From: Sasha Levin Date: Sat, 15 Mar 2025 13:34:16 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.6.84~46 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c680f0bb3da161f521852b7d2575a0c04ad0401;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/acpi-resource-irq-override-for-eluktronics-mech-17.patch b/queue-6.6/acpi-resource-irq-override-for-eluktronics-mech-17.patch new file mode 100644 index 0000000000..52d83da796 --- /dev/null +++ b/queue-6.6/acpi-resource-irq-override-for-eluktronics-mech-17.patch @@ -0,0 +1,43 @@ +From 42c4e1f2a17cc86057e33a1324e61687ba0d4f52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jan 2025 02:39:02 -0700 +Subject: ACPI: resource: IRQ override for Eluktronics MECH-17 + +From: Gannon Kolding + +[ Upstream commit 607ab6f85f4194b644ea95ac5fe660ef575db3b4 ] + +The Eluktronics MECH-17 (GM7RG7N) needs IRQ overriding for the +keyboard to work. + +Adding a DMI_MATCH entry for this laptop model makes the internal +keyboard function normally. + +Signed-off-by: Gannon Kolding +Link: https://patch.msgid.link/20250127093902.328361-1-gannon.kolding@gmail.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 64d83ff3c0d90..96a987506e717 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -549,6 +549,12 @@ static const struct dmi_system_id maingear_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "RP-15"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."), ++ DMI_MATCH(DMI_BOARD_NAME, "MECH-17"), ++ }, ++ }, + { + /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ + .matches = { +-- +2.39.5 + diff --git a/queue-6.6/alpha-elf-fix-misc-setarch-test-of-util-linux-by-rem.patch b/queue-6.6/alpha-elf-fix-misc-setarch-test-of-util-linux-by-rem.patch new file mode 100644 index 0000000000..379447c991 --- /dev/null +++ b/queue-6.6/alpha-elf-fix-misc-setarch-test-of-util-linux-by-rem.patch @@ -0,0 +1,152 @@ +From 2f0dc6956c30c6f894efb11e1dd7eac22153bbcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jan 2025 23:39:01 -0600 +Subject: alpha/elf: Fix misc/setarch test of util-linux by removing 32bit + support + +From: Eric W. Biederman + +[ Upstream commit b029628be267cba3c7684ec684749fe3e4372398 ] + +Richard Henderson writes[1]: + +> There was a Spec benchmark (I forget which) which was memory bound and ran +> twice as fast with 32-bit pointers. +> +> I copied the idea from DEC to the ELF abi, but never did all the other work +> to allow the toolchain to take advantage. +> +> Amusingly, a later Spec changed the benchmark data sets to not fit into a +> 32-bit address space, specifically because of this. +> +> I expect one could delete the ELF bit and personality and no one would +> notice. Not even the 10 remaining Alpha users. + +In [2] it was pointed out that parts of setarch weren't working +properly on alpha because it has it's own SET_PERSONALITY +implementation. In the discussion that followed Richard Henderson +pointed out that the 32bit pointer support for alpha was never +completed. + +Fix this by removing alpha's 32bit pointer support. + +As a bit of paranoia refuse to execute any alpha binaries that have +the EF_ALPHA_32BIT flag set. Just in case someone somewhere has +binaries that try to use alpha's 32bit pointer support. + +Link: https://lkml.kernel.org/r/CAFXwXrkgu=4Qn-v1PjnOR4SG0oUb9LSa0g6QXpBq4ttm52pJOQ@mail.gmail.com [1] +Link: https://lkml.kernel.org/r/20250103140148.370368-1-glaubitz@physik.fu-berlin.de [2] +Signed-off-by: Eric W. Biederman +Reviewed-by: Richard Henderson +Reviewed-by: Arnd Bergmann +Reviewed-by: John Paul Adrian Glaubitz +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/87y0zfs26i.fsf_-_@email.froward.int.ebiederm.org +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/elf.h | 6 +----- + arch/alpha/include/asm/pgtable.h | 2 +- + arch/alpha/include/asm/processor.h | 8 ++------ + arch/alpha/kernel/osf_sys.c | 11 ++--------- + 4 files changed, 6 insertions(+), 21 deletions(-) + +diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h +index e6da23f1da830..adc87404ef87f 100644 +--- a/arch/alpha/include/asm/elf.h ++++ b/arch/alpha/include/asm/elf.h +@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG]; + /* + * This is used to ensure we don't load something for the wrong architecture. + */ +-#define elf_check_arch(x) ((x)->e_machine == EM_ALPHA) ++#define elf_check_arch(x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT)) + + /* + * These are used to set parameters in the core dumps. +@@ -139,10 +139,6 @@ extern int dump_elf_task(elf_greg_t *dest, struct task_struct *task); + : amask (AMASK_CIX) ? "ev6" : "ev67"); \ + }) + +-#define SET_PERSONALITY(EX) \ +- set_personality(((EX).e_flags & EF_ALPHA_32BIT) \ +- ? PER_LINUX_32BIT : PER_LINUX) +- + extern int alpha_l1i_cacheshape; + extern int alpha_l1d_cacheshape; + extern int alpha_l2_cacheshape; +diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h +index 635f0a5f5bbde..02e8817a89212 100644 +--- a/arch/alpha/include/asm/pgtable.h ++++ b/arch/alpha/include/asm/pgtable.h +@@ -360,7 +360,7 @@ static inline pte_t pte_swp_clear_exclusive(pte_t pte) + + extern void paging_init(void); + +-/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */ ++/* We have our own get_unmapped_area */ + #define HAVE_ARCH_UNMAPPED_AREA + + #endif /* _ALPHA_PGTABLE_H */ +diff --git a/arch/alpha/include/asm/processor.h b/arch/alpha/include/asm/processor.h +index 55bb1c09fd39d..5dce5518a2111 100644 +--- a/arch/alpha/include/asm/processor.h ++++ b/arch/alpha/include/asm/processor.h +@@ -8,23 +8,19 @@ + #ifndef __ASM_ALPHA_PROCESSOR_H + #define __ASM_ALPHA_PROCESSOR_H + +-#include /* for ADDR_LIMIT_32BIT */ +- + /* + * We have a 42-bit user address space: 4TB user VM... + */ + #define TASK_SIZE (0x40000000000UL) + +-#define STACK_TOP \ +- (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL) ++#define STACK_TOP (0x00120000000UL) + + #define STACK_TOP_MAX 0x00120000000UL + + /* This decides where the kernel will search for a free chunk of vm + * space during mmap's. + */ +-#define TASK_UNMAPPED_BASE \ +- ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2) ++#define TASK_UNMAPPED_BASE (TASK_SIZE / 2) + + /* This is dead. Everything has been moved to thread_info. */ + struct thread_struct { }; +diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c +index 5db88b6274396..ebd076fad804f 100644 +--- a/arch/alpha/kernel/osf_sys.c ++++ b/arch/alpha/kernel/osf_sys.c +@@ -1211,8 +1211,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p) + return ret; + } + +-/* Get an address range which is currently unmapped. Similar to the +- generic version except that we know how to honor ADDR_LIMIT_32BIT. */ ++/* Get an address range which is currently unmapped. */ + + static unsigned long + arch_get_unmapped_area_1(unsigned long addr, unsigned long len, +@@ -1234,13 +1233,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, + unsigned long len, unsigned long pgoff, + unsigned long flags) + { +- unsigned long limit; +- +- /* "32 bit" actually means 31 bit, since pointers sign extend. */ +- if (current->personality & ADDR_LIMIT_32BIT) +- limit = 0x80000000; +- else +- limit = TASK_SIZE; ++ unsigned long limit = TASK_SIZE; + + if (len > limit) + return -ENOMEM; +-- +2.39.5 + diff --git a/queue-6.6/alsa-hda-realtek-limit-mic-boost-on-positivo-arn50.patch b/queue-6.6/alsa-hda-realtek-limit-mic-boost-on-positivo-arn50.patch new file mode 100644 index 0000000000..c2819f6ec6 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-limit-mic-boost-on-positivo-arn50.patch @@ -0,0 +1,36 @@ +From 9ff395b95e1ae8c953f575e400ec4005f88382c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Feb 2025 11:39:30 -0300 +Subject: ALSA: hda/realtek: Limit mic boost on Positivo ARN50 + +From: Edson Juliano Drosdeck + +[ Upstream commit 76b0a22d4cf7dc9091129560fdc04e73eb9db4cb ] + +The internal mic boost on the Positivo ARN50 is too high. +Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine +to limit the gain. + +Signed-off-by: Edson Juliano Drosdeck +Link: https://patch.msgid.link/20250201143930.25089-1-edson.drosdeck@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index ec57148453c82..1fd6e84b0e371 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10527,6 +10527,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13), + SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), +-- +2.39.5 + diff --git a/queue-6.6/apple-nvme-release-power-domains-when-probe-fails.patch b/queue-6.6/apple-nvme-release-power-domains-when-probe-fails.patch new file mode 100644 index 0000000000..1f01b0ea73 --- /dev/null +++ b/queue-6.6/apple-nvme-release-power-domains-when-probe-fails.patch @@ -0,0 +1,42 @@ +From f6f2d0787bdd7f5a37cc6606fb3ea6d59a9d0e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2025 11:12:59 -0500 +Subject: apple-nvme: Release power domains when probe fails + +From: Hector Martin + +[ Upstream commit eefa72a15ea03fd009333aaa9f0e360b2578e434 ] + +Signed-off-by: Hector Martin +Reviewed-by: Neal Gompa +Reviewed-by: Sven Peter +Signed-off-by: Alyssa Rosenzweig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/apple.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/apple.c b/drivers/nvme/host/apple.c +index 396eb94376597..9b1019ee74789 100644 +--- a/drivers/nvme/host/apple.c ++++ b/drivers/nvme/host/apple.c +@@ -1517,6 +1517,7 @@ static struct apple_nvme *apple_nvme_alloc(struct platform_device *pdev) + + return anv; + put_dev: ++ apple_nvme_detach_genpd(anv); + put_device(anv->dev); + return ERR_PTR(ret); + } +@@ -1545,6 +1546,7 @@ static int apple_nvme_probe(struct platform_device *pdev) + out_uninit_ctrl: + nvme_uninit_ctrl(&anv->ctrl); + nvme_put_ctrl(&anv->ctrl); ++ apple_nvme_detach_genpd(anv); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.6/asoc-arizona-madera-use-fsleep-in-up-down-dapm-event.patch b/queue-6.6/asoc-arizona-madera-use-fsleep-in-up-down-dapm-event.patch new file mode 100644 index 0000000000..dbee96412d --- /dev/null +++ b/queue-6.6/asoc-arizona-madera-use-fsleep-in-up-down-dapm-event.patch @@ -0,0 +1,174 @@ +From 8fb117c5c50edc619c94452130e3d2181760aa79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 16:08:46 +0000 +Subject: ASoC: arizona/madera: use fsleep() in up/down DAPM event delays. + +From: Vitaly Rodionov + +[ Upstream commit 679074942c2502a95842a80471d8fb718165ac77 ] + +Using `fsleep` instead of `msleep` resolves some customer complaints +regarding the precision of up/down DAPM event timing. `fsleep()` +automatically selects the appropriate sleep function, making the delay +time more predictable. + +Signed-off-by: Vitaly Rodionov +Link: https://patch.msgid.link/20250205160849.500306-1-vitalyr@opensource.cirrus.com +Reviewed-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/arizona.c | 14 +++++++------- + sound/soc/codecs/madera.c | 10 +++++----- + sound/soc/codecs/wm5110.c | 8 ++++---- + 3 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c +index 402b9a2ff0240..68cdb1027d0c0 100644 +--- a/sound/soc/codecs/arizona.c ++++ b/sound/soc/codecs/arizona.c +@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + case ARIZONA_OUT3L_ENA_SHIFT: + case ARIZONA_OUT3R_ENA_SHIFT: + priv->out_up_pending++; +- priv->out_up_delay += 17; ++ priv->out_up_delay += 17000; + break; + case ARIZONA_OUT4L_ENA_SHIFT: + case ARIZONA_OUT4R_ENA_SHIFT: +@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + case WM8997: + break; + default: +- priv->out_up_delay += 10; ++ priv->out_up_delay += 10000; + break; + } + break; +@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + if (!priv->out_up_pending && priv->out_up_delay) { + dev_dbg(component->dev, "Power up delay: %d\n", + priv->out_up_delay); +- msleep(priv->out_up_delay); ++ fsleep(priv->out_up_delay); + priv->out_up_delay = 0; + } + break; +@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + case ARIZONA_OUT3L_ENA_SHIFT: + case ARIZONA_OUT3R_ENA_SHIFT: + priv->out_down_pending++; +- priv->out_down_delay++; ++ priv->out_down_delay += 1000; + break; + case ARIZONA_OUT4L_ENA_SHIFT: + case ARIZONA_OUT4R_ENA_SHIFT: +@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + break; + case WM8998: + case WM1814: +- priv->out_down_delay += 5; ++ priv->out_down_delay += 5000; + break; + default: +- priv->out_down_delay++; ++ priv->out_down_delay += 1000; + break; + } + break; +@@ -1053,7 +1053,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w, + if (!priv->out_down_pending && priv->out_down_delay) { + dev_dbg(component->dev, "Power down delay: %d\n", + priv->out_down_delay); +- msleep(priv->out_down_delay); ++ fsleep(priv->out_down_delay); + priv->out_down_delay = 0; + } + break; +diff --git a/sound/soc/codecs/madera.c b/sound/soc/codecs/madera.c +index b9f19fbd29114..30e680ee10699 100644 +--- a/sound/soc/codecs/madera.c ++++ b/sound/soc/codecs/madera.c +@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, + case CS42L92: + case CS47L92: + case CS47L93: +- out_up_delay = 6; ++ out_up_delay = 6000; + break; + default: +- out_up_delay = 17; ++ out_up_delay = 17000; + break; + } + +@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, + case MADERA_OUT3R_ENA_SHIFT: + priv->out_up_pending--; + if (!priv->out_up_pending) { +- msleep(priv->out_up_delay); ++ fsleep(priv->out_up_delay); + priv->out_up_delay = 0; + } + break; +@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, + case MADERA_OUT3L_ENA_SHIFT: + case MADERA_OUT3R_ENA_SHIFT: + priv->out_down_pending++; +- priv->out_down_delay++; ++ priv->out_down_delay += 1000; + break; + default: + break; +@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w, + case MADERA_OUT3R_ENA_SHIFT: + priv->out_down_pending--; + if (!priv->out_down_pending) { +- msleep(priv->out_down_delay); ++ fsleep(priv->out_down_delay); + priv->out_down_delay = 0; + } + break; +diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c +index ac1f2c8503465..da5933fbdbf8a 100644 +--- a/sound/soc/codecs/wm5110.c ++++ b/sound/soc/codecs/wm5110.c +@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) + } else { + wseq = wm5110_no_dre_left_enable; + nregs = ARRAY_SIZE(wm5110_no_dre_left_enable); +- priv->out_up_delay += 10; ++ priv->out_up_delay += 10000; + } + break; + case ARIZONA_OUT1R_ENA_SHIFT: +@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w) + } else { + wseq = wm5110_no_dre_right_enable; + nregs = ARRAY_SIZE(wm5110_no_dre_right_enable); +- priv->out_up_delay += 10; ++ priv->out_up_delay += 10000; + } + break; + default: +@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w) + snd_soc_component_update_bits(component, + ARIZONA_SPARE_TRIGGERS, + ARIZONA_WS_TRG1, 0); +- priv->out_down_delay += 27; ++ priv->out_down_delay += 27000; + } + break; + case ARIZONA_OUT1R_ENA_SHIFT: +@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w) + snd_soc_component_update_bits(component, + ARIZONA_SPARE_TRIGGERS, + ARIZONA_WS_TRG2, 0); +- priv->out_down_delay += 27; ++ priv->out_down_delay += 27000; + } + break; + default: +-- +2.39.5 + diff --git a/queue-6.6/asoc-rsnd-adjust-convert-rate-limitation.patch b/queue-6.6/asoc-rsnd-adjust-convert-rate-limitation.patch new file mode 100644 index 0000000000..992d24dbc9 --- /dev/null +++ b/queue-6.6/asoc-rsnd-adjust-convert-rate-limitation.patch @@ -0,0 +1,216 @@ +From 8bf9689f7b700537d89137fefd2597a5dc7157a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 00:20:48 +0000 +Subject: ASoC: rsnd: adjust convert rate limitation + +From: Kuninori Morimoto + +[ Upstream commit 89f9cf185885d4358aa92b48e51d0f09b71775aa ] + +Current rsnd driver supports Synchronous SRC Mode, but HW allow to update +rate only within 1% from current rate. Adjust to it. + +Becially, this feature is used to fine-tune subtle difference that occur +during sampling rate conversion in SRC. So, it should be called within 1% +margin of rate difference. + +If there was difference over 1%, it will apply with 1% increments by using +loop without indicating error message. + +Cc: Yoshihiro Shimoda +Signed-off-by: Kuninori Morimoto +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Link: https://patch.msgid.link/871pwd2qe8.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/src.c | 98 ++++++++++++++++++++++++++++++++--------- + 1 file changed, 76 insertions(+), 22 deletions(-) + +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 9893839666d7b..e985681363e25 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -34,6 +34,7 @@ struct rsnd_src { + struct rsnd_mod *dma; + struct rsnd_kctrl_cfg_s sen; /* sync convert enable */ + struct rsnd_kctrl_cfg_s sync; /* sync convert */ ++ u32 current_sync_rate; + int irq; + }; + +@@ -99,7 +100,7 @@ static u32 rsnd_src_convert_rate(struct rsnd_dai_stream *io, + if (!rsnd_src_sync_is_enabled(mod)) + return rsnd_io_converted_rate(io); + +- convert_rate = src->sync.val; ++ convert_rate = src->current_sync_rate; + + if (!convert_rate) + convert_rate = rsnd_io_converted_rate(io); +@@ -200,13 +201,73 @@ static const u32 chan222222[] = { + static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, + struct rsnd_mod *mod) + { ++ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + struct rsnd_priv *priv = rsnd_mod_to_priv(mod); +- struct device *dev = rsnd_priv_to_dev(priv); ++ struct rsnd_src *src = rsnd_mod_to_src(mod); ++ u32 fin, fout, new_rate; ++ int inc, cnt, rate; ++ u64 base, val; ++ ++ if (!runtime) ++ return; ++ ++ if (!rsnd_src_sync_is_enabled(mod)) ++ return; ++ ++ fin = rsnd_src_get_in_rate(priv, io); ++ fout = rsnd_src_get_out_rate(priv, io); ++ ++ new_rate = src->sync.val; ++ ++ if (!new_rate) ++ new_rate = fout; ++ ++ /* Do nothing if no diff */ ++ if (new_rate == src->current_sync_rate) ++ return; ++ ++ /* ++ * SRCm_IFSVR::INTIFS can change within 1% ++ * see ++ * SRCm_IFSVR::INTIFS Note ++ */ ++ inc = fout / 100; ++ cnt = abs(new_rate - fout) / inc; ++ if (fout > new_rate) ++ inc *= -1; ++ ++ /* ++ * After start running SRC, we can update only SRC_IFSVR ++ * for Synchronous Mode ++ */ ++ base = (u64)0x0400000 * fin; ++ rate = fout; ++ for (int i = 0; i < cnt; i++) { ++ val = base; ++ rate += inc; ++ do_div(val, rate); ++ ++ rsnd_mod_write(mod, SRC_IFSVR, val); ++ } ++ val = base; ++ do_div(val, new_rate); ++ ++ rsnd_mod_write(mod, SRC_IFSVR, val); ++ ++ /* update current_sync_rate */ ++ src->current_sync_rate = new_rate; ++} ++ ++static void rsnd_src_init_convert_rate(struct rsnd_dai_stream *io, ++ struct rsnd_mod *mod) ++{ + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); ++ struct rsnd_priv *priv = rsnd_mod_to_priv(mod); ++ struct device *dev = rsnd_priv_to_dev(priv); + int is_play = rsnd_io_is_play(io); + int use_src = 0; + u32 fin, fout; +- u32 ifscr, fsrate, adinr; ++ u32 ifscr, adinr; + u32 cr, route; + u32 i_busif, o_busif, tmp; + const u32 *bsdsr_table; +@@ -244,26 +305,15 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, + adinr = rsnd_get_adinr_bit(mod, io) | chan; + + /* +- * SRC_IFSCR / SRC_IFSVR +- */ +- ifscr = 0; +- fsrate = 0; +- if (use_src) { +- u64 n; +- +- ifscr = 1; +- n = (u64)0x0400000 * fin; +- do_div(n, fout); +- fsrate = n; +- } +- +- /* ++ * SRC_IFSCR + * SRC_SRCCR / SRC_ROUTE_MODE0 + */ ++ ifscr = 0; + cr = 0x00011110; + route = 0x0; + if (use_src) { + route = 0x1; ++ ifscr = 0x1; + + if (rsnd_src_sync_is_enabled(mod)) { + cr |= 0x1; +@@ -334,7 +384,6 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, + rsnd_mod_write(mod, SRC_SRCIR, 1); /* initialize */ + rsnd_mod_write(mod, SRC_ADINR, adinr); + rsnd_mod_write(mod, SRC_IFSCR, ifscr); +- rsnd_mod_write(mod, SRC_IFSVR, fsrate); + rsnd_mod_write(mod, SRC_SRCCR, cr); + rsnd_mod_write(mod, SRC_BSDSR, bsdsr_table[idx]); + rsnd_mod_write(mod, SRC_BSISR, bsisr_table[idx]); +@@ -347,6 +396,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io, + + rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout); + ++ /* update SRC_IFSVR */ ++ rsnd_src_set_convert_rate(io, mod); ++ + return; + + convert_rate_err: +@@ -466,7 +518,8 @@ static int rsnd_src_init(struct rsnd_mod *mod, + int ret; + + /* reset sync convert_rate */ +- src->sync.val = 0; ++ src->sync.val = ++ src->current_sync_rate = 0; + + ret = rsnd_mod_power_on(mod); + if (ret < 0) +@@ -474,7 +527,7 @@ static int rsnd_src_init(struct rsnd_mod *mod, + + rsnd_src_activation(mod); + +- rsnd_src_set_convert_rate(io, mod); ++ rsnd_src_init_convert_rate(io, mod); + + rsnd_src_status_clear(mod); + +@@ -492,7 +545,8 @@ static int rsnd_src_quit(struct rsnd_mod *mod, + rsnd_mod_power_off(mod); + + /* reset sync convert_rate */ +- src->sync.val = 0; ++ src->sync.val = ++ src->current_sync_rate = 0; + + return 0; + } +@@ -600,7 +654,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod, + "SRC Out Rate Switch" : + "SRC In Rate Switch", + rsnd_kctrl_accept_anytime, +- rsnd_src_set_convert_rate, ++ rsnd_src_init_convert_rate, + &src->sen, 1); + if (ret < 0) + return ret; +-- +2.39.5 + diff --git a/queue-6.6/asoc-rsnd-don-t-indicate-warning-on-rsnd_kctrl_accep.patch b/queue-6.6/asoc-rsnd-don-t-indicate-warning-on-rsnd_kctrl_accep.patch new file mode 100644 index 0000000000..58ca9ed8f6 --- /dev/null +++ b/queue-6.6/asoc-rsnd-don-t-indicate-warning-on-rsnd_kctrl_accep.patch @@ -0,0 +1,125 @@ +From c50d04a9470c7c225b961f916c22ec65b7ac20b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 00:20:42 +0000 +Subject: ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime() + +From: Kuninori Morimoto + +[ Upstream commit c3fc002b206c6c83d1e3702b979733002ba6fb2c ] + +rsnd_kctrl_accept_runtime() (1) is used for runtime convert rate +(= Synchronous SRC Mode). Now, rsnd driver has 2 kctrls for it + +(A): "SRC Out Rate Switch" +(B): "SRC Out Rate" // it calls (1) + +(A): can be called anytime +(B): can be called only runtime, and will indicate warning if it was used + at non-runtime. + +To use runtime convert rate (= Synchronous SRC Mode), user might uses +command in below order. + +(X): > amixer set "SRC Out Rate" on + > aplay xxx.wav & +(Y): > amixer set "SRC Out Rate" 48010 // convert rate to 48010Hz + +(Y): calls B +(X): calls both A and B. + +In this case, when user calls (X), it calls both (A) and (B), but it is not +yet start running. So, (B) will indicate warning. + +This warning was added by commit b5c088689847 ("ASoC: rsnd: add warning +message to rsnd_kctrl_accept_runtime()"), but the message sounds like the +operation was not correct. Let's update warning message. + +The message is very SRC specific, implement it in src.c + +Signed-off-by: Kuninori Morimoto +Reviewed-by: Yoshihiro Shimoda +Link: https://patch.msgid.link/8734gt2qed.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 14 -------------- + sound/soc/sh/rcar/rsnd.h | 1 - + sound/soc/sh/rcar/src.c | 18 +++++++++++++++++- + 3 files changed, 17 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 98c7be340a536..3cd14fbca28ea 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1775,20 +1775,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io) + return 1; + } + +-int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io) +-{ +- struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); +- struct rsnd_priv *priv = rsnd_io_to_priv(io); +- struct device *dev = rsnd_priv_to_dev(priv); +- +- if (!runtime) { +- dev_warn(dev, "Can't update kctrl when idle\n"); +- return 0; +- } +- +- return 1; +-} +- + struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg) + { + cfg->cfg.val = cfg->val; +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index 43c0d675cc343..1214dbba6898b 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -755,7 +755,6 @@ struct rsnd_kctrl_cfg_s { + #define rsnd_kctrl_vals(x) ((x).val) /* = (x).cfg.val[0] */ + + int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io); +-int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io); + struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg); + struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg); + int rsnd_kctrl_new(struct rsnd_mod *mod, +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index f832165e46bc0..9893839666d7b 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -530,6 +530,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data) + return IRQ_HANDLED; + } + ++static int rsnd_src_kctrl_accept_runtime(struct rsnd_dai_stream *io) ++{ ++ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); ++ ++ if (!runtime) { ++ struct rsnd_priv *priv = rsnd_io_to_priv(io); ++ struct device *dev = rsnd_priv_to_dev(priv); ++ ++ dev_warn(dev, "\"SRC Out Rate\" can use during running\n"); ++ ++ return 0; ++ } ++ ++ return 1; ++} ++ + static int rsnd_src_probe_(struct rsnd_mod *mod, + struct rsnd_dai_stream *io, + struct rsnd_priv *priv) +@@ -593,7 +609,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod, + rsnd_io_is_play(io) ? + "SRC Out Rate" : + "SRC In Rate", +- rsnd_kctrl_accept_runtime, ++ rsnd_src_kctrl_accept_runtime, + rsnd_src_set_convert_rate, + &src->sync, 192000); + +-- +2.39.5 + diff --git a/queue-6.6/asoc-rsnd-indicate-unsupported-clock-rate.patch b/queue-6.6/asoc-rsnd-indicate-unsupported-clock-rate.patch new file mode 100644 index 0000000000..e7a090c2ad --- /dev/null +++ b/queue-6.6/asoc-rsnd-indicate-unsupported-clock-rate.patch @@ -0,0 +1,38 @@ +From d4ace9109b2fc26d8de62799bcbc36f916d8fcc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 00:20:36 +0000 +Subject: ASoC: rsnd: indicate unsupported clock rate + +From: Kuninori Morimoto + +[ Upstream commit 796106e29e5df6cd4b4e2b51262a8a19e9fa0625 ] + +It will indicate "unsupported clock rate" when setup clock failed. +But it is unclear what kind of rate was failed. Indicate it. + +Signed-off-by: Kuninori Morimoto +Reviewed-by: Yoshihiro Shimoda +Link: https://patch.msgid.link/874j192qej.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 690ac0d6ef41a..2a9e8d20c23c3 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -334,7 +334,8 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod, + return 0; + + rate_err: +- dev_err(dev, "unsupported clock rate\n"); ++ dev_err(dev, "unsupported clock rate (%d)\n", rate); ++ + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.6/asoc-simple-card-utils.c-add-missing-dlc-of_node.patch b/queue-6.6/asoc-simple-card-utils.c-add-missing-dlc-of_node.patch new file mode 100644 index 0000000000..d6b1879cc1 --- /dev/null +++ b/queue-6.6/asoc-simple-card-utils.c-add-missing-dlc-of_node.patch @@ -0,0 +1,49 @@ +From b81ef55524c12b80c7d55bcdeaf4b5499bf4de4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Feb 2025 23:50:08 +0000 +Subject: ASoC: simple-card-utils.c: add missing dlc->of_node + +From: Kuninori Morimoto + +[ Upstream commit dabbd325b25edb5cdd99c94391817202dd54b651 ] + +commit 90de551c1bf ("ASoC: simple-card-utils.c: enable multi Component +support") added muiti Component support, but was missing to add +dlc->of_node. Because of it, Sound device list will indicates strange +name if it was DPCM connection and driver supports dai->driver->dai_args, +like below + + > aplay -l + card X: sndulcbmix [xxxx], device 0: fe.