA: emu10k1: fix synthesizer sample playback position and caching") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218625 +Signed-off-by: Oswald Buddenhagen +Message-ID: <20240401145805.528794-1-oswald.buddenhagen@gmx.de> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/emu10k1/emu10k1_callback.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c +index d36234b88fb42..941bfbf812ed3 100644 +--- a/sound/pci/emu10k1/emu10k1_callback.c ++++ b/sound/pci/emu10k1/emu10k1_callback.c +@@ -255,7 +255,7 @@ lookup_voices(struct snd_emux *emu, struct snd_emu10k1 *hw, + /* check if sample is finished playing (non-looping only) */ + if (bp != best + V_OFF && bp != best + V_FREE && + (vp->reg.sample_mode & SNDRV_SFNT_SAMPLE_SINGLESHOT)) { +- val = snd_emu10k1_ptr_read(hw, CCCA_CURRADDR, vp->ch) - 64; ++ val = snd_emu10k1_ptr_read(hw, CCCA_CURRADDR, vp->ch); + if (val >= vp->reg.loopstart) + bp = best + V_OFF; + } +@@ -362,7 +362,7 @@ start_voice(struct snd_emux_voice *vp) + + map = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0); + +- addr = vp->reg.start + 64; ++ addr = vp->reg.start; + temp = vp->reg.parm.filterQ; + ccca = (temp << 28) | addr; + if (vp->apitch < 0xe400) +@@ -430,9 +430,6 @@ start_voice(struct snd_emux_voice *vp) + /* Q & current address (Q 4bit value, MSB) */ + CCCA, ccca, + +- /* cache */ +- CCR, REG_VAL_PUT(CCR_CACHEINVALIDSIZE, 64), +- + /* reset volume */ + VTFT, vtarget | vp->ftarget, + CVCF, vtarget | CVCF_CURRENTFILTER_MASK, +-- +2.43.0 + diff --git a/queue-6.6/risc-v-update-at_vector_size_arch-for-new-at_minsigs.patch b/queue-6.6/risc-v-update-at_vector_size_arch-for-new-at_minsigs.patch new file mode 100644 index 00000000000..fcf220c72f8 --- /dev/null +++ b/queue-6.6/risc-v-update-at_vector_size_arch-for-new-at_minsigs.patch @@ -0,0 +1,44 @@ +From 172a3d6a57b4866c56113756194f18b1e0cc1a21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 23:27:20 -0500 +Subject: RISC-V: Update AT_VECTOR_SIZE_ARCH for new AT_MINSIGSTKSZ + +From: Victor Isaev + +[ Upstream commit 13dddf9319808badd2c1f5d7007b4e82838a648e ] + +"riscv: signal: Report signal frame size to userspace via auxv" (e92f469) +has added new constant AT_MINSIGSTKSZ but failed to increment the size of +auxv, keeping AT_VECTOR_SIZE_ARCH at 9. +This fix correctly increments AT_VECTOR_SIZE_ARCH to 10, following the +approach in the commit 94b07c1 ("arm64: signal: Report signal frame size +to userspace via auxv"). + +Link: https://lore.kernel.org/r/73883406.20231215232720@torrio.net +Link: https://lore.kernel.org/all/20240102133617.3649-1-victor@torrio.net/ +Reported-by: Ivan Komarov +Closes: https://lore.kernel.org/linux-riscv/CY3Z02NYV1C4.11BLB9PLVW9G1@fedora/ +Fixes: e92f469b0771 ("riscv: signal: Report signal frame size to userspace via auxv") +Signed-off-by: Victor Isaev +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/uapi/asm/auxvec.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/include/uapi/asm/auxvec.h b/arch/riscv/include/uapi/asm/auxvec.h +index 10aaa83db89ef..95050ebe9ad00 100644 +--- a/arch/riscv/include/uapi/asm/auxvec.h ++++ b/arch/riscv/include/uapi/asm/auxvec.h +@@ -34,7 +34,7 @@ + #define AT_L3_CACHEGEOMETRY 47 + + /* entries in ARCH_DLINFO */ +-#define AT_VECTOR_SIZE_ARCH 9 ++#define AT_VECTOR_SIZE_ARCH 10 + #define AT_MINSIGSTKSZ 51 + + #endif /* _UAPI_ASM_RISCV_AUXVEC_H */ +-- +2.43.0 + diff --git a/queue-6.6/riscv-disable-preemption-when-using-patch_map.patch b/queue-6.6/riscv-disable-preemption-when-using-patch_map.patch new file mode 100644 index 00000000000..dbe7d1a8f2b --- /dev/null +++ b/queue-6.6/riscv-disable-preemption-when-using-patch_map.patch @@ -0,0 +1,79 @@ +From 71e74f4f04dc64c68587d54afba7ea005c538e55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 21:30:17 +0100 +Subject: riscv: Disable preemption when using patch_map() + +From: Alexandre Ghiti + +[ Upstream commit a370c2419e4680a27382d9231edcf739d5d74efc ] + +patch_map() uses fixmap mappings to circumvent the non-writability of +the kernel text mapping. + +The __set_fixmap() function only flushes the current cpu tlb, it does +not emit an IPI so we must make sure that while we use a fixmap mapping, +the current task is not migrated on another cpu which could miss the +newly introduced fixmap mapping. + +So in order to avoid any task migration, disable the preemption. + +Reported-by: Andrea Parri +Closes: https://lore.kernel.org/all/ZcS+GAaM25LXsBOl@andrea/ +Reported-by: Andy Chiu +Closes: https://lore.kernel.org/linux-riscv/CABgGipUMz3Sffu-CkmeUB1dKVwVQ73+7=sgC45-m0AE9RCjOZg@mail.gmail.com/ +Fixes: cad539baa48f ("riscv: implement a memset like function for text") +Fixes: 0ff7c3b33127 ("riscv: Use text_mutex instead of patch_lock") +Co-developed-by: Andy Chiu +Signed-off-by: Andy Chiu +Signed-off-by: Alexandre Ghiti +Acked-by: Puranjay Mohan +Link: https://lore.kernel.org/r/20240326203017.310422-3-alexghiti@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/patch.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c +index 37e87fdcf6a00..30e12b310cab7 100644 +--- a/arch/riscv/kernel/patch.c ++++ b/arch/riscv/kernel/patch.c +@@ -80,6 +80,8 @@ static int __patch_insn_set(void *addr, u8 c, size_t len) + */ + lockdep_assert_held(&text_mutex); + ++ preempt_disable(); ++ + if (across_pages) + patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1); + +@@ -92,6 +94,8 @@ static int __patch_insn_set(void *addr, u8 c, size_t len) + if (across_pages) + patch_unmap(FIX_TEXT_POKE1); + ++ preempt_enable(); ++ + return 0; + } + NOKPROBE_SYMBOL(__patch_insn_set); +@@ -122,6 +126,8 @@ static int __patch_insn_write(void *addr, const void *insn, size_t len) + if (!riscv_patch_in_stop_machine) + lockdep_assert_held(&text_mutex); + ++ preempt_disable(); ++ + if (across_pages) + patch_map(addr + PAGE_SIZE, FIX_TEXT_POKE1); + +@@ -134,6 +140,8 @@ static int __patch_insn_write(void *addr, const void *insn, size_t len) + if (across_pages) + patch_unmap(FIX_TEXT_POKE1); + ++ preempt_enable(); ++ + return ret; + } + NOKPROBE_SYMBOL(__patch_insn_write); +-- +2.43.0 + diff --git a/queue-6.6/s390-pai-cleanup-event-initialization.patch b/queue-6.6/s390-pai-cleanup-event-initialization.patch new file mode 100644 index 00000000000..660b2b87b2c --- /dev/null +++ b/queue-6.6/s390-pai-cleanup-event-initialization.patch @@ -0,0 +1,69 @@ +From 69d64bafe3b1c1f9a8323476b900b64001a304e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 11:41:33 +0100 +Subject: s390/pai: cleanup event initialization + +From: Thomas Richter + +[ Upstream commit 4711b7b8f99583f6105a33e91f106125134beacb ] + +Setting event::hw.last_tag to zero is not necessary. The memory +for each event is dynamically allocated by the kernel common code and +initialized to zero already. Remove this unnecessary assignment. +Move the comment to function paicrypt_start() for clarification. + +Suggested-by: Sumanth Korikkar +Acked-by: Sumanth Korikkar +Signed-off-by: Thomas Richter +Signed-off-by: Alexander Gordeev +Stable-dep-of: e9f3af02f639 ("s390/pai: fix sampling event removal for PMU device driver") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_pai_crypto.c | 11 +++++------ + arch/s390/kernel/perf_pai_ext.c | 