From 263441e69dcfa6935b1441a3c6bbe3f6270b8825 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 18 Mar 2024 18:55:57 -0400 Subject: [PATCH] Fixes for 6.6 Signed-off-by: Sasha Levin --- ...-alc285-reduce-pop-noise-from-headph.patch | 35 + ...m-dts-fix-dtc-interrupt_map-warnings.patch | 72 ++ ...-fix-dtc-interrupt_provider-warnings.patch | 754 ++++++++++++++++++ ...rcar-gen2-add-missing-interrupt-cell.patch | 132 +++ ...-drop-interrupts-property-from-pwm-r.patch | 99 +++ ...-fix-dtc-interrupt_provider-warnings.patch | 168 ++++ ...ts-qcom-fix-interrupt-map-cell-sizes.patch | 86 ++ ...ip-mark-system-power-controller-on-r.patch | 35 + ...the-maximum-allocation-for-the-sve-p.patch | 99 +++ ...ra-set-the-correct-phy-mode-for-mgbe.patch | 35 + ...hp-pavilion-aero-laptop-13-be2xxx-8b.patch | 42 + ...lenovo-thinkbook-21j0-into-dmi-quirk.patch | 42 + ...ix-non-functional-mic-on-lenovo-21j2.patch | 41 + ...ix-non-functional-mic-on-lenovo-82uu.patch | 44 + ...dle-error-from-devm_pm_runtime_enabl.patch | 39 + ..._rt5640-add-an-extra-entry-for-the-c.patch | 52 ++ ...-lattepanda-board-dmi-match-more-pre.patch | 63 ++ ...m-workaround-for-crashed-firmware-on.patch | 69 ++ ...le-both-spkoutr_ena-and-spkoutl_ena-.patch | 76 ++ ...le-oscillator-if-selecting-wm8962_fl.patch | 37 + ...up-incorrect-error-message-in-wm8962.patch | 36 + ...andle-empty-atoms-when-parsing-respo.patch | 65 ++ ...fix-limited-discoverable-off-timeout.patch | 51 ++ ...-fix-null-ptr-deref-in-rfcomm_check_.patch | 58 ++ ...ace-at-btrfs_use_block_rsv-when-acce.patch | 104 +++ ...aces-when-accessing-the-reserved-amo.patch | 164 ++++ ...-out-of-order-assembly-of-autodiscov.patch | 115 +++ ...e-endpoint-decoders-in-cxl_region_fi.patch | 65 ++ ...ypt-align-struct-bvec_iter-correctly.patch | 71 ++ ...e-gpu-reset-for-s3-abort-cases-on-ra.patch | 90 +++ ...ttm-tests-depend-on-uml-compile_test.patch | 50 ++ ...se-long-bus-reset-on-gap-count-error.patch | 65 ++ ...ands-fix-invalid-escape-sequence-war.patch | 36 + ...dd-required-quirk-for-synaptics-0xcd.patch | 40 + ...polled-suppress-deferred-probe-error.patch | 55 ++ ...-irq-handling-due-to-shared-interrup.patch | 140 ++++ ...-cause.bd-in-instruction_pointer_set.patch | 39 + ...-allocation-size-of-iucv_path_table-.patch | 46 ++ ...d-support-for-sys-tec-usb-spemodule1.patch | 40 + ...d-missing-config_dynamic_ftrace-chec.patch | 42 + ...karound-ampereonex-errata-ac04_mesh_.patch | 54 ++ ...xl-fix-cpmu-filter-value-mask-length.patch | 59 ++ ...cv-fix-panic-on-pmu-overflow-handler.patch | 94 +++ ...-android-tablets-fix-acer_b1_750_goo.patch | 47 ++ ...rtify-source-warning-while-accessing.patch | 131 +++ ...lax-devx-access-upon-modify-commands.patch | 47 ++ ...ure-that-changed-bytes-are-actually-.patch | 146 ++++ ...ax5970-fix-regulator-child-node-name.patch | 49 ++ ...-add-missing-interrupt-cells-to-pmic.patch | 36 + ...vent-sending-diag_reset-when-the-con.patch | 44 + ...explicitly-trigger-the-listener-diag.patch | 89 +++ ...witch-add-validation-for-the-recursi.patch | 201 +++++ ...use-exact-comparison-in-recv_partial.patch | 44 + queue-6.6/series | 63 ++ ...x-polarfire_soc_sys_ctrl-input-promp.patch | 33 + ...d-support-for-lunar-lake-m-spi-seria.patch | 35 + ...-mvm-use-correct-address-3-in-a-msdu.patch | 204 +++++ ...ly-call-drv_sta_rc_update-for-upload.patch | 39 + ...ow-15-bit-apic-ids-for-vtl-platforms.patch | 58 ++ ...vsyscall-page-read-for-copy_from_ker.patch | 100 +++ ...s_vsyscall_vaddr-into-asm-vsyscall.h.patch | 71 ++ ...-some-null-pointer-checking-to-smp.c.patch | 79 ++ ...hild-route-lookup-for-packet-offload.patch | 49 ++ ...trol-buffer-based-on-packet-offload-.patch | 45 ++ 64 files changed, 5209 insertions(+) create mode 100644 queue-6.6/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch create mode 100644 queue-6.6/arm-dts-fix-dtc-interrupt_map-warnings.patch create mode 100644 queue-6.6/arm-dts-fix-dtc-interrupt_provider-warnings.patch create mode 100644 queue-6.6/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch create mode 100644 queue-6.6/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch create mode 100644 queue-6.6/arm64-dts-fix-dtc-interrupt_provider-warnings.patch create mode 100644 queue-6.6/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch create mode 100644 queue-6.6/arm64-dts-rockchip-mark-system-power-controller-on-r.patch create mode 100644 queue-6.6/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch create mode 100644 queue-6.6/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch create mode 100644 queue-6.6/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch create mode 100644 queue-6.6/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch create mode 100644 queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch create mode 100644 queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch create mode 100644 queue-6.6/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch create mode 100644 queue-6.6/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch create mode 100644 queue-6.6/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch create mode 100644 queue-6.6/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch create mode 100644 queue-6.6/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch create mode 100644 queue-6.6/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch create mode 100644 queue-6.6/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch create mode 100644 queue-6.6/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch create mode 100644 queue-6.6/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch create mode 100644 queue-6.6/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch create mode 100644 queue-6.6/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch create mode 100644 queue-6.6/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch create mode 100644 queue-6.6/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch create mode 100644 queue-6.6/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch create mode 100644 queue-6.6/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch create mode 100644 queue-6.6/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch create mode 100644 queue-6.6/drm-ttm-tests-depend-on-uml-compile_test.patch create mode 100644 queue-6.6/firewire-core-use-long-bus-reset-on-gap-count-error.patch create mode 100644 queue-6.6/gen_compile_commands-fix-invalid-escape-sequence-war.patch create mode 100644 queue-6.6/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch create mode 100644 queue-6.6/input-gpio_keys_polled-suppress-deferred-probe-error.patch create mode 100644 queue-6.6/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch create mode 100644 queue-6.6/mips-clear-cause.bd-in-instruction_pointer_set.patch create mode 100644 queue-6.6/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch create mode 100644 queue-6.6/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch create mode 100644 queue-6.6/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch create mode 100644 queue-6.6/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch create mode 100644 queue-6.6/perf-cxl-fix-cpmu-filter-value-mask-length.patch create mode 100644 queue-6.6/perf-riscv-fix-panic-on-pmu-overflow-handler.patch create mode 100644 queue-6.6/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch create mode 100644 queue-6.6/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch create mode 100644 queue-6.6/rdma-mlx5-relax-devx-access-upon-modify-commands.patch create mode 100644 queue-6.6/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch create mode 100644 queue-6.6/regulator-max5970-fix-regulator-child-node-name.patch create mode 100644 queue-6.6/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch create mode 100644 queue-6.6/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch create mode 100644 queue-6.6/selftests-mptcp-explicitly-trigger-the-listener-diag.patch create mode 100644 queue-6.6/selftests-openvswitch-add-validation-for-the-recursi.patch create mode 100644 queue-6.6/selftests-tls-use-exact-comparison-in-recv_partial.patch create mode 100644 queue-6.6/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch create mode 100644 queue-6.6/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch create mode 100644 queue-6.6/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch create mode 100644 queue-6.6/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch create mode 100644 queue-6.6/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch create mode 100644 queue-6.6/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch create mode 100644 queue-6.6/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch create mode 100644 queue-6.6/x86-xen-add-some-null-pointer-checking-to-smp.c.patch create mode 100644 queue-6.6/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch create mode 100644 queue-6.6/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch diff --git a/queue-6.6/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch b/queue-6.6/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch new file mode 100644 index 00000000000..142582665e4 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch @@ -0,0 +1,35 @@ +From 9bc5d3093212df920948390576184a91829e3a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 14:54:34 +0800 +Subject: ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port + +From: Kailang Yang + +[ Upstream commit b34bf65838f7c6e785f62681605a538b73c2808c ] + +It had pop noise from Headphone port when system reboot state. +If NID 58h Index 0x0 to fill default value, it will reduce pop noise. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/r/7493e207919a4fb3a0599324fd010e3e@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 88d006ac9568c..234c8b46d9254 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3683,6 +3683,7 @@ static void alc285_hp_init(struct hda_codec *codec) + int i, val; + int coef38, coef0d, coef36; + ++ alc_write_coefex_idx(codec, 0x58, 0x00, 0x1888); /* write default value */ + alc_update_coef_idx(codec, 0x4a, 1<<15, 1<<15); /* Reset HP JD */ + coef38 = alc_read_coef_idx(codec, 0x38); /* Amp control */ + coef0d = alc_read_coef_idx(codec, 0x0d); /* Digital Misc control */ +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-fix-dtc-interrupt_map-warnings.patch b/queue-6.6/arm-dts-fix-dtc-interrupt_map-warnings.patch new file mode 100644 index 00000000000..30847fc3b36 --- /dev/null +++ b/queue-6.6/arm-dts-fix-dtc-interrupt_map-warnings.patch @@ -0,0 +1,72 @@ +From a451021ce380af776327b695b206e86840b503b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:28 -0600 +Subject: arm: dts: Fix dtc interrupt_map warnings + +From: Rob Herring + +[ Upstream commit f02b0f0dc26fbb77fe47b6e47cc5c211f0432c37 ] + +The dtc interrupt_map warning is off because its dependency, +interrupt_provider, is off by default. Fix all the warnings so it can be +enabled. + +Signed-off-by: Rob Herring +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-4-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts | 2 ++ + .../boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts | 2 ++ + arch/arm/boot/dts/qcom/qcom-sdx55.dtsi | 8 ++++---- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts +index 4d70f6afd13ab..6d5e69035f94d 100644 +--- a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts ++++ b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-gateway-7001.dts +@@ -60,6 +60,8 @@ pci@c0000000 { + * We have slots (IDSEL) 1 and 2 with one assigned IRQ + * each handling all IRQs. + */ ++ #interrupt-cells = <1>; ++ interrupt-map-mask = <0xf800 0 0 7>; + interrupt-map = + /* IDSEL 1 */ + <0x0800 0 0 1 &gpio0 11 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 1 is irq 11 */ +diff --git a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts +index 9ec0169bacf8c..5f4c849915db7 100644 +--- a/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts ++++ b/arch/arm/boot/dts/intel/ixp/intel-ixp42x-goramo-multilink.dts +@@ -89,6 +89,8 @@ pci@c0000000 { + * The slots have Ethernet, Ethernet, NEC and MPCI. + * The IDSELs are 11, 12, 13, 14. + */ ++ #interrupt-cells = <1>; ++ interrupt-map-mask = <0xf800 0 0 7>; + interrupt-map = + /* IDSEL 11 - Ethernet A */ + <0x5800 0 0 1 &gpio0 4 IRQ_TYPE_LEVEL_LOW>, /* INT A on slot 11 is irq 4 */ +diff --git a/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi +index 5b86b4de1a1bd..f9ad5abfbd28b 100644 +--- a/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom/qcom-sdx55.dtsi +@@ -345,10 +345,10 @@ pcie_rc: pcie@1c00000 { + "msi8"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 0 0 141 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 0 0 142 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 0 0 143 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 0 0 144 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 141 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 142 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 143 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 144 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_PCIE_PIPE_CLK>, + <&gcc GCC_PCIE_AUX_CLK>, +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-fix-dtc-interrupt_provider-warnings.patch b/queue-6.6/arm-dts-fix-dtc-interrupt_provider-warnings.patch new file mode 100644 index 00000000000..89a893b436d --- /dev/null +++ b/queue-6.6/arm-dts-fix-dtc-interrupt_provider-warnings.patch @@ -0,0 +1,754 @@ +From 4b7ba5b8a4eb90d39945690d796af69f2ab3fd49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:26 -0600 +Subject: arm: dts: Fix dtc interrupt_provider warnings + +From: Rob Herring + +[ Upstream commit 96fd598e9c34cfa68402a4da3020c9236cfacf35 ] + +The dtc interrupt_provider warning is off by default. Fix all the warnings +so it can be enabled. + +Signed-off-by: Rob Herring +Reviewed-by: Andrew Jeffery +Reviewed-by: Alexandre Torgue +Acked-by: Florian Fainelli #Broadcom +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-2-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/amazon/alpine.dtsi | 1 - + arch/arm/boot/dts/aspeed/aspeed-g4.dtsi | 14 -------------- + arch/arm/boot/dts/aspeed/aspeed-g5.dtsi | 15 +-------------- + arch/arm/boot/dts/aspeed/aspeed-g6.dtsi | 18 ++---------------- + arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi | 3 +++ + arch/arm/boot/dts/broadcom/bcm-hr2.dtsi | 1 + + arch/arm/boot/dts/broadcom/bcm-nsp.dtsi | 2 ++ + arch/arm/boot/dts/marvell/kirkwood-l-50.dts | 2 ++ + arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi | 2 ++ + .../boot/dts/nvidia/tegra30-apalis-v1.1.dtsi | 1 - + arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi | 1 - + arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts | 3 --- + arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi | 2 +- + arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi | 1 - + arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi | 1 - + .../dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi | 1 + + .../nxp/imx/imx6qdl-phytec-phycore-som.dtsi | 1 + + arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts | 1 + + .../boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts | 1 + + arch/arm/boot/dts/st/stm32429i-eval.dts | 1 - + arch/arm/boot/dts/st/stm32mp157c-dk2.dts | 1 - + .../boot/dts/ti/omap/am5729-beagleboneai.dts | 1 - + 24 files changed, 18 insertions(+), 58 deletions(-) + +diff --git a/arch/arm/boot/dts/amazon/alpine.dtsi b/arch/arm/boot/dts/amazon/alpine.dtsi +index ff68dfb4eb787..90bd12feac010 100644 +--- a/arch/arm/boot/dts/amazon/alpine.dtsi ++++ b/arch/arm/boot/dts/amazon/alpine.dtsi +@@ -167,7 +167,6 @@ pcie@fbc00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <96>; + al,msi-num-spis = <64>; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi +index 530491ae5eb26..857cb26ed6d7e 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g4.dtsi +@@ -466,7 +466,6 @@ i2c_ic: interrupt-controller@0 { + i2c0: i2c-bus@40 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x40 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -482,7 +481,6 @@ i2c0: i2c-bus@40 { + i2c1: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x80 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -498,7 +496,6 @@ i2c1: i2c-bus@80 { + i2c2: i2c-bus@c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0xc0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -515,7 +512,6 @@ i2c2: i2c-bus@c0 { + i2c3: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x100 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -532,7 +528,6 @@ i2c3: i2c-bus@100 { + i2c4: i2c-bus@140 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x140 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -549,7 +544,6 @@ i2c4: i2c-bus@140 { + i2c5: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x180 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -566,7 +560,6 @@ i2c5: i2c-bus@180 { + i2c6: i2c-bus@1c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x1c0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -583,7 +576,6 @@ i2c6: i2c-bus@1c0 { + i2c7: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x300 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -600,7 +592,6 @@ i2c7: i2c-bus@300 { + i2c8: i2c-bus@340 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x340 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -617,7 +608,6 @@ i2c8: i2c-bus@340 { + i2c9: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x380 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -634,7 +624,6 @@ i2c9: i2c-bus@380 { + i2c10: i2c-bus@3c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x3c0 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -651,7 +640,6 @@ i2c10: i2c-bus@3c0 { + i2c11: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x400 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -668,7 +656,6 @@ i2c11: i2c-bus@400 { + i2c12: i2c-bus@440 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x440 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +@@ -685,7 +672,6 @@ i2c12: i2c-bus@440 { + i2c13: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x480 0x40>; + compatible = "aspeed,ast2400-i2c-bus"; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi +index 04f98d1dbb97c..e6f3cf3c721e5 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g5.dtsi +@@ -363,6 +363,7 @@ sgpio: sgpio@1e780200 { + interrupts = <40>; + reg = <0x1e780200 0x0100>; + clocks = <&syscon ASPEED_CLK_APB>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -594,7 +595,6 @@ i2c_ic: interrupt-controller@0 { + i2c0: i2c-bus@40 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x40 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -610,7 +610,6 @@ i2c0: i2c-bus@40 { + i2c1: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x80 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -626,7 +625,6 @@ i2c1: i2c-bus@80 { + i2c2: i2c-bus@c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0xc0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -643,7 +641,6 @@ i2c2: i2c-bus@c0 { + i2c3: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x100 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -660,7 +657,6 @@ i2c3: i2c-bus@100 { + i2c4: i2c-bus@140 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x140 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -677,7 +673,6 @@ i2c4: i2c-bus@140 { + i2c5: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x180 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -694,7 +689,6 @@ i2c5: i2c-bus@180 { + i2c6: i2c-bus@1c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x1c0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -711,7 +705,6 @@ i2c6: i2c-bus@1c0 { + i2c7: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x300 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -728,7 +721,6 @@ i2c7: i2c-bus@300 { + i2c8: i2c-bus@340 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x340 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -745,7 +737,6 @@ i2c8: i2c-bus@340 { + i2c9: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x380 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -762,7 +753,6 @@ i2c9: i2c-bus@380 { + i2c10: i2c-bus@3c0 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x3c0 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -779,7 +769,6 @@ i2c10: i2c-bus@3c0 { + i2c11: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x400 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -796,7 +785,6 @@ i2c11: i2c-bus@400 { + i2c12: i2c-bus@440 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x440 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +@@ -813,7 +801,6 @@ i2c12: i2c-bus@440 { + i2c13: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + + reg = <0x480 0x40>; + compatible = "aspeed,ast2500-i2c-bus"; +diff --git a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +index c4d1faade8be3..29f94696d8b18 100644 +--- a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi ++++ b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi +@@ -474,6 +474,7 @@ sgpiom0: sgpiom@1e780500 { + reg = <0x1e780500 0x100>; + interrupts = ; + clocks = <&syscon ASPEED_CLK_APB2>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -488,6 +489,7 @@ sgpiom1: sgpiom@1e780600 { + reg = <0x1e780600 0x100>; + interrupts = ; + clocks = <&syscon ASPEED_CLK_APB2>; ++ #interrupt-cells = <2>; + interrupt-controller; + bus-frequency = <12000000>; + pinctrl-names = "default"; +@@ -902,7 +904,6 @@ &i2c { + i2c0: i2c-bus@80 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x80 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -917,7 +918,6 @@ i2c0: i2c-bus@80 { + i2c1: i2c-bus@100 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x100 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -932,7 +932,6 @@ i2c1: i2c-bus@100 { + i2c2: i2c-bus@180 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x180 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -947,7 +946,6 @@ i2c2: i2c-bus@180 { + i2c3: i2c-bus@200 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x200 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -962,7 +960,6 @@ i2c3: i2c-bus@200 { + i2c4: i2c-bus@280 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x280 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -977,7 +974,6 @@ i2c4: i2c-bus@280 { + i2c5: i2c-bus@300 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x300 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -992,7 +988,6 @@ i2c5: i2c-bus@300 { + i2c6: i2c-bus@380 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x380 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1007,7 +1002,6 @@ i2c6: i2c-bus@380 { + i2c7: i2c-bus@400 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x400 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1022,7 +1016,6 @@ i2c7: i2c-bus@400 { + i2c8: i2c-bus@480 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x480 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1037,7 +1030,6 @@ i2c8: i2c-bus@480 { + i2c9: i2c-bus@500 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x500 