(null).rsnd-dai.0 (*) [] + ... ^^^^^^ + +It will be fixed by this patch + + > aplay -l + card X: sndulcbmix [xxxx], device 0: fe.sound@ec500000.rsnd-dai.0 (*) [] + ... ^^^^^^^^^^^^^^ + +Signed-off-by: Kuninori Morimoto +Reviewed-by: Daniel Baluta +Link: https://patch.msgid.link/87ikpp2rtb.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card-utils.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c +index 2588ec735dbdf..598b0000df244 100644 +--- a/sound/soc/generic/simple-card-utils.c ++++ b/sound/soc/generic/simple-card-utils.c +@@ -1086,6 +1086,7 @@ int asoc_graph_parse_dai(struct device *dev, struct device_node *ep, + args.np = ep; + dai = snd_soc_get_dai_via_args(&args); + if (dai) { ++ dlc->of_node = node; + dlc->dai_name = snd_soc_dai_name_get(dai); + dlc->dai_args = snd_soc_copy_dai_args(dev, &args); + if (!dlc->dai_args) +-- +2.39.5 + diff --git a/queue-6.6/asoc-sof-amd-handle-ipc-replies-before-fw_boot_compl.patch b/queue-6.6/asoc-sof-amd-handle-ipc-replies-before-fw_boot_compl.patch new file mode 100644 index 0000000000..0f20a56fd0 --- /dev/null +++ b/queue-6.6/asoc-sof-amd-handle-ipc-replies-before-fw_boot_compl.patch @@ -0,0 +1,68 @@ +From 773d5f6e18616bdca7ae1719eb62b6613e813ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2025 13:46:04 +0200 +Subject: ASoC: SOF: amd: Handle IPC replies before FW_BOOT_COMPLETE + +From: Cristian Ciocaltea + +[ Upstream commit ac84ca815adb4171a4276b1d44096b75f6a150b7 ] + +In some cases, e.g. during resuming from suspend, there is a possibility +that some IPC reply messages get received by the host while the DSP +firmware has not yet reached the complete boot state. + +Detect when this happens and do not attempt to process the unexpected +replies from DSP. Instead, provide proper debugging support. + +Signed-off-by: Cristian Ciocaltea +Link: https://patch.msgid.link/20250207-sof-vangogh-fixes-v1-3-67824c1e4c9a@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp-ipc.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/sof/amd/acp-ipc.c b/sound/soc/sof/amd/acp-ipc.c +index fcb54f545fea3..a4e9bc20adaff 100644 +--- a/sound/soc/sof/amd/acp-ipc.c ++++ b/sound/soc/sof/amd/acp-ipc.c +@@ -167,6 +167,7 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) + + if (sdev->first_boot && sdev->fw_state != SOF_FW_BOOT_COMPLETE) { + acp_mailbox_read(sdev, sdev->dsp_box.offset, &status, sizeof(status)); ++ + if ((status & SOF_IPC_PANIC_MAGIC_MASK) == SOF_IPC_PANIC_MAGIC) { + snd_sof_dsp_panic(sdev, sdev->dsp_box.offset + sizeof(status), + true); +@@ -188,13 +189,21 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context) + + dsp_ack = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_SCRATCH_REG_0 + dsp_ack_write); + if (dsp_ack) { +- spin_lock_irq(&sdev->ipc_lock); +- /* handle immediate reply from DSP core */ +- acp_dsp_ipc_get_reply(sdev); +- snd_sof_ipc_reply(sdev, 0); +- /* set the done bit */ +- acp_dsp_ipc_dsp_done(sdev); +- spin_unlock_irq(&sdev->ipc_lock); ++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { ++ spin_lock_irq(&sdev->ipc_lock); ++ ++ /* handle immediate reply from DSP core */ ++ acp_dsp_ipc_get_reply(sdev); ++ snd_sof_ipc_reply(sdev, 0); ++ /* set the done bit */ ++ acp_dsp_ipc_dsp_done(sdev); ++ ++ spin_unlock_irq(&sdev->ipc_lock); ++ } else { ++ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_BOOT_COMPLETE: %#x\n", ++ dsp_ack); ++ } ++ + ipc_irq = true; + } + +-- +2.39.5 + diff --git a/queue-6.6/asoc-sof-intel-hda-add-softdep-pre-to-snd-hda-codec-.patch b/queue-6.6/asoc-sof-intel-hda-add-softdep-pre-to-snd-hda-codec-.patch new file mode 100644 index 0000000000..6acaf1e028 --- /dev/null +++ b/queue-6.6/asoc-sof-intel-hda-add-softdep-pre-to-snd-hda-codec-.patch @@ -0,0 +1,44 @@ +From 305d9aa0d6fd6efd7b8f1a85cea110e75a2a427c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 11:47:23 +0200 +Subject: ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Terry Cheong + +[ Upstream commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd ] + +In enviornment without KMOD requesting module may fail to load +snd-hda-codec-hdmi, resulting in HDMI audio not usable. +Add softdep to loading HDMI codec module first to ensure we can load it +correctly. + +Signed-off-by: Terry Cheong +Reviewed-by: Bard Liao +Reviewed-by: Johny Lin +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250206094723.18013-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-codec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c +index 328d7c227b218..82a6707fb4b80 100644 +--- a/sound/soc/sof/intel/hda-codec.c ++++ b/sound/soc/sof/intel/hda-codec.c +@@ -444,6 +444,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev) + } + EXPORT_SYMBOL_NS_GPL(hda_codec_i915_exit, SND_SOC_SOF_HDA_AUDIO_CODEC_I915); + ++MODULE_SOFTDEP("pre: snd-hda-codec-hdmi"); + #endif + + MODULE_LICENSE("Dual BSD/GPL"); +-- +2.39.5 + diff --git a/queue-6.6/asoc-tas2764-fix-power-control-mask.patch b/queue-6.6/asoc-tas2764-fix-power-control-mask.patch new file mode 100644 index 0000000000..de8e9afbfe --- /dev/null +++ b/queue-6.6/asoc-tas2764-fix-power-control-mask.patch @@ -0,0 +1,35 @@ +From c25d6f4f0aba6ed7cec7c0352c9d435a5d314eec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 18:35:35 +1000 +Subject: ASoC: tas2764: Fix power control mask + +From: Hector Martin + +[ Upstream commit a3f172359e22b2c11b750d23560481a55bf86af1 ] + +Reviewed-by: Neal Gompa +Signed-off-by: Hector Martin +Signed-off-by: James Calligeros +Link: https://patch.msgid.link/20250218-apple-codec-changes-v2-1-932760fd7e07@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h +index 168af772a898f..d13ecae9c9c2f 100644 +--- a/sound/soc/codecs/tas2764.h ++++ b/sound/soc/codecs/tas2764.h +@@ -25,7 +25,7 @@ + + /* Power Control */ + #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02) +-#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0) ++#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0) + #define TAS2764_PWR_CTRL_ACTIVE 0x0 + #define TAS2764_PWR_CTRL_MUTE BIT(0) + #define TAS2764_PWR_CTRL_SHUTDOWN BIT(1) +-- +2.39.5 + diff --git a/queue-6.6/asoc-tas2764-set-the-sdout-polarity-correctly.patch b/queue-6.6/asoc-tas2764-set-the-sdout-polarity-correctly.patch new file mode 100644 index 0000000000..a488324f22 --- /dev/null +++ b/queue-6.6/asoc-tas2764-set-the-sdout-polarity-correctly.patch @@ -0,0 +1,84 @@ +From 2a1d346556c5f6b346fd2de11b8675115773c8d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 18:36:02 +1000 +Subject: ASoC: tas2764: Set the SDOUT polarity correctly + +From: Hector Martin + +[ Upstream commit f5468beeab1b1adfc63c2717b1f29ef3f49a5fab ] + +TX launch polarity needs to be the opposite of RX capture polarity, to +generate the right bit slot alignment. + +Reviewed-by: Neal Gompa +Signed-off-by: Hector Martin +Signed-off-by: James Calligeros +Link: https://patch.msgid.link/20250218-apple-codec-changes-v2-28-932760fd7e07@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2764.c | 10 +++++++++- + sound/soc/codecs/tas2764.h | 6 ++++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c +index a9838e0738cc1..e87a07eee9737 100644 +--- a/sound/soc/codecs/tas2764.c ++++ b/sound/soc/codecs/tas2764.c +@@ -367,7 +367,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + { + struct snd_soc_component *component = dai->component; + struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component); +- u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0; ++ u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0, asi_cfg_4 = 0; + int ret; + + switch (fmt & SND_SOC_DAIFMT_INV_MASK) { +@@ -376,12 +376,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + fallthrough; + case SND_SOC_DAIFMT_NB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_RISING; ++ asi_cfg_4 = TAS2764_TDM_CFG4_TX_FALLING; + break; + case SND_SOC_DAIFMT_IB_IF: + asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; + fallthrough; + case SND_SOC_DAIFMT_IB_NF: + asi_cfg_1 = TAS2764_TDM_CFG1_RX_FALLING; ++ asi_cfg_4 = TAS2764_TDM_CFG4_TX_RISING; + break; + } + +@@ -391,6 +393,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) + if (ret < 0) + return ret; + ++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG4, ++ TAS2764_TDM_CFG4_TX_MASK, ++ asi_cfg_4); ++ if (ret < 0) ++ return ret; ++ + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: + asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START; +diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h +index d13ecae9c9c2f..9490f2686e389 100644 +--- a/sound/soc/codecs/tas2764.h ++++ b/sound/soc/codecs/tas2764.h +@@ -79,6 +79,12 @@ + #define TAS2764_TDM_CFG3_RXS_SHIFT 0x4 + #define TAS2764_TDM_CFG3_MASK GENMASK(3, 0) + ++/* TDM Configuration Reg4 */ ++#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d) ++#define TAS2764_TDM_CFG4_TX_MASK BIT(0) ++#define TAS2764_TDM_CFG4_TX_RISING 0x0 ++#define TAS2764_TDM_CFG4_TX_FALLING BIT(0) ++ + /* TDM Configuration Reg5 */ + #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e) + #define TAS2764_TDM_CFG5_VSNS_MASK BIT(6) +-- +2.39.5 + diff --git a/queue-6.6/asoc-tas2770-fix-volume-scale.patch b/queue-6.6/asoc-tas2770-fix-volume-scale.patch new file mode 100644 index 0000000000..95ee7b566c --- /dev/null +++ b/queue-6.6/asoc-tas2770-fix-volume-scale.patch @@ -0,0 +1,36 @@ +From d6c4e07ac6bd291638f01435cac28972298f7d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Feb 2025 00:54:35 +0000 +Subject: ASoC: tas2770: Fix volume scale + +From: Hector Martin + +[ Upstream commit 579cd64b9df8a60284ec3422be919c362de40e41 ] + +The scale starts at -100dB, not -128dB. + +Signed-off-by: Hector Martin +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20250208-asoc-tas2770-v1-1-cf50ff1d59a3@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 99bf402eb5667..5c6b825c757b3 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -508,7 +508,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component) + } + + static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0); +-static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0); ++static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0); + + static const struct snd_kcontrol_new tas2770_snd_controls[] = { + SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2, +-- +2.39.5 + diff --git a/queue-6.6/block-fix-kmem_cache-of-name-bio-108-already-exists.patch b/queue-6.6/block-fix-kmem_cache-of-name-bio-108-already-exists.patch new file mode 100644 index 0000000000..1f13787471 --- /dev/null +++ b/queue-6.6/block-fix-kmem_cache-of-name-bio-108-already-exists.patch @@ -0,0 +1,41 @@ +From 3beb365c9405f4fe694c03bd0935877243a63f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2025 21:26:56 +0800 +Subject: block: fix 'kmem_cache of name 'bio-108' already exists' + +From: Ming Lei + +[ Upstream commit b654f7a51ffb386131de42aa98ed831f8c126546 ] + +Device mapper bioset often has big bio_slab size, which can be more than +1000, then 8byte can't hold the slab name any more, cause the kmem_cache +allocation warning of 'kmem_cache of name 'bio-108' already exists'. + +Fix the warning by extending bio_slab->name to 12 bytes, but fix output +of /proc/slabinfo + +Reported-by: Guangwu Zhang +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20250228132656.2838008-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/bio.c b/block/bio.c +index 62419aa09d731..4a8e761699571 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -78,7 +78,7 @@ struct bio_slab { + struct kmem_cache *slab; + unsigned int slab_ref; + unsigned int slab_size; +- char name[8]; ++ char name[12]; + }; + static DEFINE_MUTEX(bio_slab_lock); + static DEFINE_XARRAY(bio_slabs); +-- +2.39.5 + diff --git a/queue-6.6/bluetooth-l2cap-fix-slab-use-after-free-read-in-l2ca.patch b/queue-6.6/bluetooth-l2cap-fix-slab-use-after-free-read-in-l2ca.patch new file mode 100644 index 0000000000..92aac64b8c --- /dev/null +++ b/queue-6.6/bluetooth-l2cap-fix-slab-use-after-free-read-in-l2ca.patch @@ -0,0 +1,196 @@ +From 973049ed6b2a60e4a3a2482128373f4f6962335a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 10:35:03 -0500 +Subject: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd + +From: Luiz Augusto von Dentz + +[ Upstream commit b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d ] + +After the hci sync command releases l2cap_conn, the hci receive data work +queue references the released l2cap_conn when sending to the upper layer. +Add hci dev lock to the hci receive data work queue to synchronize the two. + +[1] +BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 +Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837 + +CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Workqueue: hci1 hci_rx_work +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] + l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 + l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] + l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] + l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 + hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] + hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 + process_one_work kernel/workqueue.c:3229 [inline] + process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 + worker_thread+0x870/0xd30 kernel/workqueue.c:3391 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + + +Allocated by task 5837: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + poison_kmalloc_redzone