1 - + 2 files changed, 5 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index 1ac74333a78dc..270255acacb02 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -210,12 +210,6 @@ static int paicrypt_event_init(struct perf_event *event) + if (rc) + return rc; + +- /* Event initialization sets last_tag to 0. When later on the events +- * are deleted and re-added, do not reset the event count value to zero. +- * Events are added, deleted and re-added when 2 or more events +- * are active at the same time. +- */ +- event->hw.last_tag = 0; + event->destroy = paicrypt_event_destroy; + + if (a->sample_period) { +@@ -249,6 +243,11 @@ static void paicrypt_start(struct perf_event *event, int flags) + { + u64 sum; + ++ /* Event initialization sets last_tag to 0. When later on the events ++ * are deleted and re-added, do not reset the event count value to zero. ++ * Events are added, deleted and re-added when 2 or more events ++ * are active at the same time. ++ */ + if (!event->hw.last_tag) { + event->hw.last_tag = 1; + sum = paicrypt_getall(event); /* Get current value */ +diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c +index ac32107167eac..8fddde11cfb1f 100644 +--- a/arch/s390/kernel/perf_pai_ext.c ++++ b/arch/s390/kernel/perf_pai_ext.c +@@ -261,7 +261,6 @@ static int paiext_event_init(struct perf_event *event) + rc = paiext_alloc(a, event); + if (rc) + return rc; +- event->hw.last_tag = 0; + event->destroy = paiext_event_destroy; + + if (a->sample_period) { +-- +2.43.0 + diff --git a/queue-6.6/s390-pai-fix-sampling-event-removal-for-pmu-device-d.patch b/queue-6.6/s390-pai-fix-sampling-event-removal-for-pmu-device-d.patch new file mode 100644 index 00000000000..bf65fac7490 --- /dev/null +++ b/queue-6.6/s390-pai-fix-sampling-event-removal-for-pmu-device-d.patch @@ -0,0 +1,90 @@ +From edd91f101651c22faf624630ff57b9e477f6ea65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 15:00:28 +0100 +Subject: s390/pai: fix sampling event removal for PMU device driver + +From: Thomas Richter + +[ Upstream commit e9f3af02f63909f41b43c28330434cc437639c5c ] + +In case of a sampling event, the PAI PMU device drivers need a +reference to this event. Currently to PMU device driver reference +is removed when a sampling event is destroyed. This may lead to +situations where the reference of the PMU device driver is removed +while being used by a different sampling event. +Reset the event reference pointer of the PMU device driver when +a sampling event is deleted and before the next one might be added. + +Fixes: 39d62336f5c1 ("s390/pai: add support for cryptography counters") +Signed-off-by: Thomas Richter +Acked-by: Sumanth Korikkar +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_pai_crypto.c | 10 +++++++--- + arch/s390/kernel/perf_pai_ext.c | 10 +++++++--- + 2 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index 65cc74ab4cdd8..1eefbe2ff4189 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -53,7 +53,6 @@ static void paicrypt_event_destroy(struct perf_event *event) + { + struct paicrypt_map *cpump = per_cpu_ptr(&paicrypt_map, event->cpu); + +- cpump->event = NULL; + static_branch_dec(&pai_key); + mutex_lock(&pai_reserve_mutex); + debug_sprintf_event(cfm_dbg, 5, "%s event %#llx cpu %d users %d" +@@ -278,10 +277,15 @@ static int paicrypt_add(struct perf_event *event, int flags) + + static void paicrypt_stop(struct perf_event *event, int flags) + { +- if (!event->attr.sample_period) /* Counting */ ++ struct paicrypt_mapptr *mp = this_cpu_ptr(paicrypt_root.mapptr); ++ struct paicrypt_map *cpump = mp->mapptr; ++ ++ if (!event->attr.sample_period) { /* Counting */ + paicrypt_read(event); +- else /* Sampling */ ++ } else { /* Sampling */ + perf_sched_cb_dec(event->pmu); ++ cpump->event = NULL; ++ } + event->hw.state = PERF_HES_STOPPED; + } + +diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c +index bac95261ec46d..a9235071ca70b 100644 +--- a/arch/s390/kernel/perf_pai_ext.c ++++ b/arch/s390/kernel/perf_pai_ext.c +@@ -122,7 +122,6 @@ static void paiext_event_destroy(struct perf_event *event) + struct paiext_map *cpump = mp->mapptr; + + mutex_lock(&paiext_reserve_mutex); +- cpump->event = NULL; + if (refcount_dec_and_test(&cpump->refcnt)) /* Last reference gone */ + paiext_free(mp); + paiext_root_free(); +@@ -355,10 +354,15 @@ static int paiext_add(struct perf_event *event, int flags) + + static void paiext_stop(struct perf_event *event, int flags) + { +- if (!event->attr.sample_period) /* Counting */ ++ struct paiext_mapptr *mp = this_cpu_ptr(paiext_root.mapptr); ++ struct paiext_map *cpump = mp->mapptr; ++ ++ if (!event->attr.sample_period) { /* Counting */ + paiext_read(event); +- else /* Sampling */ ++ } else { /* Sampling */ + perf_sched_cb_dec(event->pmu); ++ cpump->event = NULL; ++ } + event->hw.state = PERF_HES_STOPPED; + } + +-- +2.43.0 + diff --git a/queue-6.6/s390-pai-initialize-event-count-once-at-initializati.patch b/queue-6.6/s390-pai-initialize-event-count-once-at-initializati.patch new file mode 100644 index 00000000000..7db908ed6ae --- /dev/null +++ b/queue-6.6/s390-pai-initialize-event-count-once-at-initializati.patch @@ -0,0 +1,56 @@ +From 71020b7334f94ffa19b4d924dd00d987495c9acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Oct 2023 12:09:30 +0200 +Subject: s390/pai: initialize event count once at initialization + +From: Thomas Richter + +[ Upstream commit b286997e83dcf7b498329a66a8a22fc8a5bf50f0 ] + +Event count value is initialized and set to zero in function +paicrypt_start(). This function is called once per CPU when an +event is started on that CPU. This leads to event count value +being set to zero as many times as there are online CPUs. +This is not necessary. The event count value is bound to the event +and it is sufficient to initialize the event counter once at +event creation time. This is done when the event structure +is dynamicly allocated with __GFP_ZERO flag. This sets +member count to zero. + +Acked-by: Sumanth Korikkar +Signed-off-by: Thomas Richter +Signed-off-by: Vasily Gorbik +Stable-dep-of: e9f3af02f639 ("s390/pai: fix sampling event removal for PMU device driver") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_pai_crypto.c | 1 - + arch/s390/kernel/perf_pai_ext.