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1052,7 +1044,6 @@ i2c9: i2c-bus@500 { + i2c10: i2c-bus@580 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x580 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1067,7 +1058,6 @@ i2c10: i2c-bus@580 { + i2c11: i2c-bus@600 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x600 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1082,7 +1072,6 @@ i2c11: i2c-bus@600 { + i2c12: i2c-bus@680 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x680 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1097,7 +1086,6 @@ i2c12: i2c-bus@680 { + i2c13: i2c-bus@700 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x700 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1112,7 +1100,6 @@ i2c13: i2c-bus@700 { + i2c14: i2c-bus@780 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x780 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +@@ -1127,7 +1114,6 @@ i2c14: i2c-bus@780 { + i2c15: i2c-bus@800 { + #address-cells = <1>; + #size-cells = <0>; +- #interrupt-cells = <1>; + reg = <0x800 0x80>; + compatible = "aspeed,ast2600-i2c-bus"; + clocks = <&syscon ASPEED_CLK_APB2>; +diff --git a/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi b/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi +index f9f79ed825181..07ca0d993c9fd 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-cygnus.dtsi +@@ -167,6 +167,7 @@ gpio_crmu: gpio@3024800 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&mailbox>; + interrupts = <0>; + }; +@@ -247,6 +248,7 @@ gpio_ccm: gpio@1800a000 { + gpio-controller; + interrupts = ; + interrupt-controller; ++ #interrupt-cells = <2>; + }; + + i2c1: i2c@1800b000 { +@@ -518,6 +520,7 @@ gpio_asiu: gpio@180a5000 { + gpio-controller; + + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinctrl 0 42 1>, + <&pinctrl 1 44 3>, +diff --git a/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi b/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi +index 788a6806191a3..75545b10ef2fa 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-hr2.dtsi +@@ -200,6 +200,7 @@ gpiob: gpio@30000 { + gpio-controller; + ngpios = <4>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi b/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi +index 9d20ba3b1ffb1..6a4482c931674 100644 +--- a/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/broadcom/bcm-nsp.dtsi +@@ -180,6 +180,7 @@ gpioa: gpio@20 { + gpio-controller; + ngpios = <32>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinctrl 0 0 32>; + }; +@@ -352,6 +353,7 @@ gpiob: gpio@30000 { + gpio-controller; + ngpios = <4>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm/boot/dts/marvell/kirkwood-l-50.dts b/arch/arm/boot/dts/marvell/kirkwood-l-50.dts +index dffb9f84e67c5..c841eb8e7fb1d 100644 +--- a/arch/arm/boot/dts/marvell/kirkwood-l-50.dts ++++ b/arch/arm/boot/dts/marvell/kirkwood-l-50.dts +@@ -65,6 +65,7 @@ i2c@11000 { + gpio2: gpio-expander@20 { + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + compatible = "semtech,sx1505q"; + reg = <0x20>; + +@@ -79,6 +80,7 @@ gpio2: gpio-expander@20 { + gpio3: gpio-expander@21 { + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + compatible = "semtech,sx1505q"; + reg = <0x21>; + +diff --git a/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi b/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi +index fd671c7a1e5d6..6e1f0f164cb4f 100644 +--- a/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi ++++ b/arch/arm/boot/dts/nuvoton/nuvoton-wpcm450.dtsi +@@ -120,6 +120,7 @@ gpio0: gpio@0 { + interrupts = <2 IRQ_TYPE_LEVEL_HIGH>, + <3 IRQ_TYPE_LEVEL_HIGH>, + <4 IRQ_TYPE_LEVEL_HIGH>; ++ #interrupt-cells = <2>; + interrupt-controller; + }; + +@@ -128,6 +129,7 @@ gpio1: gpio@1 { + gpio-controller; + #gpio-cells = <2>; + interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; ++ #interrupt-cells = <2>; + interrupt-controller; + }; + +diff --git a/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi b/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi +index 1640763fd4af2..ff0d684622f74 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-apalis-v1.1.dtsi +@@ -997,7 +997,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi b/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi +index 3b6fad273cabf..d38f1dd38a906 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-apalis.dtsi +@@ -980,7 +980,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi b/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi +index 4eb526fe9c558..81c8a5fd92cce 100644 +--- a/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi ++++ b/arch/arm/boot/dts/nvidia/tegra30-colibri.dtsi +@@ -861,7 +861,6 @@ touchscreen@41 { + compatible = "st,stmpe811"; + reg = <0x41>; + irq-gpio = <&gpio TEGRA_GPIO(V, 0) GPIO_ACTIVE_LOW>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts b/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts +index db8c332df6a1d..cad112e054758 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-b850v3.dts +@@ -227,7 +227,6 @@ bridge@1,0 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + bridge@2,1 { + compatible = "pci10b5,8605"; +@@ -235,7 +234,6 @@ bridge@2,1 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + /* Intel Corporation I210 Gigabit Network Connection */ + ethernet@3,0 { +@@ -250,7 +248,6 @@ bridge@2,2 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + + /* Intel Corporation I210 Gigabit Network Connection */ + switch_nic: ethernet@4,0 { +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi +index 99f4f6ac71d4a..c1ae7c47b4422 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-bx50v3.dtsi +@@ -245,6 +245,7 @@ pca9539: pca9539@74 { + reg = <0x74>; + gpio-controller; + #gpio-cells = <2>; ++ #interrupt-cells = <2>; + interrupt-controller; + interrupt-parent = <&gpio2>; + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; +@@ -390,7 +391,6 @@ pci_root: root@0,0 { + + #address-cells = <3>; + #size-cells = <2>; +- #interrupt-cells = <1>; + }; + }; + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi +index 4cc965277c521..dcb4f6a32f809 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi +@@ -619,7 +619,6 @@ stmpe811@41 { + blocks = <0x5>; + id = <0>; + interrupts = <10 IRQ_TYPE_LEVEL_LOW>; +- interrupt-controller; + interrupt-parent = <&gpio4>; + irq-trigger = <0x1>; + pinctrl-names = "default"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi +index 11d9c7a2dacb1..6cc4d6fd5f28b 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-colibri.dtsi +@@ -543,7 +543,6 @@ stmpe811@41 { + blocks = <0x5>; + interrupts = <20 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&gpio6>; +- interrupt-controller; + id = <0>; + irq-trigger = <0x1>; + pinctrl-names = "default"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi +index a63e73adc1fc5..42b2ba23aefc9 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-emcon.dtsi +@@ -225,7 +225,6 @@ da9063: pmic@58 { + pinctrl-0 = <&pinctrl_pmic>; + interrupt-parent = <&gpio2>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; +- interrupt-controller; + + onkey { + compatible = "dlg,da9063-onkey"; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi +index 113974520d544..c0c47adc5866e 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-pfla02.dtsi +@@ -124,6 +124,7 @@ pmic@58 { + reg = <0x58>; + interrupt-parent = <&gpio2>; + interrupts = <9 IRQ_TYPE_LEVEL_LOW>; /* active-low GPIO2_9 */ ++ #interrupt-cells = <2>; + interrupt-controller; + + regulators { +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi +index 86b4269e0e011..85e278eb20161 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-phytec-phycore-som.dtsi +@@ -100,6 +100,7 @@ pmic: pmic@58 { + interrupt-parent = <&gpio1>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + gpio-controller; + #gpio-cells = <2>; + +diff --git a/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts b/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts +index 12361fcbe24af..1b965652291bf 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts ++++ b/arch/arm/boot/dts/nxp/imx/imx7d-pico-dwarf.dts +@@ -63,6 +63,7 @@ pca9554: io-expander@25 { + gpio-controller; + #gpio-cells = <2>; + #interrupt-cells = <2>; ++ interrupt-controller; + reg = <0x25>; + }; + +diff --git a/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts b/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts +index 16b4e06c4efad..a248b8a453421 100644 +--- a/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts ++++ b/arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-b.dts +@@ -338,6 +338,7 @@ gpio6: io-expander@22 { + reg = <0x22>; + gpio-controller; + #gpio-cells = <2>; ++ #interrupt-cells = <2>; + interrupt-controller; + interrupt-parent = <&gpio3>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; +diff --git a/arch/arm/boot/dts/st/stm32429i-eval.dts b/arch/arm/boot/dts/st/stm32429i-eval.dts +index 576235ec3c516..afa417b34b25f 100644 +--- a/arch/arm/boot/dts/st/stm32429i-eval.dts ++++ b/arch/arm/boot/dts/st/stm32429i-eval.dts +@@ -222,7 +222,6 @@ stmpe1600: stmpe1600@42 { + reg = <0x42>; + interrupts = <8 3>; + interrupt-parent = <&gpioi>; +- interrupt-controller; + wakeup-source; + + stmpegpio: stmpe_gpio { +diff --git a/arch/arm/boot/dts/st/stm32mp157c-dk2.dts b/arch/arm/boot/dts/st/stm32mp157c-dk2.dts +index 510cca5acb79c..7a701f7ef0c70 100644 +--- a/arch/arm/boot/dts/st/stm32mp157c-dk2.dts ++++ b/arch/arm/boot/dts/st/stm32mp157c-dk2.dts +@@ -64,7 +64,6 @@ touchscreen@38 { + reg = <0x38>; + interrupts = <2 2>; + interrupt-parent = <&gpiof>; +- interrupt-controller; + touchscreen-size-x = <480>; + touchscreen-size-y = <800>; + status = "okay"; +diff --git a/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts b/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts +index 9a234dc1431d1..5b240769d300e 100644 +--- a/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts ++++ b/arch/arm/boot/dts/ti/omap/am5729-beagleboneai.dts +@@ -415,7 +415,6 @@ stmpe811@41 { + reg = <0x41>; + interrupts = <30 IRQ_TYPE_LEVEL_LOW>; + interrupt-parent = <&gpio2>; +- interrupt-controller; + id = <0>; + blocks = <0x5>; + irq-trigger = <0x1>; +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch b/queue-6.6/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch new file mode 100644 index 00000000000..701a96b6796 --- /dev/null +++ b/queue-6.6/arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch @@ -0,0 +1,132 @@ +From c530ecd8960d0f96dd562fd1227be969bc350483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 15:57:42 +0100 +Subject: ARM: dts: renesas: rcar-gen2: Add missing #interrupt-cells to DA9063 + nodes + +From: Geert Uytterhoeven + +[ Upstream commit 8c987693dc2d292d777f1be63cb35233049ae25e ] + +make dtbs_check W=2: + + arch/arm/boot/dts/renesas/r8a7790-lager.dts:444.11-458.5: Warning (interrupt_provider): /i2c-mux4/pmic@58: Missing '#interrupt-cells' in interrupt provider + ... + +Fix this by adding the missing #interrupt-cells properties. + +Reported-by: Rob Herring +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/a351e503ea97fb1af68395843f513925ff1bdf26.1707922460.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/renesas/r8a7790-lager.dts | 1 + + arch/arm/boot/dts/renesas/r8a7790-stout.dts | 1 + + arch/arm/boot/dts/renesas/r8a7791-koelsch.dts | 1 + + arch/arm/boot/dts/renesas/r8a7791-porter.dts | 1 + + arch/arm/boot/dts/renesas/r8a7792-blanche.dts | 1 + + arch/arm/boot/dts/renesas/r8a7793-gose.dts | 1 + + arch/arm/boot/dts/renesas/r8a7794-alt.dts | 1 + + arch/arm/boot/dts/renesas/r8a7794-silk.dts | 1 + + 8 files changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/renesas/r8a7790-lager.dts b/arch/arm/boot/dts/renesas/r8a7790-lager.dts +index 5ad5349a50dc9..ab7e9fa90b9fe 100644 +--- a/arch/arm/boot/dts/renesas/r8a7790-lager.dts ++++ b/arch/arm/boot/dts/renesas/r8a7790-lager.dts +@@ -437,6 +437,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7790-stout.dts b/arch/arm/boot/dts/renesas/r8a7790-stout.dts +index fe14727eefe1e..25956661a8754 100644 +--- a/arch/arm/boot/dts/renesas/r8a7790-stout.dts ++++ b/arch/arm/boot/dts/renesas/r8a7790-stout.dts +@@ -332,6 +332,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +diff --git a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts +index 26a40782cc899..4a76be68887b4 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-koelsch.dts +@@ -800,6 +800,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7791-porter.dts b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +index ec0a20d5130d6..fcc9a2313e1df 100644 +--- a/arch/arm/boot/dts/renesas/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/renesas/r8a7791-porter.dts +@@ -389,6 +389,7 @@ pmic@5a { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + watchdog { + compatible = "dlg,da9063-watchdog"; +diff --git a/arch/arm/boot/dts/renesas/r8a7792-blanche.dts b/arch/arm/boot/dts/renesas/r8a7792-blanche.dts +index 6a83923aa4612..20963c9bbf0ad 100644 +--- a/arch/arm/boot/dts/renesas/r8a7792-blanche.dts ++++ b/arch/arm/boot/dts/renesas/r8a7792-blanche.dts +@@ -330,6 +330,7 @@ pmic@58 { + interrupt-parent = <&irqc>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7793-gose.dts b/arch/arm/boot/dts/renesas/r8a7793-gose.dts +index 79b537b246426..9358fc7d0e9f6 100644 +--- a/arch/arm/boot/dts/renesas/r8a7793-gose.dts ++++ b/arch/arm/boot/dts/renesas/r8a7793-gose.dts +@@ -735,6 +735,7 @@ pmic@58 { + interrupt-parent = <&irqc0>; + interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7794-alt.dts b/arch/arm/boot/dts/renesas/r8a7794-alt.dts +index 4d93319674c6e..3a9db455ddec9 100644 +--- a/arch/arm/boot/dts/renesas/r8a7794-alt.dts ++++ b/arch/arm/boot/dts/renesas/r8a7794-alt.dts +@@ -458,6 +458,7 @@ pmic@58 { + interrupt-parent = <&gpio3>; + interrupts = <31 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + rtc { + compatible = "dlg,da9063-rtc"; +diff --git a/arch/arm/boot/dts/renesas/r8a7794-silk.dts b/arch/arm/boot/dts/renesas/r8a7794-silk.dts +index b7af1befa126b..b825f2e25dd06 100644 +--- a/arch/arm/boot/dts/renesas/r8a7794-silk.dts ++++ b/arch/arm/boot/dts/renesas/r8a7794-silk.dts +@@ -424,6 +424,7 @@ pmic@58 { + interrupt-parent = <&gpio3>; + interrupts = <31 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +-- +2.43.0 + diff --git a/queue-6.6/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch b/queue-6.6/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch new file mode 100644 index 00000000000..1bcbb5d54ef --- /dev/null +++ b/queue-6.6/arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch @@ -0,0 +1,99 @@ +From 6ae18343d50d123c1e0677ba1a878d57629fdb62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 12:32:02 +0100 +Subject: ARM: dts: rockchip: Drop interrupts property from pwm-rockchip nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit f98643d8daf3443e3b414a82d0cb3d745f8c8bbc ] + +The binding doesn't define interrupts and adding such a definition was +refused because it's unclear how they should ever be used and the +relevant registers are outside the PWM range. So drop them fixing +several dtbs_check warnings like: + + arch/arm/boot/dts/rockchip/rv1108-elgin-r1.dtb: pwm@10280030: 'interrupts' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/pwm/pwm-rockchip.yaml# + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240129113205.2453029-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rockchip/rv1108.dtsi | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/arch/arm/boot/dts/rockchip/rv1108.dtsi b/arch/arm/boot/dts/rockchip/rv1108.dtsi +index abf3006f0a842..f3291f3bbc6fd 100644 +--- a/arch/arm/boot/dts/rockchip/rv1108.dtsi ++++ b/arch/arm/boot/dts/rockchip/rv1108.dtsi +@@ -196,7 +196,6 @@ spi: spi@10270000 { + pwm4: pwm@10280000 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280000 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -208,7 +207,6 @@ pwm4: pwm@10280000 { + pwm5: pwm@10280010 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280010 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -220,7 +218,6 @@ pwm5: pwm@10280010 { + pwm6: pwm@10280020 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280020 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -232,7 +229,6 @@ pwm6: pwm@10280020 { + pwm7: pwm@10280030 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x10280030 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM>, <&cru PCLK_PWM>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -386,7 +382,6 @@ i2c0: i2c@20000000 { + pwm0: pwm@20040000 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040000 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -398,7 +393,6 @@ pwm0: pwm@20040000 { + pwm1: pwm@20040010 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040010 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -410,7 +404,6 @@ pwm1: pwm@20040010 { + pwm2: pwm@20040020 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040020 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +@@ -422,7 +415,6 @@ pwm2: pwm@20040020 { + pwm3: pwm@20040030 { + compatible = "rockchip,rv1108-pwm", "rockchip,rk3288-pwm"; + reg = <0x20040030 0x10>; +- interrupts = ; + clocks = <&cru SCLK_PWM0_PMU>, <&cru PCLK_PWM0_PMU>; + clock-names = "pwm", "pclk"; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-fix-dtc-interrupt_provider-warnings.patch b/queue-6.6/arm64-dts-fix-dtc-interrupt_provider-warnings.patch new file mode 100644 index 00000000000..9280ea20d25 --- /dev/null +++ b/queue-6.6/arm64-dts-fix-dtc-interrupt_provider-warnings.patch @@ -0,0 +1,168 @@ +From 04bf96f5cd40cb14f4b0d7d2a2a115265c488b7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:27 -0600 +Subject: arm64: dts: Fix dtc interrupt_provider warnings + +From: Rob Herring + +[ Upstream commit 91adecf911e5df78ea3e8f866e69db2c33416a5c ] + +The dtc interrupt_provider warning is off by default. Fix all the warnings +so it can be enabled. + +Signed-off-by: Rob Herring +Reviewed-By: AngeloGioacchino Del Regno # +Reviewed-by: Geert Uytterhoeven +Acked-by: Geert Uytterhoeven +Acked-by: Florian Fainelli #Broadcom +Acked-by: Chanho Min +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-3-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amazon/alpine-v2.dtsi | 1 - + arch/arm64/boot/dts/amazon/alpine-v3.dtsi | 1 - + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 1 + + arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 1 + + arch/arm64/boot/dts/lg/lg1312.dtsi | 1 - + arch/arm64/boot/dts/lg/lg1313.dtsi | 1 - + arch/arm64/boot/dts/marvell/armada-ap80x.dtsi | 1 - + arch/arm64/boot/dts/mediatek/mt8195-demo.dts | 1 + + arch/arm64/boot/dts/renesas/ulcb-kf.dtsi | 4 ++++ + 9 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +index dccbba6e7f98e..dbf2dce8d1d68 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v2.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v2.dtsi +@@ -145,7 +145,6 @@ pci@fbc00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <160>; + al,msi-num-spis = <160>; +diff --git a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +index 39481d7fd7d4d..3ea178acdddfe 100644 +--- a/arch/arm64/boot/dts/amazon/alpine-v3.dtsi ++++ b/arch/arm64/boot/dts/amazon/alpine-v3.dtsi +@@ -355,7 +355,6 @@ pcie@fbd00000 { + msix: msix@fbe00000 { + compatible = "al,alpine-msix"; + reg = <0x0 0xfbe00000 0x0 0x100000>; +- interrupt-controller; + msi-controller; + al,msi-base-spi = <336>; + al,msi-num-spis = <959>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 9dcd25ec2c041..896d1f33b5b61 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -586,6 +586,7 @@ gpio_g: gpio@660a0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + }; + +diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +index f049687d6b96d..d8516ec0dae74 100644 +--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi ++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi +@@ -450,6 +450,7 @@ gpio_hsls: gpio@d0000 { + #gpio-cells = <2>; + gpio-controller; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupts = ; + gpio-ranges = <&pinmux 0 0 16>, + <&pinmux 16 71 2>, +diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi +index 48ec4ebec0a83..b864ffa74ea8b 100644 +--- a/arch/arm64/boot/dts/lg/lg1312.