mm/kasan/common.c:377 [inline] + __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 + kasan_kmalloc include/linux/kasan.h:260 [inline] + __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 + kmalloc_noprof include/linux/slab.h:901 [inline] + kzalloc_noprof include/linux/slab.h:1037 [inline] + l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 + l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 + hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] + hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 + hci_event_func net/bluetooth/hci_event.c:7473 [inline] + hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 + hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 + process_one_work kernel/workqueue.c:3229 [inline] + process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 + worker_thread+0x870/0xd30 kernel/workqueue.c:3391 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +Freed by task 54: + kasan_save_stack mm/kasan/common.c:47 [inline] + kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 + kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 + poison_slab_object mm/kasan/common.c:247 [inline] + __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 + kasan_slab_free include/linux/kasan.h:233 [inline] + slab_free_hook mm/slub.c:2353 [inline] + slab_free mm/slub.c:4613 [inline] + kfree+0x196/0x430 mm/slub.c:4761 + l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 + hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] + hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 + hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 + hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 + process_one_work kernel/workqueue.c:3229 [inline] + process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 + worker_thread+0x870/0xd30 kernel/workqueue.c:3391 + kthread+0x2f0/0x390 kernel/kthread.c:389 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +Reported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=31c2f641b850a348a734 +Tested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 39 +++++++++++++++++++++++++++++++++----- + 1 file changed, 34 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 76a85d8b17574..f0d40b4918e59 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -949,6 +949,16 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn) + return id; + } + ++static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, ++ u8 flags) ++{ ++ /* Check if the hcon still valid before attempting to send */ ++ if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) ++ hci_send_acl(conn->hchan, skb, flags); ++ else ++ kfree_skb(skb); ++} ++ + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + void *data) + { +@@ -971,7 +981,7 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; + skb->priority = HCI_PRIO_MAX; + +- hci_send_acl(conn->hchan, skb, flags); ++ l2cap_send_acl(conn, skb, flags); + } + + static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) +@@ -1793,13 +1803,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) + + mutex_unlock(&conn->chan_lock); + +- hci_chan_del(conn->hchan); +- + if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) + cancel_delayed_work_sync(&conn->info_timer); + + hcon->l2cap_data = NULL; +- conn->hchan = NULL; + l2cap_conn_put(conn); + } + +@@ -1807,6 +1814,7 @@ static void l2cap_conn_free(struct kref *ref) + { + struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); + ++ hci_chan_del(conn->hchan); + hci_conn_put(conn->hcon); + kfree(conn); + } +@@ -7478,14 +7486,33 @@ static void l2cap_recv_reset(struct l2cap_conn *conn) + conn->rx_len = 0; + } + ++static struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) ++{ ++ BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); ++ ++ if (!kref_get_unless_zero(&c->ref)) ++ return NULL; ++ ++ return c; ++} ++ + void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + { +- struct l2cap_conn *conn = hcon->l2cap_data; ++ struct l2cap_conn *conn; + int len; + ++ /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */ ++ hci_dev_lock(hcon->hdev); ++ ++ conn = hcon->l2cap_data; ++ + if (!conn) + conn = l2cap_conn_add(hcon); + ++ conn = l2cap_conn_hold_unless_zero(conn); ++ ++ hci_dev_unlock(hcon->hdev); ++ + if (!conn) + goto drop; + +@@ -7577,6 +7604,8 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) + break; + } + ++ l2cap_conn_put(conn); ++ + drop: + kfree_skb(skb); + } +-- +2.39.5 + diff --git a/queue-6.6/cifs-treat-unhandled-directory-name-surrogate-repars.patch b/queue-6.6/cifs-treat-unhandled-directory-name-surrogate-repars.patch new file mode 100644 index 0000000000..4f84880d97 --- /dev/null +++ b/queue-6.6/cifs-treat-unhandled-directory-name-surrogate-repars.patch @@ -0,0 +1,73 @@ +From 52c7aeefea10552a1333f64f104f281d098a70ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2024 00:28:25 +0200 +Subject: cifs: Treat unhandled directory name surrogate reparse points as + mount directory nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b587fd128660d48cd2122f870f720ff8e2b4abb3 ] + +If the reparse point was not handled (indicated by the -EOPNOTSUPP from +ops->parse_reparse_point() call) but reparse tag is of type name surrogate +directory type, then treat is as a new mount point. + +Name surrogate reparse point represents another named entity in the system. + +From SMB client point of view, this another entity is resolved on the SMB +server, and server serves its content automatically. Therefore from Linux +client point of view, this name surrogate reparse point of directory type +crosses mount point. + +Signed-off-by: Pali Rohár +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/inode.c | 13 +++++++++++++ + fs/smb/common/smbfsctl.h | 3 +++ + 2 files changed, 16 insertions(+) + +diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c +index dbb407d5e6dab..b9cf05e0940d0 100644 +--- a/fs/smb/client/inode.c ++++ b/fs/smb/client/inode.c +@@ -1132,6 +1132,19 @@ static int reparse_info_to_fattr(struct cifs_open_info_data *data, + rc = server->ops->parse_reparse_point(cifs_sb, + full_path, + iov, data); ++ /* ++ * If the reparse point was not handled but it is the ++ * name surrogate which points to directory, then treat ++ * is as a new mount point. Name surrogate reparse point ++ * represents another named entity in the system. ++ */ ++ if (rc == -EOPNOTSUPP && ++ IS_REPARSE_TAG_NAME_SURROGATE(data->reparse.tag) && ++ (le32_to_cpu(data->fi.Attributes) & ATTR_DIRECTORY)) { ++ rc = 0; ++ cifs_create_junction_fattr(fattr, sb); ++ goto out; ++ } + } + break; + } +diff --git a/fs/smb/common/smbfsctl.h b/fs/smb/common/smbfsctl.h +index a94d658b88e86..6eff3a8bde096 100644 +--- a/fs/smb/common/smbfsctl.h ++++ b/fs/smb/common/smbfsctl.h +@@ -158,6 +158,9 @@ + #define IO_REPARSE_TAG_LX_CHR 0x80000025 + #define IO_REPARSE_TAG_LX_BLK 0x80000026 + ++/* If Name Surrogate Bit is set, the file or directory represents another named entity in the system. */ ++#define IS_REPARSE_TAG_NAME_SURROGATE(tag) (!!((tag) & 0x20000000)) ++ + /* fsctl flags */ + /* If Flags is set to this value, the request is an FSCTL not ioctl request */ + #define SMB2_0_IOCTL_IS_FSCTL 0x00000001 +-- +2.39.5 + diff --git a/queue-6.6/drm-nouveau-do-not-override-forced-connector-status.patch b/queue-6.6/drm-nouveau-do-not-override-forced-connector-status.patch new file mode 100644 index 0000000000..b3bbb5e447 --- /dev/null +++ b/queue-6.6/drm-nouveau-do-not-override-forced-connector-status.patch @@ -0,0 +1,35 @@ +From e192563e11902e74ea121ed02cd1667e60e2319f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 10:57:25 +0100 +Subject: drm/nouveau: Do not override forced connector status + +From: Thomas Zimmermann + +[ Upstream commit 01f1d77a2630e774ce33233c4e6723bca3ae9daa ] + +Keep user-forced connector status even if it cannot be programmed. Same +behavior as for the rest of the drivers. + +Signed-off-by: Thomas Zimmermann +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20250114100214.195386-1-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_connector.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 22a125243d81f..c1985448d9b38 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -758,7 +758,6 @@ nouveau_connector_force(struct drm_connector *connector) + if (!nv_encoder) { + NV_ERROR(drm, "can't find encoder to force %s on!\n", + connector->name); +- connector->status = connector_status_disconnected; + return; + } + +-- +2.39.5 + diff --git a/queue-6.6/drm-vkms-round-fixp2int-conversion-in-lerp_u16.patch b/queue-6.6/drm-vkms-round-fixp2int-conversion-in-lerp_u16.patch new file mode 100644 index 0000000000..05229fa80b --- /dev/null +++ b/queue-6.6/drm-vkms-round-fixp2int-conversion-in-lerp_u16.patch @@ -0,0 +1,38 @@ +From 43da0b364c3d57a59b6ca95983d4d32d43703291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 21:33:08 -0700 +Subject: drm/vkms: Round fixp2int conversion in lerp_u16 + +From: Harry Wentland + +[ Upstream commit 8ec43c58d3be615a71548bc09148212013fb7e5f ] + +fixp2int always rounds down, fixp2int_ceil rounds up. We need +the new fixp2int_round. + +Signed-off-by: Alex Hung +Signed-off-by: Harry Wentland +Reviewed-by: Louis Chauvet +Link: https://patchwork.freedesktop.org/patch/msgid/20241220043410.416867-3-alex.hung@amd.com +Signed-off-by: Louis Chauvet +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_composer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c +index e7441b227b3ce..3d6785d081f2c 100644 +--- a/drivers/gpu/drm/vkms/vkms_composer.c ++++ b/drivers/gpu/drm/vkms/vkms_composer.c +@@ -98,7 +98,7 @@ static u16 lerp_u16(u16 a, u16 b, s64 t) + + s64 delta = drm_fixp_mul(b_fp - a_fp, t); + +- return drm_fixp2int(a_fp + delta); ++ return drm_fixp2int_round(a_fp + delta); + } + + static s64 get_lut_index(const struct vkms_color_lut *lut, u16 channel_value) +-- +2.39.5 + diff --git a/queue-6.6/fuse-don-t-truncate-cached-mutated-symlink.patch b/queue-6.6/fuse-don-t-truncate-cached-mutated-symlink.patch new file mode 100644 index 0000000000..1c0d6806b1 --- /dev/null +++ b/queue-6.6/fuse-don-t-truncate-cached-mutated-symlink.patch @@ -0,0 +1,119 @@ +From b8f4c54b788c9d4130f62e470cc656b4e4f16ef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2025 11:02:58 +0100 +Subject: fuse: don't truncate cached, mutated symlink + +From: Miklos Szeredi + +[ Upstream commit b4c173dfbb6c78568578ff18f9e8822d7bd0e31b ] + +Fuse allows the value of a symlink to change and this property is exploited +by some filesystems (e.g. CVMFS). + +It has been observed, that sometimes after changing the symlink contents, +the value is truncated to the old size. + +This is caused by fuse_getattr() racing with fuse_reverse_inval_inode(). +fuse_reverse_inval_inode() updates the fuse_inode's attr_version, which +results in fuse_change_attributes() exiting before updating the cached +attributes + +This is okay, as the cached attributes remain invalid and the next call to +fuse_change_attributes() will likely update the inode with the correct +values. + +The reason this causes problems is that cached symlinks will be +returned through page_get_link(), which truncates the symlink to +inode->i_size. This is correct for filesystems that don't mutate +symlinks, but in this case it causes bad behavior. + +The solution is to just remove this truncation. This can cause a +regression in a filesystem that relies on supplying a symlink larger than +the file size, but this is unlikely. If that happens we'd need to make +this behavior conditional. + +Reported-by: Laura Promberger +Tested-by: Sam Lewis +Signed-off-by: Miklos Szeredi +Link: https://lore.kernel.org/r/20250220100258.793363-1-mszeredi@redhat.com +Reviewed-by: Bernd Schubert +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/fuse/dir.c | 2 +- + fs/namei.c | 24 +++++++++++++++++++----- + include/linux/fs.h | 2 ++ + 3 files changed, 22 insertions(+), 6 deletions(-) + +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 95f9913a35373..89bffaed421fa 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1608,7 +1608,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode, + goto out_err; + + if (fc->cache_symlinks) +- return page_get_link(dentry, inode, callback); ++ return page_get_link_raw(dentry, inode, callback); + + err = -ECHILD; + if (!dentry) +diff --git a/fs/namei.c b/fs/namei.c +index beffbb02a24e6..155e4d09a5fb2 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -5154,10 +5154,9 @@ const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done) + EXPORT_SYMBOL(vfs_get_link); + + /* get the link contents into pagecache */ +-const char *page_get_link(struct dentry *dentry, struct inode *inode, +- struct delayed_call *callback) ++static char *__page_get_link(struct dentry *dentry, struct inode *inode, ++ struct delayed_call *callback) + { +- char *kaddr; + struct page *page; + struct address_space *mapping = inode->i_mapping; + +@@ -5176,8 +5175,23 @@ const char *page_get_link(struct dentry *dentry, struct inode *inode, + } + set_delayed_call(callback, page_put_link, page); + BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM); +- kaddr = page_address(page); +- nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); ++ return page_address(page); ++} ++ ++const char *page_get_link_raw(struct dentry *dentry, struct inode *inode, ++ struct delayed_call *callback) ++{ ++ return __page_get_link(dentry, inode, callback); ++} ++EXPORT_SYMBOL_GPL(page_get_link_raw); ++ ++const char *page_get_link(struct dentry *dentry, struct inode *inode, ++ struct delayed_call *callback) ++{ ++ char *kaddr = __page_get_link(dentry, inode, callback); ++ ++ if (!IS_ERR(kaddr)) ++ nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1); + return kaddr; + } + +diff --git a/include/linux/fs.h b/include/linux/fs.h +index e47596d354ff7..81edfa1e66b60 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3085,6 +3085,8 @@ extern const struct file_operations generic_ro_fops; + + extern int readlink_copy(char __user *, int, const char *); + extern int page_readlink(struct dentry *, char __user *, int); ++extern const char *page_get_link_raw(struct dentry *, struct inode *, ++ struct delayed_call *); + extern const char *page_get_link(struct dentry *, struct inode *, + struct delayed_call *); + extern void page_put_link(void *); +-- +2.39.5 + diff --git a/queue-6.6/hid-apple-fix-up-the-f6-key-on-the-omoton-kb066-keyb.patch b/queue-6.6/hid-apple-fix-up-the-f6-key-on-the-omoton-kb066-keyb.patch new file mode 100644 index 0000000000..34ab78d900 --- /dev/null +++ b/queue-6.6/hid-apple-fix-up-the-f6-key-on-the-omoton-kb066-keyb.patch @@ -0,0 +1,53 @@ +From 588df828416e261d652ddb4aaa8d9ae2950e7443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 23:12:17 -0700 +Subject: HID: apple: fix up the F6 key on the Omoton KB066 keyboard + +From: Alex Henrie + +[ Upstream commit 819083cb6eedcc8495cbf84845877bcc741b93b3 ] + +The Omoton KB066 is an Apple A1255 keyboard clone (HID product code +05ac:022c). On both keyboards, the F6 key becomes Num Lock when the Fn +key is held. But unlike its Apple exemplar, when the Omoton's F6 key is +pressed without Fn, it sends the usage code 0xC0301 from the reserved +section of the consumer page instead of the standard F6 usage code +0x7003F from the keyboard page. The nonstandard code is translated to +KEY_UNKNOWN and becomes useless on Linux. The Omoton KB066 is a pretty +popular keyboard, judging from its 29,058 reviews on Amazon at time of +writing, so let's account for its quirk to make it more usable. + +By the way, it would be nice if we could automatically set fnmode to 0 +for Omoton keyboards because they handle the Fn key internally and the +kernel's Fn key handling creates undesirable side effects such as making +F1 and F2 always Brightness Up and Brightness Down in fnmode=1 (the +default) or always F1 and F2 in fnmode=2. Unfortunately I don't think +there's a way to identify Bluetooth keyboards more specifically than the +HID product code which is obviously inaccurate. Users of Omoton +keyboards will just have to set fnmode to 0 manually to get full Fn key +functionality. + +Signed-off-by: Alex Henrie +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 9ff40f3b98064..9f3480ef524c1 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -531,6 +531,9 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, + } + } + ++ if (usage->hid == 0xc0301) /* Omoton KB066 quirk */ ++ code = KEY_F6; ++ + if (usage->code != code) { + input_event_with_scancode(input, usage->type, code, usage->hid, value); + +-- +2.39.5 + diff --git a/queue-6.6/hid-hid-apple-apple-magic-keyboard-a3203-usb-c-suppo.patch b/queue-6.6/hid-hid-apple-apple-magic-keyboard-a3203-usb-c-suppo.patch new file mode 100644 index 0000000000..a056ecd33b --- /dev/null +++ b/queue-6.6/hid-hid-apple-apple-magic-keyboard-a3203-usb-c-suppo.patch @@ -0,0 +1,59 @@ +From 2f31a8586a2f8446304da54a948b1985bc8b4f3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jan 2025 13:13:14 +0900 +Subject: HID: hid-apple: Apple Magic Keyboard a3203 USB-C support + +From: Ievgen Vovk + +[ Upstream commit 2813e00dcd748cef47d2bffaa04071de93fddf00 ] + +Add Apple Magic Keyboard 2024 model (with USB-C port) device ID (0320) +to those recognized by the hid-apple driver. Keyboard is otherwise +compatible with the existing implementation for its earlier 2021 model. + +Signed-off-by: Ievgen Vovk +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 5 +++++ + drivers/hid/hid-ids.h | 1 + + 2 files changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index d9e9829b22001..9ff40f3b98064 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -459,6 +459,7 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input, + hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2015) + table = magic_keyboard_2015_fn_keys; + else if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 || ++ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 || + hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 || + hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021) + table = apple2021_fn_keys; +@@ -1064,6 +1065,10 @@ static const struct hid_device_id apple_devices[] = { + .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, + { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021), + .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), ++ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, ++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024), ++ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021), + .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY }, + { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021), +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b807d01ecca6e..09090803f1dd2 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -184,6 +184,7 @@ + #define USB_DEVICE_ID_APPLE_IRCONTROL4 0x8242 + #define USB_DEVICE_ID_APPLE_IRCONTROL5 0x8243 + #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 0x029c ++#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 0x0320 + #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 0x029a + #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021 0x029f + #define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102 +-- +2.39.5 + diff --git a/queue-6.6/hid-ignore-non-functional-sensor-in-hp-5mp-camera.patch b/queue-6.6/hid-ignore-non-functional-sensor-in-hp-5mp-camera.patch new file mode 100644 index 0000000000..3e06ae2af9 --- /dev/null +++ b/queue-6.6/hid-ignore-non-functional-sensor-in-hp-5mp-camera.patch @@ -0,0 +1,56 @@ +From 5fbe1f6e659658cac4af06b3202fdfc539431be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 15:00:20 +0800 +Subject: HID: ignore non-functional sensor in HP 5MP Camera + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ] + +The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that +is not actually implemented. Attempting to access this non-functional +sensor via iio_info causes system hangs as runtime PM tries to wake up +an unresponsive sensor. + + [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff + [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff + +Add this device to the HID ignore list since the sensor interface is +non-functional by design and should not be exposed to userspace. + +Signed-off-by: Chia-Lin Kao (AceLan) +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 1174626904cb0..ff996accd371d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1085,6 +1085,7 @@ + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001 + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003 + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 ++#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473 + + #define I2C_VENDOR_ID_RAYDIUM 0x2386 + #define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index e0bbf0c6345d6..5d7a418ccdbec 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -891,6 +891,7 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) }, + #endif + { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) }, + { } + }; + +-- +2.39.5 + diff --git a/queue-6.6/hid-intel-ish-hid-fix-the-length-of-mng_sync_fw_cloc.patch b/queue-6.6/hid-intel-ish-hid-fix-the-length-of-mng_sync_fw_cloc.patch new file mode 100644 index 0000000000..feb0484911 --- /dev/null +++ b/queue-6.6/hid-intel-ish-hid-fix-the-length-of-mng_sync_fw_cloc.patch @@ -0,0 +1,56 @@ +From 6e42e87489522b4be9ac75d443612d5790f283ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 09:29:00 +0800 +Subject: HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell + +From: Zhang Lixu + +[ Upstream commit 4b54ae69197b9f416baa0fceadff7e89075f8454 ] + +The timestamps in the Firmware log and HID sensor samples are incorrect. +They show 1970-01-01 because the current IPC driver only uses the first +8 bytes of bootup time when synchronizing time with the firmware. The +firmware converts the bootup time to UTC time, which results in the +display of 1970-01-01. + +In write_ipc_from_queue(), when sending the MNG_SYNC_FW_CLOCK message, +the clock is updated according to the definition of ipc_time_update_msg. +However, in _ish_sync_fw_clock(), the message length is specified as the +size of uint64_t when building the doorbell. As a result, the firmware +only receives the first 8 bytes of struct ipc_time_update_msg. +This patch corrects the length in the doorbell to ensure the entire +ipc_time_update_msg is sent, fixing the timestamp issue. + +Signed-off-by: Zhang Lixu +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index dd5fc60874ba1..b1a41c90c5741 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -577,14 +577,14 @@ static void fw_reset_work_fn(struct work_struct *unused) + static void _ish_sync_fw_clock(struct ishtp_device *dev) + { + static unsigned long prev_sync; +- uint64_t usec; ++ struct ipc_time_update_msg time = {}; + + if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ)) + return; + + prev_sync = jiffies; +- usec = ktime_to_us(ktime_get_boottime()); +- ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &usec, sizeof(uint64_t)); ++ /* The fields of time would be updated while sending message */ ++ ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time)); + } + + /** +-- +2.39.5 + diff --git a/queue-6.6/hid-intel-ish-hid-send-clock-sync-message-immediatel.patch b/queue-6.6/hid-intel-ish-hid-send-clock-sync-message-immediatel.patch new file mode 100644 index 0000000000..3b04d7a47d --- /dev/null +++ b/queue-6.6/hid-intel-ish-hid-send-clock-sync-message-immediatel.patch @@ -0,0 +1,77 @@ +From a25edfb1980ed6365517308b9c0f76b5656312de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 09:29:01 +0800 +Subject: HID: intel-ish-hid: Send clock sync message immediately after reset + +From: Zhang Lixu + +[ Upstream commit 7e0d1cff12b895f44f4ddc8cf50311bc1f775201 ] + +The ISH driver performs a clock sync with the firmware once at system +startup and then every 20 seconds. If a firmware reset occurs right +after a clock sync, the driver would wait 20 seconds before performing +another clock sync with the firmware. This is particularly problematic +with the introduction of the "load firmware from host" feature, where +the driver performs a clock sync with the bootloader and then has to +wait 20 seconds before syncing with the main firmware. + +This patch clears prev_sync immediately upon receiving an IPC reset, +so that the main firmware and driver will perform a clock sync +immediately after completing the IPC handshake. + +Signed-off-by: Zhang Lixu +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++--- + drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 2 ++ + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index b1a41c90c5741..42141a78bdb4b 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -517,6 +517,10 @@ static int ish_fw_reset_handler(struct ishtp_device *dev) + /* ISH FW is dead */ + if (!ish_is_input_ready(dev)) + return -EPIPE; ++ ++ /* Send clock sync at once after reset */ ++ ishtp_dev->prev_sync = 0; ++ + /* + * Set HOST2ISH.ILUP. Apparently we need this BEFORE sending + * RESET_NOTIFY_ACK - FW will be checking for it +@@ -576,13 +580,12 @@ static void fw_reset_work_fn(struct work_struct *unused) + */ + static void _ish_sync_fw_clock(struct ishtp_device *dev) + { +- static unsigned long prev_sync; + struct ipc_time_update_msg time = {}; + +- if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ)) ++ if (dev->prev_sync && time_before(jiffies, dev->prev_sync + 20 * HZ)) + return; + +- prev_sync = jiffies; ++ dev->prev_sync = jiffies; + /* The fields of time would be updated while sending message */ + ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time)); + } +diff --git a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h +index 32142c7d9a043..9b2ee3fe04b8f 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h ++++ b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h +@@ -212,6 +212,8 @@ struct ishtp_device { + unsigned int ipc_tx_cnt; + unsigned long long ipc_tx_bytes_cnt; + ++ /* Time of the last clock sync */ ++ unsigned long prev_sync; + const struct ishtp_hw_ops *ops; + size_t mtu; + uint32_t ishtp_msg_hdr; +-- +2.39.5 + diff --git a/queue-6.6/hid-topre-fix-n-key-rollover-on-realforce-r3s-tkl-bo.patch b/queue-6.6/hid-topre-fix-n-key-rollover-on-realforce-r3s-tkl-bo.patch new file mode 100644 index 0000000000..ea29867857 --- /dev/null +++ b/queue-6.6/hid-topre-fix-n-key-rollover-on-realforce-r3s-tkl-bo.patch @@ -0,0 +1,79 @@ +From 6dc3c477c4cf115138c98c54d06fe78b0f074db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 20:08:49 -0500 +Subject: HID: topre: Fix n-key rollover on Realforce R3S TKL boards + +From: Daniel Brackenbury + +[ Upstream commit 9271af9d846c7e49c8709b58d5853cb73c00b193 ] + +Newer model R3* Topre Realforce keyboards share an issue with their older +R2 cousins where a report descriptor fixup is needed in order for n-key +rollover to work