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index 4a4e914c283c8..0921cea849125 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -253,7 +253,6 @@ static void paicrypt_start(struct perf_event *event, int flags) + if (!event->hw.last_tag) { + event->hw.last_tag = 1; + sum = paicrypt_getall(event); /* Get current value */ +- local64_set(&event->count, 0); + local64_set(&event->hw.prev_count, sum); + } + } +diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c +index b5febe22d0546..ac32107167eac 100644 +--- a/arch/s390/kernel/perf_pai_ext.c ++++ b/arch/s390/kernel/perf_pai_ext.c +@@ -327,7 +327,6 @@ static void paiext_start(struct perf_event *event, int flags) + event->hw.last_tag = 1; + sum = paiext_getall(event); /* Get current value */ + local64_set(&event->hw.prev_count, sum); +- local64_set(&event->count, 0); + } + + static int paiext_add(struct perf_event *event, int flags) +-- +2.43.0 + diff --git a/queue-6.6/s390-pai-rework-paixxx_start-and-paixxx_stop-functio.patch b/queue-6.6/s390-pai-rework-paixxx_start-and-paixxx_stop-functio.patch new file mode 100644 index 00000000000..ed396f25808 --- /dev/null +++ b/queue-6.6/s390-pai-rework-paixxx_start-and-paixxx_stop-functio.patch @@ -0,0 +1,156 @@ +From a41f5e8eef58c810bf254494a5c31bd32c2afec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 11:04:25 +0100 +Subject: s390/pai: rework paiXXX_start and paiXXX_stop functions + +From: Thomas Richter + +[ Upstream commit cb1259b7b574bd90ef22dac2c6282327cdae31c6 ] + +The PAI crypto counter and PAI NNPA counters start and stop functions +are streamlined. Move the conditions to invoke start and stop functions +to its respective function body and call them unconditionally. +The start and stop functions now determine how to proceed. +No functional change. + +Signed-off-by: Thomas Richter +Acked-by: Mete Durlu +Signed-off-by: Alexander Gordeev +Stable-dep-of: e9f3af02f639 ("s390/pai: fix sampling event removal for PMU device driver") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_pai_crypto.c | 29 ++++++++++++------------- + arch/s390/kernel/perf_pai_ext.c | 35 ++++++++++++++---------------- + 2 files changed, 30 insertions(+), 34 deletions(-) + +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index 270255acacb02..65cc74ab4cdd8 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -248,10 +248,14 @@ static void paicrypt_start(struct perf_event *event, int flags) + * Events are added, deleted and re-added when 2 or more events + * are active at the same time. + */ +- if (!event->hw.last_tag) { +- event->hw.last_tag = 1; +- sum = paicrypt_getall(event); /* Get current value */ +- local64_set(&event->hw.prev_count, sum); ++ if (!event->attr.sample_period) { /* Counting */ ++ if (!event->hw.last_tag) { ++ event->hw.last_tag = 1; ++ sum = paicrypt_getall(event); /* Get current value */ ++ local64_set(&event->hw.prev_count, sum); ++ } ++ } else { /* Sampling */ ++ perf_sched_cb_inc(event->pmu); + } + } + +@@ -266,19 +270,18 @@ static int paicrypt_add(struct perf_event *event, int flags) + __ctl_set_bit(0, 50); + } + cpump->event = event; +- if (flags & PERF_EF_START && !event->attr.sample_period) { +- /* Only counting needs initial counter value */ ++ if (flags & PERF_EF_START) + paicrypt_start(event, PERF_EF_RELOAD); +- } + event->hw.state = 0; +- if (event->attr.sample_period) +- perf_sched_cb_inc(event->pmu); + return 0; + } + + static void paicrypt_stop(struct perf_event *event, int flags) + { +- paicrypt_read(event); ++ if (!event->attr.sample_period) /* Counting */ ++ paicrypt_read(event); ++ else /* Sampling */ ++ perf_sched_cb_dec(event->pmu); + event->hw.state = PERF_HES_STOPPED; + } + +@@ -286,11 +289,7 @@ static void paicrypt_del(struct perf_event *event, int flags) + { + struct paicrypt_map *cpump = this_cpu_ptr(&paicrypt_map); + +- if (event->attr.sample_period) +- perf_sched_cb_dec(event->pmu); +- if (!event->attr.sample_period) +- /* Only counting needs to read counter */ +- paicrypt_stop(event, PERF_EF_UPDATE); ++ paicrypt_stop(event, PERF_EF_UPDATE); + if (--cpump->active_events == 0) { + __ctl_clear_bit(0, 50); + WRITE_ONCE(S390_lowcore.ccd, 0); +diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c +index 8fddde11cfb1f..bac95261ec46d 100644 +--- a/arch/s390/kernel/perf_pai_ext.c ++++ b/arch/s390/kernel/perf_pai_ext.c +@@ -321,11 +321,15 @@ static void paiext_start(struct perf_event *event, int flags) + { + u64 sum; + +- if (event->hw.last_tag) +- return; +- event->hw.last_tag = 1; +- sum = paiext_getall(event); /* Get current value */ +- local64_set(&event->hw.prev_count, sum); ++ if (!event->attr.sample_period) { /* Counting */ ++ if (!event->hw.last_tag) { ++ event->hw.last_tag = 1; ++ sum = paiext_getall(event); /* Get current value */ ++ local64_set(&event->hw.prev_count, sum); ++ } ++ } else { /* Sampling */ ++ perf_sched_cb_inc(event->pmu); ++ } + } + + static int paiext_add(struct perf_event *event, int flags) +@@ -342,21 +346,19 @@ static int paiext_add(struct perf_event *event, int flags) + debug_sprintf_event(paiext_dbg, 4, "%s 1508 %llx acc %llx\n", + __func__, S390_lowcore.aicd, pcb->acc); + } +- if (flags & PERF_EF_START && !event->attr.sample_period) { +- /* Only counting needs initial counter value */ ++ cpump->event = event; ++ if (flags & PERF_EF_START) + paiext_start(event, PERF_EF_RELOAD); +- } + event->hw.state = 0; +- if (event->attr.sample_period) { +- cpump->event = event; +- perf_sched_cb_inc(event->pmu); +- } + return 0; + } + + static void paiext_stop(struct perf_event *event, int flags) + { +- paiext_read(event); ++ if (!event->attr.sample_period) /* Counting */ ++ paiext_read(event); ++ else /* Sampling */ ++ perf_sched_cb_dec(event->pmu); + event->hw.state = PERF_HES_STOPPED; + } + +@@ -366,12 +368,7 @@ static void paiext_del(struct perf_event *event, int flags) + struct paiext_map *cpump = mp->mapptr; + struct paiext_cb *pcb = cpump->paiext_cb; + +- if (event->attr.sample_period) +- perf_sched_cb_dec(event->pmu); +- if (!event->attr.sample_period) { +- /* Only counting needs to read counter */ +- paiext_stop(event, PERF_EF_UPDATE); +- } ++ paiext_stop(event, PERF_EF_UPDATE); + if (--cpump->active_events == 0) { + /* Disable CPU instruction lookup for PAIE1 control block */ + __ctl_clear_bit(0, 49); +-- +2.43.0 + diff --git a/queue-6.6/s390-pai_crypto-remove-per-cpu-variable-assignement-.patch b/queue-6.6/s390-pai_crypto-remove-per-cpu-variable-assignement-.patch new file mode 100644 index 00000000000..1ecfb777141 --- /dev/null +++ b/queue-6.6/s390-pai_crypto-remove-per-cpu-variable-assignement-.patch @@ -0,0 +1,47 @@ +From 4af1cf94635a824940b66a38e6f811e22d4bee74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 11:53:52 +0200 +Subject: s390/pai_crypto: remove per-cpu variable assignement in event + initialization + +From: Thomas Richter + +[ Upstream commit aecd5a37b5ef4de4f6402dc079672e4243cc4c13 ] + +Function paicrypt_event_init() initializes the PMU device driver +specific details for an event. It is called once per event creation. +The function paicrypt_event_init() is not necessarily executed on +that CPU the event will be used for. +When an event is activated, function paicrypt_start() is used to +start the event on that CPU. +The per CPU data structure struct paicrypt_map has a pointer to +the event which is active for a particular CPU. This pointer is +set in function paicrypt_start() to point to the currently installed +event. There is no need to also set this pointer in function +paicrypt_event_init() where is might be assigned to the wrong CPU. +Therefore remove this assignment in paicrypt_event_init(). + +Acked-by: Sumanth Korikkar +Signed-off-by: Thomas Richter +Signed-off-by: Vasily Gorbik +Stable-dep-of: e9f3af02f639 ("s390/pai: fix sampling event removal for PMU device driver") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_pai_crypto.