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi +@@ -126,7 +126,6 @@ eth0: ethernet@c1b00000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi +index 3869460aa5dcb..996fb39bb50c1 100644 +--- a/arch/arm64/boot/dts/lg/lg1313.dtsi ++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi +@@ -126,7 +126,6 @@ eth0: ethernet@c3700000 { + amba { + #address-cells = <2>; + #size-cells = <1>; +- #interrupt-cells = <3>; + + compatible = "simple-bus"; + interrupt-parent = <&gic>; +diff --git a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +index 2c920e22cec2b..7ec7c789d87ef 100644 +--- a/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-ap80x.dtsi +@@ -138,7 +138,6 @@ pmu { + + odmi: odmi@300000 { + compatible = "marvell,odmi-controller"; +- interrupt-controller; + msi-controller; + marvell,odmi-frames = <4>; + reg = <0x300000 0x4000>, +diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +index 5d635085fe3fd..9079e48aea23e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts +@@ -128,6 +128,7 @@ mt6360: pmic@34 { + compatible = "mediatek,mt6360"; + reg = <0x34>; + interrupt-controller; ++ #interrupt-cells = <1>; + interrupts-extended = <&pio 101 IRQ_TYPE_EDGE_FALLING>; + interrupt-names = "IRQB"; + +diff --git a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +index 3885ef3454ff6..50de17e4fb3f2 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb-kf.dtsi +@@ -234,6 +234,7 @@ gpio_exp_74: gpio@74 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <8 IRQ_TYPE_EDGE_FALLING>; + +@@ -294,6 +295,7 @@ gpio_exp_75: gpio@75 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio6>; + interrupts = <4 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -314,6 +316,7 @@ gpio_exp_76: gpio@76 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio7>; + interrupts = <3 IRQ_TYPE_EDGE_FALLING>; + }; +@@ -324,6 +327,7 @@ gpio_exp_77: gpio@77 { + gpio-controller; + #gpio-cells = <2>; + interrupt-controller; ++ #interrupt-cells = <2>; + interrupt-parent = <&gpio5>; + interrupts = <9 IRQ_TYPE_EDGE_FALLING>; + }; +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch b/queue-6.6/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch new file mode 100644 index 00000000000..32385b26b40 --- /dev/null +++ b/queue-6.6/arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch @@ -0,0 +1,86 @@ +From 515f2b6b96f56c0bc612ec017ce477029e1790b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:34:29 -0600 +Subject: arm64: dts: qcom: Fix interrupt-map cell sizes + +From: Rob Herring + +[ Upstream commit 704dccec0d490f2ad06f3f16ebed254d81906c3a ] + +The PCI node interrupt-map properties have the wrong size as #address-cells +in the interrupt parent are not accounted for. + +The dtc interrupt_map check catches this, but the warning is off because +its dependency, interrupt_provider, is off by default. + +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20240213-arm-dt-cleanups-v1-5-f2dee1292525@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq6018.dtsi | 8 ++++---- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 16 ++++++++-------- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +index fc907afe5174c..4294a5405c012 100644 +--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi +@@ -767,10 +767,10 @@ pcie0: pci@20000000 { + + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ ++ interrupt-map = <0 0 0 1 &intc 0 0 0 75 IRQ_TYPE_LEVEL_HIGH>, /* int_a */ ++ <0 0 0 2 &intc 0 0 0 78 IRQ_TYPE_LEVEL_HIGH>, /* int_b */ ++ <0 0 0 3 &intc 0 0 0 79 IRQ_TYPE_LEVEL_HIGH>, /* int_c */ ++ <0 0 0 4 &intc 0 0 0 83 IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 92fd924bbdbe5..5effd8180cc41 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -817,13 +817,13 @@ pcie1: pci@10000000 { + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 142 ++ interrupt-map = <0 0 0 1 &intc 0 0 142 + IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 143 ++ <0 0 0 2 &intc 0 0 143 + IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 144 ++ <0 0 0 3 &intc 0 0 144 + IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 145 ++ <0 0 0 4 &intc 0 0 145 + IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE1_AXI_CLK>, +@@ -879,13 +879,13 @@ pcie0: pci@20000000 { + interrupt-names = "msi"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0x7>; +- interrupt-map = <0 0 0 1 &intc 0 75 ++ interrupt-map = <0 0 0 1 &intc 0 0 75 + IRQ_TYPE_LEVEL_HIGH>, /* int_a */ +- <0 0 0 2 &intc 0 78 ++ <0 0 0 2 &intc 0 0 78 + IRQ_TYPE_LEVEL_HIGH>, /* int_b */ +- <0 0 0 3 &intc 0 79 ++ <0 0 0 3 &intc 0 0 79 + IRQ_TYPE_LEVEL_HIGH>, /* int_c */ +- <0 0 0 4 &intc 0 83 ++ <0 0 0 4 &intc 0 0 83 + IRQ_TYPE_LEVEL_HIGH>; /* int_d */ + + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-rockchip-mark-system-power-controller-on-r.patch b/queue-6.6/arm64-dts-rockchip-mark-system-power-controller-on-r.patch new file mode 100644 index 00000000000..8d2485dfe5e --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-mark-system-power-controller-on-r.patch @@ -0,0 +1,35 @@ +From a95492e4e623abe890f2aaf9818233340b9cef7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jan 2024 20:14:48 +0100 +Subject: arm64: dts: rockchip: mark system power controller on rk3588-evb1 + +From: Sebastian Reichel + +[ Upstream commit fc4657971be31ae679e2bbeee2fb8e93a7a063eb ] + +Mark the primary PMIC as system-power-controller, so that the +system properly shuts down on poweroff. + +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20240117191555.86138-1-sebastian.reichel@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts +index 229a9111f5eb0..fa8286a325af7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3588-evb1-v10.dts +@@ -215,6 +215,7 @@ pmic@0 { + <&rk806_dvs2_null>, <&rk806_dvs3_null>; + pinctrl-names = "default"; + spi-max-frequency = <1000000>; ++ system-power-controller; + + vcc1-supply = <&vcc5v0_sys>; + vcc2-supply = <&vcc5v0_sys>; +-- +2.43.0 + diff --git a/queue-6.6/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch b/queue-6.6/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch new file mode 100644 index 00000000000..8cc903353d4 --- /dev/null +++ b/queue-6.6/arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch @@ -0,0 +1,99 @@ +From ea7b6e44de1fe51bb50c2d1f702287caaba9fa35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 18:24:38 +0000 +Subject: arm64/sve: Lower the maximum allocation for the SVE ptrace regset + +From: Mark Brown + +[ Upstream commit 2813926261e436d33bc74486b51cce60b76edf78 ] + +Doug Anderson observed that ChromeOS crashes are being reported which +include failing allocations of order 7 during core dumps due to ptrace +allocating storage for regsets: + + chrome: page allocation failure: order:7, + mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), + nodemask=(null),cpuset=urgent,mems_allowed=0 + ... + regset_get_alloc+0x1c/0x28 + elf_core_dump+0x3d8/0xd8c + do_coredump+0xeb8/0x1378 + +with further investigation showing that this is: + + [ 66.957385] DOUG: Allocating 279584 bytes + +which is the maximum size of the SVE regset. As Doug observes it is not +entirely surprising that such a large allocation of contiguous memory might +fail on a long running system. + +The SVE regset is currently sized to hold SVE registers with a VQ of +SVE_VQ_MAX which is 512, substantially more than the architectural maximum +of 16 which we might see even in a system emulating the limits of the +architecture. Since we don't expose the size we tell the regset core +externally let's define ARCH_SVE_VQ_MAX with the actual architectural +maximum and use that for the regset, we'll still overallocate most of the +time but much less so which will be helpful even if the core is fixed to +not require contiguous allocations. + +Specify ARCH_SVE_VQ_MAX in terms of the maximum value that can be written +into ZCR_ELx.LEN (where this is set in the hardware). For consistency +update the maximum SME vector length to be specified in the same style +while we are at it. + +We could also teach the ptrace core about runtime discoverable regset sizes +but that would be a more invasive change and this is being observed in +practical systems. + +Reported-by: Doug Anderson +Signed-off-by: Mark Brown +Tested-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240213-arm64-sve-ptrace-regset-size-v2-1-c7600ca74b9b@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/fpsimd.h | 12 ++++++------ + arch/arm64/kernel/ptrace.c | 3 ++- + 2 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h +index b54506d707380..7415c63b41874 100644 +--- a/arch/arm64/include/asm/fpsimd.h ++++ b/arch/arm64/include/asm/fpsimd.h +@@ -36,13 +36,13 @@ + * When we defined the maximum SVE vector length we defined the ABI so + * that the maximum vector length included all the reserved for future + * expansion bits in ZCR rather than those just currently defined by +- * the architecture. While SME follows a similar pattern the fact that +- * it includes a square matrix means that any allocations that attempt +- * to cover the maximum potential vector length (such as happen with +- * the regset used for ptrace) end up being extremely large. Define +- * the much lower actual limit for use in such situations. ++ * the architecture. Using this length to allocate worst size buffers ++ * results in excessively large allocations, and this effect is even ++ * more pronounced for SME due to ZA. Define more suitable VLs for ++ * these situations. + */ +-#define SME_VQ_MAX 16 ++#define ARCH_SVE_VQ_MAX ((ZCR_ELx_LEN_MASK >> ZCR_ELx_LEN_SHIFT) + 1) ++#define SME_VQ_MAX ((SMCR_ELx_LEN_MASK >> SMCR_ELx_LEN_SHIFT) + 1) + + struct task_struct; + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index b3f64144b5cd9..c94c0f8c9a737 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1499,7 +1499,8 @@ static const struct user_regset aarch64_regsets[] = { + #ifdef CONFIG_ARM64_SVE + [REGSET_SVE] = { /* Scalable Vector Extension */ + .core_note_type = NT_ARM_SVE, +- .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), ++ .n = DIV_ROUND_UP(SVE_PT_SIZE(ARCH_SVE_VQ_MAX, ++ SVE_PT_REGS_SVE), + SVE_VQ_BYTES), + .size = SVE_VQ_BYTES, + .align = SVE_VQ_BYTES, +-- +2.43.0 + diff --git a/queue-6.6/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch b/queue-6.6/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch new file mode 100644 index 00000000000..e6233cb3670 --- /dev/null +++ b/queue-6.6/arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch @@ -0,0 +1,35 @@ +From 28a11a7a173cf7435e6d0e11b75c3c492225bbf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 11:08:12 +0100 +Subject: arm64: tegra: Set the correct PHY mode for MGBE + +From: Thierry Reding + +[ Upstream commit 4c892121d43bc2b45896ca207b54f39a8fa6b852 ] + +The PHY is configured in 10GBASE-R, so make sure to reflect that in DT. + +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +index 4413a9b6da87a..bf2ccc8ff93c4 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +@@ -174,7 +174,7 @@ ethernet@6800000 { + status = "okay"; + + phy-handle = <&mgbe0_phy>; +- phy-mode = "usxgmii"; ++ phy-mode = "10gbase-r"; + + mdio { + #address-cells = <1>; +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch b/queue-6.6/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch new file mode 100644 index 00000000000..05fa596dc24 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch @@ -0,0 +1,42 @@ +From 1eadbea30527805bff1dbfe259eafc1a6375ae22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 16:09:23 +0530 +Subject: ASoC: amd: yc: Add HP Pavilion Aero Laptop 13-be2xxx(8BD6) into DMI + quirk table + +From: Al Raj Hassain + +[ Upstream commit b3a51137607cee7c814cd3a75d96f78b9ee1dc1f ] + +The HP Pavilion Aero Laptop 13-be2xxx(8BD6) requires a quirk entry for its internal microphone to function. + +Signed-off-by: Al Raj Hassain +Reviewed-by: Mario Limonciello +Link: https://msgid.link/r/20240304103924.13673-1-alrajhassain@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index abb9589b8477c..90360f8b3e81b 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -416,6 +416,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8B2F"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8BD6"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch b/queue-6.6/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch new file mode 100644 index 00000000000..a7f010a57a5 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch @@ -0,0 +1,42 @@ +From 36f30fb98918914fa1564ebff386d0dba1d2c68f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Feb 2024 21:44:50 +0800 +Subject: ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table + +From: Johnny Hsieh + +[ Upstream commit 50ee641643dd0f46702e9a99354398196e1734c2 ] + +This patch adds Lenovo 21J0 (ThinkBook 16 G5+ ARP) to the DMI quirks table +to enable internal microphone array. + +Cc: linux-sound@vger.kernel.org +Signed-off-by: Johnny Hsieh +Link: https://msgid.link/r/TYSPR04MB8429D62DFDB6727866ECF1DEC55A2@TYSPR04MB8429.apcprd04.prod.outlook.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index cc231185d72c3..5587198751daa 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J0"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch new file mode 100644 index 00000000000..114a94da01a --- /dev/null +++ b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch @@ -0,0 +1,41 @@ +From 95d097604c0d3faa9c0db52c8fcb64cc5b65d5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 15:39:14 +0800 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 + +From: Jiawei Wang + +[ Upstream commit ed00a6945dc32462c2d3744a3518d2316da66fcc ] + +Like many other models, the Lenovo 21J2 (ThinkBook 16 G5+ APO) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Jiawei Wang +Link: https://msgid.link/r/20240228073914.232204-2-me@jwang.link +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 5587198751daa..abb9589b8477c 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -199,6 +199,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "21HY"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "21J2"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch new file mode 100644 index 00000000000..1e4a802a861 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch @@ -0,0 +1,44 @@ +From dc3c4bc6ec143820d908e4d467aca372e392bea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:36:38 +0200 +Subject: ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Attila Tőkés + +[ Upstream commit f7fe85b229bc30cb5dc95b4e9015a601c9e3a8cd ] + +Like many other models, the Lenovo 82UU (Yoga Slim 7 Pro 14ARH7) +needs a quirk entry for the internal microphone to function. + +Signed-off-by: Attila Tőkés +Link: https://msgid.link/r/20240210193638.144028-1-attitokes@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 80ad60d485ea0..cc231185d72c3 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -234,6 +234,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "82UG"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "82UU"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch b/queue-6.6/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch new file mode 100644 index 00000000000..7dfdaa68e68 --- /dev/null +++ b/queue-6.6/asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch @@ -0,0 +1,39 @@ +From 101646479e8a70dce2a7229435cdd9e2119b3b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 11:38:49 +0000 +Subject: ASoC: cs42l43: Handle error from devm_pm_runtime_enable + +From: Charles Keepax + +[ Upstream commit d1722057477a3786b8c0d60c28fc281f6ecf1cc3 ] + +As devm_pm_runtime_enable can fail due to memory allocations, it is +best to handle the error. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20240206113850.719888-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l43.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l43.c b/sound/soc/codecs/cs42l43.c +index 5643c666d7d04..8015f4b7a5b32 100644 +--- a/sound/soc/codecs/cs42l43.c ++++ b/sound/soc/codecs/cs42l43.c +@@ -2175,7 +2175,10 @@ static int cs42l43_codec_probe(struct platform_device *pdev) + pm_runtime_use_autosuspend(priv->dev); + pm_runtime_set_active(priv->dev); + pm_runtime_get_noresume(priv->dev); +- devm_pm_runtime_enable(priv->dev); ++ ++ ret = devm_pm_runtime_enable(priv->dev); ++ if (ret) ++ goto err_pm; + + for (i = 0; i < ARRAY_SIZE(cs42l43_irqs); i++) { + ret = cs42l43_request_irq(priv, dom, cs42l43_irqs[i].name, +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch b/queue-6.6/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch new file mode 100644 index 00000000000..4486d58a107 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch @@ -0,0 +1,52 @@ +From f557367d08aa0a6533dc5ee2e5f7bfd02850f487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:28:41 +0000 +Subject: ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 + tablet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alban Boyé + +[ Upstream commit f8b0127aca8c60826e7354e504a12d4a46b1c3bb ] + +The bios version can differ depending if it is a dual-boot variant of the tablet. +Therefore another DMI match is required. + +Signed-off-by: Alban Boyé +Reviewed-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240228192807.15130-1-alban.boye@protonmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 6b631a608ae8f..e609249cc38d5 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -685,6 +685,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Chuwi Vi8 dual-boot (CWI506) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "i86"), ++ /* The above are too generic, also match BIOS info */ ++ DMI_MATCH(DMI_BIOS_VERSION, "CHUWI2.D86JHBNR02"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + /* Chuwi Vi10 (CWI505) */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch b/queue-6.6/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch new file mode 100644 index 00000000000..6089c8ae36e --- /dev/null +++ b/queue-6.6/asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch @@ -0,0 +1,63 @@ +From b90c687aa8b583c4a5a61f62461d020cf8df61d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 22:27:35 +0100 +Subject: ASoC: rt5645: Make LattePanda board DMI match more precise + +From: Hans de Goede + +[ Upstream commit 551539a8606e28cb2a130f8ef3e9834235b456c4 ] + +The DMI strings used for the LattePanda board DMI quirks are very generic. + +Using the dmidecode database from https://linux-hardware.org/ shows +that the chosen DMI strings also match the following 2 laptops +which also have a rt5645 codec: + +Insignia NS-P11W7100 https://linux-hardware.org/?computer=E092FFF8BA04 +Insignia NS-P10W8100 https://linux-hardware.org/?computer=AFB6C0BF7934 + +All 4 hw revisions of the LattePanda board have "S70CR" in their BIOS +version DMI strings: + +DF-BI-7-S70CR100-* +DF-BI-7-S70CR110-* +DF-BI-7-S70CR200-* +LP-BS-7-S70CR700-* + +See e.g. https://linux-hardware.org/?computer=D98250A817C0 + +Add a partial (non exact) DMI match on this string to make the LattePanda +board DMI match more precise to avoid false-positive matches. + +Signed-off-by: Hans de Goede +Link: https://msgid.link/r/20240211212736.179605-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index ea08b7cfc31da..e0da151508309 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3829,6 +3829,16 @@ static const struct dmi_system_id dmi_platform_data[] = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), + DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"), ++ /* ++ * Above strings are too generic, LattePanda BIOS versions for ++ * all 4 hw revisions are: ++ * DF-BI-7-S70CR100-* ++ * DF-BI-7-S70CR110-* ++ * DF-BI-7-S70CR200-* ++ * LP-BS-7-S70CR700-* ++ * Do a partial match for S70CR to avoid false positive matches. ++ */ ++ DMI_MATCH(DMI_BIOS_VERSION, "S70CR"), + }, + .driver_data = (void *)&lattepanda_board_platform_data, + }, +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch b/queue-6.6/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch new file mode 100644 index 00000000000..6b44560b9eb --- /dev/null +++ b/queue-6.6/asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch @@ -0,0 +1,69 @@ +From 2cfed62bd7e854c19cc70c8818c28196d1cb8594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 13:52:33 +0200 +Subject: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system + suspend + +From: Peter Ujfalusi + +[ Upstream commit c40aad7c81e5fba34b70123ed7ce3397fa62a4d2 ] + +When the system is suspended while audio is active, the +sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during +suspend the DSP is turned off, streams will be re-started after resume. + +If the firmware crashes during while audio is running (or when we reset +the stream before suspend) then the sof_ipc4_set_multi_pipeline_state() +will fail with IPC error and the state change is interrupted. +This will cause misalignment between the kernel and firmware state on next +DSP boot resulting errors returned by firmware for IPC messages, eventually +failing the audio resume. +On stream close the errors are ignored so the kernel state will be +corrected on the next DSP boot, so the second boot after the DSP panic. + +If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free() then +state parameter is SOF_IPC4_PIPE_RESET and only in this case. + +Treat a forced pipeline reset similarly to how we treat a pcm_free by +ignoring error on state sending to allow the kernel's state to be +consistent with the state the firmware will have after the next boot. + +Link: https://github.com/thesofproject/sof/issues/8721 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Link: https://msgid.link/r/20240213115233.15716-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-pcm.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c +index db19cd03ecad8..e8acf60c27a74 100644 +--- a/sound/soc/sof/ipc4-pcm.c ++++ b/sound/soc/sof/ipc4-pcm.c +@@ -377,7 +377,18 @@ static int sof_ipc4_trigger_pipelines(struct snd_soc_component *component, + ret = sof_ipc4_set_multi_pipeline_state(sdev, state, trigger_list); + if (ret < 0) { + dev_err(sdev->dev, "failed to set final state %d for all pipelines\n", state); +- goto free; ++ /* ++ * workaround: if the firmware is crashed while setting the ++ * pipelines to reset state we must ignore the error code and ++ * reset it to 0. ++ * Since the firmware is crashed we will not send IPC messages ++ * and we are going to see errors printed, but the state of the ++ * widgets will be correct for the next boot. ++ */ ++ if (sdev->fw_state != SOF_FW_CRASHED || state != SOF_IPC4_PIPE_RESET) ++ goto free; ++ ++ ret = 0; + } + + /* update RUNNING/RESET state for all pipelines that were just triggered */ +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch b/queue-6.6/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch new file mode 100644 index 00000000000..fc4f8fb5c06 --- /dev/null +++ b/queue-6.6/asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch @@ -0,0 +1,76 @@ +From 7c32e3ba8594a2d37ff9f127ac121cb8ce45ec19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:36 +0000 +Subject: ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode + +From: Stuart Henderson + +[ Upstream commit 6fa849e4d78b880e878138bf238e4fd2bac3c4fa ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-2-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index d444b7776ece1..914f8eb418357 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2229,6 +2229,9 @@ SND_SOC_DAPM_PGA_E("HPOUT", SND_SOC_NOPM, 0, 0, NULL, 0, hp_event, + + SND_SOC_DAPM_OUTPUT("HPOUTL"), + SND_SOC_DAPM_OUTPUT("HPOUTR"), ++ ++SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), ++SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + }; + + static const struct snd_soc_dapm_widget wm8962_dapm_spk_mono_widgets[] = { +@@ -2236,7 +2239,6 @@ SND_SOC_DAPM_MIXER("Speaker Mixer", WM8962_MIXER_ENABLES, 1, 0, + spkmixl, ARRAY_SIZE(spkmixl)), + SND_SOC_DAPM_MUX_E("Speaker PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), +-SND_SOC_DAPM_PGA("Speaker Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), + SND_SOC_DAPM_OUTPUT("SPKOUT"), + }; + +@@ -2251,9 +2253,6 @@ SND_SOC_DAPM_MUX_E("SPKOUTL PGA", WM8962_PWR_MGMT_2, 4, 0, &spkoutl_mux, + SND_SOC_DAPM_MUX_E("SPKOUTR PGA", WM8962_PWR_MGMT_2, 3, 0, &spkoutr_mux, + out_pga_event, SND_SOC_DAPM_POST_PMU), + +-SND_SOC_DAPM_PGA("SPKOUTR Output", WM8962_CLASS_D_CONTROL_1, 7, 0, NULL, 0), +-SND_SOC_DAPM_PGA("SPKOUTL Output", WM8962_CLASS_D_CONTROL_1, 6, 0, NULL, 0), +- + SND_SOC_DAPM_OUTPUT("SPKOUTL"), + SND_SOC_DAPM_OUTPUT("SPKOUTR"), + }; +@@ -2366,12 +2365,18 @@ static const struct snd_soc_dapm_route wm8962_spk_mono_intercon[] = { + { "Speaker PGA", "Mixer", "Speaker Mixer" }, + { "Speaker PGA", "DAC", "DACL" }, + +- { "Speaker Output", NULL, "Speaker PGA" }, +- { "Speaker Output", NULL, "SYSCLK" }, +- { "Speaker Output", NULL, "TOCLK" }, +- { "Speaker Output", NULL, "TEMP_SPK" }, ++ { "SPKOUTL Output", NULL, "Speaker PGA" }, ++ { "SPKOUTL Output", NULL, "SYSCLK" }, ++ { "SPKOUTL Output", NULL, "TOCLK" }, ++ { "SPKOUTL Output", NULL, "TEMP_SPK" }, ++ ++ { "SPKOUTR Output", NULL, "Speaker PGA" }, ++ { "SPKOUTR Output", NULL, "SYSCLK" }, ++ { "SPKOUTR Output", NULL, "TOCLK" }, ++ { "SPKOUTR Output", NULL, "TEMP_SPK" }, + +- { "SPKOUT", NULL, "Speaker Output" }, ++ { "SPKOUT", NULL, "SPKOUTL Output" }, ++ { "SPKOUT", NULL, "SPKOUTR Output" }, + }; + + static const struct snd_soc_dapm_route wm8962_spk_stereo_intercon[] = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch b/queue-6.6/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch new file mode 100644 index 00000000000..efbfa7ee55c --- /dev/null +++ b/queue-6.6/asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch @@ -0,0 +1,37 @@ +From fe4618768431113864735aa874065316d49919af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:35 +0000 +Subject: ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC + +From: Stuart Henderson + +[ Upstream commit 03c7874106ca5032a312626b927b1c35f07b1f35 ] + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-1-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 