correctly, otherwise only 6-key rollover is available. +This patch adds some new hardware IDs for the R3S 87-key keyboard and +makes amendments to the existing hid-topre driver in order to change the +correct byte in the new model. + +Signed-off-by: Daniel Brackenbury +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/Kconfig | 3 ++- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-topre.c | 7 +++++++ + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 9e2cde55b465c..979ebe69c8e30 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -1151,7 +1151,8 @@ config HID_TOPRE + tristate "Topre REALFORCE keyboards" + depends on HID + help +- Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key keyboards. ++ Say Y for N-key rollover support on Topre REALFORCE R2 108/87 key and ++ Topre REALFORCE R3S 87 key keyboards. + + config HID_THINGM + tristate "ThingM blink(1) USB RGB LED" +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index ff996accd371d..b807d01ecca6e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1285,6 +1285,7 @@ + #define USB_VENDOR_ID_TOPRE 0x0853 + #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_108 0x0148 + #define USB_DEVICE_ID_TOPRE_REALFORCE_R2_87 0x0146 ++#define USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87 0x0313 + + #define USB_VENDOR_ID_TOPSEED 0x0766 + #define USB_DEVICE_ID_TOPSEED_CYBERLINK 0x0204 +diff --git a/drivers/hid/hid-topre.c b/drivers/hid/hid-topre.c +index d1d5ca310eadc..e69367267d841 100644 +--- a/drivers/hid/hid-topre.c ++++ b/drivers/hid/hid-topre.c +@@ -29,6 +29,11 @@ static __u8 *topre_report_fixup(struct hid_device *hdev, __u8 *rdesc, + hid_info(hdev, + "fixing up Topre REALFORCE keyboard report descriptor\n"); + rdesc[72] = 0x02; ++ } else if (*rsize >= 106 && rdesc[28] == 0x29 && rdesc[29] == 0xe7 && ++ rdesc[30] == 0x81 && rdesc[31] == 0x00) { ++ hid_info(hdev, ++ "fixing up Topre REALFORCE keyboard report descriptor\n"); ++ rdesc[31] = 0x02; + } + return rdesc; + } +@@ -38,6 +43,8 @@ static const struct hid_device_id topre_id_table[] = { + USB_DEVICE_ID_TOPRE_REALFORCE_R2_108) }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, + USB_DEVICE_ID_TOPRE_REALFORCE_R2_87) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_TOPRE, ++ USB_DEVICE_ID_TOPRE_REALFORCE_R3S_87) }, + { } + }; + MODULE_DEVICE_TABLE(hid, topre_id_table); +-- +2.39.5 + diff --git a/queue-6.6/hrtimers-mark-is_migration_base-with-__always_inline.patch b/queue-6.6/hrtimers-mark-is_migration_base-with-__always_inline.patch new file mode 100644 index 0000000000..91f756c342 --- /dev/null +++ b/queue-6.6/hrtimers-mark-is_migration_base-with-__always_inline.patch @@ -0,0 +1,79 @@ +From b7e09c5fd36669b9b494296641237942b11ffcf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 18:07:45 +0200 +Subject: hrtimers: Mark is_migration_base() with __always_inline + +From: Andy Shevchenko + +[ Upstream commit 27af31e44949fa85550176520ef7086a0d00fd7b ] + +When is_migration_base() is unused, it prevents kernel builds +with clang, `make W=1` and CONFIG_WERROR=y: + +kernel/time/hrtimer.c:156:20: error: unused function 'is_migration_base' [-Werror,-Wunused-function] + 156 | static inline bool is_migration_base(struct hrtimer_clock_base *base) + | ^~~~~~~~~~~~~~~~~ + +Fix this by marking it with __always_inline. + +[ tglx: Use __always_inline instead of __maybe_unused and move it into the + usage sites conditional ] + +Signed-off-by: Andy Shevchenko +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20250116160745.243358-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +--- + kernel/time/hrtimer.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 5db6912b8f6e1..877535b06e73a 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -145,11 +145,6 @@ static struct hrtimer_cpu_base migration_cpu_base = { + + #define migration_base migration_cpu_base.clock_base[0] + +-static inline bool is_migration_base(struct hrtimer_clock_base *base) +-{ +- return base == &migration_base; +-} +- + /* + * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock + * means that all timers which are tied to this base via timer->base are +@@ -275,11 +270,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, + + #else /* CONFIG_SMP */ + +-static inline bool is_migration_base(struct hrtimer_clock_base *base) +-{ +- return false; +-} +- + static inline struct hrtimer_clock_base * + lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags) + __acquires(&timer->base->cpu_base->lock) +@@ -1381,6 +1371,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base, + } + } + ++#ifdef CONFIG_SMP ++static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) ++{ ++ return base == &migration_base; ++} ++#else ++static __always_inline bool is_migration_base(struct hrtimer_clock_base *base) ++{ ++ return false; ++} ++#endif ++ + /* + * This function is called on PREEMPT_RT kernels when the fast path + * deletion of a timer failed because the timer callback function was +-- +2.39.5 + diff --git a/queue-6.6/io-wq-backoff-when-retrying-worker-creation.patch b/queue-6.6/io-wq-backoff-when-retrying-worker-creation.patch new file mode 100644 index 0000000000..997f6bcabc --- /dev/null +++ b/queue-6.6/io-wq-backoff-when-retrying-worker-creation.patch @@ -0,0 +1,193 @@ +From 1b52254cea2475fe9f3abf4b84559f255bda3ca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Feb 2025 13:42:13 -0700 +Subject: io-wq: backoff when retrying worker creation + +From: Uday Shankar + +[ Upstream commit 13918315c5dc5a515926c8799042ea6885c2b734 ] + +When io_uring submission goes async for the first time on a given task, +we'll try to create a worker thread to handle the submission. Creating +this worker thread can fail due to various transient conditions, such as +an outstanding signal in the forking thread, so we have retry logic with +a limit of 3 retries. However, this retry logic appears to be too +aggressive/fast - we've observed a thread blowing through the retry +limit while having the same outstanding signal the whole time. Here's an +excerpt of some tracing that demonstrates the issue: + +First, signal 26 is generated for the process. It ends up getting routed +to thread 92942. + + 0) cbd-92284 /* signal_generate: sig=26 errno=0 code=-2 comm=psblkdASD pid=92934 grp=1 res=0 */ + +This causes create_io_thread in the signalled thread to fail with +ERESTARTNOINTR, and thus a retry is queued. + +13) task_th-92942 /* io_uring_queue_async_work: ring 000000007325c9ae, request 0000000080c96d8e, user_data 0x0, opcode URING_CMD, flags 0x8240001, normal queue, work 000000006e96dd3f */ +13) task_th-92942 io_wq_enqueue() { +13) task_th-92942 _raw_spin_lock(); +13) task_th-92942 io_wq_activate_free_worker(); +13) task_th-92942 _raw_spin_lock(); +13) task_th-92942 create_io_worker() { +13) task_th-92942 __kmalloc_cache_noprof(); +13) task_th-92942 __init_swait_queue_head(); +13) task_th-92942 kprobe_ftrace_handler() { +13) task_th-92942 get_kprobe(); +13) task_th-92942 aggr_pre_handler() { +13) task_th-92942 pre_handler_kretprobe(); +13) task_th-92942 /* create_enter: (create_io_thread+0x0/0x50) fn=0xffffffff8172c0e0 arg=0xffff888996bb69c0 node=-1 */ +13) task_th-92942 } /* aggr_pre_handler */ +... +13) task_th-92942 } /* copy_process */ +13) task_th-92942 } /* create_io_thread */ +13) task_th-92942 kretprobe_rethook_handler() { +13) task_th-92942 /* create_exit: (create_io_worker+0x8a/0x1a0 <- create_io_thread) arg1=0xfffffffffffffdff */ +13) task_th-92942 } /* kretprobe_rethook_handler */ +13) task_th-92942 queue_work_on() { +... + +The CPU is then handed to a kworker to process the queued retry: + +------------------------------------------ + 13) task_th-92942 => kworker-54154 +------------------------------------------ +13) kworker-54154 io_workqueue_create() { +13) kworker-54154 io_queue_worker_create() { +13) kworker-54154 task_work_add() { +13) kworker-54154 wake_up_state() { +13) kworker-54154 try_to_wake_up() { +13) kworker-54154 _raw_spin_lock_irqsave(); +13) kworker-54154 _raw_spin_unlock_irqrestore(); +13) kworker-54154 } /* try_to_wake_up */ +13) kworker-54154 } /* wake_up_state */ +13) kworker-54154 kick_process(); +13) kworker-54154 } /* task_work_add */ +13) kworker-54154 } /* io_queue_worker_create */ +13) kworker-54154 } /* io_workqueue_create */ + +And then we immediately switch back to the original task to try creating +a worker again. This fails, because the original task still hasn't +handled its signal. + +----------------------------------------- + 13) kworker-54154 => task_th-92942 +------------------------------------------ +13) task_th-92942 create_worker_cont() { +13) task_th-92942 kprobe_ftrace_handler() { +13) task_th-92942 get_kprobe(); +13) task_th-92942 aggr_pre_handler() { +13) task_th-92942 pre_handler_kretprobe(); +13) task_th-92942 /* create_enter: (create_io_thread+0x0/0x50) fn=0xffffffff8172c0e0 arg=0xffff888996bb69c0 node=-1 */ +13) task_th-92942 } /* aggr_pre_handler */ +13) task_th-92942 } /* kprobe_ftrace_handler */ +13) task_th-92942 create_io_thread() { +13) task_th-92942 copy_process() { +13) task_th-92942 task_active_pid_ns(); +13) task_th-92942 _raw_spin_lock_irq(); +13) task_th-92942 recalc_sigpending(); +13) task_th-92942 _raw_spin_lock_irq(); +13) task_th-92942 } /* copy_process */ +13) task_th-92942 } /* create_io_thread */ +13) task_th-92942 kretprobe_rethook_handler() { +13) task_th-92942 /* create_exit: (create_worker_cont+0x35/0x1b0 <- create_io_thread) arg1=0xfffffffffffffdff */ +13) task_th-92942 } /* kretprobe_rethook_handler */ +13) task_th-92942 io_worker_release(); +13) task_th-92942 queue_work_on() { +13) task_th-92942 clear_pending_if_disabled(); +13) task_th-92942 __queue_work() { +13) task_th-92942 } /* __queue_work */ +13) task_th-92942 } /* queue_work_on */ +13) task_th-92942 } /* create_worker_cont */ + +The pattern repeats another couple times until we blow through the retry +counter, at which point we give up. All outstanding work is canceled, +and the io_uring command which triggered all this is failed with +ECANCELED: + +13) task_th-92942 io_acct_cancel_pending_work() { +... +13) task_th-92942 /* io_uring_complete: ring 000000007325c9ae, req 0000000080c96d8e, user_data 0x0, result -125, cflags 0x0 extra1 0 extra2 0 */ + +Finally, the task gets around to processing its outstanding signal 26, +but it's too late. + +13) task_th-92942 /* signal_deliver: sig=26 errno=0 code=-2 sa_handler=59566a0 sa_flags=14000000 */ + +Try to address this issue by adding a small scaling delay when retrying +worker creation. This should give the forking thread time to handle its +signal in the above case. This isn't a particularly satisfying solution, +as sufficiently paradoxical scheduling would still have us hitting the +same issue, and I'm open to suggestions for something better. But this +is likely to prevent this (already rare) issue from hitting in practice. + +Signed-off-by: Uday Shankar +Link: https://lore.kernel.org/r/20250208-wq_retry-v2-1-4f6f5041d303@purestorage.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io-wq.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c +index a1e31723c9ed6..93f3e4d1df853 100644 +--- a/io_uring/io-wq.c ++++ b/io_uring/io-wq.c +@@ -65,7 +65,7 @@ struct io_worker { + + union { + struct rcu_head rcu; +- struct work_struct work; ++ struct delayed_work work; + }; + }; + +@@ -771,6 +771,18 @@ static inline bool io_should_retry_thread(struct io_worker *worker, long err) + } + } + ++static void queue_create_worker_retry(struct io_worker *worker) ++{ ++ /* ++ * We only bother retrying because there's a chance that the ++ * failure to create a worker is due to some temporary condition ++ * in the forking task (e.g. outstanding signal); give the task ++ * some time to clear that condition. ++ */ ++ schedule_delayed_work(&worker->work, ++ msecs_to_jiffies(worker->init_retries * 5)); ++} ++ + static void create_worker_cont(struct callback_head *cb) + { + struct io_worker *worker; +@@ -810,12 +822,13 @@ static void create_worker_cont(struct callback_head *cb) + + /* re-create attempts grab a new worker ref, drop the existing one */ + io_worker_release(worker); +- schedule_work(&worker->work); ++ queue_create_worker_retry(worker); + } + + static void io_workqueue_create(struct work_struct *work) + { +- struct io_worker *worker = container_of(work, struct io_worker, work); ++ struct io_worker *worker = container_of(work, struct io_worker, ++ work.work); + struct io_wq_acct *acct = io_wq_get_acct(worker); + + if (!io_queue_worker_create(worker, acct, create_worker_cont)) +@@ -856,8 +869,8 @@ static bool create_io_worker(struct io_wq *wq, int index) + kfree(worker); + goto fail; + } else { +- INIT_WORK(&worker->work, io_workqueue_create); +- schedule_work(&worker->work); ++ INIT_DELAYED_WORK(&worker->work, io_workqueue_create); ++ queue_create_worker_retry(worker); + } + + return true; +-- +2.39.5 + diff --git a/queue-6.6/iscsi_ibft-fix-ubsan-shift-out-of-bounds-warning-in-.patch b/queue-6.6/iscsi_ibft-fix-ubsan-shift-out-of-bounds-warning-in-.patch new file mode 100644 index 0000000000..be2e18fcba --- /dev/null +++ b/queue-6.6/iscsi_ibft-fix-ubsan-shift-out-of-bounds-warning-in-.patch @@ -0,0 +1,42 @@ +From 7c9022d706b44183d30bc7d7eccbb8cf03160915 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 12:12:34 +0800 +Subject: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in + ibft_attr_show_nic() + +From: Chengen Du + +[ Upstream commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 ] + +When performing an iSCSI boot using IPv6, iscsistart still reads the +/sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix +length is 64, this causes the shift exponent to become negative, +triggering a UBSAN warning. As the concept of a subnet mask does not +apply to IPv6, the value is set to ~0 to suppress the warning message. + +Signed-off-by: Chengen Du +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Sasha Levin +--- + drivers/firmware/iscsi_ibft.