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c +index 0921cea849125..1ac74333a78dc 100644 +--- a/arch/s390/kernel/perf_pai_crypto.c ++++ b/arch/s390/kernel/perf_pai_crypto.c +@@ -216,7 +216,6 @@ static int paicrypt_event_init(struct perf_event *event) + * are active at the same time. + */ + event->hw.last_tag = 0; +- cpump->event = event; + event->destroy = paicrypt_event_destroy; + + if (a->sample_period) { +-- +2.43.0 + diff --git a/queue-6.6/scsi-mylex-fix-sysfs-buffer-lengths.patch b/queue-6.6/scsi-mylex-fix-sysfs-buffer-lengths.patch new file mode 100644 index 00000000000..52ae0e2d6a4 --- /dev/null +++ b/queue-6.6/scsi-mylex-fix-sysfs-buffer-lengths.patch @@ -0,0 +1,189 @@ +From 2f859c213e39d24da38154ec297aad6777afed6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 23:38:06 +0100 +Subject: scsi: mylex: Fix sysfs buffer lengths + +From: Arnd Bergmann + +[ Upstream commit 1197c5b2099f716b3de327437fb50900a0b936c9 ] + +The myrb and myrs drivers use an odd way of implementing their sysfs files, +calling snprintf() with a fixed length of 32 bytes to print into a page +sized buffer. One of the strings is actually longer than 32 bytes, which +clang can warn about: + +drivers/scsi/myrb.c:1906:10: error: 'snprintf' will always be truncated; specified size is 32, but format string expands to at least 34 [-Werror,-Wformat-truncation] +drivers/scsi/myrs.c:1089:10: error: 'snprintf' will always be truncated; specified size is 32, but format string expands to at least 34 [-Werror,-Wformat-truncation] + +These could all be plain sprintf() without a length as the buffer is always +long enough. On the other hand, sysfs files should not be overly long +either, so just double the length to make sure the longest strings don't +get truncated here. + +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Fixes: 081ff398c56c ("scsi: myrb: Add Mylex RAID controller (block interface)") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240326223825.4084412-8-arnd@kernel.org +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/myrb.c | 20 ++++++++++---------- + drivers/scsi/myrs.c | 24 ++++++++++++------------ + 2 files changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/scsi/myrb.c b/drivers/scsi/myrb.c +index ca2e932dd9b70..f684eb5e04898 100644 +--- a/drivers/scsi/myrb.c ++++ b/drivers/scsi/myrb.c +@@ -1775,9 +1775,9 @@ static ssize_t raid_state_show(struct device *dev, + + name = myrb_devstate_name(ldev_info->state); + if (name) +- ret = snprintf(buf, 32, "%s\n", name); ++ ret = snprintf(buf, 64, "%s\n", name); + else +- ret = snprintf(buf, 32, "Invalid (%02X)\n", ++ ret = snprintf(buf, 64, "Invalid (%02X)\n", + ldev_info->state); + } else { + struct myrb_pdev_state *pdev_info = sdev->hostdata; +@@ -1796,9 +1796,9 @@ static ssize_t raid_state_show(struct device *dev, + else + name = myrb_devstate_name(pdev_info->state); + if (name) +- ret = snprintf(buf, 32, "%s\n", name); ++ ret = snprintf(buf, 64, "%s\n", name); + else +- ret = snprintf(buf, 32, "Invalid (%02X)\n", ++ ret = snprintf(buf, 64, "Invalid (%02X)\n", + pdev_info->state); + } + return ret; +@@ -1886,11 +1886,11 @@ static ssize_t raid_level_show(struct device *dev, + + name = myrb_raidlevel_name(ldev_info->raid_level); + if (!name) +- return snprintf(buf, 32, "Invalid (%02X)\n", ++ return snprintf(buf, 64, "Invalid (%02X)\n", + ldev_info->state); +- return snprintf(buf, 32, "%s\n", name); ++ return snprintf(buf, 64, "%s\n", name); + } +- return snprintf(buf, 32, "Physical Drive\n"); ++ return snprintf(buf, 64, "Physical Drive\n"); + } + static DEVICE_ATTR_RO(raid_level); + +@@ -1903,15 +1903,15 @@ static ssize_t rebuild_show(struct device *dev, + unsigned char status; + + if (sdev->channel < myrb_logical_channel(sdev->host)) +- return snprintf(buf, 32, "physical device - not rebuilding\n"); ++ return snprintf(buf, 64, "physical device - not rebuilding\n"); + + status = myrb_get_rbld_progress(cb, &rbld_buf); + + if (rbld_buf.ldev_num != sdev->id || + status != MYRB_STATUS_SUCCESS) +- return snprintf(buf, 32, "not rebuilding\n"); ++ return snprintf(buf, 64, "not rebuilding\n"); + +- return snprintf(buf, 32, "rebuilding block %u of %u\n", ++ return snprintf(buf, 64, "rebuilding block %u of %u\n", + rbld_buf.ldev_size - rbld_buf.blocks_left, + rbld_buf.ldev_size); + } +diff --git a/drivers/scsi/myrs.c b/drivers/scsi/myrs.c +index a1eec65a9713f..e824be9d9bbb9 100644 +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -947,9 +947,9 @@ static ssize_t raid_state_show(struct device *dev, + + name = myrs_devstate_name(ldev_info->dev_state); + if (name) +- ret = snprintf(buf, 32, "%s\n", name); ++ ret = snprintf(buf, 64, "%s\n", name); + else +- ret = snprintf(buf, 32, "Invalid (%02X)\n", ++ ret = snprintf(buf, 64, "Invalid (%02X)\n", + ldev_info->dev_state); + } else { + struct myrs_pdev_info *pdev_info; +@@ -958,9 +958,9 @@ static ssize_t raid_state_show(struct device *dev, + pdev_info = sdev->hostdata; + name = myrs_devstate_name(pdev_info->dev_state); + if (name) +- ret = snprintf(buf, 32, "%s\n", name); ++ ret = snprintf(buf, 64, "%s\n", name); + else +- ret = snprintf(buf, 32, "Invalid (%02X)\n", ++ ret = snprintf(buf, 64, "Invalid (%02X)\n", + pdev_info->dev_state); + } + return ret; +@@ -1066,13 +1066,13 @@ static ssize_t raid_level_show(struct device *dev, + ldev_info = sdev->hostdata; + name = myrs_raid_level_name(ldev_info->raid_level); + if (!name) +- return snprintf(buf, 32, "Invalid (%02X)\n", ++ return snprintf(buf, 64, "Invalid (%02X)\n", + ldev_info->dev_state); + + } else + name = myrs_raid_level_name(MYRS_RAID_PHYSICAL); + +- return snprintf(buf, 32, "%s\n", name); ++ return snprintf(buf, 64, "%s\n", name); + } + static DEVICE_ATTR_RO(raid_level); + +@@ -1086,7 +1086,7 @@ static ssize_t rebuild_show(struct device *dev, + unsigned char status; + + if (sdev->channel < cs->ctlr_info->physchan_present) +- return snprintf(buf, 32, "physical device - not rebuilding\n"); ++ return snprintf(buf, 64, "physical device - not rebuilding\n"); + + ldev_info = sdev->hostdata; + ldev_num = ldev_info->ldev_num; +@@ -1098,11 +1098,11 @@ static ssize_t rebuild_show(struct device *dev, + return -EIO; + } + if (ldev_info->rbld_active) { +- return snprintf(buf, 32, "rebuilding block %zu of %zu\n", ++ return snprintf(buf, 64, "rebuilding block %zu of %zu\n", + (size_t)ldev_info->rbld_lba, + (size_t)ldev_info->cfg_devsize); + } else +- return snprintf(buf, 32, "not rebuilding\n"); ++ return snprintf(buf, 64, "not rebuilding\n"); + } + + static ssize_t rebuild_store(struct device *dev, +@@ -1190,7 +1190,7 @@ static ssize_t consistency_check_show(struct device *dev, + unsigned short ldev_num; + + if (sdev->channel < cs->ctlr_info->physchan_present) +- return snprintf(buf, 32, "physical device - not checking\n"); ++ return snprintf(buf, 64, "physical device - not checking\n"); + + ldev_info = sdev->hostdata; + if (!ldev_info) +@@ -1198,11 +1198,11 @@ static ssize_t consistency_check_show(struct device *dev, + ldev_num = ldev_info->ldev_num; + myrs_get_ldev_info(cs, ldev_num, ldev_info); + if (ldev_info->cc_active) +- return snprintf(buf, 32, "checking block %zu of %zu\n", ++ return snprintf(buf, 64, "checking block %zu of %zu\n", + (size_t)ldev_info->cc_lba, + (size_t)ldev_info->cfg_devsize); + else +- return snprintf(buf, 32, "not checking\n"); ++ return snprintf(buf, 64, "not checking\n"); + } + + static