83ce5dbecc45d..d444b7776ece1 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2914,8 +2914,12 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + switch (fll_id) { + case WM8962_FLL_MCLK: + case WM8962_FLL_BCLK: ++ fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ break; + case WM8962_FLL_OSC: + fll1 |= (fll_id - 1) << WM8962_FLL_REFCLK_SRC_SHIFT; ++ snd_soc_component_update_bits(component, WM8962_PLL2, ++ WM8962_OSC_ENA, WM8962_OSC_ENA); + break; + case WM8962_FLL_INT: + snd_soc_component_update_bits(component, WM8962_FLL_CONTROL_1, +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch b/queue-6.6/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch new file mode 100644 index 00000000000..719380430ed --- /dev/null +++ b/queue-6.6/asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch @@ -0,0 +1,36 @@ +From 68875409b49da6b3cfb20f4faaa9fa656ddf6f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 16:14:39 +0000 +Subject: ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll + +From: Stuart Henderson + +[ Upstream commit 96e202f8c52ac49452f83317cf3b34cd1ad81e18 ] + +Use source instead of ret, which seems to be unrelated and will always +be zero. + +Signed-off-by: Stuart Henderson +Link: https://msgid.link/r/20240306161439.1385643-5-stuarth@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 914f8eb418357..4f50b07848fd8 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2933,7 +2933,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s + WM8962_FLL_FRC_NCO, WM8962_FLL_FRC_NCO); + break; + default: +- dev_err(component->dev, "Unknown FLL source %d\n", ret); ++ dev_err(component->dev, "Unknown FLL source %d\n", source); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.6/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch b/queue-6.6/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch new file mode 100644 index 00000000000..b3536f6eda1 --- /dev/null +++ b/queue-6.6/block-sed-opal-handle-empty-atoms-when-parsing-respo.patch @@ -0,0 +1,65 @@ +From 40b2c6e3f22a96adf2b48ea43c66afea1d642df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:04:17 -0600 +Subject: block: sed-opal: handle empty atoms when parsing response + +From: Greg Joyce + +[ Upstream commit 5429c8de56f6b2bd8f537df3a1e04e67b9c04282 ] + +The SED Opal response parsing function response_parse() does not +handle the case of an empty atom in the response. This causes +the entry count to be too high and the response fails to be +parsed. Recognizing, but ignoring, empty atoms allows response +handling to succeed. + +Signed-off-by: Greg Joyce +Link: https://lore.kernel.org/r/20240216210417.3526064-2-gjoyce@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/opal_proto.h | 1 + + block/sed-opal.c | 6 +++++- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/block/opal_proto.h b/block/opal_proto.h +index dec7ce3a3edb7..d247a457bf6e3 100644 +--- a/block/opal_proto.h ++++ b/block/opal_proto.h +@@ -71,6 +71,7 @@ enum opal_response_token { + #define SHORT_ATOM_BYTE 0xBF + #define MEDIUM_ATOM_BYTE 0xDF + #define LONG_ATOM_BYTE 0xE3 ++#define EMPTY_ATOM_BYTE 0xFF + + #define OPAL_INVAL_PARAM 12 + #define OPAL_MANUFACTURED_INACTIVE 0x08 +diff --git a/block/sed-opal.c b/block/sed-opal.c +index 04f38a3f5d959..e27109be77690 100644 +--- a/block/sed-opal.c ++++ b/block/sed-opal.c +@@ -1055,16 +1055,20 @@ static int response_parse(const u8 *buf, size_t length, + token_length = response_parse_medium(iter, pos); + else if (pos[0] <= LONG_ATOM_BYTE) /* long atom */ + token_length = response_parse_long(iter, pos); ++ else if (pos[0] == EMPTY_ATOM_BYTE) /* empty atom */ ++ token_length = 1; + else /* TOKEN */ + token_length = response_parse_token(iter, pos); + + if (token_length < 0) + return token_length; + ++ if (pos[0] != EMPTY_ATOM_BYTE) ++ num_entries++; ++ + pos += token_length; + total -= token_length; + iter++; +- num_entries++; + } + + resp->num = num_entries; +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch b/queue-6.6/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch new file mode 100644 index 00000000000..753bd23c503 --- /dev/null +++ b/queue-6.6/bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch @@ -0,0 +1,51 @@ +From a22fe0583e898893bd3613e2010659ebfec7f37c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 17:59:55 +0100 +Subject: Bluetooth: mgmt: Fix limited discoverable off timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +[ Upstream commit 0bd1fb586235224048c726922db048d1bce6354a ] + +LIMITED_DISCOVERABLE flag is not reset from Class of Device and +advertisement on limited discoverable timeout. This prevents to pass PTS +test GAP/DISC/LIMM/BV-02-C + +Calling set_discoverable_sync as when the limited discovery is set +correctly update the Class of Device and advertisement. + +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 9dd815b6603fe..2448a154a4069 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -1045,6 +1045,8 @@ static void rpa_expired(struct work_struct *work) + hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); + } + ++static int set_discoverable_sync(struct hci_dev *hdev, void *data); ++ + static void discov_off(struct work_struct *work) + { + struct hci_dev *hdev = container_of(work, struct hci_dev, +@@ -1063,7 +1065,7 @@ static void discov_off(struct work_struct *work) + hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); + hdev->discov_timeout = 0; + +- hci_update_discoverable(hdev); ++ hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); + + mgmt_new_settings(hdev); + +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch b/queue-6.6/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch new file mode 100644 index 00000000000..bec1e03cb6e --- /dev/null +++ b/queue-6.6/bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch @@ -0,0 +1,58 @@ +From d432321da452bff2993d0be5991b48043d36b24d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 17:10:43 +0800 +Subject: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security + +From: Yuxuan Hu <20373622@buaa.edu.cn> + +[ Upstream commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 ] + +During our fuzz testing of the connection and disconnection process at the +RFCOMM layer, we discovered this bug. By comparing the packets from a +normal connection and disconnection process with the testcase that +triggered a KASAN report. We analyzed the cause of this bug as follows: + +1. In the packets captured during a normal connection, the host sends a +`Read Encryption Key Size` type of `HCI_CMD` packet +(Command Opcode: 0x1408) to the controller to inquire the length of +encryption key.After receiving this packet, the controller immediately +replies with a Command Completepacket (Event Code: 0x0e) to return the +Encryption Key Size. + +2. In our fuzz test case, the timing of the controller's response to this +packet was delayed to an unexpected point: after the RFCOMM and L2CAP +layers had disconnected but before the HCI layer had disconnected. + +3. After receiving the Encryption Key Size Response at the time described +in point 2, the host still called the rfcomm_check_security function. +However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` +had already been released, and when the function executed +`return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, +specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. + +To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling +rfcomm_recv_frame in rfcomm_process_rx. + +Signed-off-by: Yuxuan Hu <20373622@buaa.edu.cn> +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c +index 053ef8f25fae4..1d34d84970332 100644 +--- a/net/bluetooth/rfcomm/core.c ++++ b/net/bluetooth/rfcomm/core.c +@@ -1941,7 +1941,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) + /* Get data directly from socket receive queue without copying it. */ + while ((skb = skb_dequeue(&sk->sk_receive_queue))) { + skb_orphan(skb); +- if (!skb_linearize(skb)) { ++ if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { + s = rfcomm_recv_frame(s, skb); + if (!s) + break; +-- +2.43.0 + diff --git a/queue-6.6/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch b/queue-6.6/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch new file mode 100644 index 00000000000..fb18f898781 --- /dev/null +++ b/queue-6.6/btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch @@ -0,0 +1,104 @@ +From c2da22eaa207cf64b5fb7fc49300f665409b1142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 20:10:07 +0000 +Subject: btrfs: fix data race at btrfs_use_block_rsv() when accessing block + reserve + +From: Filipe Manana + +[ Upstream commit c7bb26b847e5b97814f522686068c5628e2b3646 ] + +At btrfs_use_block_rsv() we read the size of a block reserve without +locking its spinlock, which makes KCSAN complain because the size of a +block reserve is always updated while holding its spinlock. The report +from KCSAN is the following: + + [653.313148] BUG: KCSAN: data-race in btrfs_update_delayed_refs_rsv [btrfs] / btrfs_use_block_rsv [btrfs] + + [653.314755] read to 0x000000017f5871b8 of 8 bytes by task 7519 on cpu 0: + [653.314779] btrfs_use_block_rsv+0xe4/0x2f8 [btrfs] + [653.315606] btrfs_alloc_tree_block+0xdc/0x998 [btrfs] + [653.316421] btrfs_force_cow_block+0x220/0xe38 [btrfs] + [653.317242] btrfs_cow_block+0x1ac/0x568 [btrfs] + [653.318060] btrfs_search_slot+0xda2/0x19b8 [btrfs] + [653.318879] btrfs_del_csums+0x1dc/0x798 [btrfs] + [653.319702] __btrfs_free_extent.isra.0+0xc24/0x2028 [btrfs] + [653.320538] __btrfs_run_delayed_refs+0xd3c/0x2390 [btrfs] + [653.321340] btrfs_run_delayed_refs+0xae/0x290 [btrfs] + [653.322140] flush_space+0x5e4/0x718 [btrfs] + [653.322958] btrfs_preempt_reclaim_metadata_space+0x102/0x2f8 [btrfs] + [653.323781] process_one_work+0x3b6/0x838 + [653.323800] worker_thread+0x75e/0xb10 + [653.323817] kthread+0x21a/0x230 + [653.323836] __ret_from_fork+0x6c/0xb8 + [653.323855] ret_from_fork+0xa/0x30 + + [653.323887] write to 0x000000017f5871b8 of 8 bytes by task 576 on cpu 3: + [653.323906] btrfs_update_delayed_refs_rsv+0x1a4/0x250 [btrfs] + [653.324699] btrfs_add_delayed_data_ref+0x468/0x6d8 [btrfs] + [653.325494] btrfs_free_extent+0x76/0x120 [btrfs] + [653.326280] __btrfs_mod_ref+0x6a8/0x6b8 [btrfs] + [653.327064] btrfs_dec_ref+0x50/0x70 [btrfs] + [653.327849] walk_up_proc+0x236/0xa50 [btrfs] + [653.328633] walk_up_tree+0x21c/0x448 [btrfs] + [653.329418] btrfs_drop_snapshot+0x802/0x1328 [btrfs] + [653.330205] btrfs_clean_one_deleted_snapshot+0x184/0x238 [btrfs] + [653.330995] cleaner_kthread+0x2b0/0x2f0 [btrfs] + [653.331781] kthread+0x21a/0x230 + [653.331800] __ret_from_fork+0x6c/0xb8 + [653.331818] ret_from_fork+0xa/0x30 + +So add a helper to get the size of a block reserve while holding the lock. +Reading the field while holding the lock instead of using the data_race() +annotation is used in order to prevent load tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.c | 2 +- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/block-rsv.c b/fs/btrfs/block-rsv.c +index 77684c5e0c8ba..db8da4e7b2289 100644 +--- a/fs/btrfs/block-rsv.c ++++ b/fs/btrfs/block-rsv.c +@@ -486,7 +486,7 @@ struct btrfs_block_rsv *btrfs_use_block_rsv(struct btrfs_trans_handle *trans, + + block_rsv = get_block_rsv(trans, root); + +- if (unlikely(block_rsv->size == 0)) ++ if (unlikely(btrfs_block_rsv_size(block_rsv) == 0)) + goto try_reserve; + again: + ret = btrfs_block_rsv_use_bytes(block_rsv, blocksize); +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index fb440a074700a..43a9a6b5a79f4 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -117,4 +117,20 @@ static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) + return ret; + } + ++/* ++ * Get the size of a block reserve in a context where getting a stale value is ++ * acceptable, instead of accessing it directly and trigger data race warning ++ * from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_size(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->size; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +-- +2.43.0 + diff --git a/queue-6.6/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch b/queue-6.6/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch new file mode 100644 index 00000000000..8e328d4ff14 --- /dev/null +++ b/queue-6.6/btrfs-fix-data-races-when-accessing-the-reserved-amo.patch @@ -0,0 +1,164 @@ +From 45895779de38f64826cc3d1dfd48d87f79e86cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 19:41:23 +0000 +Subject: btrfs: fix data races when accessing the reserved amount of block + reserves + +From: Filipe Manana + +[ Upstream commit e06cc89475eddc1f3a7a4d471524256152c68166 ] + +At space_info.c we have several places where we access the ->reserved +field of a block reserve without taking the block reserve's spinlock +first, which makes KCSAN warn about a data race since that field is +always updated while holding the spinlock. + +The reports from KCSAN are like the following: + + [117.193526] BUG: KCSAN: data-race in btrfs_block_rsv_release [btrfs] / need_preemptive_reclaim [btrfs] + + [117.195148] read to 0x000000017f587190 of 8 bytes by task 6303 on cpu 3: + [117.195172] need_preemptive_reclaim+0x222/0x2f0 [btrfs] + [117.195992] __reserve_bytes+0xbb0/0xdc8 [btrfs] + [117.196807] btrfs_reserve_metadata_bytes+0x4c/0x120 [btrfs] + [117.197620] btrfs_block_rsv_add+0x78/0xa8 [btrfs] + [117.198434] btrfs_delayed_update_inode+0x154/0x368 [btrfs] + [117.199300] btrfs_update_inode+0x108/0x1c8 [btrfs] + [117.200122] btrfs_dirty_inode+0xb4/0x140 [btrfs] + [117.200937] btrfs_update_time+0x8c/0xb0 [btrfs] + [117.201754] touch_atime+0x16c/0x1e0 + [117.201789] filemap_read+0x674/0x728 + [117.201823] btrfs_file_read_iter+0xf8/0x410 [btrfs] + [117.202653] vfs_read+0x2b6/0x498 + [117.203454] ksys_read+0xa2/0x150 + [117.203473] __s390x_sys_read+0x68/0x88 + [117.203495] do_syscall+0x1c6/0x210 + [117.203517] __do_syscall+0xc8/0xf0 + [117.203539] system_call+0x70/0x98 + + [117.203579] write to 0x000000017f587190 of 8 bytes by task 11 on cpu 0: + [117.203604] btrfs_block_rsv_release+0x2e8/0x578 [btrfs] + [117.204432] btrfs_delayed_inode_release_metadata+0x7c/0x1d0 [btrfs] + [117.205259] __btrfs_update_delayed_inode+0x37c/0x5e0 [btrfs] + [117.206093] btrfs_async_run_delayed_root+0x356/0x498 [btrfs] + [117.206917] btrfs_work_helper+0x160/0x7a0 [btrfs] + [117.207738] process_one_work+0x3b6/0x838 + [117.207768] worker_thread+0x75e/0xb10 + [117.207797] kthread+0x21a/0x230 + [117.207830] __ret_from_fork+0x6c/0xb8 + [117.207861] ret_from_fork+0xa/0x30 + +So add a helper to get the reserved amount of a block reserve while +holding the lock. The value may be not be up to date anymore when used by +need_preemptive_reclaim() and btrfs_preempt_reclaim_metadata_space(), but +that's ok since the worst it can do is cause more reclaim work do be done +sooner rather than later. Reading the field while holding the lock instead +of using the data_race() annotation is used in order to prevent load +tearing. + +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-rsv.h | 16 ++++++++++++++++ + fs/btrfs/space-info.c | 26 +++++++++++++------------- + 2 files changed, 29 insertions(+), 13 deletions(-) + +diff --git a/fs/btrfs/block-rsv.h b/fs/btrfs/block-rsv.h +index b0bd12b8652f4..fb440a074700a 100644 +--- a/fs/btrfs/block-rsv.h ++++ b/fs/btrfs/block-rsv.h +@@ -101,4 +101,20 @@ static inline bool btrfs_block_rsv_full(const struct btrfs_block_rsv *rsv) + return data_race(rsv->full); + } + ++/* ++ * Get the reserved mount of a block reserve in a context where getting a stale ++ * value is acceptable, instead of accessing it directly and trigger data race ++ * warning from KCSAN. ++ */ ++static inline u64 btrfs_block_rsv_reserved(struct btrfs_block_rsv *rsv) ++{ ++ u64 ret; ++ ++ spin_lock(&rsv->lock); ++ ret = rsv->reserved; ++ spin_unlock(&rsv->lock); ++ ++ return ret; ++} ++ + #endif /* BTRFS_BLOCK_RSV_H */ +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index d7e8cd4f140cf..3f7a9605e2d3a 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -837,7 +837,7 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_fs_info *fs_info, + static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + struct btrfs_space_info *space_info) + { +- u64 global_rsv_size = fs_info->global_block_rsv.reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(&fs_info->global_block_rsv); + u64 ordered, delalloc; + u64 thresh; + u64 used; +@@ -937,8 +937,8 @@ static bool need_preemptive_reclaim(struct btrfs_fs_info *fs_info, + ordered = percpu_counter_read_positive(&fs_info->ordered_bytes) >> 1; + delalloc = percpu_counter_read_positive(&fs_info->delalloc_bytes); + if (ordered >= delalloc) +- used += fs_info->delayed_refs_rsv.reserved + +- fs_info->delayed_block_rsv.reserved; ++ used += btrfs_block_rsv_reserved(&fs_info->delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(&fs_info->delayed_block_rsv); + else + used += space_info->bytes_may_use - global_rsv_size; + +@@ -1153,7 +1153,7 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + enum btrfs_flush_state flush; + u64 delalloc_size = 0; + u64 to_reclaim, block_rsv_size; +- u64 global_rsv_size = global_rsv->reserved; ++ const u64 global_rsv_size = btrfs_block_rsv_reserved(global_rsv); + + loops++; + +@@ -1165,9 +1165,9 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + * assume it's tied up in delalloc reservations. + */ + block_rsv_size = global_rsv_size + +- delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved + +- trans_rsv->reserved; ++ btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv) + ++ btrfs_block_rsv_reserved(trans_rsv); + if (block_rsv_size < space_info->bytes_may_use) + delalloc_size = space_info->bytes_may_use - block_rsv_size; + +@@ -1187,16 +1187,16 @@ static void btrfs_preempt_reclaim_metadata_space(struct work_struct *work) + to_reclaim = delalloc_size; + flush = FLUSH_DELALLOC; + } else if (space_info->bytes_pinned > +- (delayed_block_rsv->reserved + +- delayed_refs_rsv->reserved)) { ++ (btrfs_block_rsv_reserved(delayed_block_rsv) + ++ btrfs_block_rsv_reserved(delayed_refs_rsv))) { + to_reclaim = space_info->bytes_pinned; + flush = COMMIT_TRANS; +- } else if (delayed_block_rsv->reserved > +- delayed_refs_rsv->reserved) { +- to_reclaim = delayed_block_rsv->reserved; ++ } else if (btrfs_block_rsv_reserved(delayed_block_rsv) > ++ btrfs_block_rsv_reserved(delayed_refs_rsv)) { ++ to_reclaim = btrfs_block_rsv_reserved(delayed_block_rsv); + flush = FLUSH_DELAYED_ITEMS_NR; + } else { +- to_reclaim = delayed_refs_rsv->reserved; ++ to_reclaim = btrfs_block_rsv_reserved(delayed_refs_rsv); + flush = FLUSH_DELAYED_REFS_NR; + } + +-- +2.43.0 + diff --git a/queue-6.6/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch b/queue-6.6/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch new file mode 100644 index 00000000000..25ec5c38b66 --- /dev/null +++ b/queue-6.6/cxl-region-allow-out-of-order-assembly-of-autodiscov.patch @@ -0,0 +1,115 @@ +From 97e8ff31a733139e1ab911096f65d75fffeb26aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 13:59:31 -0800 +Subject: cxl/region: Allow out of order assembly of autodiscovered regions + +From: Alison Schofield + +[ Upstream commit cb66b1d60c283bb340a2fc19deff7de8acea74b1 ] + +Autodiscovered regions can fail to assemble if they are not discovered +in HPA decode order. The user will see failure messages like: + +[] cxl region0: endpoint5: HPA order violation region1 +[] cxl region0: endpoint5: failed to allocate region reference + +The check that is causing the failure helps the CXL driver enforce +a CXL spec mandate that decoders be committed in HPA order. The +check is needless for autodiscovered regions since their decoders +are already programmed. Trying to enforce order in the assembly of +these regions is useless because they are assembled once all their +member endpoints arrive, and there is no guarantee on the order in +which endpoints are discovered during probe. + +Keep the existing check, but for autodiscovered regions, allow the +out of order assembly after a sanity check that the lesser numbered +decoder has the lesser HPA starting address. + +Signed-off-by: Alison Schofield +Tested-by: Wonjae Lee +Link: https://lore.kernel.org/r/3dec69ee97524ab229a20c6739272c3000b18408.1706736863.git.alison.schofield@intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/region.c | 48 +++++++++++++++++++++++++++++++-------- + 1 file changed, 38 insertions(+), 10 deletions(-) + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index a3d82ef5599e8..e2a82ee4ff0cf 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -757,8 +757,31 @@ cxl_region_find_decoder(struct cxl_port *port, + return to_cxl_decoder(dev); + } + +-static struct cxl_region_ref *alloc_region_ref(struct cxl_port *port, +- struct cxl_region *cxlr) ++static bool auto_order_ok(struct cxl_port *port, struct cxl_region *cxlr_iter, ++ struct cxl_decoder *cxld) ++{ ++ struct cxl_region_ref *rr = cxl_rr_load(port, cxlr_iter); ++ struct cxl_decoder *cxld_iter = rr->decoder; ++ ++ /* ++ * Allow the out of order assembly of auto-discovered regions. ++ * Per CXL Spec 3.1 8.2.4.20.12 software must commit decoders ++ * in HPA order. Confirm that the decoder with the lesser HPA ++ * starting address has the lesser id. ++ */ ++ dev_dbg(&cxld->dev, "check for HPA violation %s:%d < %s:%d\n", ++ dev_name(&cxld->dev), cxld->id, ++ dev_name(&cxld_iter->dev), cxld_iter->id); ++ ++ if (cxld_iter->id > cxld->id) ++ return true; ++ ++ return false; ++} ++ ++static struct cxl_region_ref * ++alloc_region_ref(struct cxl_port *port, struct cxl_region *cxlr, ++ struct cxl_endpoint_decoder *cxled) + { + struct cxl_region_params *p = &cxlr->params; + struct cxl_region_ref *cxl_rr, *iter; +@@ -768,16 +791,21 @@ static struct cxl_region_ref *alloc_region_ref(struct cxl_port *port, + xa_for_each(&port->regions, index, iter) { + struct cxl_region_params *ip = &iter->region->params; + +- if (!ip->res) ++ if (!ip->res || ip->res->start < p->res->start) + continue; + +- if (ip->res->start > p->res->start) { +- dev_dbg(&cxlr->dev, +- "%s: HPA order violation %s:%pr vs %pr\n", +- dev_name(&port->dev), +- dev_name(&iter->region->dev), ip->res, p->res); +- return ERR_PTR(-EBUSY); ++ if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) { ++ struct cxl_decoder *cxld; ++ ++ cxld = cxl_region_find_decoder(port, cxled, cxlr); ++ if (auto_order_ok(port, iter->region, cxld)) ++ continue; + } ++ dev_dbg(&cxlr->dev, "%s: HPA order violation %s:%pr vs %pr\n", ++ dev_name(&port->dev), ++ dev_name(&iter->region->dev), ip->res, p->res); ++ ++ return ERR_PTR(-EBUSY); + } + + cxl_rr = kzalloc(sizeof(*cxl_rr), GFP_KERNEL); +@@ -954,7 +982,7 @@ static int cxl_port_attach_region(struct cxl_port *port, + nr_targets_inc = true; + } + } else { +- cxl_rr = alloc_region_ref(port, cxlr); ++ cxl_rr = alloc_region_ref(port, cxlr, cxled); + if (IS_ERR(cxl_rr)) { + dev_dbg(&cxlr->dev, + "%s: failed to allocate region reference\n", +-- +2.43.0 + diff --git a/queue-6.6/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch b/queue-6.6/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch new file mode 100644 index 00000000000..ea6b070a17b --- /dev/null +++ b/queue-6.6/cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch @@ -0,0 +1,65 @@ +From 8a0a1f5dfb3bc56fa3924bba238845250f7451a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 13:59:30 -0800 +Subject: cxl/region: Handle endpoint decoders in cxl_region_find_decoder() + +From: Alison Schofield + +[ Upstream commit 453a7fde8031a5192ed2f9646ad048c1a5e930dc ] + +In preparation for adding a new caller of cxl_region_find_decoders() +teach it to find a decoder from a cxl_endpoint_decoder structure. + +Combining switch and endpoint decoder lookup in one function prevents +code duplication in call sites. + +Update the existing caller. + +Signed-off-by: Alison Schofield +Tested-by: Wonjae Lee +Link: https://lore.kernel.org/r/79ae6d72978ef9f3ceec9722e1cb793820553c8e.1706736863.git.alison.schofield@intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/core/region.