From 446b3ce56d3a809d992c9e47db7c88ce9e5bbef8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 3 Apr 2023 10:46:23 +0200 Subject: [PATCH] 6.2-stable patches added patches: alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch drm-i915-gem-flush-lmem-contents-after-construction.patch dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch pinctrl-amd-disable-and-mask-interrupts-on-resume.patch pinctrl-at91-pio4-fix-domain-name-assignment.patch platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch rcu-fix-rcu_torture_read-ftrace-event.patch s390-reintroduce-expoline-dependence-to-scripts.patch s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch vmxnet3-use-gro-callback-when-upt-is-enabled.patch xen-netback-don-t-do-grant-copy-across-page-boundary.patch xtensa-fix-kasan-report-for-show_stack.patch zonefs-always-invalidate-last-cached-page-on-append-write.patch --- ...partial-revert-of-a-quirk-for-lenovo.patch | 59 +++++++ ...dd-quirk-for-lenovo-zhaoyang-cf4620z.patch | 32 ++++ ...ek-add-quirks-for-some-clevo-laptops.patch | 60 ++++++++ ...ession-on-detection-of-roland-vs-100.patch | 46 ++++++ ...deadlock-by-moving-j1939_sk_errqueue.patch | 88 +++++++++++ ...ios-to-always-allow-for-splitting-io.patch | 55 +++++++ ...pport-for-synaptics-cascaded-mst-hub.patch | 82 ++++++++++ ...c-overhead-into-timeslot-calculation.patch | 145 ++++++++++++++++++ ...apus-to-do-mode2-reset-when-go-to-s4.patch | 43 ++++++ ...ce-leak-when-mmaping-imported-buffer.patch | 41 +++++ ...pt-treat-the-dpt-bo-as-a-framebuffer.patch | 85 ++++++++++ ...ush-lmem-contents-after-construction.patch | 45 ++++++ ...c-spi-nor-document-cpol-cpha-support.patch | 47 ++++++ ...ing-of-crcs-on-32-bit-build-machines.patch | 38 +++++ ...fault-value-for-tx-rx-internal-delay.patch | 55 +++++++ ...ing-open-state-after-a-server-reboot.patch | 45 ++++++ ...isable-and-mask-interrupts-on-resume.patch | 97 ++++++++++++ ...at91-pio4-fix-domain-name-assignment.patch | 39 +++++ ...top-stop-sending-key_touchpad_toggle.patch | 87 +++++++++++ ...e_needs_flush-false-positive-warning.patch | 54 +++++++ ...-copy-ppr-for-task-with-null-pt_regs.patch | 81 ++++++++++ ...r-dlpar-if-copy-paste-is-not-enabled.patch | 60 ++++++++ ...cu-fix-rcu_torture_read-ftrace-event.patch | 39 +++++ ...oduce-expoline-dependence-to-scripts.patch | 48 ++++++ ...yclobber-annotations-to-__clear_user.patch | 37 +++++ queue-6.2/series | 30 ++++ ...ssor_thermal-fix-additional-deadlock.patch | 39 +++++ ...use-gro-callback-when-upt-is-enabled.patch | 48 ++++++ ...t-do-grant-copy-across-page-boundary.patch | 118 ++++++++++++++ ...ensa-fix-kasan-report-for-show_stack.patch | 53 +++++++ ...ate-last-cached-page-on-append-write.patch | 62 ++++++++ 31 files changed, 1858 insertions(+) create mode 100644 queue-6.2/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch create mode 100644 queue-6.2/alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch create mode 100644 queue-6.2/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch create mode 100644 queue-6.2/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch create mode 100644 queue-6.2/can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch create mode 100644 queue-6.2/dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch create mode 100644 queue-6.2/drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch create mode 100644 queue-6.2/drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch create mode 100644 queue-6.2/drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch create mode 100644 queue-6.2/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch create mode 100644 queue-6.2/drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch create mode 100644 queue-6.2/drm-i915-gem-flush-lmem-contents-after-construction.patch create mode 100644 queue-6.2/dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch create mode 100644 queue-6.2/modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch create mode 100644 queue-6.2/net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch create mode 100644 queue-6.2/nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch create mode 100644 queue-6.2/pinctrl-amd-disable-and-mask-interrupts-on-resume.patch create mode 100644 queue-6.2/pinctrl-at91-pio4-fix-domain-name-assignment.patch create mode 100644 queue-6.2/platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch create mode 100644 queue-6.2/powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch create mode 100644 queue-6.2/powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch create mode 100644 queue-6.2/powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch create mode 100644 queue-6.2/rcu-fix-rcu_torture_read-ftrace-event.patch create mode 100644 queue-6.2/s390-reintroduce-expoline-dependence-to-scripts.patch create mode 100644 queue-6.2/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch create mode 100644 queue-6.2/thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch create mode 100644 queue-6.2/vmxnet3-use-gro-callback-when-upt-is-enabled.patch create mode 100644 queue-6.2/xen-netback-don-t-do-grant-copy-across-page-boundary.patch create mode 100644 queue-6.2/xtensa-fix-kasan-report-for-show_stack.patch create mode 100644 queue-6.2/zonefs-always-invalidate-last-cached-page-on-append-write.patch diff --git a/queue-6.2/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch b/queue-6.2/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch new file mode 100644 index 00000000000..dbadc985982 --- /dev/null +++ b/queue-6.2/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch @@ -0,0 +1,59 @@ +From b871cb971c683f7f212e7ca3c9a6709a75785116 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 20 Mar 2023 15:09:54 +0100 +Subject: ALSA: hda/conexant: Partial revert of a quirk for Lenovo + +From: Takashi Iwai + +commit b871cb971c683f7f212e7ca3c9a6709a75785116 upstream. + +The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for +LENOVO 20149 Notebook model") introduced a quirk for the device with +17aa:3977, but this caused a regression on another model (Lenovo +Ideadpad U31) with the very same PCI SSID. And, through skimming over +the net, it seems that this PCI SSID is used for multiple different +models, so it's no good idea to apply the quirk with the SSID. + +Although we may take a different ID check (e.g. the codec SSID instead +of the PCI SSID), unfortunately, the original patch author couldn't +identify the hardware details any longer as the machine was returned, +and we can't develop the further proper fix. + +In this patch, instead, we partially revert the change so that the +quirk won't be applied as default for addressing the regression. +Meanwhile, the quirk function itself is kept, and it's now made to be +applicable via the explicit model=lenovo-20149 option. + +Fixes: f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") +Reported-by: Jetro Jormalainen +Link: https://lore.kernel.org/r/20230308215009.4d3e58a6@mopti +Cc: +Link: https://lore.kernel.org/r/20230320140954.31154-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_conexant.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -980,7 +980,10 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK), ++ /* NOTE: we'd need to extend the quirk for 17aa:3977 as the same ++ * PCI SSID is used on multiple Lenovo models ++ */ ++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), +@@ -1003,6 +1006,7 @@ static const struct hda_model_fixup cxt5 + { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, + { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" }, + { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, ++ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + {} + }; + diff --git a/queue-6.2/alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch b/queue-6.2/alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch new file mode 100644 index 00000000000..7c46fd21cdd --- /dev/null +++ b/queue-6.2/alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch @@ -0,0 +1,32 @@ +From 52aad39385e1bfdb34a1b405f699a8ef302c58b0 Mon Sep 17 00:00:00 2001 +From: huangwenhui +Date: Tue, 28 Mar 2023 15:46:44 +0800 +Subject: ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z + +From: huangwenhui + +commit 52aad39385e1bfdb34a1b405f699a8ef302c58b0 upstream. + +Fix headset microphone detection on Lenovo ZhaoYang CF4620Z. + +[ adjusted to be applicable to the latest tree -- tiwai ] + +Signed-off-by: huangwenhui +Cc: +Link: https://lore.kernel.org/r/20230328074644.30142-1-huangwenhuia@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9712,6 +9712,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), ++ SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK), + SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), diff --git a/queue-6.2/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch b/queue-6.2/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch new file mode 100644 index 00000000000..fb6443b0cc1 --- /dev/null +++ b/queue-6.2/alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch @@ -0,0 +1,60 @@ +From b7a5822810c4398515300d614d988cf638adecad Mon Sep 17 00:00:00 2001 +From: Tim Crawford +Date: Fri, 17 Mar 2023 08:18:25 -0600 +Subject: ALSA: hda/realtek: Add quirks for some Clevo laptops + +From: Tim Crawford + +commit b7a5822810c4398515300d614d988cf638adecad upstream. + +Add the audio quirk for some of Clevo's latest RPL laptops: + +- NP50RNJS (ALC256) +- NP70SNE (ALC256) +- PD50SNE (ALC1220) +- PE60RNE (ALC1220) + +Co-authored-by: Jeremy Soller +Signed-off-by: Tim Crawford +Cc: +Link: https://lore.kernel.org/r/20230317141825.11807-1-tcrawford@system76.