ssize_t consistency_check_store(struct device *dev, +-- +2.43.0 + diff --git a/queue-6.6/scsi-sd-unregister-device-if-device_add_disk-failed-.patch b/queue-6.6/scsi-sd-unregister-device-if-device_add_disk-failed-.patch new file mode 100644 index 00000000000..ab92e39176a --- /dev/null +++ b/queue-6.6/scsi-sd-unregister-device-if-device_add_disk-failed-.patch @@ -0,0 +1,43 @@ +From 99c8ed0312c8a64f52fb0c6696c33eca3a26f73a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:23:35 +0800 +Subject: scsi: sd: Unregister device if device_add_disk() failed in sd_probe() + +From: Li Nan + +[ Upstream commit 0296bea01cfa6526be6bd2d16dc83b4e7f1af91f ] + +"if device_add() succeeds, you should call device_del() when you want to +get rid of it." + +In sd_probe(), device_add_disk() fails when device_add() has already +succeeded, so change put_device() to device_unregister() to ensure device +resources are released. + +Fixes: 2a7a891f4c40 ("scsi: sd: Add error handling support for add_disk()") +Signed-off-by: Li Nan +Link: https://lore.kernel.org/r/20231208082335.1754205-1-linan666@huaweicloud.com +Reviewed-by: Bart Van Assche +Reviewed-by: Yu Kuai +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index e80c33cdad2b9..c62f677084b4c 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -3754,7 +3754,7 @@ static int sd_probe(struct device *dev) + + error = device_add_disk(dev, gd, NULL); + if (error) { +- put_device(&sdkp->disk_dev); ++ device_unregister(&sdkp->disk_dev); + put_disk(gd); + goto out; + } +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 261d1636f2c..a2f8e7f028b 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -155,3 +155,46 @@ net-ravb-always-process-tx-descriptor-ring.patch net-ravb-always-update-error-counters.patch kvm-svm-use-unsigned-integers-when-dealing-with-asid.patch kvm-svm-add-support-for-allowing-zero-sev-asids.patch +fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch +9p-fix-read-write-debug-statements-to-report-server-.patch +asoc-wm_adsp-fix-missing-mutex_lock-in-wm_adsp_write.patch +drivers-perf-riscv-disable-perf_sample_branch_-while.patch +risc-v-update-at_vector_size_arch-for-new-at_minsigs.patch +regmap-maple-fix-cache-corruption-in-regcache_maple_.patch +alsa-hda-cs35l56-add-acpi-device-match-tables.patch +drm-panfrost-fix-power-transition-timeout-warnings.patch +nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch +drm-prime-unbreak-virtgpu-dma-buf-export.patch +asoc-rt5682-sdw-fix-locking-sequence.patch +asoc-rt711-sdca-fix-locking-sequence.patch +asoc-rt711-sdw-fix-locking-sequence.patch +asoc-rt712-sdca-sdw-fix-locking-sequence.patch +asoc-rt722-sdca-sdw-fix-locking-sequence.patch +asoc-ops-fix-wraparound-for-mask-in-snd_soc_get_vols.patch +asoc-tas2781-mark-dvc_tlv-with-__maybe_unused.patch +spi-s3c64xx-extract-fifo-depth-calculation-to-a-dedi.patch +spi-s3c64xx-sort-headers-alphabetically.patch +spi-s3c64xx-explicitly-include-linux-bits.h.patch +spi-s3c64xx-remove-else-after-return.patch +spi-s3c64xx-define-a-magic-value.patch +spi-s3c64xx-allow-full-fifo-masks.patch +spi-s3c64xx-determine-the-fifo-depth-only-once.patch +spi-s3c64xx-use-dma-mode-from-fifo-size.patch +asoc-amd-acp-fix-for-acp_init-function-error-handlin.patch +regmap-maple-fix-uninitialized-symbol-ret-warnings.patch +ata-sata_sx4-fix-pdc20621_get_from_dimm-on-64-bit.patch +scsi-mylex-fix-sysfs-buffer-lengths.patch +scsi-sd-unregister-device-if-device_add_disk-failed-.patch +revert-alsa-emu10k1-fix-synthesizer-sample-playback-.patch +cifs-fix-caching-to-try-to-do-open-o_wronly-as-rdwr-.patch +spi-mchp-pci1xxx-fix-a-possible-null-pointer-derefer.patch +s390-pai-initialize-event-count-once-at-initializati.patch +s390-pai_crypto-remove-per-cpu-variable-assignement-.patch +s390-pai-cleanup-event-initialization.patch +s390-pai-rework-paixxx_start-and-paixxx_stop-functio.patch +s390-pai-fix-sampling-event-removal-for-pmu-device-d.patch +ata-sata_mv-fix-pci-device-id-table-declaration-comp.patch +asoc-sof-amd-fix-for-false-dsp-interrupts.patch +sunrpc-fix-a-slow-server-side-memory-leak-with-rpc-o.patch +riscv-disable-preemption-when-using-patch_map.patch +nfsd-hold-a-lighter-weight-client-reference-over-cb_.patch diff --git a/queue-6.6/spi-mchp-pci1xxx-fix-a-possible-null-pointer-derefer.patch b/queue-6.6/spi-mchp-pci1xxx-fix-a-possible-null-pointer-derefer.patch new file mode 100644 index 00000000000..eb0b4f1fcd6 --- /dev/null +++ b/queue-6.6/spi-mchp-pci1xxx-fix-a-possible-null-pointer-derefer.patch @@ -0,0 +1,44 @@ +From 7b6ccb2cfad508ee0de19245cc45aaedf1282991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 09:42:21 +0800 +Subject: spi: mchp-pci1xxx: Fix a possible null pointer dereference in + pci1xxx_spi_probe + +From: Huai-Yuan Liu + +[ Upstream commit 1f886a7bfb3faf4c1021e73f045538008ce7634e ] + +In function pci1xxxx_spi_probe, there is a potential null pointer that +may be caused by a failed memory allocation by the function devm_kzalloc. +Hence, a null pointer check needs to be added to prevent null pointer +dereferencing later in the code. + +To fix this issue, spi_bus->spi_int[iter] should be checked. The memory +allocated by devm_kzalloc will be automatically released, so just directly +return -ENOMEM without worrying about memory leaks. + +Fixes: 1cc0cbea7167 ("spi: microchip: pci1xxxx: Add driver for SPI controller of PCI1XXXX PCIe switch") +Signed-off-by: Huai-Yuan Liu +Link: https://msgid.link/r/20240403014221.969801-1-qq810974084@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pci1xxxx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-pci1xxxx.c b/drivers/spi/spi-pci1xxxx.c +index 3638e974f5d49..06bf58b7e5d72 100644 +--- a/drivers/spi/spi-pci1xxxx.c ++++ b/drivers/spi/spi-pci1xxxx.c +@@ -275,6 +275,8 @@ static int pci1xxxx_spi_probe(struct pci_dev *pdev, const struct pci_device_id * + spi_bus->spi_int[iter] = devm_kzalloc(&pdev->dev, + sizeof(struct pci1xxxx_spi_internal), + GFP_KERNEL); ++ if (!spi_bus->spi_int[iter]) ++ return -ENOMEM; + spi_sub_ptr = spi_bus->spi_int[iter]; + spi_sub_ptr->spi_host = devm_spi_alloc_host(dev, sizeof(struct spi_controller)); + if (!spi_sub_ptr->spi_host) +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-allow-full-fifo-masks.patch b/queue-6.6/spi-s3c64xx-allow-full-fifo-masks.patch new file mode 100644 index 00000000000..91d69292e88 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-allow-full-fifo-masks.patch @@ -0,0 +1,152 @@ +From b7fdf5e3e0d7a8e395f4d3be566ac204647a1558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 07:05:46 +0000 +Subject: spi: s3c64xx: allow full FIFO masks + +From: Tudor Ambarus + +[ Upstream commit d6911cf27e5c8491cbfedd4ae2d1ee74a3e685b4 ] + +The driver is wrong because is using partial register field masks for the +SPI_STATUS.{RX, TX}_FIFO_LVL register fields. + +We see s3c64xx_spi_port_config.fifo_lvl_mask with different values for +different instances of the same IP. Take s5pv210_spi_port_config for +example, it defines: + .fifo_lvl_mask = { 0x1ff, 0x7F }, + +fifo_lvl_mask is used to determine the FIFO depth of the instance of the +IP. In this case, the integrator uses a 256 bytes FIFO for the first SPI +instance of the IP, and a 64 bytes FIFO for the second instance. While +the first mask reflects the SPI_STATUS.