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c +index 6ebd12f7970bc..a3d82ef5599e8 100644 +--- a/drivers/cxl/core/region.c ++++ b/drivers/cxl/core/region.c +@@ -729,12 +729,17 @@ static int match_auto_decoder(struct device *dev, void *data) + return 0; + } + +-static struct cxl_decoder *cxl_region_find_decoder(struct cxl_port *port, +- struct cxl_region *cxlr) ++static struct cxl_decoder * ++cxl_region_find_decoder(struct cxl_port *port, ++ struct cxl_endpoint_decoder *cxled, ++ struct cxl_region *cxlr) + { + struct device *dev; + int id = 0; + ++ if (port == cxled_to_port(cxled)) ++ return &cxled->cxld; ++ + if (test_bit(CXL_REGION_F_AUTO, &cxlr->flags)) + dev = device_find_child(&port->dev, &cxlr->params, + match_auto_decoder); +@@ -852,10 +857,7 @@ static int cxl_rr_alloc_decoder(struct cxl_port *port, struct cxl_region *cxlr, + { + struct cxl_decoder *cxld; + +- if (port == cxled_to_port(cxled)) +- cxld = &cxled->cxld; +- else +- cxld = cxl_region_find_decoder(port, cxlr); ++ cxld = cxl_region_find_decoder(port, cxled, cxlr); + if (!cxld) { + dev_dbg(&cxlr->dev, "%s: no decoder available\n", + dev_name(&port->dev)); +-- +2.43.0 + diff --git a/queue-6.6/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch b/queue-6.6/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch new file mode 100644 index 00000000000..efae0b5bea3 --- /dev/null +++ b/queue-6.6/dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch @@ -0,0 +1,71 @@ +From 833fa53b7154fc172b264066368ad7c527b225a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 19:11:51 +0100 +Subject: dm-verity, dm-crypt: align "struct bvec_iter" correctly + +From: Mikulas Patocka + +[ Upstream commit 787f1b2800464aa277236a66eb3c279535edd460 ] + +"struct bvec_iter" is defined with the __packed attribute, so it is +aligned on a single byte. On X86 (and on other architectures that support +unaligned addresses in hardware), "struct bvec_iter" is accessed using the +8-byte and 4-byte memory instructions, however these instructions are less +efficient if they operate on unaligned addresses. + +(on RISC machines that don't have unaligned access in hardware, GCC +generates byte-by-byte accesses that are very inefficient - see [1]) + +This commit reorders the entries in "struct dm_verity_io" and "struct +convert_context", so that "struct bvec_iter" is aligned on 8 bytes. + +[1] https://lore.kernel.org/all/ZcLuWUNRZadJr0tQ@fedora/T/ + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 4 ++-- + drivers/md/dm-verity.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 5a296db23feb3..aa6bb5b4704ba 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -53,11 +53,11 @@ + struct convert_context { + struct completion restart; + struct bio *bio_in; +- struct bio *bio_out; + struct bvec_iter iter_in; ++ struct bio *bio_out; + struct bvec_iter iter_out; +- u64 cc_sector; + atomic_t cc_pending; ++ u64 cc_sector; + union { + struct skcipher_request *req; + struct aead_request *req_aead; +diff --git a/drivers/md/dm-verity.h b/drivers/md/dm-verity.h +index 4620a98c99561..db93a91169d5e 100644 +--- a/drivers/md/dm-verity.h ++++ b/drivers/md/dm-verity.h +@@ -80,12 +80,12 @@ struct dm_verity_io { + /* original value of bio->bi_end_io */ + bio_end_io_t *orig_bi_end_io; + ++ struct bvec_iter iter; ++ + sector_t block; + unsigned int n_blocks; + bool in_tasklet; + +- struct bvec_iter iter; +- + struct work_struct work; + + char *recheck_buffer; +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch b/queue-6.6/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch new file mode 100644 index 00000000000..61914c9a080 --- /dev/null +++ b/queue-6.6/drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch @@ -0,0 +1,90 @@ +From d1c595db85e5cf4f456fcb2aa0028525b1d80997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 20:56:59 +0800 +Subject: drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series + +From: Prike Liang + +[ Upstream commit c671ec01311b4744b377f98b0b4c6d033fe569b3 ] + +Currently, GPU resets can now be performed successfully on the Raven +series. While GPU reset is required for the S3 suspend abort case. +So now can enable gpu reset for S3 abort cases on the Raven series. + +Signed-off-by: Prike Liang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 45 +++++++++++++++++------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 2a7c606d1d191..a41ed67ea9fea 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -574,11 +574,34 @@ soc15_asic_reset_method(struct amdgpu_device *adev) + return AMD_RESET_METHOD_MODE1; + } + ++static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) ++{ ++ u32 sol_reg; ++ ++ sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); ++ ++ /* Will reset for the following suspend abort cases. ++ * 1) Only reset limit on APU side, dGPU hasn't checked yet. ++ * 2) S3 suspend abort and TOS already launched. ++ */ ++ if (adev->flags & AMD_IS_APU && adev->in_s3 && ++ !adev->suspend_complete && ++ sol_reg) ++ return true; ++ ++ return false; ++} ++ + static int soc15_asic_reset(struct amdgpu_device *adev) + { + /* original raven doesn't have full asic reset */ +- if ((adev->apu_flags & AMD_APU_IS_RAVEN) || +- (adev->apu_flags & AMD_APU_IS_RAVEN2)) ++ /* On the latest Raven, the GPU reset can be performed ++ * successfully. So now, temporarily enable it for the ++ * S3 suspend abort case. ++ */ ++ if (((adev->apu_flags & AMD_APU_IS_RAVEN) || ++ (adev->apu_flags & AMD_APU_IS_RAVEN2)) && ++ !soc15_need_reset_on_resume(adev)) + return 0; + + switch (soc15_asic_reset_method(adev)) { +@@ -1296,24 +1319,6 @@ static int soc15_common_suspend(void *handle) + return soc15_common_hw_fini(adev); + } + +-static bool soc15_need_reset_on_resume(struct amdgpu_device *adev) +-{ +- u32 sol_reg; +- +- sol_reg = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_81); +- +- /* Will reset for the following suspend abort cases. +- * 1) Only reset limit on APU side, dGPU hasn't checked yet. +- * 2) S3 suspend abort and TOS already launched. +- */ +- if (adev->flags & AMD_IS_APU && adev->in_s3 && +- !adev->suspend_complete && +- sol_reg) +- return true; +- +- return false; +-} +- + static int soc15_common_resume(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +-- +2.43.0 + diff --git a/queue-6.6/drm-ttm-tests-depend-on-uml-compile_test.patch b/queue-6.6/drm-ttm-tests-depend-on-uml-compile_test.patch new file mode 100644 index 00000000000..0be0d900862 --- /dev/null +++ b/queue-6.6/drm-ttm-tests-depend-on-uml-compile_test.patch @@ -0,0 +1,50 @@ +From 10f05062cfec036f96940c23d7673361a526190c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 08:18:59 +0100 +Subject: drm/ttm/tests: depend on UML || COMPILE_TEST +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 9d3f8a723c7950e56e0b95ab84b572caee29e065 ] + +At least the device test requires that no other driver using TTM is +loaded. So make those unit tests depend on UML || COMPILE_TEST to +prevent people from trying them on bare metal. + +Signed-off-by: Christian König +Acked-by: Alex Deucher +Link: https://lore.kernel.org/all/20240219230116.77b8ad68@yea/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 3caa020391c75..ec4abf9ff47b5 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -198,7 +198,7 @@ config DRM_TTM + config DRM_TTM_KUNIT_TEST + tristate "KUnit tests for TTM" if !KUNIT_ALL_TESTS + default n +- depends on DRM && KUNIT && MMU ++ depends on DRM && KUNIT && MMU && (UML || COMPILE_TEST) + select DRM_TTM + select DRM_EXPORT_FOR_TESTS if m + select DRM_KUNIT_TEST_HELPERS +@@ -206,7 +206,8 @@ config DRM_TTM_KUNIT_TEST + help + Enables unit tests for TTM, a GPU memory manager subsystem used + to manage memory buffers. This option is mostly useful for kernel +- developers. ++ developers. It depends on (UML || COMPILE_TEST) since no other driver ++ which uses TTM can be loaded while running the tests. + + If in doubt, say "N". + +-- +2.43.0 + diff --git a/queue-6.6/firewire-core-use-long-bus-reset-on-gap-count-error.patch b/queue-6.6/firewire-core-use-long-bus-reset-on-gap-count-error.patch new file mode 100644 index 00000000000..7fd4d63bdb2 --- /dev/null +++ b/queue-6.6/firewire-core-use-long-bus-reset-on-gap-count-error.patch @@ -0,0 +1,65 @@ +From 8fb774f7aec2217de7d21f68178a38b41ba91328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 22:17:37 +0900 +Subject: firewire: core: use long bus reset on gap count error + +From: Takashi Sakamoto + +[ Upstream commit d0b06dc48fb15902d7da09c5c0861e7f042a9381 ] + +When resetting the bus after a gap count error, use a long rather than +short bus reset. + +IEEE 1394-1995 uses only long bus resets. IEEE 1394a adds the option of +short bus resets. When video or audio transmission is in progress and a +device is hot-plugged elsewhere on the bus, the resulting bus reset can +cause video frame drops or audio dropouts. Short bus resets reduce or +eliminate this problem. Accordingly, short bus resets are almost always +preferred. + +However, on a mixed 1394/1394a bus, a short bus reset can trigger an +immediate additional bus reset. This double bus reset can be interpreted +differently by different nodes on the bus, resulting in an inconsistent gap +count after the bus reset. An inconsistent gap count will cause another bus +reset, leading to a neverending bus reset loop. This only happens for some +bus topologies, not for all mixed 1394/1394a buses. + +By instead sending a long bus reset after a gap count inconsistency, we +avoid the doubled bus reset, restoring the bus to normal operation. + +Signed-off-by: Adam Goldman +Link: https://sourceforge.net/p/linux1394/mailman/message/58741624/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/core-card.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c +index 8aaa7fcb2630d..401a77e3b5fa8 100644 +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -500,7 +500,19 @@ static void bm_work(struct work_struct *work) + fw_notice(card, "phy config: new root=%x, gap_count=%d\n", + new_root_id, gap_count); + fw_send_phy_config(card, new_root_id, generation, gap_count); +- reset_bus(card, true); ++ /* ++ * Where possible, use a short bus reset to minimize ++ * disruption to isochronous transfers. But in the event ++ * of a gap count inconsistency, use a long bus reset. ++ * ++ * As noted in 1394a 8.4.6.2, nodes on a mixed 1394/1394a bus ++ * may set different gap counts after a bus reset. On a mixed ++ * 1394/1394a bus, a short bus reset can get doubled. Some ++ * nodes may treat the double reset as one bus reset and others ++ * may treat it as two, causing a gap count inconsistency ++ * again. Using a long bus reset prevents this. ++ */ ++ reset_bus(card, card->gap_count != 0); + /* Will allocate broadcast channel after the reset. */ + goto out; + } +-- +2.43.0 + diff --git a/queue-6.6/gen_compile_commands-fix-invalid-escape-sequence-war.patch b/queue-6.6/gen_compile_commands-fix-invalid-escape-sequence-war.patch new file mode 100644 index 00000000000..c2a5b3fa3f9 --- /dev/null +++ b/queue-6.6/gen_compile_commands-fix-invalid-escape-sequence-war.patch @@ -0,0 +1,36 @@ +From d803d60153580f23150556e0be45234b5eca4b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:23:05 -0600 +Subject: gen_compile_commands: fix invalid escape sequence warning + +From: Andrew Ballance + +[ Upstream commit dae4a0171e25884787da32823b3081b4c2acebb2 ] + +With python 3.12, '\#' results in this warning + SyntaxWarning: invalid escape sequence '\#' + +Signed-off-by: Andrew Ballance +Reviewed-by: Justin Stitt +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/clang-tools/gen_compile_commands.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/clang-tools/gen_compile_commands.py b/scripts/clang-tools/gen_compile_commands.py +index a84cc5737c2c6..bc005cac19441 100755 +--- a/scripts/clang-tools/gen_compile_commands.py ++++ b/scripts/clang-tools/gen_compile_commands.py +@@ -170,7 +170,7 @@ def process_line(root_directory, command_prefix, file_path): + # escape the pound sign '#', either as '\#' or '$(pound)' (depending on the + # kernel version). The compile_commands.json file is not interepreted + # by Make, so this code replaces the escaped version with '#'. +- prefix = command_prefix.replace('\#', '#').replace('$(pound)', '#') ++ prefix = command_prefix.replace(r'\#', '#').replace('$(pound)', '#') + + # Use os.path.abspath() to normalize the path resolving '.' and '..' . + abs_path = os.path.abspath(os.path.join(root_directory, file_path)) +-- +2.43.0 + diff --git a/queue-6.6/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch b/queue-6.6/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch new file mode 100644 index 00000000000..d8692e5760a --- /dev/null +++ b/queue-6.6/hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch @@ -0,0 +1,40 @@ +From e56b40511950a1fe6f52b3af2cd9fde9d256b3b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 19:04:29 +0000 +Subject: HID: multitouch: Add required quirk for Synaptics 0xcddc device + +From: Manuel Fombuena + +[ Upstream commit 1741a8269e1c51fa08d4bfdf34667387a6eb10ec ] + +Add support for the pointing stick (Accupoint) and 2 mouse buttons. + +Present on some Toshiba/dynabook Portege X30 and X40 laptops. + +It should close https://bugzilla.kernel.org/show_bug.cgi?id=205817 + +Signed-off-by: Manuel Fombuena +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 5ec1f174127a3..3816fd06bc953 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2153,6 +2153,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xcd7e) }, + ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_SYNAPTICS, 0xcddc) }, ++ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_SYNAPTICS, 0xce08) }, +-- +2.43.0 + diff --git a/queue-6.6/input-gpio_keys_polled-suppress-deferred-probe-error.patch b/queue-6.6/input-gpio_keys_polled-suppress-deferred-probe-error.patch new file mode 100644 index 00000000000..a8ebe77a8da --- /dev/null +++ b/queue-6.6/input-gpio_keys_polled-suppress-deferred-probe-error.patch @@ -0,0 +1,55 @@ +From 452b145989e5e964dc44d4baec67255c8b90ed6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:10:42 +0100 +Subject: Input: gpio_keys_polled - suppress deferred probe error for gpio +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 963465a33141d0d52338e77f80fe543d2c9dc053 ] + +On a PC Engines APU our admins are faced with: + + $ dmesg | grep -c "gpio-keys-polled gpio-keys-polled: unable to claim gpio 0, err=-517" + 261 + +Such a message always appears when e.g. a new USB device is plugged in. + +Suppress this message which considerably clutters the kernel log for +EPROBE_DEFER (i.e. -517). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240305101042.10953-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/gpio_keys_polled.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/keyboard/gpio_keys_polled.c b/drivers/input/keyboard/gpio_keys_polled.c +index ba00ecfbd343b..b41fd1240f431 100644 +--- a/drivers/input/keyboard/gpio_keys_polled.c ++++ b/drivers/input/keyboard/gpio_keys_polled.c +@@ -315,12 +315,10 @@ static int gpio_keys_polled_probe(struct platform_device *pdev) + + error = devm_gpio_request_one(dev, button->gpio, + flags, button->desc ? : DRV_NAME); +- if (error) { +- dev_err(dev, +- "unable to claim gpio %u, err=%d\n", +- button->gpio, error); +- return error; +- } ++ if (error) ++ return dev_err_probe(dev, error, ++ "unable to claim gpio %u\n", ++ button->gpio); + + bdata->gpiod = gpio_to_desc(button->gpio); + if (!bdata->gpiod) { +-- +2.43.0 + diff --git a/queue-6.6/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch b/queue-6.6/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch new file mode 100644 index 00000000000..b8a72bfc0ec --- /dev/null +++ b/queue-6.6/media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch @@ -0,0 +1,140 @@ +From d4695ef0e6f53f55c58fca4a7338525e01ad4da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 08:54:01 +0100 +Subject: media: rkisp1: Fix IRQ handling due to shared interrupts + +From: Tomi Valkeinen + +[ Upstream commit ffb635bb398fc07cb38f8a7b4a82cbe5f412f08e ] + +The driver requests the interrupts as IRQF_SHARED, so the interrupt +handlers can be called at any time. If such a call happens while the ISP +is powered down, the SoC will hang as the driver tries to access the +ISP registers. + +This can be reproduced even without the platform sharing the IRQ line: +Enable CONFIG_DEBUG_SHIRQ and unload the driver, and the board will +hang. + +Fix this by adding a new field, 'irqs_enabled', which is used to bail +out from the interrupt handler when the ISP is not operational. + +Link: https://lore.kernel.org/r/20231218-rkisp-shirq-fix-v1-2-173007628248@ideasonboard.com + +Signed-off-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-common.h | 2 ++ + .../platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++ + .../platform/rockchip/rkisp1/rkisp1-dev.c | 22 +++++++++++++++++++ + .../platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++ + 5 files changed, 33 insertions(+) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +index 8f3cba3197623..c584bb6d31998 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c +@@ -723,6 +723,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx) + unsigned int i; + u32 status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +index 104a1dbeff433..e9bc6c155d2fc 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h +@@ -467,6 +467,7 @@ struct rkisp1_debug { + * @debug: debug params to be exposed on debugfs + * @info: version-specific ISP information + * @irqs: IRQ line numbers ++ * @irqs_enabled: the hardware is enabled and can cause interrupts + */ + struct rkisp1_device { + void __iomem *base_addr; +@@ -488,6 +489,7 @@ struct rkisp1_device { + struct rkisp1_debug debug; + const struct rkisp1_info *info; + int irqs[RKISP1_NUM_IRQS]; ++ bool irqs_enabled; + }; + + /* +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +index 0a67eb96402cb..1537dccbd2e28 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c +@@ -211,6 +211,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 val, status; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS); + if (!status) + return IRQ_NONE; +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +index acc559652d6eb..73cf08a740118 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -305,6 +305,24 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev) + { + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + ++ rkisp1->irqs_enabled = false; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ ++ /* ++ * Wait until any running IRQ handler has returned. The IRQ handler ++ * may get called even after this (as it's a shared interrupt line) ++ * but the 'irqs_enabled' flag will make the handler return immediately. ++ */ ++ for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) { ++ if (rkisp1->irqs[il] == -1) ++ continue; ++ ++ /* Skip if the irq line is the same as previous */ ++ if (il == 0 || rkisp1->irqs[il - 1] != rkisp1->irqs[il]) ++ synchronize_irq(rkisp1->irqs[il]); ++ } ++ + clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks); + return pinctrl_pm_select_sleep_state(dev); + } +@@ -321,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev) + if (ret) + return ret; + ++ rkisp1->irqs_enabled = true; ++ /* Make sure the IRQ handler will see the above */ ++ mb(); ++ + return 0; + } + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +index 2239fb6c7d393..8fc9c1c116f1d 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c +@@ -1027,6 +1027,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx) + struct rkisp1_device *rkisp1 = dev_get_drvdata(dev); + u32 status, isp_err; + ++ if (!rkisp1->irqs_enabled) ++ return IRQ_NONE; ++ + status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS); + if (!status) + return IRQ_NONE; +-- +2.43.0 + diff --git a/queue-6.6/mips-clear-cause.bd-in-instruction_pointer_set.patch b/queue-6.6/mips-clear-cause.bd-in-instruction_pointer_set.patch new file mode 100644 index 00000000000..de7c25772f2 --- /dev/null +++ b/queue-6.6/mips-clear-cause.bd-in-instruction_pointer_set.patch @@ -0,0 +1,39 @@ +From a0547bc02151554294e8af3aff48ab7bfb0820e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 12:30:27 +0000 +Subject: MIPS: Clear Cause.BD in instruction_pointer_set + +From: Jiaxun Yang + +[ Upstream commit 9d6e21ddf20293b3880ae55b9d14de91c5891c59 ] + +Clear Cause.BD after we use instruction_pointer_set to override +EPC. + +This can prevent exception_epc check against instruction code at +new return address. +It won't be considered as "in delay slot" after epc being overridden +anyway. + +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/ptrace.