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2631,6 +2631,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x66a2, "Clevo PE60RNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +@@ -2651,6 +2652,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950), ++ SND_PCI_QUIRK(0x1558, 0xd502, "Clevo PD50SNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD), + SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD), + SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530), +@@ -9574,6 +9576,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x5630, "Clevo NP50RNJS", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -9608,6 +9611,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL5[03]RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), diff --git a/queue-6.2/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch b/queue-6.2/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch new file mode 100644 index 00000000000..e988ecc15b1 --- /dev/null +++ b/queue-6.2/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch @@ -0,0 +1,46 @@ +From fa4e7a6fa12b1132340785e14bd439cbe95b7a5a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 24 Mar 2023 08:50:05 +0100 +Subject: ALSA: usb-audio: Fix regression on detection of Roland VS-100 + +From: Takashi Iwai + +commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a upstream. + +It's been reported that the recent kernel can't probe the PCM devices +on Roland VS-100 properly, and it turned out to be a regression by the +recent addition of the bit shift range check for the format bits. +In the old code, we just did bit-shift and it resulted in zero, which +is then corrected to the standard PCM format, while the new code +explicitly returns an error in such a case. + +For addressing the regression, relax the check and fallback to the +standard PCM type (with the info output). + +Fixes: 43d5ca88dfcd ("ALSA: usb-audio: Fix potential out-of-bounds shift") +Cc: +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217084 +Link: https://lore.kernel.org/r/20230324075005.19403-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/format.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -39,8 +39,12 @@ static u64 parse_audio_format_i_type(str + case UAC_VERSION_1: + default: { + struct uac_format_type_i_discrete_descriptor *fmt = _fmt; +- if (format >= 64) +- return 0; /* invalid format */ ++ if (format >= 64) { ++ usb_audio_info(chip, ++ "%u:%d: invalid format type 0x%llx is detected, processed as PCM\n", ++ fp->iface, fp->altsetting, format); ++ format = UAC_FORMAT_TYPE_I_PCM; ++ } + sample_width = fmt->bBitResolution; + sample_bytes = fmt->bSubframeSize; + format = 1ULL << format; diff --git a/queue-6.2/can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch b/queue-6.2/can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch new file mode 100644 index 00000000000..d09ec9be1e6 --- /dev/null +++ b/queue-6.2/can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch @@ -0,0 +1,88 @@ +From d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Fri, 24 Mar 2023 14:01:41 +0100 +Subject: can: j1939: prevent deadlock by moving j1939_sk_errqueue() + +From: Oleksij Rempel + +commit d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 upstream. + +This commit addresses a deadlock situation that can occur in certain +scenarios, such as when running data TP/ETP transfer and subscribing to +the error queue while receiving a net down event. The deadlock involves +locks in the following order: + +3 + j1939_session_list_lock -> active_session_list_lock + j1939_session_activate + ... + j1939_sk_queue_activate_next -> sk_session_queue_lock + ... + j1939_xtp_rx_eoma_one + +2 + j1939_sk_queue_drop_all -> sk_session_queue_lock + ... + j1939_sk_netdev_event_netdown -> j1939_socks_lock + j1939_netdev_notify + +1 + j1939_sk_errqueue -> j1939_socks_lock + __j1939_session_cancel -> active_session_list_lock + j1939_tp_rxtimer + + CPU0 CPU1 + ---- ---- + lock(&priv->active_session_list_lock); + lock(&jsk->sk_session_queue_lock); + lock(&priv->active_session_list_lock); + lock(&priv->j1939_socks_lock); + +The solution implemented in this commit is to move the +j1939_sk_errqueue() call out of the active_session_list_lock context, +thus preventing the deadlock situation. + +Reported-by: syzbot+ee1cd780f69483a8616b@syzkaller.appspotmail.com +Fixes: 5b9272e93f2e ("can: j1939: extend UAPI to notify about RX status") +Co-developed-by: Hillf Danton +Signed-off-by: Hillf Danton +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/all/20230324130141.2132787-1-o.rempel@pengutronix.de +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1124,8 +1124,6 @@ static void __j1939_session_cancel(struc + + if (session->sk) + j1939_sk_send_loop_abort(session->sk, session->err); +- else +- j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + static void j1939_session_cancel(struct j1939_session *session, +@@ -1140,6 +1138,9 @@ static void j1939_session_cancel(struct + } + + j1939_session_list_unlock(session->priv); ++ ++ if (!session->sk) ++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer) +@@ -1253,6 +1254,9 @@ static enum hrtimer_restart j1939_tp_rxt + __j1939_session_cancel(session, J1939_XTP_ABORT_TIMEOUT); + } + j1939_session_list_unlock(session->priv); ++ ++ if (!session->sk) ++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT); + } + + j1939_session_put(session); diff --git a/queue-6.2/dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch b/queue-6.2/dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch new file mode 100644 index 00000000000..1bab70d1746 --- /dev/null +++ b/queue-6.2/dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch @@ -0,0 +1,55 @@ +From 666eed46769d929c3e13636134ecfc67d75ef548 Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Thu, 30 Mar 2023 15:09:29 -0400 +Subject: dm: fix __send_duplicate_bios() to always allow for splitting IO + +From: Mike Snitzer + +commit 666eed46769d929c3e13636134ecfc67d75ef548 upstream. + +Commit 7dd76d1feec70 ("dm: improve bio splitting and associated IO +accounting") only called setup_split_accounting() from +__send_duplicate_bios() if a single bio were being issued. But the case +where duplicate bios are issued must call it too. + +Otherwise the bio won't be split and resubmitted (via recursion through +block core back to DM) to submit the later portions of a bio (which may +map to an entirely different target). + +For example, when discarding an entire DM striped device with the +following DM table: + vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048 + vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048 + +Before (broken, discards the first striped target's devices twice): + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 + device-mapper: striped: target_stripe=0, bdev=7:0, start=2049 len=22528 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=22528 + +After (works as expected): + device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 + device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 + device-mapper: striped: target_stripe=0, bdev=7:2, start=2048 len=22528 + device-mapper: striped: target_stripe=1, bdev=7:3, start=2048 len=22528 + +Fixes: 7dd76d1feec70 ("dm: improve bio splitting and associated IO accounting") +Cc: stable@vger.kernel.org +Reported-by: Orange Kao +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1509,6 +1509,8 @@ static int __send_duplicate_bios(struct + ret = 1; + break; + default: ++ if (len) ++ setup_split_accounting(ci, *len); + /* dm_accept_partial_bio() is not supported with shared tio->len_ptr */ + alloc_multiple_bios(&blist, ci, ti, num_bios); + while ((clone = bio_list_pop(&blist))) { diff --git a/queue-6.2/drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch b/queue-6.2/drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch new file mode 100644 index 00000000000..6a36499bc68 --- /dev/null +++ b/queue-6.2/drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch @@ -0,0 +1,82 @@ +From f4f3b7dedbe849e780c779ba67365bb1db0d8637 Mon Sep 17 00:00:00 2001 +From: Fangzhi Zuo +Date: Fri, 24 Feb 2023 13:45:21 -0500 +Subject: drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub + +From: Fangzhi Zuo + +commit f4f3b7dedbe849e780c779ba67365bb1db0d8637 upstream. + +Traditional synaptics hub has one MST branch device without virtual dpcd. +Synaptics cascaded hub has two chained MST branch devices. DSC decoding +is performed via root MST branch device, instead of the second MST branch +device. + +Reviewed-by: Hersen Wu +Acked-by: Qingqing Zhuo +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 19 ++++++++++++ + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 12 +++++++ + 2 files changed, 31 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -208,6 +208,21 @@ bool needs_dsc_aux_workaround(struct dc_ + return false; + } + ++bool is_synaptics_cascaded_panamera(struct dc_link *link, struct drm_dp_mst_port *port) ++{ ++ u8 branch_vendor_data[4] = { 0 }; // Vendor data 0x50C ~ 0x50F ++ ++ if (drm_dp_dpcd_read(port->mgr->aux, DP_BRANCH_VENDOR_SPECIFIC_START, &branch_vendor_data, 4) == 4) { ++ if (link->dpcd_caps.branch_dev_id == DP_BRANCH_DEVICE_ID_90CC24 && ++ IS_SYNAPTICS_CASCADED_PANAMERA(link->dpcd_caps.branch_dev_name, branch_vendor_data)) { ++ DRM_INFO("Synaptics Cascaded MST hub\n"); ++ return true; ++ } ++ } ++ ++ return false; ++} ++ + static bool validate_dsc_caps_on_connector(struct amdgpu_dm_connector *aconnector) + { + struct dc_sink *dc_sink = aconnector->dc_sink; +@@ -231,6 +246,10 @@ static bool validate_dsc_caps_on_connect + needs_dsc_aux_workaround(aconnector->dc_link)) + aconnector->dsc_aux = &aconnector->mst_port->dm_dp_aux.aux; + ++ /* synaptics cascaded MST hub case */ ++ if (!aconnector->dsc_aux && is_synaptics_cascaded_panamera(aconnector->dc_link, port)) ++ aconnector->dsc_aux = port->mgr->aux; ++ + if (!aconnector->dsc_aux) + return false; + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +@@ -34,6 +34,18 @@ + #define SYNAPTICS_RC_OFFSET 0x4BC + #define SYNAPTICS_RC_DATA 0x4C0 + ++#define DP_BRANCH_VENDOR_SPECIFIC_START 0x50C ++ ++/** ++ * Panamera MST Hub detection ++ * Offset DPCD 050Eh == 0x5A indicates cascaded MST hub case ++ * Check from beginning of branch device vendor specific field (050Ch) ++ */ ++#define IS_SYNAPTICS_PANAMERA(branchDevName) (((int)branchDevName[4] & 0xF0) == 0x50 ? 