{RX, TX}_FIFO_LVL register +fields, the second one is two bits short. Using partial field masks is +misleading and can hide problems of the driver's logic. + +Allow platforms to specify the full FIFO mask, regardless of the FIFO +depth. + +Introduce {rx, tx}_fifomask to represent the SPI_STATUS.{RX, TX}_FIFO_LVL +register fields. It's a shifted mask defining the field's length and +position. We'll be able to deprecate the use of @rx_lvl_offset, as the +shift value can be determined from the mask. The existing compatibles +shall start using {rx, tx}_fifomask so that they use the full field mask +and to avoid shifting the mask to position, and then shifting it back to +zero in the {TX, RX}_FIFO_LVL macros. + +@rx_lvl_offset will be deprecated in a further patch, after we have the +infrastructure to deprecate @fifo_lvl_mask as well. + +No functional change intended. + +Signed-off-by: Tudor Ambarus +Link: https://msgid.link/r/20240216070555.2483977-4-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 40 +++++++++++++++++++++++++++++++++++---- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 3da940e6299f0..688b8fad9e2fd 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -3,6 +3,7 @@ + // Copyright (c) 2009 Samsung Electronics Co., Ltd. + // Jaswinder Singh + ++#include + #include + #include + #include +@@ -107,10 +108,10 @@ + #define FIFO_LVL_MASK(i) ((i)->port_conf->fifo_lvl_mask[i->port_id]) + #define S3C64XX_SPI_ST_TX_DONE(v, i) (((v) & \ + (1 << (i)->port_conf->tx_st_done)) ? 1 : 0) +-#define TX_FIFO_LVL(v, i) (((v) >> S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT) & \ +- FIFO_LVL_MASK(i)) +-#define RX_FIFO_LVL(v, i) (((v) >> (i)->port_conf->rx_lvl_offset) & \ +- FIFO_LVL_MASK(i)) ++#define TX_FIFO_LVL(v, sdd) (((v) & (sdd)->tx_fifomask) >> \ ++ __ffs((sdd)->tx_fifomask)) ++#define RX_FIFO_LVL(v, sdd) (((v) & (sdd)->rx_fifomask) >> \ ++ __ffs((sdd)->rx_fifomask)) + #define FIFO_DEPTH(i) ((FIFO_LVL_MASK(i) >> 1) + 1) + + #define S3C64XX_SPI_MAX_TRAILCNT 0x3ff +@@ -136,6 +137,10 @@ struct s3c64xx_spi_dma_data { + * struct s3c64xx_spi_port_config - SPI Controller hardware info + * @fifo_lvl_mask: Bit-mask for {TX|RX}_FIFO_LVL bits in SPI_STATUS register. + * @rx_lvl_offset: Bit offset of RX_FIFO_LVL bits in SPI_STATUS regiter. ++ * @rx_fifomask: SPI_STATUS.RX_FIFO_LVL mask. Shifted mask defining the field's ++ * length and position. ++ * @tx_fifomask: SPI_STATUS.TX_FIFO_LVL mask. Shifted mask defining the field's ++ * length and position. + * @tx_st_done: Bit offset of TX_DONE bit in SPI_STATUS regiter. + * @clk_div: Internal clock divider + * @quirks: Bitmask of known quirks +@@ -153,6 +158,8 @@ struct s3c64xx_spi_dma_data { + struct s3c64xx_spi_port_config { + int fifo_lvl_mask[MAX_SPI_PORTS]; + int rx_lvl_offset; ++ u32 rx_fifomask; ++ u32 tx_fifomask; + int tx_st_done; + int quirks; + int clk_div; +@@ -182,6 +189,10 @@ struct s3c64xx_spi_port_config { + * @tx_dma: Local transmit DMA data (e.g. chan and direction) + * @port_conf: Local SPI port configuartion data + * @port_id: Port identification number ++ * @rx_fifomask: SPI_STATUS.RX_FIFO_LVL mask. Shifted mask defining the field's ++ * length and position. ++ * @tx_fifomask: SPI_STATUS.TX_FIFO_LVL mask. Shifted mask defining the field's ++ * length and position. + */ + struct s3c64xx_spi_driver_data { + void __iomem *regs; +@@ -201,6 +212,8 @@ struct s3c64xx_spi_driver_data { + struct s3c64xx_spi_dma_data tx_dma; + const struct s3c64xx_spi_port_config *port_conf; + unsigned int port_id; ++ u32 rx_fifomask; ++ u32 tx_fifomask; + }; + + static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd) +@@ -1145,6 +1158,23 @@ static inline const struct s3c64xx_spi_port_config *s3c64xx_spi_get_port_config( + return (const struct s3c64xx_spi_port_config *)platform_get_device_id(pdev)->driver_data; + } + ++static void s3c64xx_spi_set_fifomask(struct s3c64xx_spi_driver_data *sdd) ++{ ++ const struct s3c64xx_spi_port_config *port_conf = sdd->port_conf; ++ ++ if (port_conf->rx_fifomask) ++ sdd->rx_fifomask = port_conf->rx_fifomask; ++ else ++ sdd->rx_fifomask = FIFO_LVL_MASK(sdd) << ++ port_conf->rx_lvl_offset; ++ ++ if (port_conf->tx_fifomask) ++ sdd->tx_fifomask = port_conf->tx_fifomask; ++ else ++ sdd->tx_fifomask = FIFO_LVL_MASK(sdd) << ++ S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT; ++} ++ + static int s3c64xx_spi_probe(struct platform_device *pdev) + { + struct resource *mem_res; +@@ -1190,6 +1220,8 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) + sdd->port_id = pdev->id; + } + ++ s3c64xx_spi_set_fifomask(sdd); ++ + sdd->cur_bpw = 8; + + sdd->tx_dma.direction = DMA_MEM_TO_DEV; +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-define-a-magic-value.patch b/queue-6.6/spi-s3c64xx-define-a-magic-value.patch new file mode 100644 index 00000000000..2ecfda88c03 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-define-a-magic-value.patch @@ -0,0 +1,45 @@ +From e1a06b0606f0656407722c40cebc1a8eab88ab24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 07:05:45 +0000 +Subject: spi: s3c64xx: define a magic value + +From: Tudor Ambarus + +[ Upstream commit ff8faa8a5c0f4c2da797cd22a163ee3cc8823b13 ] + +Define a magic value, it will be used in the next patch as well. + +Signed-off-by: Tudor Ambarus +Link: https://msgid.link/r/20240216070555.2483977-3-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 29e99410c9716..3da940e6299f0 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -76,6 +76,7 @@ + #define S3C64XX_SPI_INT_RX_FIFORDY_EN (1<<1) + #define S3C64XX_SPI_INT_TX_FIFORDY_EN (1<<0) + ++#define S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT 6 + #define S3C64XX_SPI_ST_RX_OVERRUN_ERR (1<<5) + #define S3C64XX_SPI_ST_RX_UNDERRUN_ERR (1<<4) + #define S3C64XX_SPI_ST_TX_OVERRUN_ERR (1<<3) +@@ -106,7 +107,8 @@ + #define FIFO_LVL_MASK(i) ((i)->port_conf->fifo_lvl_mask[i->port_id]) + #define S3C64XX_SPI_ST_TX_DONE(v, i) (((v) & \ + (1 << (i)->port_conf->tx_st_done)) ? 1 : 0) +-#define TX_FIFO_LVL(v, i) (((v) >> 6) & FIFO_LVL_MASK(i)) ++#define TX_FIFO_LVL(v, i) (((v) >> S3C64XX_SPI_ST_TX_FIFO_LVL_SHIFT) & \ ++ FIFO_LVL_MASK(i)) + #define RX_FIFO_LVL(v, i) (((v) >> (i)->port_conf->rx_lvl_offset) & \ + FIFO_LVL_MASK(i)) + #define FIFO_DEPTH(i) ((FIFO_LVL_MASK(i) >> 1) + 1) +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-determine-the-fifo-depth-only-once.patch b/queue-6.6/spi-s3c64xx-determine-the-fifo-depth-only-once.patch new file mode 100644 index 00000000000..e4af2022e46 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-determine-the-fifo-depth-only-once.patch @@ -0,0 +1,99 @@ +From 0775d8f28a19f70186de150e220cc1347cd153bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 07:05:47 +0000 +Subject: spi: s3c64xx: determine the fifo depth only once + +From: Tudor Ambarus + +[ Upstream commit c6e776ab6abdfce5a1edcde7a22c639e76499939 ] + +Determine the FIFO depth only once, at probe time. +``sdd->fifo_depth`` can be set later on with the FIFO depth +specified in the device tree. + +Signed-off-by: Tudor Ambarus +Link: https://msgid.link/r/20240216070555.2483977-5-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 688b8fad9e2fd..e059fb9db1da1 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -189,6 +189,7 @@ struct s3c64xx_spi_port_config { + * @tx_dma: Local transmit DMA data (e.g. chan and direction) + * @port_conf: Local SPI port configuartion data + * @port_id: Port identification number ++ * @fifo_depth: depth of the FIFO. + * @rx_fifomask: SPI_STATUS.RX_FIFO_LVL mask. Shifted mask defining the field's + * length and position. + * @tx_fifomask: SPI_STATUS.TX_FIFO_LVL mask. Shifted mask defining the field's +@@ -212,6 +213,7 @@ struct s3c64xx_spi_driver_data { + struct s3c64xx_spi_dma_data tx_dma; + const struct s3c64xx_spi_port_config *port_conf; + unsigned int port_id; ++ unsigned int fifo_depth; + u32 rx_fifomask; + u32 tx_fifomask; + }; +@@ -422,7 +424,7 @@ static bool s3c64xx_spi_can_dma(struct spi_controller *host, + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); + + if (sdd->rx_dma.ch && sdd->tx_dma.ch) +- return xfer->len > FIFO_DEPTH(sdd); ++ return xfer->len > sdd->fifo_depth; + + return false; + } +@@ -509,7 +511,7 @@ static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd, + void __iomem *regs = sdd->regs; + unsigned long val = 1; + u32 status; +- u32 max_fifo = FIFO_DEPTH(sdd); ++ u32 max_fifo = sdd->fifo_depth; + + if (timeout_ms) + val = msecs_to_loops(timeout_ms); +@@ -616,7 +618,7 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd, + * For any size less than the fifo size the below code is + * executed atleast once. + */ +- loops = xfer->len / FIFO_DEPTH(sdd); ++ loops = xfer->len / sdd->fifo_depth; + buf = xfer->rx_buf; + do { + /* wait for data to be received in the fifo */ +@@ -753,7 +755,7 @@ static int s3c64xx_spi_transfer_one(struct spi_controller *host, + struct spi_transfer *xfer) + { + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); +- const unsigned int fifo_len = FIFO_DEPTH(sdd); ++ const unsigned int fifo_len = sdd->fifo_depth; + const void *tx_buf = NULL; + void *rx_buf = NULL; + int target_len = 0, origin_len = 0; +@@ -1220,6 +1222,8 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) + sdd->port_id = pdev->id; + } + ++ sdd->fifo_depth = FIFO_DEPTH(sdd); ++ + s3c64xx_spi_set_fifomask(sdd); + + sdd->cur_bpw = 8; +@@ -1311,7 +1315,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) + dev_dbg(&pdev->dev, "Samsung SoC SPI Driver loaded for Bus SPI-%d with %d Targets attached\n", + sdd->port_id, host->num_chipselect); + dev_dbg(&pdev->dev, "\tIOmem=[%pR]\tFIFO %dbytes\n", +- mem_res, FIFO_DEPTH(sdd)); ++ mem_res, sdd->fifo_depth); + + pm_runtime_mark_last_busy(&pdev->dev); + pm_runtime_put_autosuspend(&pdev->dev); +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-explicitly-include-linux-bits.h.patch b/queue-6.6/spi-s3c64xx-explicitly-include-linux-bits.h.patch new file mode 100644 index 00000000000..2a7ee229370 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-explicitly-include-linux-bits.h.patch @@ -0,0 +1,42 @@ +From 0c610838dcc722982c4940bd96eb03f6135cf9c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 12:04:17 +0000 +Subject: spi: s3c64xx: explicitly include + +From: Tudor Ambarus + +[ Upstream commit 4568fa574fcef3811a8140702979f076ef0f5bc0 ] + +The driver uses GENMASK() but does not include . + +It is good practice to directly include all headers used, it avoids +implicit dependencies and spurious breakage if someone rearranges +headers and causes the implicit include to vanish. + +Include the missing header. + +Reviewed-by: Peter Griffin +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20240207120431.2766269-4-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 26d389d95af92..1e519b1537e71 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -3,6 +3,7 @@ + // Copyright (c) 2009 Samsung Electronics Co., Ltd. + // Jaswinder Singh + ++#include + #include + #include + #include +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-extract-fifo-depth-calculation-to-a-dedi.patch b/queue-6.6/spi-s3c64xx-extract-fifo-depth-calculation-to-a-dedi.patch new file mode 100644 index 00000000000..c843778d3f0 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-extract-fifo-depth-calculation-to-a-dedi.patch @@ -0,0 +1,84 @@ +From ce9c6ae96e6609a97d71ee0c7ffc0b3ce6119ddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jan 2024 11:00:01 -0600 +Subject: spi: s3c64xx: Extract FIFO depth calculation to a dedicated macro + +From: Sam Protsenko + +[ Upstream commit 460efee706c2b6a4daba62ec143fea29c2e7b358 ] + +Simplify the code by extracting all cases of FIFO depth calculation into +a dedicated macro. No functional change. + +Signed-off-by: Sam Protsenko +Reviewed-by: Andi Shyti +Link: https://msgid.link/r/20240120170001.3356-1-semen.protsenko@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 0e48ffd499b9f..432ec60d35684 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -109,6 +109,7 @@ + #define TX_FIFO_LVL(v, i) (((v) >> 6) & FIFO_LVL_MASK(i)) + #define RX_FIFO_LVL(v, i) (((v) >> (i)->port_conf->rx_lvl_offset) & \ + FIFO_LVL_MASK(i)) ++#define FIFO_DEPTH(i) ((FIFO_LVL_MASK(i) >> 1) + 1) + + #define S3C64XX_SPI_MAX_TRAILCNT 0x3ff + #define S3C64XX_SPI_TRAILCNT_OFF 19 +@@ -406,7 +407,7 @@ static bool s3c64xx_spi_can_dma(struct spi_controller *host, + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); + + if (sdd->rx_dma.ch && sdd->tx_dma.ch) { +- return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1; ++ return xfer->len > FIFO_DEPTH(sdd); + } else { + return false; + } +@@ -495,9 +496,7 @@ static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd, + void __iomem *regs = sdd->regs; + unsigned long val = 1; + u32 status; +- +- /* max fifo depth available */ +- u32 max_fifo = (FIFO_LVL_MASK(sdd) >> 1) + 1; ++ u32 max_fifo = FIFO_DEPTH(sdd); + + if (timeout_ms) + val = msecs_to_loops(timeout_ms); +@@ -604,7 +603,7 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd, + * For any size less than the fifo size the below code is + * executed atleast once. + */ +- loops = xfer->len / ((FIFO_LVL_MASK(sdd) >> 1) + 1); ++ loops = xfer->len / FIFO_DEPTH(sdd); + buf = xfer->rx_buf; + do { + /* wait for data to be received in the fifo */ +@@ -741,7 +740,7 @@ static int s3c64xx_spi_transfer_one(struct spi_controller *host, + struct spi_transfer *xfer) + { + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); +- const unsigned int fifo_len = (FIFO_LVL_MASK(sdd) >> 1) + 1; ++ const unsigned int fifo_len = FIFO_DEPTH(sdd); + const void *tx_buf = NULL; + void *rx_buf = NULL; + int target_len = 0, origin_len = 0; +@@ -1280,7 +1279,7 @@ static int s3c64xx_spi_probe(struct platform_device *pdev) + dev_dbg(&pdev->dev, "Samsung SoC SPI Driver loaded for Bus SPI-%d with %d Targets attached\n", + sdd->port_id, host->num_chipselect); + dev_dbg(&pdev->dev, "\tIOmem=[%pR]\tFIFO %dbytes\n", +- mem_res, (FIFO_LVL_MASK(sdd) >> 1) + 1); ++ mem_res, FIFO_DEPTH(sdd)); + + pm_runtime_mark_last_busy(&pdev->dev); + pm_runtime_put_autosuspend(&pdev->dev); +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-remove-else-after-return.patch b/queue-6.6/spi-s3c64xx-remove-else-after-return.patch new file mode 100644 