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c +index 6e9788324fea5..371f24569b3b2 100644 +--- a/drivers/firmware/iscsi_ibft.c ++++ b/drivers/firmware/iscsi_ibft.c +@@ -310,7 +310,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) + str += sprintf_ipaddr(str, nic->ip_addr); + break; + case ISCSI_BOOT_ETH_SUBNET_MASK: +- val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); ++ if (nic->subnet_mask_prefix > 32) ++ val = cpu_to_be32(~0); ++ else ++ val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); + str += sprintf(str, "%pI4", &val); + break; + case ISCSI_BOOT_ETH_PREFIX_LEN: +-- +2.39.5 + diff --git a/queue-6.6/mptcp-safety-check-before-fallback.patch b/queue-6.6/mptcp-safety-check-before-fallback.patch new file mode 100644 index 0000000000..6715ac5948 --- /dev/null +++ b/queue-6.6/mptcp-safety-check-before-fallback.patch @@ -0,0 +1,41 @@ +From 3244876a29f0bf5bd4c2d138b89f92a848093f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2025 19:11:52 +0100 +Subject: mptcp: safety check before fallback + +From: Matthieu Baerts (NGI0) + +[ Upstream commit db75a16813aabae3b78c06b1b99f5e314c1f55d3 ] + +Recently, some fallback have been initiated, while the connection was +not supposed to fallback. + +Add a safety check with a warning to detect when an wrong attempt to +fallback is being done. This should help detecting any future issues +quicker. + +Acked-by: Paolo Abeni +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250224-net-mptcp-misc-fixes-v1-3-f550f636b435@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h +index 0bb0386aa0897..d67add91c9b90 100644 +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -1103,6 +1103,8 @@ static inline void __mptcp_do_fallback(struct mptcp_sock *msk) + pr_debug("TCP fallback already done (msk=%p)\n", msk); + return; + } ++ if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback))) ++ return; + set_bit(MPTCP_FALLBACK_DONE, &msk->flags); + } + +-- +2.39.5 + diff --git a/queue-6.6/net-handle-napi_schedule-calls-from-non-interrupt.patch b/queue-6.6/net-handle-napi_schedule-calls-from-non-interrupt.patch new file mode 100644 index 0000000000..35aa5af5e1 --- /dev/null +++ b/queue-6.6/net-handle-napi_schedule-calls-from-non-interrupt.patch @@ -0,0 +1,109 @@ +From a48a5a2fcb19b2cb4eb1ba24ccc0d6df4d5d3be7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2025 23:17:08 +0100 +Subject: net: Handle napi_schedule() calls from non-interrupt + +From: Frederic Weisbecker + +[ Upstream commit 77e45145e3039a0fb212556ab3f8c87f54771757 ] + +napi_schedule() is expected to be called either: + +* From an interrupt, where raised softirqs are handled on IRQ exit + +* From a softirq disabled section, where raised softirqs are handled on + the next call to local_bh_enable(). + +* From a softirq handler, where raised softirqs are handled on the next + round in do_softirq(), or further deferred to a dedicated kthread. + +Other bare tasks context may end up ignoring the raised NET_RX vector +until the next random softirq handling opportunity, which may not +happen before a while if the CPU goes idle afterwards with the tick +stopped. + +Such "misuses" have been detected on several places thanks to messages +of the kind: + + "NOHZ tick-stop error: local softirq work is pending, handler #08!!!" + +For example: + + __raise_softirq_irqoff + __napi_schedule + rtl8152_runtime_resume.isra.0 + rtl8152_resume + usb_resume_interface.isra.0 + usb_resume_both + __rpm_callback + rpm_callback + rpm_resume + __pm_runtime_resume + usb_autoresume_device + usb_remote_wakeup + hub_event + process_one_work + worker_thread + kthread + ret_from_fork + ret_from_fork_asm + +And also: + +* drivers/net/usb/r8152.c::rtl_work_func_t +* drivers/net/netdevsim/netdev.c::nsim_start_xmit + +There is a long history of issues of this kind: + + 019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()") + 330068589389 ("idpf: disable local BH when scheduling napi for marker packets") + e3d5d70cb483 ("net: lan78xx: fix "softirq work is pending" error") + e55c27ed9ccf ("mt76: mt7615: add missing bh-disable around rx napi schedule") + c0182aa98570 ("mt76: mt7915: add missing bh-disable around tx napi enable/schedule") + 970be1dff26d ("mt76: disable BH around napi_schedule() calls") + 019edd01d174 ("ath10k: sdio: Add missing BH locking around napi_schdule()") + 30bfec4fec59 ("can: rx-offload: can_rx_offload_threaded_irq_finish(): add new function to be called from threaded interrupt") + e63052a5dd3c ("mlx5e: add add missing BH locking around napi_schdule()") + 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule") + bd4ce941c8d5 ("mlx4: Invoke softirqs after napi_reschedule") + 8cf699ec849f ("mlx4: do not call napi_schedule() without care") + ec13ee80145c ("virtio_net: invoke softirqs after __napi_schedule") + +This shows that relying on the caller to arrange a proper context for +the softirqs to be handled while calling napi_schedule() is very fragile +and error prone. Also fixing them can also prove challenging if the +caller may be called from different kinds of contexts. + +Therefore fix this from napi_schedule() itself with waking up ksoftirqd +when softirqs are raised from task contexts. + +Reported-by: Paul Menzel +Reported-by: Jakub Kicinski +Reported-by: Francois Romieu +Closes: https://lore.kernel.org/lkml/354a2690-9bbf-4ccb-8769-fa94707a9340@molgen.mpg.de/ +Cc: Breno Leitao +Signed-off-by: Frederic Weisbecker +Reviewed-by: Eric Dumazet +Link: https://patch.msgid.link/20250223221708.27130-1-frederic@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 8c30cdcf05d4b..c31a7f7bedf3d 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4532,7 +4532,7 @@ static inline void ____napi_schedule(struct softnet_data *sd, + * we have to raise NET_RX_SOFTIRQ. + */ + if (!sd->in_net_rx_action) +- __raise_softirq_irqoff(NET_RX_SOFTIRQ); ++ raise_softirq_irqoff(NET_RX_SOFTIRQ); + } + + #ifdef CONFIG_RPS +-- +2.39.5 + diff --git a/queue-6.6/net-wwan-mhi_wwan_mbim-silence-sequence-number-glitc.patch b/queue-6.6/net-wwan-mhi_wwan_mbim-silence-sequence-number-glitc.patch new file mode 100644 index 0000000000..460cb92598 --- /dev/null +++ b/queue-6.6/net-wwan-mhi_wwan_mbim-silence-sequence-number-glitc.patch @@ -0,0 +1,61 @@ +From 09790e56e3b8e2d1599fe30c4620b46193c771bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 12:15:35 +0100 +Subject: net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors + +From: Stephan Gerhold + +[ Upstream commit 0d1fac6d26aff5df21bb4ec980d9b7a11c410b96 ] + +When using the Qualcomm X55 modem on the ThinkPad X13s, the kernel log is +constantly being filled with errors related to a "sequence number glitch", +e.g.: + + [ 1903.284538] sequence number glitch prev=16 curr=0 + [ 1913.812205] sequence number glitch prev=50 curr=0 + [ 1923.698219] sequence number glitch prev=142 curr=0 + [ 2029.248276] sequence number glitch prev=1555 curr=0 + [ 2046.333059] sequence number glitch prev=70 curr=0 + [ 2076.520067] sequence number glitch prev=272 curr=0 + [ 2158.704202] sequence number glitch prev=2655 curr=0 + [ 2218.530776] sequence number glitch prev=2349 curr=0 + [ 2225.579092] sequence number glitch prev=6 curr=0 + +Internet connectivity is working fine, so this error seems harmless. It +looks like modem does not preserve the sequence number when entering low +power state; the amount of errors depends on how actively the modem is +being used. + +A similar issue has also been seen on USB-based MBIM modems [1]. However, +in cdc_ncm.c the "sequence number glitch" message is a debug message +instead of an error. Apply the same to the mhi_wwan_mbim.c driver to +silence these errors when using the modem. + +[1]: https://lists.freedesktop.org/archives/libmbim-devel/2016-November/000781.html + +Signed-off-by: Stephan Gerhold +Reviewed-by: Loic Poulain +Acked-by: Manivannan Sadhasivam +Link: https://patch.msgid.link/20250212-mhi-wwan-mbim-sequence-glitch-v1-1-503735977cbd@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/mhi_wwan_mbim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c +index 3f72ae943b294..b1b2870a054ba 100644 +--- a/drivers/net/wwan/mhi_wwan_mbim.c ++++ b/drivers/net/wwan/mhi_wwan_mbim.c +@@ -209,7 +209,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *s + if (mbim->rx_seq + 1 != le16_to_cpu(nth16->wSequence) && + (mbim->rx_seq || le16_to_cpu(nth16->wSequence)) && + !(mbim->rx_seq == 0xffff && !le16_to_cpu(nth16->wSequence))) { +- net_err_ratelimited("sequence number glitch prev=%d curr=%d\n", ++ net_dbg_ratelimited("sequence number glitch prev=%d curr=%d\n", + mbim->rx_seq, le16_to_cpu(nth16->wSequence)); + } + mbim->rx_seq = le16_to_cpu(nth16->wSequence); +-- +2.39.5 + diff --git a/queue-6.6/nvme-fc-do-not-ignore-connectivity-loss-during-conne.patch b/queue-6.6/nvme-fc-do-not-ignore-connectivity-loss-during-conne.patch new file mode 100644 index 0000000000..75e8e37746 --- /dev/null +++ b/queue-6.6/nvme-fc-do-not-ignore-connectivity-loss-during-conne.patch @@ -0,0 +1,113 @@ +From 3d64dfd435005d2c2c83f63c93dacacb4353c1e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 14:30:49 +0100 +Subject: nvme-fc: do not ignore connectivity loss during connecting + +From: Daniel Wagner + +[ Upstream commit ee59e3820ca92a9f4307ae23dfc7229dc8b8d400 ] + +When a connectivity loss occurs while nvme_fc_create_assocation is +being executed, it's possible that the ctrl ends up stuck in the LIVE +state: + + 1) nvme nvme10: NVME-FC{10}: create association : ... + 2) nvme nvme10: NVME-FC{10}: controller connectivity lost. + Awaiting Reconnect + nvme nvme10: queue_size 128 > ctrl maxcmd 32, reducing to maxcmd + 3) nvme nvme10: Could not set queue count (880) + nvme nvme10: Failed to configure AEN (cfg 900) + 4) nvme nvme10: NVME-FC{10}: controller connect complete + 5) nvme nvme10: failed nvme_keep_alive_end_io error=4 + +A connection attempt starts 1) and the ctrl is in state CONNECTING. +Shortly after the LLDD driver detects a connection lost event and calls +nvme_fc_ctrl_connectivity_loss 2). Because we are still in CONNECTING +state, this event is ignored. + +nvme_fc_create_association continues to run in parallel and tries to +communicate with the controller and these commands will fail. Though +these errors are filtered out, e.g in 3) setting the I/O queues numbers +fails which leads to an early exit in nvme_fc_create_io_queues. Because +the number of IO queues is 0 at this point, there is nothing left in +nvme_fc_create_association which could detected the connection drop. +Thus the ctrl enters LIVE state 4). + +Eventually the keep alive handler times out 5) but because nothing is +being done, the ctrl stays in LIVE state. + +There is already the ASSOC_FAILED flag to track connectivity loss event +but this bit is set too late in the recovery code path. Move this into +the connectivity loss event handler and synchronize it with the state +change. This ensures that the ASSOC_FAILED flag is seen by +nvme_fc_create_io_queues and it does not enter the LIVE state after a +connectivity loss event. If the connectivity loss event happens after we +entered the LIVE state the normal error recovery path is executed. + +Signed-off-by: Daniel Wagner +Reviewed-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 0641050f590f3..66c4c411ebe04 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -782,11 +782,19 @@ nvme_fc_abort_lsops(struct nvme_fc_rport *rport) + static void + nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl) + { ++ enum nvme_ctrl_state state; ++ unsigned long flags; ++ + dev_info(ctrl->ctrl.device, + "NVME-FC{%d}: controller connectivity lost. Awaiting " + "Reconnect", ctrl->cnum); + +- switch (nvme_ctrl_state(&ctrl->ctrl)) { ++ spin_lock_irqsave(&ctrl->lock, flags); ++ set_bit(ASSOC_FAILED, &ctrl->flags); ++ state = nvme_ctrl_state(&ctrl->ctrl); ++ spin_unlock_irqrestore(&ctrl->lock, flags); ++ ++ switch (state) { + case NVME_CTRL_NEW: + case NVME_CTRL_LIVE: + /* +@@ -2546,7 +2554,6 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg) + */ + if (state == NVME_CTRL_CONNECTING) { + __nvme_fc_abort_outstanding_ios(ctrl, true); +- set_bit(ASSOC_FAILED, &ctrl->flags); + dev_warn(ctrl->ctrl.device, + "NVME-FC{%d}: transport error during (re)connect\n", + ctrl->cnum); +@@ -3168,12 +3175,18 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl) + else + ret = nvme_fc_recreate_io_queues(ctrl); + } +- if (!ret && test_bit(ASSOC_FAILED, &ctrl->flags)) +- ret = -EIO; + if (ret) + goto out_term_aen_ops; + +- changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); ++ spin_lock_irqsave(&ctrl->lock, flags); ++ if (!test_bit(ASSOC_FAILED, &ctrl->flags)) ++ changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE); ++ else ++ ret = -EIO; ++ spin_unlock_irqrestore(&ctrl->lock, flags); ++ ++ if (ret) ++ goto out_term_aen_ops; + + ctrl->ctrl.nr_reconnects = 0; + +-- +2.39.5 + diff --git a/queue-6.6/nvme-fc-go-straight-to-connecting-state-when-initial.patch b/queue-6.6/nvme-fc-go-straight-to-connecting-state-when-initial.patch new file mode 100644 index 0000000000..1fe43c29cb --- /dev/null +++ b/queue-6.6/nvme-fc-go-straight-to-connecting-state-when-initial.patch @@ -0,0 +1,43 @@ +From 57c0b52d67e4d2cd1010e0c28da8f93d98b215ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 14:30:47 +0100 +Subject: nvme-fc: go straight to connecting state when initializing + +From: Daniel Wagner + +[ Upstream commit d3d380eded7ee5fc2fc53b3b0e72365ded025c4a ] + +The initial controller initialization mimiks the reconnect loop +behavior by switching from NEW to RESETTING and then to CONNECTING. + +The transition from NEW to CONNECTING is a valid transition, so there is +no point entering the RESETTING state. TCP and RDMA also transition +directly to CONNECTING state. + +Reviewed-by: Sagi Grimberg +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 91324791a5b66..0641050f590f3 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -3553,8 +3553,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + list_add_tail(&ctrl->ctrl_list, &rport->ctrl_list); + spin_unlock_irqrestore(&rport->lock, flags); + +- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING) || +- !