1 : 0) ++#define BRANCH_HW_REVISION_PANAMERA_A2 0x10 ++#define SYNAPTICS_CASCADED_HUB_ID 0x5A ++#define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0) ++ + struct amdgpu_display_manager; + struct amdgpu_dm_connector; + diff --git a/queue-6.2/drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch b/queue-6.2/drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch new file mode 100644 index 00000000000..d8614cdcc46 --- /dev/null +++ b/queue-6.2/drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch @@ -0,0 +1,145 @@ +From 68dc1846c3a44d5e633be145c169ce2fd5420695 Mon Sep 17 00:00:00 2001 +From: Fangzhi Zuo +Date: Tue, 28 Feb 2023 21:34:58 -0500 +Subject: drm/amd/display: Take FEC Overhead into Timeslot Calculation + +From: Fangzhi Zuo + +commit 68dc1846c3a44d5e633be145c169ce2fd5420695 upstream. + +8b/10b encoding needs to add 3% fec overhead into the pbn. +In the Synapcis Cascaded MST hub, the first stage MST branch device +needs the information to determine the timeslot count for the +second stage MST branch device. Missing this overhead will leads to +insufficient timeslot allocation. + +Cc: stable@vger.kernel.org +Cc: Mario Limonciello +Reviewed-by: Hersen Wu +Acked-by: Qingqing Zhuo +Signed-off-by: Fangzhi Zuo +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 32 +++++++++--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 3 + + 2 files changed, 27 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -646,12 +646,25 @@ struct dsc_mst_fairness_params { + struct amdgpu_dm_connector *aconnector; + }; + +-static int kbps_to_peak_pbn(int kbps) ++static uint16_t get_fec_overhead_multiplier(struct dc_link *dc_link) ++{ ++ u8 link_coding_cap; ++ uint16_t fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B; ++ ++ link_coding_cap = dc_link_dp_mst_decide_link_encoding_format(dc_link); ++ if (link_coding_cap == DP_128b_132b_ENCODING) ++ fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B; ++ ++ return fec_overhead_multiplier_x1000; ++} ++ ++static int kbps_to_peak_pbn(int kbps, uint16_t fec_overhead_multiplier_x1000) + { + u64 peak_kbps = kbps; + + peak_kbps *= 1006; +- peak_kbps = div_u64(peak_kbps, 1000); ++ peak_kbps *= fec_overhead_multiplier_x1000; ++ peak_kbps = div_u64(peak_kbps, 1000 * 1000); + return (int) DIV64_U64_ROUND_UP(peak_kbps * 64, (54 * 8 * 1000)); + } + +@@ -745,11 +758,12 @@ static int increase_dsc_bpp(struct drm_a + int link_timeslots_used; + int fair_pbn_alloc; + int ret = 0; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + for (i = 0; i < count; i++) { + if (vars[i + k].dsc_enabled) { + initial_slack[i] = +- kbps_to_peak_pbn(params[i].bw_range.max_kbps) - vars[i + k].pbn; ++ kbps_to_peak_pbn(params[i].bw_range.max_kbps, fec_overhead_multiplier_x1000) - vars[i + k].pbn; + bpp_increased[i] = false; + remaining_to_increase += 1; + } else { +@@ -845,6 +859,7 @@ static int try_disable_dsc(struct drm_at + int next_index; + int remaining_to_try = 0; + int ret; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + for (i = 0; i < count; i++) { + if (vars[i + k].dsc_enabled +@@ -874,7 +889,7 @@ static int try_disable_dsc(struct drm_at + if (next_index == -1) + break; + +- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps); ++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + ret = drm_dp_atomic_find_time_slots(state, + params[next_index].port->mgr, + params[next_index].port, +@@ -887,7 +902,7 @@ static int try_disable_dsc(struct drm_at + vars[next_index].dsc_enabled = false; + vars[next_index].bpp_x16 = 0; + } else { +- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps); ++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps, fec_overhead_multiplier_x1000); + ret = drm_dp_atomic_find_time_slots(state, + params[next_index].port->mgr, + params[next_index].port, +@@ -916,6 +931,7 @@ static int compute_mst_dsc_configs_for_l + int count = 0; + int i, k, ret; + bool debugfs_overwrite = false; ++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link); + + memset(params, 0, sizeof(params)); + +@@ -977,7 +993,7 @@ static int compute_mst_dsc_configs_for_l + /* Try no compression */ + for (i = 0; i < count; i++) { + vars[i + k].aconnector = params[i].aconnector; +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = false; + vars[i + k].bpp_x16 = 0; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, params[i].port, +@@ -996,7 +1012,7 @@ static int compute_mst_dsc_configs_for_l + /* Try max compression */ + for (i = 0; i < count; i++) { + if (params[i].compression_possible && params[i].clock_force_enable != DSC_CLK_FORCE_DISABLE) { +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = true; + vars[i + k].bpp_x16 = params[i].bw_range.min_target_bpp_x16; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, +@@ -1004,7 +1020,7 @@ static int compute_mst_dsc_configs_for_l + if (ret < 0) + return ret; + } else { +- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps); ++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000); + vars[i + k].dsc_enabled = false; + vars[i + k].bpp_x16 = 0; + ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h +@@ -46,6 +46,9 @@ + #define SYNAPTICS_CASCADED_HUB_ID 0x5A + #define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0) + ++#define PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B 1031 ++#define PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B 1000 ++ + struct amdgpu_display_manager; + struct amdgpu_dm_connector; + diff --git a/queue-6.2/drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch b/queue-6.2/drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch new file mode 100644 index 00000000000..ff74486a0d1 --- /dev/null +++ b/queue-6.2/drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch @@ -0,0 +1,43 @@ +From 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 Mon Sep 17 00:00:00 2001 +From: Tim Huang +Date: Thu, 30 Mar 2023 10:33:02 +0800 +Subject: drm/amdgpu: allow more APUs to do mode2 reset when go to S4 + +From: Tim Huang + +commit 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 upstream. + +Skip mode2 reset only for IMU enabled APUs when do S4. + +This patch is to fix the regression issue +https://gitlab.freedesktop.org/drm/amd/-/issues/2483 +It is generated by commit b589626674de ("drm/amdgpu: skip ASIC reset +for APUs when go to S4"). + +Fixes: b589626674de ("drm/amdgpu: skip ASIC reset for APUs when go to S4") +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2483 +Tested-by: Yuan Perry +Signed-off-by: Tim Huang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -981,7 +981,12 @@ static bool amdgpu_atcs_pci_probe_handle + */ + bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev) + { +- if (adev->flags & AMD_IS_APU) ++ if ((adev->flags & AMD_IS_APU) && ++ adev->gfx.imu.funcs) /* Not need to do mode2 reset for IMU enabled APUs */ ++ return false; ++ ++ if ((adev->flags & AMD_IS_APU) && ++ amdgpu_acpi_is_s3_active(adev)) + return false; + + if (amdgpu_sriov_vf(adev)) diff --git a/queue-6.2/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch b/queue-6.2/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch new file mode 100644 index 00000000000..272a86953bf --- /dev/null +++ b/queue-6.2/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch @@ -0,0 +1,41 @@ +From 963b2e8c428f79489ceeb058e8314554ec9cbe6f Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 24 Feb 2023 18:21:54 +0100 +Subject: drm/etnaviv: fix reference leak when mmaping imported buffer + +From: Lucas Stach + +commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f upstream. + +drm_gem_prime_mmap() takes a reference on the GEM object, but before that +drm_gem_mmap_obj() already takes a reference, which will be leaked as only +one reference is dropped when the mapping is closed. Drop the extra +reference when dma_buf_mmap() succeeds. + +Cc: stable@vger.kernel.org +Signed-off-by: Lucas Stach +Reviewed-by: Christian Gmeiner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +@@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl + static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj, + struct vm_area_struct *vma) + { +- return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ int ret; ++ ++ ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ if (!ret) { ++ /* Drop the reference acquired by drm_gem_mmap_obj(). */ ++ drm_gem_object_put(&etnaviv_obj->base); ++ } ++ ++ return ret; + } + + static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = { diff --git a/queue-6.2/drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch b/queue-6.2/drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch new file mode 100644 index 00000000000..db14e0634db --- /dev/null +++ b/queue-6.2/drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch @@ -0,0 +1,85 @@ +From 3413881e1ecc3cba722a2e87ec099692eed5be28 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 20 Mar 2023 11:05:17 +0200 +Subject: drm/i915/dpt: Treat the DPT BO as a framebuffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 3413881e1ecc3cba722a2e87ec099692eed5be28 upstream. + +Currently i915_gem_object_is_framebuffer() doesn't treat the +BO containing the framebuffer's DPT as a framebuffer itself. +This means eg. that the shrinker can evict the DPT BO while +leaving the actual FB BO bound, when the DPT is allocated +from regular shmem. + +That causes an immediate oops during hibernate as we +try to rewrite the PTEs inside the already evicted +DPT obj. + +TODO: presumably this might also be the reason for the +DPT related display faults under heavy memory pressure, +but I'm still not sure how that would happen as the object +should be pinned by intel_dpt_pin() while in active use by +the display engine... + +Cc: stable@vger.kernel.org +Cc: Juha-Pekka Heikkila +Cc: Matthew Auld +Cc: Imre Deak +Fixes: 0dc987b699ce ("drm/i915/display: Add smem fallback allocation for dpt") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230320090522.9909-2-ville.syrjala@linux.intel.com +Reviewed-by: Juha-Pekka Heikkila +(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dpt.c | 2 ++ + drivers/gpu/drm/i915/gem/i915_gem_object.h | 2 +- + drivers/gpu/drm/i915/gem/i915_gem_object_types.h | 3 +++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dpt.c ++++ b/drivers/gpu/drm/i915/display/intel_dpt.c +@@ -301,6 +301,7 @@ intel_dpt_create(struct intel_framebuffe + vm->pte_encode = gen8_ggtt_pte_encode; + + dpt->obj = dpt_obj; ++ dpt->obj->is_dpt = true; + + return &dpt->vm; + } +@@ -309,5 +310,6 @@ void intel_dpt_destroy(struct i915_addre + { + struct i915_dpt *dpt = i915_vm_to_dpt(vm); + ++ dpt->obj->is_dpt = false; + i915_vm_put(&dpt->vm); + } +--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h +@@ -319,7 +319,7 @@ i915_gem_object_never_mmap(const struct + static inline bool + i915_gem_object_is_framebuffer(const struct drm_i915_gem_object *obj) + { +- return READ_ONCE(obj->frontbuffer); ++ return READ_ONCE(obj->frontbuffer) || obj->is_dpt; + } + + static inline unsigned int +--- a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h ++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h +@@ -491,6 +491,9 @@ struct drm_i915_gem_object { + */ + unsigned int cache_dirty:1; + ++ /* @is_dpt: Object houses a display page table (DPT) */ ++ unsigned int is_dpt:1; ++ + /** + * @read_domains: Read memory domains. + * diff --git a/queue-6.2/drm-i915-gem-flush-lmem-contents-after-construction.patch b/queue-6.2/drm-i915-gem-flush-lmem-contents-after-construction.patch new file mode 100644 index 00000000000..4578ae64eb2 --- /dev/null +++ b/queue-6.2/drm-i915-gem-flush-lmem-contents-after-construction.patch @@ -0,0 +1,45 @@ +From d032ca43f2c80049ce5aabd3f208dc3849359497 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 16 Mar 2023 17:59:18 +0100 +Subject: drm/i915/gem: Flush lmem contents after construction + +From: Chris Wilson + +commit d032ca43f2c80049ce5aabd3f208dc3849359497 upstream. + +i915_gem_object_create_lmem_from_data() lacks the flush of the data +written to lmem to ensure the object is marked as dirty and the writes +flushed to the backing store. Once created, we can immediately release +the obj->mm.mapping caching of the vmap. + +Fixes: 7acbbc7cf485 ("drm/i915/guc: put all guc objects in lmem when available") +Cc: Matthew Auld +Cc: Daniele Ceraolo Spurio +Cc: Andi Shyti +Cc: Matthew Brost +Cc: John Harrison +Signed-off-by: Chris Wilson +Cc: # v5.16+ +Signed-off-by: Nirmoy Das +Reviewed-by: Andi Shyti +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20230316165918.13074-1-nirmoy.das@intel.com +(cherry picked from commit e2ee10474ce766686e7a7496585cdfaf79e3a1bf) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_lmem.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c +@@ -127,7 +127,8 @@ i915_gem_object_create_lmem_from_data(st + + memcpy(map, data, size); + +- i915_gem_object_unpin_map(obj); ++ i915_gem_object_flush_map(obj); ++ __i915_gem_object_release_map(obj); + + return obj; + } diff --git a/queue-6.2/dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch b/queue-6.2/dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch new file mode 100644 index 00000000000..f82e5760078 --- /dev/null +++ b/queue-6.2/dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch @@ -0,0 +1,47 @@ +From a56cde41340ac4049fa6edac9e6cfbcd2804074e Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 14 Feb 2023 15:26:43 +0100 +Subject: dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support + +From: Geert Uytterhoeven + +commit a56cde41340ac4049fa6edac9e6cfbcd2804074e upstream. + +SPI EEPROMs typically support both SPI Mode 0 (CPOL=CPHA=0) and Mode 3 +(CPOL=CPHA=1). However, using the latter is currently flagged as an +error by "make dtbs_check", e.g.: + + arch/arm/boot/dts/r8a7791-koelsch.dtb: flash@0: Unevaluated properties are not allowed ('spi-cpha', 'spi-cpol' were unexpected) + From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml + +Fix this by documenting support for CPOL=CPHA=1. + +Fixes: 233363aba72ac638 ("spi/panel: dt-bindings: drop CPHA and CPOL from common properties") +Cc: stable@vger.kernel.org +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Miquel Raynal +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/afe470603028db9374930b0c57464b1f6d52bdd3.1676384304.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml ++++ b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml +@@ -76,6 +76,13 @@ properties: + If "broken-flash-reset" is present then having this property does not + make any difference. + ++ spi-cpol: true ++ spi-cpha: true ++ ++dependencies: ++ spi-cpol: [ spi-cpha ] ++ spi-cpha: [ spi-cpol ] ++ + unevaluatedProperties: false + + examples: diff --git a/queue-6.2/modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch b/queue-6.2/modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch new file mode 100644 index 00000000000..51d646830f8 --- /dev/null +++ b/queue-6.2/modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch @@ -0,0 +1,38 @@ +From fb27e70f6e408dee5d22b083e7a38a59e6118253 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Wed, 22 Mar 2023 19:11:45 +0100 +Subject: modpost: Fix processing of CRCs on 32-bit build machines + +From: Ben Hutchings + +commit fb27e70f6e408dee5d22b083e7a38a59e6118253 upstream. + +modpost now reads CRCs from .*.cmd files, parsing them using strtol(). +This is inconsistent with its parsing of Module.symvers and with their +definition as *unsigned* 32-bit values. + +strtol() clamps values to [LONG_MIN, LONG_MAX], and when building on a +32-bit system this changes all CRCs >= 0x80000000 to be 0x7fffffff. + +Change extract_crcs_for_object() to use strtoul() instead. + +Cc: stable@vger.kernel.org +Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files") +Signed-off-by: Ben Hutchings +Signed-off-by: Masahiro Yamada +Signed-off-by: Greg Kroah-Hartman +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1733,7 +1733,7 @@ static void extract_crcs_for_object(cons + if (!isdigit(*p)) + continue; /* skip this line */ + +- crc = strtol(p, &p, 0); ++ crc = strtoul(p, &p, 0); + if (*p != '\n') + continue; /* skip this line */ + diff --git a/queue-6.2/net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch b/queue-6.2/net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch new file mode 100644 index 00000000000..d0abd519ebe --- /dev/null +++ b/queue-6.2/net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch @@ -0,0 +1,55 @@ +From 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 Mon Sep 17 00:00:00 2001 +From: Josua Mayer +Date: Thu, 23 Mar 2023 12:25:36 +0200 +Subject: net: phy: dp83869: fix default value for tx-/rx-internal-delay + +From: Josua Mayer + +commit 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 upstream. + +dp83869 internally uses a look-up table for mapping supported delays in +nanoseconds to register values. +When specific delays are defined in device-tree, phy_get_internal_delay +does the lookup automatically returning an index. + +The default case wrongly assigns the nanoseconds value from the lookup +table, resulting in numeric value 2000 applied to delay configuration +register, rather than the expected index values 0-7 (7 for 2000). +Ultimately this issue broke RX for 1Gbps links. + +Fix default delay configuration by assigning the intended index value +directly. + +Cc: stable@vger.kernel.org +Fixes: 736b25afe284 ("net: dp83869: Add RGMII internal delay configuration") +Co-developed-by: Yazan Shhady +Signed-off-by: Yazan Shhady +Signed-off-by: Josua Mayer +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230323102536.31988-1-josua@solid-run.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83869.