index 00000000000..93adc763f20 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-remove-else-after-return.patch @@ -0,0 +1,44 @@ +From de161fe93de0b2e03c0bcca72523047e61185000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 12:04:22 +0000 +Subject: spi: s3c64xx: remove else after return + +From: Tudor Ambarus + +[ Upstream commit 9d47e411f4d636519a8d26587928d34cf52c0c1f ] + +Else case is not needed after a return, remove it. + +Reviewed-by: Andi Shyti +Reviewed-by: Sam Protsenko +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20240207120431.2766269-9-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 1e519b1537e71..29e99410c9716 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -406,12 +406,10 @@ static bool s3c64xx_spi_can_dma(struct spi_controller *host, + { + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); + +- if (sdd->rx_dma.ch && sdd->tx_dma.ch) { ++ if (sdd->rx_dma.ch && sdd->tx_dma.ch) + return xfer->len > FIFO_DEPTH(sdd); +- } else { +- return false; +- } + ++ return false; + } + + static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-sort-headers-alphabetically.patch b/queue-6.6/spi-s3c64xx-sort-headers-alphabetically.patch new file mode 100644 index 00000000000..09c1825d526 --- /dev/null +++ b/queue-6.6/spi-s3c64xx-sort-headers-alphabetically.patch @@ -0,0 +1,56 @@ +From 2d4329b69296195ce3a1d6b95873ef86a65b485e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 12:04:15 +0000 +Subject: spi: s3c64xx: sort headers alphabetically + +From: Tudor Ambarus + +[ Upstream commit a77ce80f63f06d7ae933c332ed77c79136fa69b0 ] + +Sorting headers alphabetically helps locating duplicates, +and makes it easier to figure out where to insert new headers. + +Reviewed-by: Andi Shyti +Reviewed-by: Peter Griffin +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20240207120431.2766269-2-tudor.ambarus@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: a3d3eab627bb ("spi: s3c64xx: Use DMA mode from fifo size") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index 432ec60d35684..26d389d95af92 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -3,19 +3,18 @@ + // Copyright (c) 2009 Samsung Electronics Co., Ltd. + // Jaswinder Singh + +-#include +-#include +-#include +-#include + #include ++#include + #include + #include ++#include ++#include ++#include ++#include ++#include + #include + #include + #include +-#include +- +-#include + + #define MAX_SPI_PORTS 12 + #define S3C64XX_SPI_QUIRK_CS_AUTO (1 << 1) +-- +2.43.0 + diff --git a/queue-6.6/spi-s3c64xx-use-dma-mode-from-fifo-size.patch b/queue-6.6/spi-s3c64xx-use-dma-mode-from-fifo-size.patch new file mode 100644 index 00000000000..d8e5086d7da --- /dev/null +++ b/queue-6.6/spi-s3c64xx-use-dma-mode-from-fifo-size.patch @@ -0,0 +1,54 @@ +From 93a58640567adeddf6820d53caf13285d9f8fb7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Mar 2024 17:58:40 +0900 +Subject: spi: s3c64xx: Use DMA mode from fifo size + +From: Jaewon Kim + +[ Upstream commit a3d3eab627bbbb0cb175910cf8d0f7022628a642 ] + +If the SPI data size is smaller than FIFO, it operates in PIO mode, +and if it is larger than FIFO size, it oerates in DMA mode. + +If the SPI data size is equal to fifo, it operates in PIO mode and it is +separated to 2 transfers. To prevent it, it must operate in DMA mode +from the case where the data size and the fifo size are the same. + +Fixes: 1ee806718d5e ("spi: s3c64xx: support interrupt based pio mode") +Signed-off-by: Jaewon Kim +Reviewed-by: Sam Protsenko +Link: https://lore.kernel.org/r/20240329085840.65856-1-jaewon02.kim@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index e059fb9db1da1..652eadbefe24c 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -424,7 +424,7 @@ static bool s3c64xx_spi_can_dma(struct spi_controller *host, + struct s3c64xx_spi_driver_data *sdd = spi_controller_get_devdata(host); + + if (sdd->rx_dma.ch && sdd->tx_dma.ch) +- return xfer->len > sdd->fifo_depth; ++ return xfer->len >= sdd->fifo_depth; + + return false; + } +@@ -783,10 +783,9 @@ static int s3c64xx_spi_transfer_one(struct spi_controller *host, + return status; + } + +- if (!is_polling(sdd) && (xfer->len > fifo_len) && ++ if (!is_polling(sdd) && xfer->len >= fifo_len && + sdd->rx_dma.ch && sdd->tx_dma.ch) { + use_dma = 1; +- + } else if (xfer->len >= fifo_len) { + tx_buf = xfer->tx_buf; + rx_buf = xfer->rx_buf; +-- +2.43.0 + diff --git a/queue-6.6/sunrpc-fix-a-slow-server-side-memory-leak-with-rpc-o.patch b/queue-6.6/sunrpc-fix-a-slow-server-side-memory-leak-with-rpc-o.patch new file mode 100644 index 00000000000..7de8d2497c5 --- /dev/null +++ b/queue-6.6/sunrpc-fix-a-slow-server-side-memory-leak-with-rpc-o.patch @@ -0,0 +1,67 @@ +From dfe879bfb9542154b6d758925c8c513eb46a6d67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 10:36:25 -0400 +Subject: SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP + +From: Chuck Lever + +[ Upstream commit 05258a0a69b3c5d2c003f818702c0a52b6fea861 ] + +Jan Schunk reports that his small NFS servers suffer from memory +exhaustion after just a few days. A bisect shows that commit +e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single +sock_sendmsg() call") is the first bad commit. + +That commit assumed that sock_sendmsg() releases all the pages in +the underlying bio_vec array, but the reality is that it doesn't. +svc_xprt_release() releases the rqst's response pages, but the +record marker page fragment isn't one of those, so it is never +released. + +This is a narrow fix that can be applied to stable kernels. A +more extensive fix is in the works. + +Reported-by: Jan Schunk +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218671 +Fixes: e18e157bb5c8 ("SUNRPC: Send RPC message on TCP with a single sock_sendmsg() call") +Cc: Alexander Duyck +Cc: Jakub Kacinski +Cc: David Howells +Reviewed-by: David Howells +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/svcsock.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index e0ce4276274be..933e12e3a55c7 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -1216,15 +1216,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp) + * MSG_SPLICE_PAGES is used exclusively to reduce the number of + * copy operations in this path. Therefore the caller must ensure + * that the pages backing @xdr are unchanging. +- * +- * Note that the send is non-blocking. The caller has incremented +- * the reference count on each page backing the RPC message, and +- * the network layer will "put" these pages when transmission is +- * complete. +- * +- * This is safe for our RPC services because the memory backing +- * the head and tail components is never kmalloc'd. These always +- * come from pages in the svc_rqst::rq_pages array. + */ + static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, + rpc_fraghdr marker, unsigned int *sentp) +@@ -1254,6 +1245,7 @@ static int svc_tcp_sendmsg(struct svc_sock *svsk, struct svc_rqst *rqstp, + iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, rqstp->rq_bvec, + 1 + count, sizeof(marker) + rqstp->rq_res.len); + ret = sock_sendmsg(svsk->sk_sock, &msg); ++ page_frag_free(buf); + if (ret < 0) + return ret; + *sentp += ret; +-- +2.43.0 +