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h +index 701a233583c2c..d14d0e37ad02d 100644 +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -60,6 +60,7 @@ static inline void instruction_pointer_set(struct pt_regs *regs, + unsigned long val) + { + regs->cp0_epc = val; ++ regs->cp0_cause &= ~CAUSEF_BD; + } + + /* Query offset/name of register from its name/offset */ +-- +2.43.0 + diff --git a/queue-6.6/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch b/queue-6.6/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch new file mode 100644 index 00000000000..f768629162b --- /dev/null +++ b/queue-6.6/net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch @@ -0,0 +1,46 @@ +From 7bccba905a36528fedd1808816efa52951c6a6f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 17:32:40 +0100 +Subject: net/iucv: fix the allocation size of iucv_path_table array + +From: Alexander Gordeev + +[ Upstream commit b4ea9b6a18ebf7f9f3a7a60f82e925186978cfcf ] + +iucv_path_table is a dynamically allocated array of pointers to +struct iucv_path items. Yet, its size is calculated as if it was +an array of struct iucv_path items. + +Signed-off-by: Alexander Gordeev +Reviewed-by: Alexandra Winter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/iucv/iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c +index fc3fddeb6f36d..f66b5f74cd83a 100644 +--- a/net/iucv/iucv.c ++++ b/net/iucv/iucv.c +@@ -156,7 +156,7 @@ static char iucv_error_pathid[16] = "INVALID PATHID"; + static LIST_HEAD(iucv_handler_list); + + /* +- * iucv_path_table: an array of iucv_path structures. ++ * iucv_path_table: array of pointers to iucv_path structures. + */ + static struct iucv_path **iucv_path_table; + static unsigned long iucv_max_pathid; +@@ -544,7 +544,7 @@ static int iucv_enable(void) + + cpus_read_lock(); + rc = -ENOMEM; +- alloc_size = iucv_max_pathid * sizeof(struct iucv_path); ++ alloc_size = iucv_max_pathid * sizeof(*iucv_path_table); + iucv_path_table = kzalloc(alloc_size, GFP_KERNEL); + if (!iucv_path_table) + goto out; +-- +2.43.0 + diff --git a/queue-6.6/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch b/queue-6.6/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch new file mode 100644 index 00000000000..e5d9ce2195a --- /dev/null +++ b/queue-6.6/net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch @@ -0,0 +1,40 @@ +From 1e6e99364a1e37c0eefcb0cd77c83baed82336ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 06:33:32 +0100 +Subject: net: smsc95xx: add support for SYS TEC USB-SPEmodule1 + +From: Andre Werner + +[ Upstream commit 45532b21dc2a692444b6ad5f71c253cca53e8103 ] + +This patch adds support for the SYS TEC USB-SPEmodule1 10Base-T1L +ethernet device to the existing smsc95xx driver by adding the new +USB VID/PID pair. + +Signed-off-by: Andre Werner +Link: https://lore.kernel.org/r/20240219053413.4732-1-andre.werner@systec-electronic.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index a530f20ee2575..2fa46baa589e5 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -2104,6 +2104,11 @@ static const struct usb_device_id products[] = { + USB_DEVICE(0x0424, 0x9E08), + .driver_info = (unsigned long) &smsc95xx_info, + }, ++ { ++ /* SYSTEC USB-SPEmodule1 10BASE-T1L Ethernet Device */ ++ USB_DEVICE(0x0878, 0x1400), ++ .driver_info = (unsigned long)&smsc95xx_info, ++ }, + { + /* Microchip's EVB-LAN8670-USB 10BASE-T1S Ethernet Device */ + USB_DEVICE(0x184F, 0x0051), +-- +2.43.0 + diff --git a/queue-6.6/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch b/queue-6.6/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch new file mode 100644 index 00000000000..ba74dba14e2 --- /dev/null +++ b/queue-6.6/parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch @@ -0,0 +1,42 @@ +From ea1c774be6ec6a25213c11496b352ec077e3cdec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 23:43:14 +0100 +Subject: parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check + +From: Max Kellermann + +[ Upstream commit 250f5402e636a5cec9e0e95df252c3d54307210f ] + +Fixes a bug revealed by -Wmissing-prototypes when +CONFIG_FUNCTION_GRAPH_TRACER is enabled but not CONFIG_DYNAMIC_FTRACE: + + arch/parisc/kernel/ftrace.c:82:5: error: no previous prototype for 'ftrace_enable_ftrace_graph_caller' [-Werror=missing-prototypes] + 82 | int ftrace_enable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + arch/parisc/kernel/ftrace.c:88:5: error: no previous prototype for 'ftrace_disable_ftrace_graph_caller' [-Werror=missing-prototypes] + 88 | int ftrace_disable_ftrace_graph_caller(void) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Max Kellermann +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/ftrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/ftrace.c b/arch/parisc/kernel/ftrace.c +index d1defb9ede70c..621a4b386ae4f 100644 +--- a/arch/parisc/kernel/ftrace.c ++++ b/arch/parisc/kernel/ftrace.c +@@ -78,7 +78,7 @@ asmlinkage void notrace __hot ftrace_function_trampoline(unsigned long parent, + #endif + } + +-#ifdef CONFIG_FUNCTION_GRAPH_TRACER ++#if defined(CONFIG_DYNAMIC_FTRACE) && defined(CONFIG_FUNCTION_GRAPH_TRACER) + int ftrace_enable_ftrace_graph_caller(void) + { + static_key_enable(&ftrace_graph_enable.key); +-- +2.43.0 + diff --git a/queue-6.6/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch b/queue-6.6/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch new file mode 100644 index 00000000000..6bbf505dfbc --- /dev/null +++ b/queue-6.6/perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch @@ -0,0 +1,54 @@ +From 8d24321b89f5a20c4e6da9f3bbf73d57b717fe7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 17:11:09 +0000 +Subject: perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect + child count) + +From: Ilkka Koskinen + +[ Upstream commit 50572064ec7109b00eef8880e905f55861c8b3de ] + +AmpereOneX mesh implementation has a bug in HN-P nodes that makes them +report incorrect child count. The failing crosspoints report 8 children +while they only have two. + +When the driver tries to access the inexistent child nodes, it believes it +has reached an invalid node type and probing fails. The workaround is to +ignore those incorrect child nodes and continue normally. + +Signed-off-by: Ilkka Koskinen +[ rm: rewrote simpler generalised version ] +Tested-by: Ilkka Koskinen +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/ce4b1442135fe03d0de41859b04b268c88c854a3.1707498577.git.robin.murphy@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 6404b17d3aeb0..2c684e49a6fc7 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -2301,6 +2301,17 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + dev_dbg(cmn->dev, "ignoring external node %llx\n", reg); + continue; + } ++ /* ++ * AmpereOneX erratum AC04_MESH_1 makes some XPs report a bogus ++ * child count larger than the number of valid child pointers. ++ * A child offset of 0 can only occur on CMN-600; otherwise it ++ * would imply the root node being its own grandchild, which ++ * we can safely dismiss in general. ++ */ ++ if (reg == 0 && cmn->part != PART_CMN600) { ++ dev_dbg(cmn->dev, "bogus child pointer?\n"); ++ continue; ++ } + + arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn); + +-- +2.43.0 + diff --git a/queue-6.6/perf-cxl-fix-cpmu-filter-value-mask-length.patch b/queue-6.6/perf-cxl-fix-cpmu-filter-value-mask-length.patch new file mode 100644 index 00000000000..154e0eac997 --- /dev/null +++ b/queue-6.6/perf-cxl-fix-cpmu-filter-value-mask-length.patch @@ -0,0 +1,59 @@ +From fe3c7e3a1a53c92f4a7cc7044da13160ae111c4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 10:45:22 +0900 +Subject: perf: CXL: fix CPMU filter value mask length + +From: Hojin Nam + +[ Upstream commit 802379b8f9e169293e9ba7089e5f1a6340e2e7a3 ] + +CPMU filter value is described as 4B length in CXL r3.0 8.2.7.2.2. +However, it is used as 2B length in code and comments. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Hojin Nam +Link: https://lore.kernel.org/r/20240216014522.32321-1-hj96.nam@samsung.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/cxl_pmu.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c +index bc0d414a6aff9..308c9969642e1 100644 +--- a/drivers/perf/cxl_pmu.c ++++ b/drivers/perf/cxl_pmu.c +@@ -59,7 +59,7 @@ + #define CXL_PMU_COUNTER_CFG_EVENT_GRP_ID_IDX_MSK GENMASK_ULL(63, 59) + + #define CXL_PMU_FILTER_CFG_REG(n, f) (0x400 + 4 * ((f) + (n) * 8)) +-#define CXL_PMU_FILTER_CFG_VALUE_MSK GENMASK(15, 0) ++#define CXL_PMU_FILTER_CFG_VALUE_MSK GENMASK(31, 0) + + #define CXL_PMU_COUNTER_REG(n) (0xc00 + 8 * (n)) + +@@ -314,9 +314,9 @@ static bool cxl_pmu_config1_get_edge(struct perf_event *event) + } + + /* +- * CPMU specification allows for 8 filters, each with a 16 bit value... +- * So we need to find 8x16bits to store it in. +- * As the value used for disable is 0xffff, a separate enable switch ++ * CPMU specification allows for 8 filters, each with a 32 bit value... ++ * So we need to find 8x32bits to store it in. ++ * As the value used for disable is 0xffff_ffff, a separate enable switch + * is needed. + */ + +@@ -642,7 +642,7 @@ static void cxl_pmu_event_start(struct perf_event *event, int flags) + if (cxl_pmu_config1_hdm_filter_en(event)) + cfg = cxl_pmu_config2_get_hdm_decoder(event); + else +- cfg = GENMASK(15, 0); /* No filtering if 0xFFFF_FFFF */ ++ cfg = GENMASK(31, 0); /* No filtering if 0xFFFF_FFFF */ + writeq(cfg, base + CXL_PMU_FILTER_CFG_REG(hwc->idx, 0)); + } + +-- +2.43.0 + diff --git a/queue-6.6/perf-riscv-fix-panic-on-pmu-overflow-handler.patch b/queue-6.6/perf-riscv-fix-panic-on-pmu-overflow-handler.patch new file mode 100644 index 00000000000..0a1ef75a3b3 --- /dev/null +++ b/queue-6.6/perf-riscv-fix-panic-on-pmu-overflow-handler.patch @@ -0,0 +1,94 @@ +From 1b91acf51dc3a75bcf13cd3970d2e6a91e601c2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:54:25 +0800 +Subject: perf: RISCV: Fix panic on pmu overflow handler + +From: Fei Wu + +[ Upstream commit 34b567868777e9fd39ec5333969728a7f0cf179c ] + +(1 << idx) of int is not desired when setting bits in unsigned long +overflowed_ctrs, use BIT() instead. This panic happens when running +'perf record -e branches' on sophgo sg2042. + +[ 273.311852] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098 +[ 273.320851] Oops [#1] +[ 273.323179] Modules linked in: +[ 273.326303] CPU: 0 PID: 1475 Comm: perf Not tainted 6.6.0-rc3+ #9 +[ 273.332521] Hardware name: Sophgo Mango (DT) +[ 273.336878] epc : riscv_pmu_ctr_get_width_mask+0x8/0x62 +[ 273.342291] ra : pmu_sbi_ovf_handler+0x2e0/0x34e +[ 273.347091] epc : ffffffff80aecd98 ra : ffffffff80aee056 sp : fffffff6e36928b0 +[ 273.354454] gp : ffffffff821f82d0 tp : ffffffd90c353200 t0 : 0000002ade4f9978 +[ 273.361815] t1 : 0000000000504d55 t2 : ffffffff8016cd8c s0 : fffffff6e3692a70 +[ 273.369180] s1 : 0000000000000020 a0 : 0000000000000000 a1 : 00001a8e81800000 +[ 273.376540] a2 : 0000003c00070198 a3 : 0000003c00db75a4 a4 : 0000000000000015 +[ 273.383901] a5 : ffffffd7ff8804b0 a6 : 0000000000000015 a7 : 000000000000002a +[ 273.391327] s2 : 000000000000ffff s3 : 0000000000000000 s4 : ffffffd7ff8803b0 +[ 273.398773] s5 : 0000000000504d55 s6 : ffffffd905069800 s7 : ffffffff821fe210 +[ 273.406139] s8 : 000000007fffffff s9 : ffffffd7ff8803b0 s10: ffffffd903f29098 +[ 273.413660] s11: 0000000080000000 t3 : 0000000000000003 t4 : ffffffff8017a0ca +[ 273.421022] t5 : ffffffff8023cfc2 t6 : ffffffd9040780e8 +[ 273.426437] status: 0000000200000100 badaddr: 0000000000000098 cause: 000000000000000d +[ 273.434512] [] riscv_pmu_ctr_get_width_mask+0x8/0x62 +[ 273.441169] [] handle_percpu_devid_irq+0x98/0x1ee +[ 273.447562] [] generic_handle_domain_irq+0x28/0x36 +[ 273.454151] [] riscv_intc_irq+0x36/0x4e +[ 273.459659] [] handle_riscv_irq+0x4a/0x74 +[ 273.465442] [] do_irq+0x62/0x92 +[ 273.470360] Code: 0420 60a2 6402 5529 0141 8082 0013 0000 0013 0000 (6d5c) b783 +[ 273.477921] ---[ end trace 0000000000000000 ]--- +[ 273.482630] Kernel panic - not syncing: Fatal exception in interrupt + +Reviewed-by: Alexandre Ghiti +Reviewed-by: Atish Patra +Signed-off-by: Fei Wu +Link: https://lore.kernel.org/r/20240228115425.2613856-1-fei2.wu@intel.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + drivers/perf/riscv_pmu_sbi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c +index cd8a2b9efd787..d80b4b09152df 100644 +--- a/drivers/perf/riscv_pmu_sbi.c ++++ b/drivers/perf/riscv_pmu_sbi.c +@@ -512,7 +512,7 @@ static void pmu_sbi_set_scounteren(void *arg) + + if (event->hw.idx != -1) + csr_write(CSR_SCOUNTEREN, +- csr_read(CSR_SCOUNTEREN) | (1 << pmu_sbi_csr_index(event))); ++ csr_read(CSR_SCOUNTEREN) | BIT(pmu_sbi_csr_index(event))); + } + + static void pmu_sbi_reset_scounteren(void *arg) +@@ -521,7 +521,7 @@ static void pmu_sbi_reset_scounteren(void *arg) + + if (event->hw.idx != -1) + csr_write(CSR_SCOUNTEREN, +- csr_read(CSR_SCOUNTEREN) & ~(1 << pmu_sbi_csr_index(event))); ++ csr_read(CSR_SCOUNTEREN) & ~BIT(pmu_sbi_csr_index(event))); + } + + static void pmu_sbi_ctr_start(struct perf_event *event, u64 ival) +@@ -731,14 +731,14 @@ static irqreturn_t pmu_sbi_ovf_handler(int irq, void *dev) + /* compute hardware counter index */ + hidx = info->csr - CSR_CYCLE; + /* check if the corresponding bit is set in sscountovf */ +- if (!(overflow & (1 << hidx))) ++ if (!(overflow & BIT(hidx))) + continue; + + /* + * Keep a track of overflowed counters so that they can be started + * with updated initial value. + */ +- overflowed_ctrs |= 1 << lidx; ++ overflowed_ctrs |= BIT(lidx); + hw_evt = &event->hw; + riscv_pmu_event_update(event); + perf_sample_data_init(&data, 0, hw_evt->last_period); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch b/queue-6.6/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch new file mode 100644 index 00000000000..9c63364d65b --- /dev/null +++ b/queue-6.6/platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch @@ -0,0 +1,47 @@ +From e181e5fed47a275b33890639872e4c8c1ecbd474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 21:17:21 +0100 +Subject: platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name + +From: Hans de Goede + +[ Upstream commit 8215ca518164d35f10c0b5545c8bb80f538638b8 ] + +The Acer B1 750 tablet used a Novatek NVT-ts touchscreen, +not a Goodix touchscreen. + +Rename acer_b1_750_goodix_gpios to acer_b1_750_nvt_ts_gpios +to correctly reflect this. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20240216201721.239791-5-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/x86-android-tablets/other.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/x86-android-tablets/other.c b/drivers/platform/x86/x86-android-tablets/other.c +index e79549c6aae17..fe5f68fa7bca7 100644 +--- a/drivers/platform/x86/x86-android-tablets/other.c ++++ b/drivers/platform/x86/x86-android-tablets/other.c +@@ -66,7 +66,7 @@ static const struct x86_i2c_client_info acer_b1_750_i2c_clients[] __initconst = + }, + }; + +-static struct gpiod_lookup_table acer_b1_750_goodix_gpios = { ++static struct gpiod_lookup_table acer_b1_750_nvt_ts_gpios = { + .dev_id = "i2c-NVT-ts", + .table = { + GPIO_LOOKUP("INT33FC:01", 26, "reset", GPIO_ACTIVE_LOW), +@@ -75,7 +75,7 @@ static struct gpiod_lookup_table acer_b1_750_goodix_gpios = { + }; + + static struct gpiod_lookup_table * const acer_b1_750_gpios[] = { +- &acer_b1_750_goodix_gpios, ++ &acer_b1_750_nvt_ts_gpios, + &int3496_reference_gpios, + NULL + }; +-- +2.43.0 + diff --git a/queue-6.6/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch b/queue-6.6/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch new file mode 100644 index 00000000000..a992d7bb1b4 --- /dev/null +++ b/queue-6.6/rdma-mlx5-fix-fortify-source-warning-while-accessing.patch @@ -0,0 +1,131 @@ +From d5262002223a2158273140074f7a7357489caca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:11 +0200 +Subject: RDMA/mlx5: Fix fortify source warning while accessing Eth segment + +From: Leon Romanovsky + +[ Upstream commit 4d5e86a56615cc387d21c629f9af8fb0e958d350 ] + + ------------[ cut here ]------------ + memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) + WARNING: CPU: 0 PID: 293779 at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Modules linked in: 8021q garp mrp stp llc rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) ib_uverbs(OE) ib_core(OE) mlx5_core(OE) pci_hyperv_intf mlxdevm(OE) mlx_compat(OE) tls mlxfw(OE) psample nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink mst_pciconf(OE) knem(OE) vfio_pci vfio_pci_core vfio_iommu_type1 vfio iommufd irqbypass cuse nfsv3 nfs fscache netfs xfrm_user xfrm_algo ipmi_devintf ipmi_msghandler binfmt_misc crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel sha512_ssse3 snd_pcsp aesni_intel crypto_simd cryptd snd_pcm snd_timer joydev snd soundcore input_leds serio_raw evbug nfsd auth_rpcgss nfs_acl lockd grace sch_fq_codel sunrpc drm efi_pstore ip_tables x_tables autofs4 psmouse virtio_net net_failover failover floppy + [last unloaded: mlx_compat(OE)] + CPU: 0 PID: 293779 Comm: ssh Tainted: G OE 6.2.0-32-generic #32~22.04.1-Ubuntu + Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 + RIP: 0010:mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + Code: 0c 01 00 a8 01 75 25 48 8b 75 a0 b9 02 00 00 00 48 c7 c2 10 5b fd c0 48 c7 c7 80 5b fd c0 c6 05 57 0c 03 00 01 e8 95 4d 93 da <0f> 0b 44 8b 4d b0 4c 8b 45 c8 48 8b 4d c0 e9 49 fb ff ff 41 0f b7 + RSP: 0018:ffffb5b48478b570 EFLAGS: 00010046 + RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffffb5b48478b628 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: ffffb5b48478b5e8 + R13: ffff963a3c609b5e R14: ffff9639c3fbd800 R15: ffffb5b480475a80 + FS: 00007fc03b444c80(0000) GS:ffff963a3dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000556f46bdf000 CR3: 0000000006ac6003 CR4: 00000000003706f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? show_regs+0x72/0x90 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? __warn+0x8d/0x160 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + ? report_bug+0x1bb/0x1d0 + ? handle_bug+0x46/0x90 + ? exc_invalid_op+0x19/0x80 + ? asm_exc_invalid_op+0x1b/0x20 + ? mlx5_ib_post_send+0x191b/0x1a60 [mlx5_ib] + mlx5_ib_post_send_nodrain+0xb/0x20 [mlx5_ib] + ipoib_send+0x2ec/0x770 [ib_ipoib] + ipoib_start_xmit+0x5a0/0x770 [ib_ipoib] + dev_hard_start_xmit+0x8e/0x1e0 + ? validate_xmit_skb_list+0x4d/0x80 + sch_direct_xmit+0x116/0x3a0 + __dev_xmit_skb+0x1fd/0x580 + __dev_queue_xmit+0x284/0x6b0 + ? _raw_spin_unlock_irq+0xe/0x50 + ? __flush_work.isra.0+0x20d/0x370 + ? push_pseudo_header+0x17/0x40 [ib_ipoib] + neigh_connected_output+0xcd/0x110 + ip_finish_output2+0x179/0x480 + ? __smp_call_single_queue+0x61/0xa0 + __ip_finish_output+0xc3/0x190 + ip_finish_output+0x2e/0xf0 + ip_output+0x78/0x110 + ? __pfx_ip_finish_output+0x10/0x10 + ip_local_out+0x64/0x70 + __ip_queue_xmit+0x18a/0x460 + ip_queue_xmit+0x15/0x30 + __tcp_transmit_skb+0x914/0x9c0 + tcp_write_xmit+0x334/0x8d0 + tcp_push_one+0x3c/0x60 + tcp_sendmsg_locked+0x2e1/0xac0 + tcp_sendmsg+0x2d/0x50 + inet_sendmsg+0x43/0x90 + sock_sendmsg+0x68/0x80 + sock_write_iter+0x93/0x100 + vfs_write+0x326/0x3c0 + ksys_write+0xbd/0xf0 + ? do_syscall_64+0x69/0x90 + __x64_sys_write+0x19/0x30 + do_syscall_64+0x59/0x90 + ? do_user_addr_fault+0x1d0/0x640 + ? exit_to_user_mode_prepare+0x3b/0xd0 + ? irqentry_exit_to_user_mode+0x9/0x20 + ? irqentry_exit+0x43/0x50 + ? exc_page_fault+0x92/0x1b0 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + RIP: 0033:0x7fc03ad14a37 + Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 + RSP: 002b:00007ffdf8697fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 0000000000008024 RCX: 00007fc03ad14a37 + RDX: 0000000000008024 RSI: 0000556f46bd8270 RDI: 0000000000000003 + RBP: 0000556f46bb1800 R08: 0000000000007fe3 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 + R13: 0000556f46bc66b0 R14: 000000000000000a R15: 0000556f46bb2f50 + + ---[ end trace 0000000000000000 ]--- + +Link: https://lore.kernel.org/r/8228ad34bd1a25047586270f7b1fb4ddcd046282.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/wr.c | 2 +- + include/linux/mlx5/qp.h | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/wr.c b/drivers/infiniband/hw/mlx5/wr.c +index df1d1b0a3ef72..9947feb7fb8a0 100644 +--- a/drivers/infiniband/hw/mlx5/wr.c ++++ b/drivers/infiniband/hw/mlx5/wr.c +@@ -78,7 +78,7 @@ static void set_eth_seg(const struct ib_send_wr *wr, struct mlx5_ib_qp *qp, + */ + copysz = min_t(u64, *cur_edge - (void *)eseg->inline_hdr.start, + left); +- memcpy(eseg->inline_hdr.start, pdata, copysz); ++ memcpy(eseg->inline_hdr.data, pdata, copysz); + stride = ALIGN(sizeof(struct mlx5_wqe_eth_seg) - + sizeof(eseg->inline_hdr.start) + copysz, 16); + *size += stride / 16; +diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h +index bd53cf4be7bdc..f0e55bf3ec8b5 100644 +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -269,7 +269,10 @@ struct mlx5_wqe_eth_seg { + union { + struct { + __be16 sz; +- u8 start[2]; ++ union { ++ u8 start[2]; ++ DECLARE_FLEX_ARRAY(u8, data); ++ }; + } inline_hdr; + struct { + __be16 type; +-- +2.43.0 + diff --git a/queue-6.6/rdma-mlx5-relax-devx-access-upon-modify-commands.patch b/queue-6.6/rdma-mlx5-relax-devx-access-upon-modify-commands.patch new file mode 100644 index 00000000000..7c1faf411d7 --- /dev/null +++ b/queue-6.6/rdma-mlx5-relax-devx-access-upon-modify-commands.patch @@ -0,0 +1,47 @@ +From e83afcf09d019a0296874c2f188e536fcfe0c3f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 11:29:13 +0200 +Subject: RDMA/mlx5: Relax DEVX access upon modify commands + +From: Yishai Hadas + +[ Upstream commit be551ee1574280ef8afbf7c271212ac3e38933ef ] + +Relax DEVX access upon modify commands to be UVERBS_ACCESS_READ. + +The kernel doesn't need to protect what firmware protects, or what +causes no damage to anyone but the user. + +As firmware needs to protect itself from parallel access to the same +object, don't block parallel modify/query commands on the same object in +the kernel side. + +This change will allow user space application to run parallel updates to +different entries in the same bulk object. + +Tested-by: Tamar Mashiah +Signed-off-by: Yishai Hadas +Reviewed-by: Michael Guralnik +Link: https://lore.kernel.org/r/7407d5ed35dc427c1097699e12b49c01e1073406.1706433934.