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/net/phy/dp83869.c ++++ b/drivers/net/phy/dp83869.c +@@ -588,15 +588,13 @@ static int dp83869_of_init(struct phy_de + &dp83869_internal_delay[0], + delay_size, true); + if (dp83869->rx_int_delay < 0) +- dp83869->rx_int_delay = +- dp83869_internal_delay[DP83869_CLK_DELAY_DEF]; ++ dp83869->rx_int_delay = DP83869_CLK_DELAY_DEF; + + dp83869->tx_int_delay = phy_get_internal_delay(phydev, dev, + &dp83869_internal_delay[0], + delay_size, false); + if (dp83869->tx_int_delay < 0) +- dp83869->tx_int_delay = +- dp83869_internal_delay[DP83869_CLK_DELAY_DEF]; ++ dp83869->tx_int_delay = DP83869_CLK_DELAY_DEF; + + return ret; + } diff --git a/queue-6.2/nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch b/queue-6.2/nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch new file mode 100644 index 00000000000..ab823ee4dd0 --- /dev/null +++ b/queue-6.2/nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch @@ -0,0 +1,45 @@ +From 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 21 Mar 2023 00:17:36 -0400 +Subject: NFSv4: Fix hangs when recovering open state after a server reboot + +From: Trond Myklebust + +commit 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 upstream. + +When we're using a cached open stateid or a delegation in order to avoid +sending a CLAIM_PREVIOUS open RPC call to the server, we don't have a +new open stateid to present to update_open_stateid(). +Instead rely on nfs4_try_open_cached(), just as if we were doing a +normal open. + +Fixes: d2bfda2e7aa0 ("NFSv4: don't reprocess cached open CLAIM_PREVIOUS") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1980,8 +1980,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(str + if (!data->rpc_done) { + if (data->rpc_status) + return ERR_PTR(data->rpc_status); +- /* cached opens have already been processed */ +- goto update; ++ return nfs4_try_open_cached(data); + } + + ret = nfs_refresh_inode(inode, &data->f_attr); +@@ -1990,7 +1989,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(str + + if (data->o_res.delegation_type != 0) + nfs4_opendata_check_deleg(data, state); +-update: ++ + if (!update_open_stateid(state, &data->o_res.stateid, + NULL, data->o_arg.fmode)) + return ERR_PTR(-EAGAIN); diff --git a/queue-6.2/pinctrl-amd-disable-and-mask-interrupts-on-resume.patch b/queue-6.2/pinctrl-amd-disable-and-mask-interrupts-on-resume.patch new file mode 100644 index 00000000000..d51d44b013a --- /dev/null +++ b/queue-6.2/pinctrl-amd-disable-and-mask-interrupts-on-resume.patch @@ -0,0 +1,97 @@ +From b26cd9325be4c1fcd331b77f10acb627c560d4d7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kornel=20Dul=C4=99ba?= +Date: Mon, 20 Mar 2023 09:32:59 +0000 +Subject: pinctrl: amd: Disable and mask interrupts on resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kornel Dulęba + +commit b26cd9325be4c1fcd331b77f10acb627c560d4d7 upstream. + +This fixes a similar problem to the one observed in: +commit 4e5a04be88fe ("pinctrl: amd: disable and mask interrupts on probe"). + +On some systems, during suspend/resume cycle firmware leaves +an interrupt enabled on a pin that is not used by the kernel. +This confuses the AMD pinctrl driver and causes spurious interrupts. + +The driver already has logic to detect if a pin is used by the kernel. +Leverage it to re-initialize interrupt fields of a pin only if it's not +used by us. + +Cc: stable@vger.kernel.org +Fixes: dbad75dd1f25 ("pinctrl: add AMD GPIO driver support.") +Signed-off-by: Kornel Dulęba +Link: https://lore.kernel.org/r/20230320093259.845178-1-korneld@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-amd.c | 36 ++++++++++++++++++++---------------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -865,32 +865,34 @@ static const struct pinconf_ops amd_pinc + .pin_config_group_set = amd_pinconf_group_set, + }; + +-static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) ++static void amd_gpio_irq_init_pin(struct amd_gpio *gpio_dev, int pin) + { +- struct pinctrl_desc *desc = gpio_dev->pctrl->desc; ++ const struct pin_desc *pd; + unsigned long flags; + u32 pin_reg, mask; +- int i; + + mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) | + BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) | + BIT(WAKE_CNTRL_OFF_S4); + +- for (i = 0; i < desc->npins; i++) { +- int pin = desc->pins[i].number; +- const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin); +- +- if (!pd) +- continue; ++ pd = pin_desc_get(gpio_dev->pctrl, pin); ++ if (!pd) ++ return; + +- raw_spin_lock_irqsave(&gpio_dev->lock, flags); ++ raw_spin_lock_irqsave(&gpio_dev->lock, flags); ++ pin_reg = readl(gpio_dev->base + pin * 4); ++ pin_reg &= ~mask; ++ writel(pin_reg, gpio_dev->base + pin * 4); ++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); ++} + +- pin_reg = readl(gpio_dev->base + i * 4); +- pin_reg &= ~mask; +- writel(pin_reg, gpio_dev->base + i * 4); ++static void amd_gpio_irq_init(struct amd_gpio *gpio_dev) ++{ ++ struct pinctrl_desc *desc = gpio_dev->pctrl->desc; ++ int i; + +- raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); +- } ++ for (i = 0; i < desc->npins; i++) ++ amd_gpio_irq_init_pin(gpio_dev, i); + } + + #ifdef CONFIG_PM_SLEEP +@@ -943,8 +945,10 @@ static int amd_gpio_resume(struct device + for (i = 0; i < desc->npins; i++) { + int pin = desc->pins[i].number; + +- if (!amd_gpio_should_save(gpio_dev, pin)) ++ if (!amd_gpio_should_save(gpio_dev, pin)) { ++ amd_gpio_irq_init_pin(gpio_dev, pin); + continue; ++ } + + raw_spin_lock_irqsave(&gpio_dev->lock, flags); + gpio_dev->saved_regs[i] |= readl(gpio_dev->base + pin * 4) & PIN_IRQ_PENDING; diff --git a/queue-6.2/pinctrl-at91-pio4-fix-domain-name-assignment.patch b/queue-6.2/pinctrl-at91-pio4-fix-domain-name-assignment.patch new file mode 100644 index 00000000000..17d6fd2c3cf --- /dev/null +++ b/queue-6.2/pinctrl-at91-pio4-fix-domain-name-assignment.patch @@ -0,0 +1,39 @@ +From 7bb97e360acdd38b68ad0a1defb89c6e89c85596 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 24 Feb 2023 14:08:28 +0100 +Subject: pinctrl: at91-pio4: fix domain name assignment + +From: Johan Hovold + +commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 upstream. + +Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name +information only") an IRQ domain is always given a name during +allocation (e.g. used for the debugfs entry). + +Drop the no longer valid name assignment, which would lead to an attempt +to free a string constant when removing the domain on late probe +failures (e.g. probe deferral). + +Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea # on SAMA7G5 +Link: https://lore.kernel.org/r/20230224130828.27985-1-johan+linaro@kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1206,7 +1206,6 @@ static int atmel_pinctrl_probe(struct pl + dev_err(dev, "can't add the irq domain\n"); + return -ENODEV; + } +- atmel_pioctrl->irq_domain->name = "atmel gpio"; + + for (i = 0; i < atmel_pioctrl->npins; i++) { + int irq = irq_create_mapping(atmel_pioctrl->irq_domain, i); diff --git a/queue-6.2/platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch b/queue-6.2/platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch new file mode 100644 index 00000000000..a30f0669e89 --- /dev/null +++ b/queue-6.2/platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch @@ -0,0 +1,87 @@ +From e3271a5917d1501089b1a224d702aa053e2877f4 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 30 Mar 2023 21:46:44 +0200 +Subject: platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE + +From: Hans de Goede + +commit e3271a5917d1501089b1a224d702aa053e2877f4 upstream. + +Commit 5829f8a897e4 ("platform/x86: ideapad-laptop: Send +KEY_TOUCHPAD_TOGGLE on some models") made ideapad-laptop send +KEY_TOUCHPAD_TOGGLE when we receive an ACPI notify with VPC event bit 5 set +and the touchpad-state has not been changed by the EC itself already. + +This was done under the assumption that this would be good to do to make +the touchpad-toggle hotkey work on newer models where the EC does not +toggle the touchpad on/off itself (because it is not routed through +the PS/2 controller, but uses I2C). + +But it turns out that at least some models, e.g. the Yoga 7-15ITL5 the EC +triggers an ACPI notify with VPC event bit 5 set on resume, which would +now cause a spurious KEY_TOUCHPAD_TOGGLE on resume to which the desktop +environment responds by disabling the touchpad in software, breaking +the touchpad (until manually re-enabled) on resume. + +It was never confirmed that sending KEY_TOUCHPAD_TOGGLE actually improves +things on new models and at least some new models like the Yoga 7-15ITL5 +don't have a touchpad on/off toggle hotkey at all, while still sending +ACPI notify events with VPC event bit 5 set. + +So it seems best to revert the change to send KEY_TOUCHPAD_TOGGLE when +receiving an ACPI notify events with VPC event bit 5 and the touchpad +state as reported by the EC has not changed. + +Note this is not a full revert the code to cache the last EC touchpad +state is kept to avoid sending spurious KEY_TOUCHPAD_ON / _OFF events +on resume. + +Fixes: 5829f8a897e4 ("platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217234 +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230330194644.64628-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/ideapad-laptop.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -1170,7 +1170,6 @@ static const struct key_entry ideapad_ke + { KE_KEY, 65, { KEY_PROG4 } }, + { KE_KEY, 66, { KEY_TOUCHPAD_OFF } }, + { KE_KEY, 67, { KEY_TOUCHPAD_ON } }, +- { KE_KEY, 68, { KEY_TOUCHPAD_TOGGLE } }, + { KE_KEY, 128, { KEY_ESC } }, + + /* +@@ -1526,18 +1525,16 @@ static void ideapad_sync_touchpad_state( + if (priv->features.ctrl_ps2_aux_port) + i8042_command(¶m, value ? I8042_CMD_AUX_ENABLE : I8042_CMD_AUX_DISABLE); + +- if (send_events) { +- /* +- * On older models the EC controls the touchpad and toggles it +- * on/off itself, in this case we report KEY_TOUCHPAD_ON/_OFF. +- * If the EC did not toggle, report KEY_TOUCHPAD_TOGGLE. +- */ +- if (value != priv->r_touchpad_val) { +- ideapad_input_report(priv, value ? 67 : 66); +- sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad"); +- } else { +- ideapad_input_report(priv, 68); +- } ++ /* ++ * On older models the EC controls the touchpad and toggles it on/off ++ * itself, in this case we report KEY_TOUCHPAD_ON/_OFF. Some models do ++ * an acpi-notify with VPC bit 5 set on resume, so this function get ++ * called with send_events=true on every resume. Therefor if the EC did ++ * not toggle, do nothing to avoid sending spurious KEY_TOUCHPAD_TOGGLE. ++ */ ++ if (send_events && value != priv->r_touchpad_val) { ++ ideapad_input_report(priv, value ? 67 : 66); ++ sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad"); + } + + priv->r_touchpad_val = value; diff --git a/queue-6.2/powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch b/queue-6.2/powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch new file mode 100644 index 00000000000..3ad81c7ad7a --- /dev/null +++ b/queue-6.2/powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch @@ -0,0 +1,54 @@ +From 1abce0580b89464546ae06abd5891ebec43c9470 Mon Sep 17 00:00:00 2001 +From: Benjamin Gray +Date: Fri, 3 Mar 2023 09:59:47 +1100 +Subject: powerpc/64s: Fix __pte_needs_flush() false positive warning + +From: Benjamin Gray + +commit 1abce0580b89464546ae06abd5891ebec43c9470 upstream. + +Userspace PROT_NONE ptes set _PAGE_PRIVILEGED, triggering a false +positive debug assertion that __pte_flags_need_flush() is not called +on a kernel mapping. + +Detect when it is a userspace PROT_NONE page by checking the required +bits of PAGE_NONE are set, and none of the RWX bits are set. +pte_protnone() is insufficient here because it always returns 0 when +CONFIG_NUMA_BALANCING=n. + +Fixes: b11931e9adc1 ("powerpc/64s: add pte_needs_flush and huge_pmd_needs_flush") +Cc: stable@vger.kernel.org # v6.1+ +Reported-by: Russell Currey +Signed-off-by: Benjamin Gray +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230302225947.81083-1-bgray@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/book3s/64/tlbflush.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/include/asm/book3s/64/tlbflush.h ++++ b/arch/powerpc/include/asm/book3s/64/tlbflush.h +@@ -148,6 +148,11 @@ static inline void flush_tlb_fix_spuriou + */ + } + ++static inline bool __pte_protnone(unsigned long pte) ++{ ++ return (pte & (pgprot_val(PAGE_NONE) | _PAGE_RWX)) == pgprot_val(PAGE_NONE); ++} ++ + static inline bool __pte_flags_need_flush(unsigned long oldval, + unsigned long newval) + { +@@ -164,8 +169,8 @@ static inline bool __pte_flags_need_flus + /* + * We do not expect kernel mappings or non-PTEs or not-present PTEs. + */ +- VM_WARN_ON_ONCE(oldval & _PAGE_PRIVILEGED); +- VM_WARN_ON_ONCE(newval & _PAGE_PRIVILEGED); ++ VM_WARN_ON_ONCE(!__pte_protnone(oldval) && oldval & _PAGE_PRIVILEGED); ++ VM_WARN_ON_ONCE(!__pte_protnone(newval) && newval & _PAGE_PRIVILEGED); + VM_WARN_ON_ONCE(!(oldval & _PAGE_PTE)); + VM_WARN_ON_ONCE(!(newval & _PAGE_PTE)); + VM_WARN_ON_ONCE(!(oldval & _PAGE_PRESENT)); diff --git a/queue-6.2/powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch b/queue-6.2/powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch new file mode 100644 index 00000000000..729bb50eda5 --- /dev/null +++ b/queue-6.2/powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch @@ -0,0 +1,81 @@ +From fd7276189450110ed835eb0a334e62d2f1c4e3be Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Sun, 26 Mar 2023 16:15:57 -0600 +Subject: powerpc: Don't try to copy PPR for task with NULL pt_regs + +From: Jens Axboe + +commit fd7276189450110ed835eb0a334e62d2f1c4e3be upstream. + +powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which +from my (arguably very short) checking is not commonly done for other +archs. This is fine, except when PF_IO_WORKER's have been created and +the task does something that causes a coredump to be generated. Then we +get this crash: + + Kernel attempted to read user page (160) - exploit attempt? (uid: 1000) + BUG: Kernel NULL pointer dereference on read at 0x00000160 + Faulting instruction address: 0xc0000000000c3a60 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries + Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod + CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 + Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries + NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 + REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) + MSR: 800000000280b033 CR: 88082828 XER: 200400f8 + ... + NIP memcpy_power7+0x200/0x7d0 + LR ppr_get+0x64/0xb0 + Call Trace: + ppr_get+0x40/0xb0 (unreliable) + __regset_get+0x180/0x1f0 + regset_get_alloc+0x64/0x90 + elf_core_dump+0xb98/0x1b60 + do_coredump+0x1c34/0x24a0 + get_signal+0x71c/0x1410 + do_notify_resume+0x140/0x6f0 + interrupt_exit_user_prepare_main+0x29c/0x320 + interrupt_exit_user_prepare+0x6c/0xa0 + interrupt_return_srr_user+0x8/0x138 + +Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL +pt_regs. + +Check for a valid pt_regs in both ppc_get/ppr_set, and return an error +if not set. The actual error value doesn't seem to be important here, so +just pick -EINVAL. + +Fixes: fa439810cc1b ("powerpc/ptrace: Enable support for NT_PPPC_TAR, NT_PPC_PPR, NT_PPC_DSCR") +Cc: stable@vger.kernel.org # v4.8+ +Signed-off-by: Jens Axboe +[mpe: Trim oops in change log, add Fixes & Cc stable] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/d9f63344-fe7c-56ae-b420-4a1a04a2ae4c@kernel.dk +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/ptrace/ptrace-view.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/powerpc/kernel/ptrace/ptrace-view.c ++++ b/arch/powerpc/kernel/ptrace/ptrace-view.c +@@ -290,6 +290,9 @@ static int gpr_set(struct task_struct *t + static int ppr_get(struct task_struct *target, const struct user_regset *regset, + struct membuf to) + { ++ if (!target->thread.regs) ++ return -EINVAL; ++ + return membuf_write(&to, &target->thread.regs->ppr, sizeof(u64)); + } + +@@ -297,6 +300,9 @@ static int ppr_set(struct task_struct *t + unsigned int pos, unsigned int count, const void *kbuf, + const void __user *ubuf) + { ++ if (!target->thread.regs) ++ return -EINVAL; ++ + return user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &target->thread.regs->ppr, 0, sizeof(u64)); + } diff --git a/queue-6.2/powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch b/queue-6.2/powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch new file mode 100644 index 00000000000..6e72cd767d2 --- /dev/null +++ b/queue-6.2/powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch @@ -0,0 +1,60 @@ +From eca9f6e6f83b6725b84e1c76fdde19b003cff0eb Mon Sep 17 00:00:00 2001 +From: Haren Myneni +Date: Mon, 20 Mar 2023 19:50:08 -0700 +Subject: powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled + +From: Haren Myneni + +commit eca9f6e6f83b6725b84e1c76fdde19b003cff0eb upstream. + +The hypervisor supports user-mode NX from Power10. + +pseries_vas_dlpar_cpu() is called from lparcfg_write() to update VAS +windows for DLPAR event in shared processor mode and the kernel gets +-ENOTSUPP for HCALLs if the user-mode NX is not supported. The current +VAS implementation also supports only with Radix page tables. Whereas in +dedicated processor mode, pseries_vas_notifier() is registered only if +the copy/paste feature is enabled. So instead of displaying HCALL error +messages, update VAS capabilities if the copy/paste feature is +available. + +This patch ignores updating VAS capabilities in pseries_vas_dlpar_cpu() +and returns success if the copy/paste feature is not enabled. Then +lparcfg_write() completes the processor DLPAR operations without any +failures. + +Fixes: 2147783d6bf0 ("powerpc/pseries: Use lparcfg to reconfig VAS windows for DLPAR CPU") +Cc: stable@vger.kernel.org # v6.1+ +Signed-off-by: Haren Myneni +Reviewed-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://msgid.link/1d0e727e7dbd9a28627ef08ca9df9c86a50175e2.camel@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/pseries/vas.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/powerpc/platforms/pseries/vas.c ++++ b/arch/powerpc/platforms/pseries/vas.c +@@ -857,6 +857,13 @@ int pseries_vas_dlpar_cpu(void) + { + int new_nr_creds, rc; + ++ /* ++ * NX-GZIP is not enabled. Nothing to do for DLPAR event ++ */ ++ if (!copypaste_feat) ++ return 0; ++ ++ + rc = h_query_vas_capabilities(H_QUERY_VAS_CAPABILITIES, + vascaps[VAS_GZIP_DEF_FEAT_TYPE].feat, + (u64)virt_to_phys(&hv_cop_caps)); +@@ -1013,6 +1020,7 @@ static int __init pseries_vas_init(void) + * Linux supports user space COPY/PASTE only with Radix + */ + if (!radix_enabled()) { ++ copypaste_feat = false; + pr_err("API is supported only with radix page tables\n"); + return -ENOTSUPP; + } diff --git a/queue-6.2/rcu-fix-rcu_torture_read-ftrace-event.patch b/queue-6.2/rcu-fix-rcu_torture_read-ftrace-event.patch new file mode 100644 index 00000000000..737d7044199 --- /dev/null +++ b/queue-6.2/rcu-fix-rcu_torture_read-ftrace-event.patch @@ -0,0 +1,39 @@ +From d18a04157fc171fd48075e3dc96471bd3b87f0dd Mon Sep 17 00:00:00 2001 +From: Douglas Raillard +Date: Mon, 6 Mar 2023 12:27:43 +0000 +Subject: rcu: Fix rcu_torture_read ftrace event + +From: Douglas Raillard + +commit d18a04157fc171fd48075e3dc96471bd3b87f0dd upstream. + +Fix the rcutorturename field so that its size is correctly reported in +the text format embedded in trace.dat files. As it stands, it is +reported as being of size 1: + + field:char rcutorturename[8]; offset:8; size:1; signed:0; + +Signed-off-by: Douglas Raillard +Reviewed-by: Mukesh Ojha +Cc: stable@vger.kernel.org +Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") +Reviewed-by: Steven Rostedt (Google) +[ boqun: Add "Cc" and "Fixes" tags per Steven ] +Signed-off-by: Boqun Feng +Signed-off-by: Paul E. McKenney +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/events/rcu.