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/devx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 8ba53edf23119..6e19974ecf6e7 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -2949,7 +2949,7 @@ DECLARE_UVERBS_NAMED_METHOD( + MLX5_IB_METHOD_DEVX_OBJ_MODIFY, + UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_MODIFY_HANDLE, + UVERBS_IDR_ANY_OBJECT, +- UVERBS_ACCESS_WRITE, ++ UVERBS_ACCESS_READ, + UA_MANDATORY), + UVERBS_ATTR_PTR_IN( + MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN, +-- +2.43.0 + diff --git a/queue-6.6/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch b/queue-6.6/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch new file mode 100644 index 00000000000..553ace13dce --- /dev/null +++ b/queue-6.6/regmap-kunit-ensure-that-changed-bytes-are-actually-.patch @@ -0,0 +1,146 @@ +From 41128618f7fc0994a3ddac43114b1839d2aa7493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 16:58:17 +0000 +Subject: regmap: kunit: Ensure that changed bytes are actually different + +From: Mark Brown + +[ Upstream commit 2f0dbb24f78a333433a2b875c0b76bf55c119cd4 ] + +During the cache sync test we verify that values we expect to have been +written only to the cache do not appear in the hardware. This works most +of the time but since we randomly generate both the original and new values +there is a low probability that these values may actually be the same. +Wrap get_random_bytes() to ensure that the values are different, there +are other tests which should have similar verification that we actually +changed something. + +While we're at it refactor the test to use three changed values rather +than attempting to use one of them twice, that just complicates checking +that our new values are actually new. + +We use random generation to try to avoid data dependencies in the tests. + +Reported-by: Guenter Roeck +Reviewed-by: Guenter Roeck +Tested-by: Guenter Roeck +Signed-off-by: Mark Brown +Link: https://msgid.link/r/20240211-regmap-kunit-random-change-v3-1-e387a9ea4468@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap-kunit.c | 54 +++++++++++++++++++++--------- + 1 file changed, 38 insertions(+), 16 deletions(-) + +diff --git a/drivers/base/regmap/regmap-kunit.c b/drivers/base/regmap/regmap-kunit.c +index 264d29b3fced0..5f1e914646cd9 100644 +--- a/drivers/base/regmap/regmap-kunit.c ++++ b/drivers/base/regmap/regmap-kunit.c +@@ -9,6 +9,23 @@ + + #define BLOCK_TEST_SIZE 12 + ++static void get_changed_bytes(void *orig, void *new, size_t size) ++{ ++ char *o = orig; ++ char *n = new; ++ int i; ++ ++ get_random_bytes(new, size); ++ ++ /* ++ * This could be nicer and more efficient but we shouldn't ++ * super care. ++ */ ++ for (i = 0; i < size; i++) ++ while (n[i] == o[i]) ++ get_random_bytes(&n[i], 1); ++} ++ + static const struct regmap_config test_regmap_config = { + .max_register = BLOCK_TEST_SIZE, + .reg_stride = 1, +@@ -1131,7 +1148,7 @@ static void raw_sync(struct kunit *test) + struct regmap *map; + struct regmap_config config; + struct regmap_ram_data *data; +- u16 val[2]; ++ u16 val[3]; + u16 *hw_buf; + unsigned int rval; + int i; +@@ -1145,17 +1162,13 @@ static void raw_sync(struct kunit *test) + + hw_buf = (u16 *)data->vals; + +- get_random_bytes(&val, sizeof(val)); ++ get_changed_bytes(&hw_buf[2], &val[0], sizeof(val)); + + /* Do a regular write and a raw write in cache only mode */ + regcache_cache_only(map, true); +- KUNIT_EXPECT_EQ(test, 0, regmap_raw_write(map, 2, val, sizeof(val))); +- if (config.val_format_endian == REGMAP_ENDIAN_BIG) +- KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 6, +- be16_to_cpu(val[0]))); +- else +- KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 6, +- le16_to_cpu(val[0]))); ++ KUNIT_EXPECT_EQ(test, 0, regmap_raw_write(map, 2, val, ++ sizeof(u16) * 2)); ++ KUNIT_EXPECT_EQ(test, 0, regmap_write(map, 4, val[2])); + + /* We should read back the new values, and defaults for the rest */ + for (i = 0; i < config.max_register + 1; i++) { +@@ -1164,24 +1177,34 @@ static void raw_sync(struct kunit *test) + switch (i) { + case 2: + case 3: +- case 6: + if (config.val_format_endian == REGMAP_ENDIAN_BIG) { + KUNIT_EXPECT_EQ(test, rval, +- be16_to_cpu(val[i % 2])); ++ be16_to_cpu(val[i - 2])); + } else { + KUNIT_EXPECT_EQ(test, rval, +- le16_to_cpu(val[i % 2])); ++ le16_to_cpu(val[i - 2])); + } + break; ++ case 4: ++ KUNIT_EXPECT_EQ(test, rval, val[i - 2]); ++ break; + default: + KUNIT_EXPECT_EQ(test, config.reg_defaults[i].def, rval); + break; + } + } ++ ++ /* ++ * The value written via _write() was translated by the core, ++ * translate the original copy for comparison purposes. ++ */ ++ if (config.val_format_endian == REGMAP_ENDIAN_BIG) ++ val[2] = cpu_to_be16(val[2]); ++ else ++ val[2] = cpu_to_le16(val[2]); + + /* The values should not appear in the "hardware" */ +- KUNIT_EXPECT_MEMNEQ(test, &hw_buf[2], val, sizeof(val)); +- KUNIT_EXPECT_MEMNEQ(test, &hw_buf[6], val, sizeof(u16)); ++ KUNIT_EXPECT_MEMNEQ(test, &hw_buf[2], &val[0], sizeof(val)); + + for (i = 0; i < config.max_register + 1; i++) + data->written[i] = false; +@@ -1192,8 +1215,7 @@ static void raw_sync(struct kunit *test) + KUNIT_EXPECT_EQ(test, 0, regcache_sync(map)); + + /* The values should now appear in the "hardware" */ +- KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], val, sizeof(val)); +- KUNIT_EXPECT_MEMEQ(test, &hw_buf[6], val, sizeof(u16)); ++ KUNIT_EXPECT_MEMEQ(test, &hw_buf[2], &val[0], sizeof(val)); + + regmap_exit(map); + } +-- +2.43.0 + diff --git a/queue-6.6/regulator-max5970-fix-regulator-child-node-name.patch b/queue-6.6/regulator-max5970-fix-regulator-child-node-name.patch new file mode 100644 index 00000000000..6eae393574d --- /dev/null +++ b/queue-6.6/regulator-max5970-fix-regulator-child-node-name.patch @@ -0,0 +1,49 @@ +From c1963aa9540d061d6da097aa1a9f3f18a738731c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 20:28:00 +0530 +Subject: regulator: max5970: Fix regulator child node name + +From: Naresh Solanki + +[ Upstream commit e5d40e9afd84cec01cdbbbfe62d52f89959ab3ee ] + +Update regulator child node name to lower case i.e., sw0 & sw1 as +descibed in max5970 dt binding. + +Signed-off-by: Naresh Solanki +Link: https://msgid.link/r/20240213145801.2564518-1-naresh.solanki@9elements.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max5970-regulator.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/max5970-regulator.c b/drivers/regulator/max5970-regulator.c +index 5c2d49ae332fb..4362f332f746b 100644 +--- a/drivers/regulator/max5970-regulator.c ++++ b/drivers/regulator/max5970-regulator.c +@@ -28,8 +28,8 @@ struct max5970_regulator { + }; + + enum max597x_regulator_id { +- MAX597X_SW0, +- MAX597X_SW1, ++ MAX597X_sw0, ++ MAX597X_sw1, + }; + + static int max597x_uvp_ovp_check_mode(struct regulator_dev *rdev, int severity) +@@ -251,8 +251,8 @@ static int max597x_dt_parse(struct device_node *np, + } + + static const struct regulator_desc regulators[] = { +- MAX597X_SWITCH(SW0, MAX5970_REG_CHXEN, 0, "vss1"), +- MAX597X_SWITCH(SW1, MAX5970_REG_CHXEN, 1, "vss2"), ++ MAX597X_SWITCH(sw0, MAX5970_REG_CHXEN, 0, "vss1"), ++ MAX597X_SWITCH(sw1, MAX5970_REG_CHXEN, 1, "vss2"), + }; + + static int max597x_regmap_read_clear(struct regmap *map, unsigned int reg, +-- +2.43.0 + diff --git a/queue-6.6/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch b/queue-6.6/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch new file mode 100644 index 00000000000..f08e093c3d3 --- /dev/null +++ b/queue-6.6/riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch @@ -0,0 +1,36 @@ +From e5b652da76182f5ecd23e7b3f522bef0679d2556 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 19:45:40 +0000 +Subject: riscv: dts: sifive: add missing #interrupt-cells to pmic + +From: Conor Dooley + +[ Upstream commit ce6b6d1513965f500a05f3facf223fa01fd74920 ] + +At W=2 dtc complains: +hifive-unmatched-a00.dts:120.10-238.4: Warning (interrupt_provider): /soc/i2c@10030000/pmic@58: Missing '#interrupt-cells' in interrupt provider + +Add the missing property. + +Reviewed-by: Samuel Holland +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +index 07387f9c135ca..72b87b08ab444 100644 +--- a/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts ++++ b/arch/riscv/boot/dts/sifive/hifive-unmatched-a00.dts +@@ -123,6 +123,7 @@ pmic@58 { + interrupt-parent = <&gpio>; + interrupts = <1 IRQ_TYPE_LEVEL_LOW>; + interrupt-controller; ++ #interrupt-cells = <2>; + + onkey { + compatible = "dlg,da9063-onkey"; +-- +2.43.0 + diff --git a/queue-6.6/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch b/queue-6.6/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch new file mode 100644 index 00000000000..4aa6ed71c55 --- /dev/null +++ b/queue-6.6/scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch @@ -0,0 +1,44 @@ +From 76e7becb5ae93d5d0edc42e53f9c172008dd40bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 12:47:24 +0530 +Subject: scsi: mpt3sas: Prevent sending diag_reset when the controller is + ready + +From: Ranjan Kumar + +[ Upstream commit ee0017c3ed8a8abfa4d40e42f908fb38c31e7515 ] + +If the driver detects that the controller is not ready before sending the +first IOC facts command, it will wait for a maximum of 10 seconds for it to +become ready. However, even if the controller becomes ready within 10 +seconds, the driver will still issue a diagnostic reset. + +Modify the driver to avoid sending a diag reset if the controller becomes +ready within the 10-second wait time. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20240221071724.14986-1-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index a75f670bf5519..aa29e250cf15f 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7387,7 +7387,9 @@ _base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout) + return -EFAULT; + } + +- issue_diag_reset: ++ return 0; ++ ++issue_diag_reset: + rc = _base_diag_reset(ioc); + return rc; + } +-- +2.43.0 + diff --git a/queue-6.6/selftests-mptcp-explicitly-trigger-the-listener-diag.patch b/queue-6.6/selftests-mptcp-explicitly-trigger-the-listener-diag.patch new file mode 100644 index 00000000000..7d1ef3604b7 --- /dev/null +++ b/queue-6.6/selftests-mptcp-explicitly-trigger-the-listener-diag.patch @@ -0,0 +1,89 @@ +From 74f2e54aa15772aee0fee291a50ad7a42517c6c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 17:14:20 +0100 +Subject: selftests: mptcp: explicitly trigger the listener diag code-path + +From: Paolo Abeni + +[ Upstream commit b4b51d36bbaa3ddb93b3e1ca3a1ef0aa629d6521 ] + +The mptcp diag interface already experienced a few locking bugs +that lockdep and appropriate coverage have detected in advance. + +Let's add a test-case triggering the relevant code path, to prevent +similar issues in the future. + +Be careful to cope with very slow environments. + +Note that we don't need an explicit timeout on the mptcp_connect +subprocess to cope with eventual bug/hang-up as the final cleanup +terminating the child processes will take care of that. + +Signed-off-by: Paolo Abeni +Reviewed-by: Matthieu Baerts (NGI0) +Signed-off-by: Matthieu Baerts (NGI0) +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240223-upstream-net-20240223-misc-fixes-v1-10-162e87e48497@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/diag.sh | 30 ++++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/mptcp/diag.sh b/tools/testing/selftests/net/mptcp/diag.sh +index 4d8c59be1b30c..ff9a4f45f852f 100755 +--- a/tools/testing/selftests/net/mptcp/diag.sh ++++ b/tools/testing/selftests/net/mptcp/diag.sh +@@ -20,7 +20,7 @@ flush_pids() + + ip netns pids "${ns}" | xargs --no-run-if-empty kill -SIGUSR1 &>/dev/null + +- for _ in $(seq 10); do ++ for _ in $(seq $((timeout_poll * 10))); do + [ -z "$(ip netns pids "${ns}")" ] && break + sleep 0.1 + done +@@ -91,6 +91,15 @@ chk_msk_nr() + __chk_msk_nr "grep -c token:" "$@" + } + ++chk_listener_nr() ++{ ++ local expected=$1 ++ local msg="$2" ++ ++ __chk_nr "ss -inmlHMON $ns | wc -l" "$expected" "$msg - mptcp" 0 ++ __chk_nr "ss -inmlHtON $ns | wc -l" "$expected" "$msg - subflows" ++} ++ + wait_msk_nr() + { + local condition="grep -c token:" +@@ -306,5 +315,24 @@ flush_pids + chk_msk_inuse 0 "many->0" + chk_msk_cestab 0 "many->0" + ++chk_listener_nr 0 "no listener sockets" ++NR_SERVERS=100 ++for I in $(seq 1 $NR_SERVERS); do ++ ip netns exec $ns ./mptcp_connect -p $((I + 20001)) \ ++ -t ${timeout_poll} -l 0.0.0.0 >/dev/null 2>&1 & ++done ++ ++for I in $(seq 1 $NR_SERVERS); do ++ mptcp_lib_wait_local_port_listen $ns $((I + 20001)) ++done ++ ++chk_listener_nr $NR_SERVERS "many listener sockets" ++ ++# graceful termination ++for I in $(seq 1 $NR_SERVERS); do ++ echo a | ip netns exec $ns ./mptcp_connect -p $((I + 20001)) 127.0.0.1 >/dev/null 2>&1 & ++done ++flush_pids ++ + mptcp_lib_result_print_all_tap + exit $ret +-- +2.43.0 + diff --git a/queue-6.6/selftests-openvswitch-add-validation-for-the-recursi.patch b/queue-6.6/selftests-openvswitch-add-validation-for-the-recursi.patch new file mode 100644 index 00000000000..73afa43d480 --- /dev/null +++ b/queue-6.6/selftests-openvswitch-add-validation-for-the-recursi.patch @@ -0,0 +1,201 @@ +From c7ddd87a161998b46a0de3fc521fc234e2e643e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:24:16 -0500 +Subject: selftests: openvswitch: Add validation for the recursion test + +From: Aaron Conole + +[ Upstream commit bd128f62c365504e1268dc09fcccdfb1f091e93a ] + +Add a test case into the netlink checks that will show the number of +nested action recursions won't exceed 16. Going to 17 on a small +clone call isn't enough to exhaust the stack on (most) systems, so +it should be safe to run even on systems that don't have the fix +applied. + +Signed-off-by: Aaron Conole +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20240207132416.1488485-3-aconole@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../selftests/net/openvswitch/openvswitch.sh | 13 ++++ + .../selftests/net/openvswitch/ovs-dpctl.py | 71 +++++++++++++++---- + 2 files changed, 69 insertions(+), 15 deletions(-) + +diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh +index f8499d4c87f3f..36e40256ab92a 100755 +--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh ++++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh +@@ -502,7 +502,20 @@ test_netlink_checks () { + wc -l) == 2 ] || \ + return 1 + ++ info "Checking clone depth" + ERR_MSG="Flow actions may not be safe on all matching packets" ++ PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") ++ ovs_add_flow "test_netlink_checks" nv0 \ ++ 'in_port(1),eth(),eth_type(0x800),ipv4()' \ ++ 'clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(clone(drop)))))))))))))))))' \ ++ >/dev/null 2>&1 && return 1 ++ POST_TEST=$(dmesg | grep -c "${ERR_MSG}") ++ ++ if [ "$PRE_TEST" == "$POST_TEST" ]; then ++ info "failed - clone depth too large" ++ return 1 ++ fi ++ + PRE_TEST=$(dmesg | grep -c "${ERR_MSG}") + ovs_add_flow "test_netlink_checks" nv0 \ + 'in_port(1),eth(),eth_type(0x0806),arp()' 'drop(0),2' \ +diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +index b97e621face95..5e0e539a323d5 100644 +--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py ++++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +@@ -299,7 +299,7 @@ class ovsactions(nla): + ("OVS_ACTION_ATTR_PUSH_NSH", "none"), + ("OVS_ACTION_ATTR_POP_NSH", "flag"), + ("OVS_ACTION_ATTR_METER", "none"), +- ("OVS_ACTION_ATTR_CLONE", "none"), ++ ("OVS_ACTION_ATTR_CLONE", "recursive"), + ("OVS_ACTION_ATTR_CHECK_PKT_LEN", "none"), + ("OVS_ACTION_ATTR_ADD_MPLS", "none"), + ("OVS_ACTION_ATTR_DEC_TTL", "none"), +@@ -465,29 +465,42 @@ class ovsactions(nla): + print_str += "pop_mpls" + else: + datum = self.get_attr(field[0]) +- print_str += datum.dpstr(more) ++ if field[0] == "OVS_ACTION_ATTR_CLONE": ++ print_str += "clone(" ++ print_str += datum.dpstr(more) ++ print_str += ")" ++ else: ++ print_str += datum.dpstr(more) + + return print_str + + def parse(self, actstr): ++ totallen = len(actstr) + while len(actstr) != 0: + parsed = False ++ parencount = 0 + if actstr.startswith("drop"): + # If no reason is provided, the implicit drop is used (i.e no + # action). If some reason is given, an explicit action is used. +- actstr, reason = parse_extract_field( +- actstr, +- "drop(", +- "([0-9]+)", +- lambda x: int(x, 0), +- False, +- None, +- ) ++ reason = None ++ if actstr.startswith("drop("): ++ parencount += 1 ++ ++ actstr, reason = parse_extract_field( ++ actstr, ++ "drop(", ++ "([0-9]+)", ++ lambda x: int(x, 0), ++ False, ++ None, ++ ) ++ + if reason is not None: + self["attrs"].append(["OVS_ACTION_ATTR_DROP", reason]) + parsed = True + else: +- return ++ actstr = actstr[len("drop"): ] ++ return (totallen - len(actstr)) + + elif parse_starts_block(actstr, "^(\d+)", False, True): + actstr, output = parse_extract_field( +@@ -504,6 +517,7 @@ class ovsactions(nla): + False, + 0, + ) ++ parencount += 1 + self["attrs"].append(["OVS_ACTION_ATTR_RECIRC", recircid]) + parsed = True + +@@ -516,12 +530,22 @@ class ovsactions(nla): + + for flat_act in parse_flat_map: + if parse_starts_block(actstr, flat_act[0], False): +- actstr += len(flat_act[0]) ++ actstr = actstr[len(flat_act[0]):] + self["attrs"].append([flat_act[1]]) + actstr = actstr[strspn(actstr, ", ") :] + parsed = True + +- if parse_starts_block(actstr, "ct(", False): ++ if parse_starts_block(actstr, "clone(", False): ++ parencount += 1 ++ subacts = ovsactions() ++ actstr = actstr[len("clone("):] ++ parsedLen = subacts.parse(actstr) ++ lst = [] ++ self["attrs"].append(("OVS_ACTION_ATTR_CLONE", subacts)) ++ actstr = actstr[parsedLen:] ++ parsed = True ++ elif parse_starts_block(actstr, "ct(", False): ++ parencount += 1 + actstr = actstr[len("ct(") :] + ctact = ovsactions.ctact() + +@@ -553,6 +577,7 @@ class ovsactions(nla): + natact = ovsactions.ctact.natattr() + + if actstr.startswith("("): ++ parencount += 1 + t = None + actstr = actstr[1:] + if actstr.startswith("src"): +@@ -607,15 +632,29 @@ class ovsactions(nla): + actstr = actstr[strspn(actstr, ", ") :] + + ctact["attrs"].append(["OVS_CT_ATTR_NAT", natact]) +- actstr = actstr[strspn(actstr, ",) ") :] ++ actstr = actstr[strspn(actstr, ", ") :] + + self["attrs"].append(["OVS_ACTION_ATTR_CT", ctact]) + parsed = True + +- actstr = actstr[strspn(actstr, "), ") :] ++ actstr = actstr[strspn(actstr, ", ") :] ++ while parencount > 0: ++ parencount -= 1 ++ actstr = actstr[strspn(actstr, " "):] ++ if len(actstr) and actstr[0] != ")": ++ raise ValueError("Action str: '%s' unbalanced" % actstr) ++ actstr = actstr[1:] ++ ++ if len(actstr) and actstr[0] == ")": ++ return (totallen - len(actstr)) ++ ++ actstr = actstr[strspn(actstr, ", ") :] ++ + if not parsed: + raise ValueError("Action str: '%s' not supported" % actstr) + ++ return (totallen - len(actstr)) ++ + + class ovskey(nla): + nla_flags = NLA_F_NESTED +@@ -2111,6 +2150,8 @@ def main(argv): + ovsflow = OvsFlow() + ndb = NDB() + ++ sys.setrecursionlimit(100000) ++ + if hasattr(args, "showdp"): + found = False + for iface in ndb.interfaces: +-- +2.43.0 + diff --git a/queue-6.6/selftests-tls-use-exact-comparison-in-recv_partial.patch b/queue-6.6/selftests-tls-use-exact-comparison-in-recv_partial.patch new file mode 100644 index 00000000000..b120c810129 --- /dev/null +++ b/queue-6.6/selftests-tls-use-exact-comparison-in-recv_partial.patch @@ -0,0 +1,44 @@ +From 875ac99ec8b3d63fded43b6cde57450b1dad8517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Feb 2024 17:18:23 -0800 +Subject: selftests: tls: use exact comparison in recv_partial + +From: Jakub Kicinski + +[ Upstream commit 49d821064c44cb5ffdf272905236012ea9ce50e3 ] + +This exact case was fail for async crypto and we weren't +catching it. + +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/tls.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 464853a7f9829..ad993ab3ac181 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -988,12 +988,12 @@ TEST_F(tls, recv_partial) + + memset(recv_mem, 0, sizeof(recv_mem)); + EXPECT_EQ(send(self->fd, test_str, send_len, 0), send_len); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_first), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_first), ++ MSG_WAITALL), strlen(test_str_first)); + EXPECT_EQ(memcmp(test_str_first, recv_mem, strlen(test_str_first)), 0); + memset(recv_mem, 0, sizeof(recv_mem)); +- EXPECT_NE(recv(self->cfd, recv_mem, strlen(test_str_second), +- MSG_WAITALL), -1); ++ EXPECT_EQ(recv(self->cfd, recv_mem, strlen(test_str_second), ++ MSG_WAITALL), strlen(test_str_second)); + EXPECT_EQ(memcmp(test_str_second, recv_mem, strlen(test_str_second)), + 0); + } +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 82d86f23690..ce18a13c22c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -2,3 +2,66 @@ platform-x86-p2sb-on-goldmont-only-cache-p2sb-and-sp.patch io_uring-unix-drop-usage-of-io_uring-socket.patch io_uring-drop-any-code-related-to-scm_rights.patch soc-qcom-pmic_glink_altmode-fix-drm-bridge-use-after.patch +media-rkisp1-fix-irq-handling-due-to-shared-interrup.patch +asoc-cs42l43-handle-error-from-devm_pm_runtime_enabl.patch +wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch +perf-arm-cmn-workaround-ampereonex-errata-ac04_mesh_.patch +selftests-openvswitch-add-validation-for-the-recursi.patch +selftests-tls-use-exact-comparison-in-recv_partial.patch +asoc-rt5645-make-lattepanda-board-dmi-match-more-pre.patch +spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch +regmap-kunit-ensure-that-changed-bytes-are-actually-.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-82uu.patch +x86-xen-add-some-null-pointer-checking-to-smp.c.patch +mips-clear-cause.bd-in-instruction_pointer_set.patch +hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch +asoc-sof-ipc4-pcm-workaround-for-crashed-firmware-on.patch +gen_compile_commands-fix-invalid-escape-sequence-war.patch +arm64-sve-lower-the-maximum-allocation-for-the-sve-p.patch +soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch +arm64-dts-rockchip-mark-system-power-controller-on-r.patch +rdma-mlx5-fix-fortify-source-warning-while-accessing.patch +rdma-mlx5-relax-devx-access-upon-modify-commands.patch +arm-dts-rockchip-drop-interrupts-property-from-pwm-r.patch +riscv-dts-sifive-add-missing-interrupt-cells-to-pmic.patch +x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch +x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch +net-iucv-fix-the-allocation-size-of-iucv_path_table-.patch +parisc-ftrace-add-missing-config_dynamic_ftrace-chec.patch +block-sed-opal-handle-empty-atoms-when-parsing-respo.patch +cxl-region-handle-endpoint-decoders-in-cxl_region_fi.patch +cxl-region-allow-out-of-order-assembly-of-autodiscov.patch +perf-cxl-fix-cpmu-filter-value-mask-length.patch +platform-x86-x86-android-tablets-fix-acer_b1_750_goo.patch +dm-verity-dm-crypt-align-struct-bvec_iter-correctly.patch +arm-dts-fix-dtc-interrupt_provider-warnings.patch +arm64-dts-fix-dtc-interrupt_provider-warnings.patch +arm-dts-fix-dtc-interrupt_map-warnings.patch +arm64-dts-qcom-fix-interrupt-map-cell-sizes.patch +arm-dts-renesas-rcar-gen2-add-missing-interrupt-cell.patch +regulator-max5970-fix-regulator-child-node-name.patch +btrfs-fix-data-races-when-accessing-the-reserved-amo.patch +btrfs-fix-data-race-at-btrfs_use_block_rsv-when-acce.patch +net-smsc95xx-add-support-for-sys-tec-usb-spemodule1.patch +wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch +drm-ttm-tests-depend-on-uml-compile_test.patch +asoc-amd-yc-add-lenovo-thinkbook-21j0-into-dmi-quirk.patch +scsi-mpt3sas-prevent-sending-diag_reset-when-the-con.patch +selftests-mptcp-explicitly-trigger-the-listener-diag.patch +alsa-hda-realtek-alc285-reduce-pop-noise-from-headph.patch +drm-amdgpu-enable-gpu-reset-for-s3-abort-cases-on-ra.patch +asoc-amd-yc-fix-non-functional-mic-on-lenovo-21j2.patch +bluetooth-rfcomm-fix-null-ptr-deref-in-rfcomm_check_.patch +bluetooth-mgmt-fix-limited-discoverable-off-timeout.patch +firewire-core-use-long-bus-reset-on-gap-count-error.patch +perf-riscv-fix-panic-on-pmu-overflow-handler.patch +arm64-tegra-set-the-correct-phy-mode-for-mgbe.patch +asoc-intel-bytcr_rt5640-add-an-extra-entry-for-the-c.patch +x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch +asoc-amd-yc-add-hp-pavilion-aero-laptop-13-be2xxx-8b.patch +xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch +xfrm-set-skb-control-buffer-based-on-packet-offload-.patch +input-gpio_keys_polled-suppress-deferred-probe-error.patch +asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch +asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch +asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch diff --git a/queue-6.6/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch b/queue-6.6/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch new file mode 100644 index 00000000000..1ed948accc2 --- /dev/null +++ b/queue-6.6/soc-microchip-fix-polarfire_soc_sys_ctrl-input-promp.patch @@ -0,0 +1,33 @@ +From 0ca97bc7aae677e0cf4106945fddcee666d570bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jan 2024 16:04:14 +0100 +Subject: soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt + +From: Geert Uytterhoeven + +[ Upstream commit 6dd9a236042e305d7b69ee92db7347bf5943e7d3 ] + +The symbol's prompt should be a one-line description, instead of just +duplicating the symbol name. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Conor Dooley +Signed-off-by: Sasha Levin +--- + drivers/soc/microchip/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/microchip/Kconfig b/drivers/soc/microchip/Kconfig +index eb656b33156ba..f19e74d342aa2 100644 +--- a/drivers/soc/microchip/Kconfig ++++ b/drivers/soc/microchip/Kconfig +@@ -1,5 +1,5 @@ + config POLARFIRE_SOC_SYS_CTRL +- tristate "POLARFIRE_SOC_SYS_CTRL" ++ tristate "Microchip PolarFire SoC (MPFS) system controller support" + depends on POLARFIRE_SOC_MAILBOX + help + This driver adds support for the PolarFire SoC (MPFS) system controller. +-- +2.43.0 + diff --git a/queue-6.6/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch b/queue-6.6/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch new file mode 100644 index 00000000000..6d937ec3aac --- /dev/null +++ b/queue-6.6/spi-intel-pci-add-support-for-lunar-lake-m-spi-seria.patch @@ -0,0 +1,35 @@ +From ccd612e721a56fa2f591a6eaa68cef5c637c8292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 10:20:27 +0200 +Subject: spi: intel-pci: Add support for Lunar Lake-M SPI serial flash + +From: Mika Westerberg + +[ Upstream commit 8f44e3808200c1434c26ef459722f88f48b306df ] + +Add Intel Lunar Lake-M PCI ID to the driver list of supported devices. +This is the same controller found in previous generations. + +Signed-off-by: Mika Westerberg +Link: https://msgid.link/r/20240212082027.2462849-1-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index 07d20ca1164c3..4337ca51d7aa2 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -85,6 +85,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa2a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, + { }, + }; + MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch b/queue-6.6/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch new file mode 100644 index 00000000000..b4af4d07fda --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-use-correct-address-3-in-a-msdu.patch @@ -0,0 +1,204 @@ +From b3990f1e1bbd14f2e7345f10bc52b32b91e65a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 00:06:03 +0200 +Subject: wifi: iwlwifi: mvm: use correct address 3 in A-MSDU + +From: Daniel Gabay + +[ Upstream commit 2e57b77583ca34fdb6e14f253172636c52f81cf2 ] + +As described in IEEE sta 802.11-2020, table 9-30 (Address +field contents), A-MSDU address 3 should contain the BSSID +address. + +In TX_CMD we copy the MAC header from skb, and skb address 3 +holds the destination address, but it may not be identical to +the BSSID. + +Using the wrong destination address appears to work with (most) +receivers without MLO, but in MLO some devices are checking for +it carefully, perhaps as a consequence of link to MLD address +translation. + +Replace address 3 in the TX_CMD MAC header with the correct +address while retaining the skb address 3 unchanged. +This ensures that skb address 3 will be utilized later for +constructing the A-MSDU subframes. + +Note that we fill in the MLD address, but the firmware will do the +necessary translation to link address after encryption. + +Signed-off-by: Daniel Gabay +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240204235836.4583a1bf9188.I3f8e7892bdf8f86b4daa28453771a8c9817b2416@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 69 ++++++++++++++++++--- + 1 file changed, 59 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index 6fdb2c38518e3..4ea3aabc64883 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -500,13 +500,24 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm, + } + } + ++static void iwl_mvm_copy_hdr(void *cmd, const void *hdr, int hdrlen, ++ const u8 *addr3_override) ++{ ++ struct ieee80211_hdr *out_hdr = cmd; ++ ++ memcpy(cmd, hdr, hdrlen); ++ if (addr3_override) ++ memcpy(out_hdr->addr3, addr3_override, ETH_ALEN); ++} ++ + /* + * Allocates and sets the Tx cmd the driver data pointers in the skb + */ + static struct iwl_device_tx_cmd * + iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + struct ieee80211_tx_info *info, int hdrlen, +- struct ieee80211_sta *sta, u8 sta_id) ++ struct ieee80211_sta *sta, u8 sta_id, ++ const u8 *addr3_override) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct iwl_device_tx_cmd *dev_cmd; +@@ -564,7 +575,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + cmd->len = cpu_to_le16((u16)skb->len); + + /* Copy MAC header from skb into command buffer */ +- memcpy(cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override); + + cmd->flags = cpu_to_le16(flags); + cmd->rate_n_flags = cpu_to_le32(rate_n_flags); +@@ -579,7 +590,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + cmd->len = cpu_to_le16((u16)skb->len); + + /* Copy MAC header from skb into command buffer */ +- memcpy(cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(cmd->hdr, hdr, hdrlen, addr3_override); + + cmd->flags = cpu_to_le32(flags); + cmd->rate_n_flags = cpu_to_le32(rate_n_flags); +@@ -597,7 +608,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, + iwl_mvm_set_tx_cmd_rate(mvm, tx_cmd, info, sta, hdr->frame_control); + + /* Copy MAC header from skb into command buffer */ +- memcpy(tx_cmd->hdr, hdr, hdrlen); ++ iwl_mvm_copy_hdr(tx_cmd->hdr, hdr, hdrlen, addr3_override); + + out: + return dev_cmd; +@@ -800,7 +811,8 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) + + IWL_DEBUG_TX(mvm, "station Id %d, queue=%d\n", sta_id, queue); + +- dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id); ++ dev_cmd = iwl_mvm_set_tx_params(mvm, skb, &info, hdrlen, NULL, sta_id, ++ NULL); + if (!dev_cmd) + return -1; + +@@ -1120,7 +1132,8 @@ static int iwl_mvm_tx_pkt_queued(struct iwl_mvm *mvm, + */ + static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, + struct ieee80211_tx_info *info, +- struct ieee80211_sta *sta) ++ struct ieee80211_sta *sta, ++ const u8 *addr3_override) + { + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct iwl_mvm_sta *mvmsta; +@@ -1152,7 +1165,8 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, + iwl_mvm_probe_resp_set_noa(mvm, skb); + + dev_cmd = iwl_mvm_set_tx_params(mvm, skb, info, hdrlen, +- sta, mvmsta->deflink.sta_id); ++ sta, mvmsta->deflink.sta_id, ++ addr3_override); + if (!dev_cmd) + goto drop; + +@@ -1274,9 +1288,11 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct ieee80211_tx_info info; + struct sk_buff_head mpdus_skbs; ++ struct ieee80211_vif *vif; + unsigned int payload_len; + int ret; + struct sk_buff *orig_skb = skb; ++ const u8 *addr3; + + if (WARN_ON_ONCE(!mvmsta)) + return -1; +@@ -1287,26 +1303,59 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, + memcpy(&info, skb->cb, sizeof(info)); + + if (!skb_is_gso(skb)) +- return iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL); + + payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) - + tcp_hdrlen(skb) + skb->data_len; + + if (payload_len <= skb_shinfo(skb)->gso_size) +- return iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ return iwl_mvm_tx_mpdu(mvm, skb, &info, sta, NULL); + + __skb_queue_head_init(&mpdus_skbs); + ++ vif = info.control.vif; ++ if (!vif) ++ return -1; ++ + ret = iwl_mvm_tx_tso(mvm, skb, &info, sta, &mpdus_skbs); + if (ret) + return ret; + + WARN_ON(skb_queue_empty(&mpdus_skbs)); + ++ /* ++ * As described in IEEE sta 802.11-2020, table 9-30 (Address ++ * field contents), A-MSDU address 3 should contain the BSSID ++ * address. ++ * Pass address 3 down to iwl_mvm_tx_mpdu() and further to set it ++ * in the command header. We need to preserve the original ++ * address 3 in the skb header to correctly create all the ++ * A-MSDU subframe headers from it. ++ */ ++ switch (vif->type) { ++ case NL80211_IFTYPE_STATION: ++ addr3 = vif->cfg.ap_addr; ++ break; ++ case NL80211_IFTYPE_AP: ++ addr3 = vif->addr; ++ break; ++ default: ++ addr3 = NULL; ++ break; ++ } ++ + while (!skb_queue_empty(&mpdus_skbs)) { ++ struct ieee80211_hdr *hdr; ++ bool amsdu; ++ + skb = __skb_dequeue(&mpdus_skbs); ++ hdr = (void *)skb->data; ++ amsdu = ieee80211_is_data_qos(hdr->frame_control) && ++ (*ieee80211_get_qos_ctl(hdr) & ++ IEEE80211_QOS_CTL_A_MSDU_PRESENT); + +- ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta); ++ ret = iwl_mvm_tx_mpdu(mvm, skb, &info, sta, ++ amsdu ? addr3 : NULL); + if (ret) { + /* Free skbs created as part of TSO logic that have not yet been dequeued */ + __skb_queue_purge(&mpdus_skbs); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch b/queue-6.6/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch new file mode 100644 index 00000000000..1ce08a0b25d --- /dev/null +++ b/queue-6.6/wifi-mac80211-only-call-drv_sta_rc_update-for-upload.patch @@ -0,0 +1,39 @@ +From 653c16ee61db8eb292708f8e47833fb053410919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Feb 2024 15:05:35 +0100 +Subject: wifi: mac80211: only call drv_sta_rc_update for uploaded stations + +From: Felix Fietkau + +[ Upstream commit 413dafc8170fcb925fb17af8842f06af305f8e0b ] + +When a station has not been uploaded yet, receiving SMPS or channel width +notification action frames can lead to rate_control_rate_update calling +drv_sta_rc_update with uninitialized driver private data. +Fix this by adding a missing check for sta->uploaded. + +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240221140535.16102-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rate.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c +index d5ea5f5bcf3a0..9d33fd2377c88 100644 +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -119,7 +119,8 @@ void rate_control_rate_update(struct ieee80211_local *local, + rcu_read_unlock(); + } + +- drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); ++ if (sta->uploaded) ++ drv_sta_rc_update(local, sta->sdata, &sta->sta, changed); + } + + int ieee80211_rate_control_register(const struct rate_control_ops *ops) +-- +2.43.0 + diff --git a/queue-6.6/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch b/queue-6.6/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch new file mode 100644 index 00000000000..39f1b4f2a2e --- /dev/null +++ b/queue-6.6/x86-hyperv-allow-15-bit-apic-ids-for-vtl-platforms.patch @@ -0,0 +1,58 @@ +From c97c49ed247f68435d5bb00a4d25373f818e00e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jan 2024 09:57:40 -0800 +Subject: x86/hyperv: Allow 15-bit APIC IDs for VTL platforms + +From: Saurabh Sengar + +[ Upstream commit 0d63e4c0ebc2b5c329babde44fd61d3f08db814d ] + +The current method for signaling the compatibility of a Hyper-V host +with MSIs featuring 15-bit APIC IDs relies on a synthetic cpuid leaf. +However, for higher VTLs, this leaf is not reported, due to the absence +of an IO-APIC. + +As an alternative, assume that when running at a high VTL, the host +supports 15-bit APIC IDs. This assumption is safe, as Hyper-V does not +employ any architectural MSIs at higher VTLs + +This unblocks startup of VTL2 environments with more than 256 CPUs. + +Signed-off-by: Saurabh Sengar +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1705341460-18394-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <1705341460-18394-1-git-send-email-ssengar@linux.microsoft.com> +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/hv_vtl.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c +index 999f5ac82fe90..53b309d41b3b9 100644 +--- a/arch/x86/hyperv/hv_vtl.c ++++ b/arch/x86/hyperv/hv_vtl.c +@@ -16,6 +16,11 @@ + extern struct boot_params boot_params; + static struct real_mode_header hv_vtl_real_mode_header; + ++static bool __init hv_vtl_msi_ext_dest_id(void) ++{ ++ return true; ++} ++ + void __init hv_vtl_init_platform(void) + { + pr_info("Linux runs in Hyper-V Virtual Trust Level\n"); +@@ -38,6 +43,8 @@ void __init hv_vtl_init_platform(void) + x86_platform.legacy.warm_reset = 0; + x86_platform.legacy.reserve_bios_regions = 0; + x86_platform.legacy.devices.pnpbios = 0; ++ ++ x86_init.hyper.msi_ext_dest_id = hv_vtl_msi_ext_dest_id; + } + + static inline u64 hv_vtl_system_desc_base(struct ldttss_desc *desc) +-- +2.43.0 + diff --git a/queue-6.6/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch b/queue-6.6/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch new file mode 100644 index 00000000000..fde102df3cc --- /dev/null +++ b/queue-6.6/x86-mm-disallow-vsyscall-page-read-for-copy_from_ker.patch @@ -0,0 +1,100 @@ +From dcf3cde667cdf1d04137cd3bc814ab355731e739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:34 +0800 +Subject: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() + +From: Hou Tao + +[ Upstream commit 32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58 ] + +When trying to use copy_from_kernel_nofault() to read vsyscall page +through a bpf program, the following oops was reported: + + BUG: unable to handle page fault for address: ffffffffff600000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... + RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 + ...... + Call Trace: + + ? copy_from_kernel_nofault+0x6f/0x110 + bpf_probe_read_kernel+0x1d/0x50 + bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d + trace_call_bpf+0xc5/0x1c0 + perf_call_bpf_enter.isra.0+0x69/0xb0 + perf_syscall_enter+0x13e/0x200 + syscall_trace_enter+0x188/0x1c0 + do_syscall_64+0xb5/0xe0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + + ...... + ---[ end trace 0000000000000000 ]--- + +The oops is triggered when: + +1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall +page and invokes copy_from_kernel_nofault() which in turn calls +__get_user_asm(). + +2) Because the vsyscall page address is not readable from kernel space, +a page fault exception is triggered accordingly. + +3) handle_page_fault() considers the vsyscall page address as a user +space address instead of a kernel space address. This results in the +fix-up setup by bpf not being applied and a page_fault_oops() is invoked +due to SMAP. + +Considering handle_page_fault() has already considered the vsyscall page +address as a userspace address, fix the problem by disallowing vsyscall +page read for copy_from_kernel_nofault(). + +Originally-by: Thomas Gleixner +Reported-by: syzbot+72aa0161922eba61b50e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/bpf/CAG48ez06TZft=ATH1qh2c5mpS5BT8UakwNkzi6nvK5_djC-4Nw@mail.gmail.com +Reported-by: xingwei lee +Closes: https://lore.kernel.org/bpf/CABOYnLynjBoFZOf3Z4BhaZkc5hx_kHfsjiW+UWLoB=w33LvScw@mail.gmail.com +Signed-off-by: Hou Tao +Reviewed-by: Sohil Mehta +Acked-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240202103935.3154011-3-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/mm/maccess.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/x86/mm/maccess.c b/arch/x86/mm/maccess.c +index 6993f026adec9..42115ac079cfe 100644 +--- a/arch/x86/mm/maccess.c ++++ b/arch/x86/mm/maccess.c +@@ -3,6 +3,8 @@ + #include + #include + ++#include ++ + #ifdef CONFIG_X86_64 + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + { +@@ -15,6 +17,14 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + if (vaddr < TASK_SIZE_MAX + PAGE_SIZE) + return false; + ++ /* ++ * Reading from the vsyscall page may cause an unhandled fault in ++ * certain cases. Though it is at an address above TASK_SIZE_MAX, it is ++ * usually considered as a user space address. ++ */ ++ if (is_vsyscall_vaddr(vaddr)) ++ return false; ++ + /* + * Allow everything during early boot before 'x86_virt_bits' + * is initialized. Needed for instruction decoding in early +-- +2.43.0 + diff --git a/queue-6.6/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch b/queue-6.6/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch new file mode 100644 index 00000000000..80d5d5e724b --- /dev/null +++ b/queue-6.6/x86-mm-move-is_vsyscall_vaddr-into-asm-vsyscall.h.patch @@ -0,0 +1,71 @@ +From afcf8d9aea873f074df2359aab6f3dc578f7d064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 18:39:33 +0800 +Subject: x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h + +From: Hou Tao + +[ Upstream commit ee0e39a63b78849f8abbef268b13e4838569f646 ] + +Move is_vsyscall_vaddr() into asm/vsyscall.h to make it available for +copy_from_kernel_nofault_allowed() in arch/x86/mm/maccess.c. + +Reviewed-by: Sohil Mehta +Signed-off-by: Hou Tao +Link: https://lore.kernel.org/r/20240202103935.3154011-2-houtao@huaweicloud.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/vsyscall.h | 10 ++++++++++ + arch/x86/mm/fault.c | 9 --------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h +index ab60a71a8dcb9..472f0263dbc61 100644 +--- a/arch/x86/include/asm/vsyscall.h ++++ b/arch/x86/include/asm/vsyscall.h +@@ -4,6 +4,7 @@ + + #include + #include ++#include + + #ifdef CONFIG_X86_VSYSCALL_EMULATION + extern void map_vsyscall(void); +@@ -24,4 +25,13 @@ static inline bool emulate_vsyscall(unsigned long error_code, + } + #endif + ++/* ++ * The (legacy) vsyscall page is the long page in the kernel portion ++ * of the address space that has user-accessible permissions. ++ */ ++static inline bool is_vsyscall_vaddr(unsigned long vaddr) ++{ ++ return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); ++} ++ + #endif /* _ASM_X86_VSYSCALL_H */ +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index ab778eac19520..a9d69ec994b75 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -798,15 +798,6 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code, + show_opcodes(regs, loglvl); + } + +-/* +- * The (legacy) vsyscall page is the long page in the kernel portion +- * of the address space that has user-accessible permissions. +- */ +-static bool is_vsyscall_vaddr(unsigned long vaddr) +-{ +- return unlikely((vaddr & PAGE_MASK) == VSYSCALL_ADDR); +-} +- + static void + __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code, + unsigned long address, u32 pkey, int si_code) +-- +2.43.0 + diff --git a/queue-6.6/x86-xen-add-some-null-pointer-checking-to-smp.c.patch b/queue-6.6/x86-xen-add-some-null-pointer-checking-to-smp.c.patch new file mode 100644 index 00000000000..ab42589f4bc --- /dev/null +++ b/queue-6.6/x86-xen-add-some-null-pointer-checking-to-smp.c.patch @@ -0,0 +1,79 @@ +From 91758dc2b81853b2e855623ebed320dff8d79c73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 17:49:48 +0800 +Subject: x86/xen: Add some null pointer checking to smp.c + +From: Kunwu Chan + +[ Upstream commit 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ +Suggested-by: Markus Elfring +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 4b0d6fff88de5..1fb9a1644d944 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) + char *resched_name, *callfunc_name, *debug_name; + + resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); ++ if (!resched_name) ++ goto fail_mem; + per_cpu(xen_resched_irq, cpu).name = resched_name; + rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, + cpu, +@@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) + per_cpu(xen_resched_irq, cpu).irq = rc; + + callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; + per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, + cpu, +@@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) + + if (!xen_fifo_events) { + debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ if (!debug_name) ++ goto fail_mem; ++ + per_cpu(xen_debug_irq, cpu).name = debug_name; + rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, + xen_debug_interrupt, +@@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) + } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); ++ if (!callfunc_name) ++ goto fail_mem; ++ + per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, + cpu, +@@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) + + return 0; + ++ fail_mem: ++ rc = -ENOMEM; + fail: + xen_smp_intr_free(cpu); + return rc; +-- +2.43.0 + diff --git a/queue-6.6/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch b/queue-6.6/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch new file mode 100644 index 00000000000..7e7440bae48 --- /dev/null +++ b/queue-6.6/xfrm-fix-xfrm-child-route-lookup-for-packet-offload.patch @@ -0,0 +1,49 @@ +From 243e98ede3c6a3e7efe128876e0201e39271bea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 12:24:08 +0000 +Subject: xfrm: fix xfrm child route lookup for packet offload + +From: Mike Yu + +[ Upstream commit d4872d70fc6feabfc8e897edad993a81096ade9f ] + +In current code, xfrm_bundle_create() always uses the matched +SA's family type to look up a xfrm child route for the skb. +The route returned by xfrm_dst_lookup() will eventually be +used in xfrm_output_resume() (skb_dst(skb)->ops->local_out()). + +If packet offload is used, the above behavior can lead to +calling ip_local_out() for an IPv6 packet or calling +ip6_local_out() for an IPv4 packet, which is likely to fail. + +This change fixes the behavior by checking if the matched SA +has packet offload enabled. If not, keep the same behavior; +if yes, use the matched SP's family type for the lookup. + +Test: verified IPv6-in-IPv4 packets on Android device with + IPsec packet offload enabled +Signed-off-by: Mike Yu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index d24b4d4f620ea..97d69ec54ff9c 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -2679,7 +2679,9 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy, + if (xfrm[i]->props.smark.v || xfrm[i]->props.smark.m) + mark = xfrm_smark_get(fl->flowi_mark, xfrm[i]); + +- family = xfrm[i]->props.family; ++ if (xfrm[i]->xso.type != XFRM_DEV_OFFLOAD_PACKET) ++ family = xfrm[i]->props.family; ++ + oif = fl->flowi_oif ? : fl->flowi_l3mdev; + dst = xfrm_dst_lookup(xfrm[i], tos, oif, + &saddr, &daddr, family, mark); +-- +2.43.0 + diff --git a/queue-6.6/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch b/queue-6.6/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch new file mode 100644 index 00000000000..ee6fce778df --- /dev/null +++ b/queue-6.6/xfrm-set-skb-control-buffer-based-on-packet-offload-.patch @@ -0,0 +1,45 @@ +From 1e6e92288a31c56a628da29f5770d73180f3ab12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 12:24:09 +0000 +Subject: xfrm: set skb control buffer based on packet offload as well + +From: Mike Yu + +[ Upstream commit 8688ab2170a5be0bc922195f7091c38b506bab2e ] + +In packet offload, packets are not encrypted in XFRM stack, so +the next network layer which the packets will be forwarded to +should depend on where the packet came from (either xfrm4_output +or xfrm6_output) rather than the matched SA's family type. + +Test: verified IPv6-in-IPv4 packets on Android device with + IPsec packet offload enabled +Signed-off-by: Mike Yu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 662c83beb345e..e5722c95b8bb3 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -704,9 +704,13 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + { + struct net *net = dev_net(skb_dst(skb)->dev); + struct xfrm_state *x = skb_dst(skb)->xfrm; ++ int family; + int err; + +- switch (x->outer_mode.family) { ++ family = (x->xso.type != XFRM_DEV_OFFLOAD_PACKET) ? x->outer_mode.family ++ : skb_dst(skb)->ops->family; ++ ++ switch (family) { + case AF_INET: + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; +-- +2.43.0 + -- 2.47.2