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/trace/events/rcu.h ++++ b/include/trace/events/rcu.h +@@ -768,7 +768,7 @@ TRACE_EVENT_RCU(rcu_torture_read, + TP_ARGS(rcutorturename, rhp, secs, c_old, c), + + TP_STRUCT__entry( +- __field(char, rcutorturename[RCUTORTURENAME_LEN]) ++ __array(char, rcutorturename, RCUTORTURENAME_LEN) + __field(struct rcu_head *, rhp) + __field(unsigned long, secs) + __field(unsigned long, c_old) diff --git a/queue-6.2/s390-reintroduce-expoline-dependence-to-scripts.patch b/queue-6.2/s390-reintroduce-expoline-dependence-to-scripts.patch new file mode 100644 index 00000000000..d67e46a6765 --- /dev/null +++ b/queue-6.2/s390-reintroduce-expoline-dependence-to-scripts.patch @@ -0,0 +1,48 @@ +From 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac Mon Sep 17 00:00:00 2001 +From: "Jiri Slaby (SUSE)" +Date: Thu, 16 Mar 2023 12:28:09 +0100 +Subject: s390: reintroduce expoline dependence to scripts + +From: Jiri Slaby (SUSE) + +commit 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac upstream. + +Expolines depend on scripts/basic/fixdep. And build of expolines can now +race with the fixdep build: + + make[1]: *** Deleting file 'arch/s390/lib/expoline/expoline.o' + /bin/sh: line 1: scripts/basic/fixdep: Permission denied + make[1]: *** [../scripts/Makefile.build:385: arch/s390/lib/expoline/expoline.o] Error 126 + make: *** [../arch/s390/Makefile:166: expoline_prepare] Error 2 + +The dependence was removed in the below Fixes: commit. So reintroduce +the dependence on scripts. + +Fixes: a0b0987a7811 ("s390/nospec: remove unneeded header includes") +Cc: Joe Lawrence +Cc: stable@vger.kernel.org +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Alexander Gordeev +Cc: Christian Borntraeger +Cc: Sven Schnelle +Cc: linux-s390@vger.kernel.org +Signed-off-by: Jiri Slaby (SUSE) +Link: https://lore.kernel.org/r/20230316112809.7903-1-jirislaby@kernel.org +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/Makefile ++++ b/arch/s390/Makefile +@@ -162,7 +162,7 @@ vdso_prepare: prepare0 + + ifdef CONFIG_EXPOLINE_EXTERN + modules_prepare: expoline_prepare +-expoline_prepare: ++expoline_prepare: scripts + $(Q)$(MAKE) $(build)=arch/s390/lib/expoline arch/s390/lib/expoline/expoline.o + endif + endif diff --git a/queue-6.2/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch b/queue-6.2/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch new file mode 100644 index 00000000000..aba1dd301e3 --- /dev/null +++ b/queue-6.2/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch @@ -0,0 +1,37 @@ +From 89aba4c26fae4e459f755a18912845c348ee48f3 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Thu, 23 Mar 2023 13:09:16 +0100 +Subject: s390/uaccess: add missing earlyclobber annotations to __clear_user() + +From: Heiko Carstens + +commit 89aba4c26fae4e459f755a18912845c348ee48f3 upstream. + +Add missing earlyclobber annotation to size, to, and tmp2 operands of the +__clear_user() inline assembly since they are modified or written to before +the last usage of all input operands. This can lead to incorrect register +allocation for the inline assembly. + +Fixes: 6c2a9e6df604 ("[S390] Use alternative user-copy operations for new hardware.") +Reported-by: Mark Rutland +Link: https://lore.kernel.org/all/20230321122514.1743889-3-mark.rutland@arm.com/ +Cc: stable@vger.kernel.org +Reviewed-by: Gerald Schaefer +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/lib/uaccess.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/lib/uaccess.c ++++ b/arch/s390/lib/uaccess.c +@@ -172,7 +172,7 @@ unsigned long __clear_user(void __user * + "4: slgr %0,%0\n" + "5:\n" + EX_TABLE(0b,2b) EX_TABLE(6b,2b) EX_TABLE(3b,5b) EX_TABLE(7b,5b) +- : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2) ++ : "+&a" (size), "+&a" (to), "+a" (tmp1), "=&a" (tmp2) + : "a" (empty_zero_page), [spec] "d" (spec.val) + : "cc", "memory", "0"); + return size; diff --git a/queue-6.2/series b/queue-6.2/series index a256c45f83a..c250be8ab92 100644 --- a/queue-6.2/series +++ b/queue-6.2/series @@ -140,3 +140,33 @@ zonefs-do-not-propagate-iomap_dio_rw-enotblk-error-to-user-space.patch io_uring-poll-clear-single-double-poll-flags-on-poll-arming.patch io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch io_uring-fix-poll-netmsg-alloc-caches.patch +vmxnet3-use-gro-callback-when-upt-is-enabled.patch +zonefs-always-invalidate-last-cached-page-on-append-write.patch +dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch +can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch +xen-netback-don-t-do-grant-copy-across-page-boundary.patch +net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch +modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch +pinctrl-amd-disable-and-mask-interrupts-on-resume.patch +pinctrl-at91-pio4-fix-domain-name-assignment.patch +platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch +thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch +powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch +powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch +powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch +nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch +alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch +alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch +alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch +alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch +xtensa-fix-kasan-report-for-show_stack.patch +rcu-fix-rcu_torture_read-ftrace-event.patch +dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch +s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch +s390-reintroduce-expoline-dependence-to-scripts.patch +drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch +drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch +drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch +drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch +drm-i915-gem-flush-lmem-contents-after-construction.patch +drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch diff --git a/queue-6.2/thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch b/queue-6.2/thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch new file mode 100644 index 00000000000..bf2ed99c80d --- /dev/null +++ b/queue-6.2/thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch @@ -0,0 +1,39 @@ +From a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Wed, 29 Mar 2023 08:22:07 -0700 +Subject: thermal: intel: int340x: processor_thermal: Fix additional deadlock + +From: Srinivas Pandruvada + +commit a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 upstream. + +Commit 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix +deadlock") addressed deadlock issue during user space trip update. But it +missed a case when thermal zone device is disabled when user writes 0. + +Call to thermal_zone_device_disable() also causes deadlock as it also +tries to lock tz->lock, which is already claimed by trip_point_temp_store() +in the thermal core code. + +Remove call to thermal_zone_device_disable() in the function +sys_set_trip_temp(), which is called from trip_point_temp_store(). + +Fixes: 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix deadlock") +Signed-off-by: Srinivas Pandruvada +Cc: 6.2+ # 6.2+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c ++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c +@@ -181,7 +181,6 @@ static int sys_set_trip_temp(struct ther + cancel_delayed_work_sync(&pci_info->work); + proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_INT_ENABLE_0, 0); + proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_THRES_0, 0); +- thermal_zone_device_disable(tzd); + pci_info->stored_thres = 0; + return 0; + } diff --git a/queue-6.2/vmxnet3-use-gro-callback-when-upt-is-enabled.patch b/queue-6.2/vmxnet3-use-gro-callback-when-upt-is-enabled.patch new file mode 100644 index 00000000000..ff88a276773 --- /dev/null +++ b/queue-6.2/vmxnet3-use-gro-callback-when-upt-is-enabled.patch @@ -0,0 +1,48 @@ +From 3bced313b9a5a237c347e0f079c8c2fe4b3935aa Mon Sep 17 00:00:00 2001 +From: Ronak Doshi +Date: Thu, 23 Mar 2023 13:07:21 -0700 +Subject: vmxnet3: use gro callback when UPT is enabled + +From: Ronak Doshi + +commit 3bced313b9a5a237c347e0f079c8c2fe4b3935aa upstream. + +Currently, vmxnet3 uses GRO callback only if LRO is disabled. However, +on smartNic based setups where UPT is supported, LRO can be enabled +from guest VM but UPT devicve does not support LRO as of now. In such +cases, there can be performance degradation as GRO is not being done. + +This patch fixes this issue by calling GRO API when UPT is enabled. We +use updateRxProd to determine if UPT mode is active or not. + +To clarify few things discussed over the thread: +The patch is not neglecting any feature bits nor disabling GRO. It uses +GRO callback when UPT is active as LRO is not available in UPT. +GRO callback cannot be used as default for all cases as it degrades +performance for non-UPT cases or for cases when LRO is already done in +ESXi. + +Cc: stable@vger.kernel.org +Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers") +Signed-off-by: Ronak Doshi +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230323200721.27622-1-doshir@vmware.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -1688,7 +1688,9 @@ not_lro: + if (unlikely(rcd->ts)) + __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rcd->tci); + +- if (adapter->netdev->features & NETIF_F_LRO) ++ /* Use GRO callback if UPT is enabled */ ++ if ((adapter->netdev->features & NETIF_F_LRO) && ++ !rq->shared->updateRxProd) + netif_receive_skb(skb); + else + napi_gro_receive(&rq->napi, skb); diff --git a/queue-6.2/xen-netback-don-t-do-grant-copy-across-page-boundary.patch b/queue-6.2/xen-netback-don-t-do-grant-copy-across-page-boundary.patch new file mode 100644 index 00000000000..9dc60d64804 --- /dev/null +++ b/queue-6.2/xen-netback-don-t-do-grant-copy-across-page-boundary.patch @@ -0,0 +1,118 @@ +From 05310f31ca74673a96567fb14637b7d5d6c82ea5 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Mon, 27 Mar 2023 10:36:45 +0200 +Subject: xen/netback: don't do grant copy across page boundary + +From: Juergen Gross + +commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 upstream. + +Fix xenvif_get_requests() not to do grant copy operations across local +page boundaries. This requires to double the maximum number of copy +operations per queue, as each copy could now be split into 2. + +Make sure that struct xenvif_tx_cb doesn't grow too large. + +Cc: stable@vger.kernel.org +Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") +Signed-off-by: Juergen Gross +Reviewed-by: Paul Durrant +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/common.h | 2 +- + drivers/net/xen-netback/netback.c | 25 +++++++++++++++++++++++-- + 2 files changed, 24 insertions(+), 3 deletions(-) + +--- a/drivers/net/xen-netback/common.h ++++ b/drivers/net/xen-netback/common.h +@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue data + struct pending_tx_info pending_tx_info[MAX_PENDING_REQS]; + grant_handle_t grant_tx_handle[MAX_PENDING_REQS]; + +- struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS]; ++ struct gnttab_copy tx_copy_ops[2 * MAX_PENDING_REQS]; + struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS]; + struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS]; + /* passed to gnttab_[un]map_refs with pages under (un)mapping */ +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -334,6 +334,7 @@ static int xenvif_count_requests(struct + struct xenvif_tx_cb { + u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1]; + u8 copy_count; ++ u32 split_mask; + }; + + #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) +@@ -361,6 +362,8 @@ static inline struct sk_buff *xenvif_all + struct sk_buff *skb = + alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN, + GFP_ATOMIC | __GFP_NOWARN); ++ ++ BUILD_BUG_ON(sizeof(*XENVIF_TX_CB(skb)) > sizeof(skb->cb)); + if (unlikely(skb == NULL)) + return NULL; + +@@ -396,11 +399,13 @@ static void xenvif_get_requests(struct x + nr_slots = shinfo->nr_frags + 1; + + copy_count(skb) = 0; ++ XENVIF_TX_CB(skb)->split_mask = 0; + + /* Create copy ops for exactly data_len bytes into the skb head. */ + __skb_put(skb, data_len); + while (data_len > 0) { + int amount = data_len > txp->size ? txp->size : data_len; ++ bool split = false; + + cop->source.u.ref = txp->gref; + cop->source.domid = queue->vif->domid; +@@ -413,6 +418,13 @@ static void xenvif_get_requests(struct x + cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb) + - data_len); + ++ /* Don't cross local page boundary! */ ++ if (cop->dest.offset + amount > XEN_PAGE_SIZE) { ++ amount = XEN_PAGE_SIZE - cop->dest.offset; ++ XENVIF_TX_CB(skb)->split_mask |= 1U << copy_count(skb); ++ split = true; ++ } ++ + cop->len = amount; + cop->flags = GNTCOPY_source_gref; + +@@ -420,7 +432,8 @@ static void xenvif_get_requests(struct x + pending_idx = queue->pending_ring[index]; + callback_param(queue, pending_idx).ctx = NULL; + copy_pending_idx(skb, copy_count(skb)) = pending_idx; +- copy_count(skb)++; ++ if (!split) ++ copy_count(skb)++; + + cop++; + data_len -= amount; +@@ -441,7 +454,8 @@ static void xenvif_get_requests(struct x + nr_slots--; + } else { + /* The copy op partially covered the tx_request. +- * The remainder will be mapped. ++ * The remainder will be mapped or copied in the next ++ * iteration. + */ + txp->offset += amount; + txp->size -= amount; +@@ -539,6 +553,13 @@ static int xenvif_tx_check_gop(struct xe + pending_idx = copy_pending_idx(skb, i); + + newerr = (*gopp_copy)->status; ++ ++ /* Split copies need to be handled together. */ ++ if (XENVIF_TX_CB(skb)->split_mask & (1U << i)) { ++ (*gopp_copy)++; ++ if (!newerr) ++ newerr = (*gopp_copy)->status; ++ } + if (likely(!newerr)) { + /* The first frag might still have this slot mapped */ + if (i < copy_count(skb) - 1 || !sharedslot) diff --git a/queue-6.2/xtensa-fix-kasan-report-for-show_stack.patch b/queue-6.2/xtensa-fix-kasan-report-for-show_stack.patch new file mode 100644 index 00000000000..07419b30401 --- /dev/null +++ b/queue-6.2/xtensa-fix-kasan-report-for-show_stack.patch @@ -0,0 +1,53 @@ +From 1d3b7a788ca7435156809a6bd5b20c95b2370d45 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Thu, 16 Mar 2023 23:00:21 -0700 +Subject: xtensa: fix KASAN report for show_stack + +From: Max Filippov + +commit 1d3b7a788ca7435156809a6bd5b20c95b2370d45 upstream. + +show_stack dumps raw stack contents which may trigger an unnecessary +KASAN report. Fix it by copying stack contents to a temporary buffer +with __memcpy and then printing that buffer instead of passing stack +pointer directly to the print_hex_dump. + +Cc: stable@vger.kernel.org +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman +--- + arch/xtensa/kernel/traps.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/arch/xtensa/kernel/traps.c ++++ b/arch/xtensa/kernel/traps.c +@@ -539,7 +539,7 @@ static size_t kstack_depth_to_print = CO + + void show_stack(struct task_struct *task, unsigned long *sp, const char *loglvl) + { +- size_t len; ++ size_t len, off = 0; + + if (!sp) + sp = stack_pointer(task); +@@ -548,9 +548,17 @@ void show_stack(struct task_struct *task + kstack_depth_to_print * STACK_DUMP_ENTRY_SIZE); + + printk("%sStack:\n", loglvl); +- print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE, +- STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE, +- sp, len, false); ++ while (off < len) { ++ u8 line[STACK_DUMP_LINE_SIZE]; ++ size_t line_len = len - off > STACK_DUMP_LINE_SIZE ? ++ STACK_DUMP_LINE_SIZE : len - off; ++ ++ __memcpy(line, (u8 *)sp + off, line_len); ++ print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE, ++ STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE, ++ line, line_len, false); ++ off += STACK_DUMP_LINE_SIZE; ++ } + show_trace(task, sp, loglvl); + } + diff --git a/queue-6.2/zonefs-always-invalidate-last-cached-page-on-append-write.patch b/queue-6.2/zonefs-always-invalidate-last-cached-page-on-append-write.patch new file mode 100644 index 00000000000..fb8ec926d11 --- /dev/null +++ b/queue-6.2/zonefs-always-invalidate-last-cached-page-on-append-write.patch @@ -0,0 +1,62 @@ +From c1976bd8f23016d8706973908f2bb0ac0d852a8f Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 29 Mar 2023 13:16:01 +0900 +Subject: zonefs: Always invalidate last cached page on append write + +From: Damien Le Moal + +commit c1976bd8f23016d8706973908f2bb0ac0d852a8f upstream. + +When a direct append write is executed, the append offset may correspond +to the last page of a sequential file inode which might have been cached +already by buffered reads, page faults with mmap-read or non-direct +readahead. To ensure that the on-disk and cached data is consistant for +such last cached page, make sure to always invalidate it in +zonefs_file_dio_append(). If the invalidation fails, return -EBUSY to +userspace to differentiate from IO errors. + +This invalidation will always be a no-op when the FS block size (device +zone write granularity) is equal to the page size (e.g. 4K). + +Reported-by: Hans Holmberg +Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Tested-by: Hans Holmberg +Signed-off-by: Greg Kroah-Hartman +--- + fs/zonefs/file.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/fs/zonefs/file.c ++++ b/fs/zonefs/file.c +@@ -382,6 +382,7 @@ static ssize_t zonefs_file_dio_append(st + struct zonefs_zone *z = zonefs_inode_zone(inode); + struct block_device *bdev = inode->i_sb->s_bdev; + unsigned int max = bdev_max_zone_append_sectors(bdev); ++ pgoff_t start, end; + struct bio *bio; + ssize_t size; + int nr_pages; +@@ -390,6 +391,19 @@ static ssize_t zonefs_file_dio_append(st + max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize); + iov_iter_truncate(from, max); + ++ /* ++ * If the inode block size (zone write granularity) is smaller than the ++ * page size, we may be appending data belonging to the last page of the ++ * inode straddling inode->i_size, with that page already cached due to ++ * a buffered read or readahead. So make sure to invalidate that page. ++ * This will always be a no-op for the case where the block size is ++ * equal to the page size. ++ */ ++ start = iocb->ki_pos >> PAGE_SHIFT; ++ end = (iocb->ki_pos + iov_iter_count(from) - 1) >> PAGE_SHIFT; ++ if (invalidate_inode_pages2_range(inode->i_mapping, start, end)) ++ return -EBUSY; ++ + nr_pages = iov_iter_npages(from, BIO_MAX_VECS); + if (!nr_pages) + return 0; -- 2.47.3