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { ++ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { + dev_err(ctrl->ctrl.device, + "NVME-FC{%d}: failed to init ctrl state\n", ctrl->cnum); + goto fail_ctrl; +-- +2.39.5 + diff --git a/queue-6.6/nvme-only-allow-entering-live-from-connecting-state.patch b/queue-6.6/nvme-only-allow-entering-live-from-connecting-state.patch new file mode 100644 index 0000000000..4a25faada3 --- /dev/null +++ b/queue-6.6/nvme-only-allow-entering-live-from-connecting-state.patch @@ -0,0 +1,38 @@ +From 2895b270880a928e33757fd16c22dfa5016f7787 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 09:02:03 +0100 +Subject: nvme: only allow entering LIVE from CONNECTING state + +From: Daniel Wagner + +[ Upstream commit d2fe192348f93fe3a0cb1e33e4aba58e646397f4 ] + +The fabric transports and also the PCI transport are not entering the +LIVE state from NEW or RESETTING. This makes the state machine more +restrictive and allows to catch not supported state transitions, e.g. +directly switching from RESETTING to LIVE. + +Reviewed-by: Sagi Grimberg +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 8a200931bc297..f00665ad0c11a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -503,8 +503,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + switch (new_state) { + case NVME_CTRL_LIVE: + switch (old_state) { +- case NVME_CTRL_NEW: +- case NVME_CTRL_RESETTING: + case NVME_CTRL_CONNECTING: + changed = true; + fallthrough; +-- +2.39.5 + diff --git a/queue-6.6/nvme-pci-quirk-acer-fa100-for-non-uniqueue-identifie.patch b/queue-6.6/nvme-pci-quirk-acer-fa100-for-non-uniqueue-identifie.patch new file mode 100644 index 0000000000..8f0350cd4a --- /dev/null +++ b/queue-6.6/nvme-pci-quirk-acer-fa100-for-non-uniqueue-identifie.patch @@ -0,0 +1,86 @@ +From 75b5d317bf892c052c34cb376171a28b335ce4fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 08:59:29 -0500 +Subject: nvme-pci: quirk Acer FA100 for non-uniqueue identifiers + +From: Christopher Lentocha + +[ Upstream commit fcd875445866a5219cf2be3101e276b21fc843f3 ] + +In order for two Acer FA100 SSDs to work in one PC (in the case of +myself, a Lenovo Legion T5 28IMB05), and not show one drive and not +the other, and sometimes mix up what drive shows up (randomly), these +two lines of code need to be added, and then both of the SSDs will +show up and not conflict when booting off of one of them. If you boot +up your computer with both SSDs installed without this patch, you may +also randomly get into a kernel panic (if the initrd is not set up) or +stuck in the initrd "/init" process, it is set up, however, if you do +apply this patch, there should not be problems with booting or seeing +both contents of the drive. Tested with the btrfs filesystem with a +RAID configuration of having the root drive '/' combined to make two +256GB Acer FA100 SSDs become 512GB in total storage. + +Kernel Logs with patch applied (`dmesg -t | grep -i nvm`): + +``` +... +nvme 0000:04:00.0: platform quirk: setting simple suspend +nvme nvme0: pci function 0000:04:00.0 +nvme 0000:05:00.0: platform quirk: setting simple suspend +nvme nvme1: pci function 0000:05:00.0 +nvme nvme1: missing or invalid SUBNQN field. +nvme nvme1: allocated 64 MiB host memory buffer. +nvme nvme0: missing or invalid SUBNQN field. +nvme nvme0: allocated 64 MiB host memory buffer. +nvme nvme1: 8/0/0 default/read/poll queues +nvme nvme1: Ignoring bogus Namespace Identifiers +nvme nvme0: 8/0/0 default/read/poll queues +nvme nvme0: Ignoring bogus Namespace Identifiers +nvme0n1: p1 p2 +... +``` + +Kernel Logs with patch not applied (`dmesg -t | grep -i nvm`): + +``` +... +nvme 0000:04:00.0: platform quirk: setting simple suspend +nvme nvme0: pci function 0000:04:00.0 +nvme 0000:05:00.0: platform quirk: setting simple suspend +nvme nvme1: pci function 0000:05:00.0 +nvme nvme0: missing or invalid SUBNQN field. +nvme nvme1: missing or invalid SUBNQN field. +nvme nvme0: allocated 64 MiB host memory buffer. +nvme nvme1: allocated 64 MiB host memory buffer. +nvme nvme0: 8/0/0 default/read/poll queues +nvme nvme1: 8/0/0 default/read/poll queues +nvme nvme1: globally duplicate IDs for nsid 1 +nvme nvme1: VID:DID 1dbe:5216 model:Acer SSD FA100 256GB firmware:1.Z.J.2X +nvme0n1: p1 p2 +... +``` + +Signed-off-by: Christopher Lentocha +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index b1310e69d07da..a36ec6df6624b 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3509,6 +3509,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1cc1, 0x5350), /* ADATA XPG GAMMIX S50 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ { PCI_DEVICE(0x1dbe, 0x5216), /* Acer/INNOGRIT FA100/5216 NVMe SSD */ ++ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1dbe, 0x5236), /* ADATA XPG GAMMIX S70 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1e49, 0x0021), /* ZHITAI TiPro5000 NVMe SSD */ +-- +2.39.5 + diff --git a/queue-6.6/nvme-tcp-add-basic-support-for-the-c2htermreq-pdu.patch b/queue-6.6/nvme-tcp-add-basic-support-for-the-c2htermreq-pdu.patch new file mode 100644 index 0000000000..aec87a51c9 --- /dev/null +++ b/queue-6.6/nvme-tcp-add-basic-support-for-the-c2htermreq-pdu.patch @@ -0,0 +1,103 @@ +From 5902c5e9cdf0568db63c003481f1b9da3baeca68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Feb 2025 17:08:27 +0100 +Subject: nvme-tcp: add basic support for the C2HTermReq PDU + +From: Maurizio Lombardi + +[ Upstream commit 84e009042d0f3dfe91bec60bcd208ee3f866cbcd ] + +Previously, the NVMe/TCP host driver did not handle the C2HTermReq PDU, +instead printing "unsupported pdu type (3)" when received. This patch adds +support for processing the C2HTermReq PDU, allowing the driver +to print the Fatal Error Status field. + +Example of output: +nvme nvme4: Received C2HTermReq (FES = Invalid PDU Header Field) + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 43 ++++++++++++++++++++++++++++++++++++++++ + include/linux/nvme-tcp.h | 2 ++ + 2 files changed, 45 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index be04c5f3856d2..83366a8f0f916 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -707,6 +707,40 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, + return 0; + } + ++static void nvme_tcp_handle_c2h_term(struct nvme_tcp_queue *queue, ++ struct nvme_tcp_term_pdu *pdu) ++{ ++ u16 fes; ++ const char *msg; ++ u32 plen = le32_to_cpu(pdu->hdr.plen); ++ ++ static const char * const msg_table[] = { ++ [NVME_TCP_FES_INVALID_PDU_HDR] = "Invalid PDU Header Field", ++ [NVME_TCP_FES_PDU_SEQ_ERR] = "PDU Sequence Error", ++ [NVME_TCP_FES_HDR_DIGEST_ERR] = "Header Digest Error", ++ [NVME_TCP_FES_DATA_OUT_OF_RANGE] = "Data Transfer Out Of Range", ++ [NVME_TCP_FES_R2T_LIMIT_EXCEEDED] = "R2T Limit Exceeded", ++ [NVME_TCP_FES_UNSUPPORTED_PARAM] = "Unsupported Parameter", ++ }; ++ ++ if (plen < NVME_TCP_MIN_C2HTERM_PLEN || ++ plen > NVME_TCP_MAX_C2HTERM_PLEN) { ++ dev_err(queue->ctrl->ctrl.device, ++ "Received a malformed C2HTermReq PDU (plen = %u)\n", ++ plen); ++ return; ++ } ++ ++ fes = le16_to_cpu(pdu->fes); ++ if (fes && fes < ARRAY_SIZE(msg_table)) ++ msg = msg_table[fes]; ++ else ++ msg = "Unknown"; ++ ++ dev_err(queue->ctrl->ctrl.device, ++ "Received C2HTermReq (FES = %s)\n", msg); ++} ++ + static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, + unsigned int *offset, size_t *len) + { +@@ -728,6 +762,15 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, + return 0; + + hdr = queue->pdu; ++ if (unlikely(hdr->type == nvme_tcp_c2h_term)) { ++ /* ++ * C2HTermReq never includes Header or Data digests. ++ * Skip the checks. ++ */ ++ nvme_tcp_handle_c2h_term(queue, (void *)queue->pdu); ++ return -EINVAL; ++ } ++ + if (queue->hdr_digest) { + ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); + if (unlikely(ret)) +diff --git a/include/linux/nvme-tcp.h b/include/linux/nvme-tcp.h +index e07e8978d691b..e435250fcb4d0 100644 +--- a/include/linux/nvme-tcp.h ++++ b/include/linux/nvme-tcp.h +@@ -13,6 +13,8 @@ + #define NVME_TCP_ADMIN_CCSZ SZ_8K + #define NVME_TCP_DIGEST_LENGTH 4 + #define NVME_TCP_MIN_MAXH2CDATA 4096 ++#define NVME_TCP_MIN_C2HTERM_PLEN 24 ++#define NVME_TCP_MAX_C2HTERM_PLEN 152 + + enum nvme_tcp_pfv { + NVME_TCP_PFV_1_0 = 0x0, +-- +2.39.5 + diff --git a/queue-6.6/nvmet-rdma-recheck-queue-state-is-live-in-state-lock.patch b/queue-6.6/nvmet-rdma-recheck-queue-state-is-live-in-state-lock.patch new file mode 100644 index 0000000000..d42c2ba0ba --- /dev/null +++ b/queue-6.6/nvmet-rdma-recheck-queue-state-is-live-in-state-lock.patch @@ -0,0 +1,79 @@ +From f42d8f8ea19cca21dfae1ab9f4e676ed07952688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Feb 2025 20:49:56 +0800 +Subject: nvmet-rdma: recheck queue state is LIVE in state lock in recv done + +From: Ruozhu Li + +[ Upstream commit 3988ac1c67e6e84d2feb987d7b36d5791174b3da ] + +The queue state checking in nvmet_rdma_recv_done is not in queue state +lock.Queue state can transfer to LIVE in cm establish handler between +state checking and state lock here, cause a silent drop of nvme connect +cmd. +Recheck queue state whether in LIVE state in state lock to prevent this +issue. + +Signed-off-by: Ruozhu Li +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/rdma.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c +index a6d55ebb82382..298c46834a539 100644 +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -997,6 +997,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue, + nvmet_req_complete(&cmd->req, status); + } + ++static bool nvmet_rdma_recv_not_live(struct nvmet_rdma_queue *queue, ++ struct nvmet_rdma_rsp *rsp) ++{ ++ unsigned long flags; ++ bool ret = true; ++ ++ spin_lock_irqsave(&queue->state_lock, flags); ++ /* ++ * recheck queue state is not live to prevent a race condition ++ * with RDMA_CM_EVENT_ESTABLISHED handler. ++ */ ++ if (queue->state == NVMET_RDMA_Q_LIVE) ++ ret = false; ++ else if (queue->state == NVMET_RDMA_Q_CONNECTING) ++ list_add_tail(&rsp->wait_list, &queue->rsp_wait_list); ++ else ++ nvmet_rdma_put_rsp(rsp); ++ spin_unlock_irqrestore(&queue->state_lock, flags); ++ return ret; ++} ++ + static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) + { + struct nvmet_rdma_cmd *cmd = +@@ -1038,17 +1059,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc) + rsp->req.port = queue->port; + rsp->n_rdma = 0; + +- if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) { +- unsigned long flags; +- +- spin_lock_irqsave(&queue->state_lock, flags); +- if (queue->state == NVMET_RDMA_Q_CONNECTING) +- list_add_tail(&rsp->wait_list, &queue->rsp_wait_list); +- else +- nvmet_rdma_put_rsp(rsp); +- spin_unlock_irqrestore(&queue->state_lock, flags); ++ if (unlikely(queue->state != NVMET_RDMA_Q_LIVE) && ++ nvmet_rdma_recv_not_live(queue, rsp)) + return; +- } + + nvmet_rdma_handle_command(queue, rsp); + } +-- +2.39.5 + diff --git a/queue-6.6/objtool-ignore-dangling-jump-table-entries.patch b/queue-6.6/objtool-ignore-dangling-jump-table-entries.patch new file mode 100644 index 0000000000..088297c09c --- /dev/null +++ b/queue-6.6/objtool-ignore-dangling-jump-table-entries.patch @@ -0,0 +1,52 @@ +From 26783dec14c6ddc552ba393c8cf26204d52967d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 13:57:58 -0800 +Subject: objtool: Ignore dangling jump table entries + +From: Josh Poimboeuf + +[ Upstream commit 3724062ca2b1364f02cf44dbea1a552227844ad1 ] + +Clang sometimes leaves dangling unused jump table entries which point to +the end of the function. Ignore them. + +Closes: https://lore.kernel.org/20250113235835.vqgvb7cdspksy5dn@jpoimboe +Reported-by: Klaus Kusche +Signed-off-by: Josh Poimboeuf +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/ee25c0b7e80113e950bd1d4c208b671d35774ff4.1736891751.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 1b242c3c2d451..6e59e7f578ffe 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -2028,6 +2028,14 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, + reloc_addend(reloc) == pfunc->offset) + break; + ++ /* ++ * Clang sometimes leaves dangling unused jump table entries ++ * which point to the end of the function. Ignore them. ++ */ ++ if (reloc->sym->sec == pfunc->sec && ++ reloc_addend(reloc) == pfunc->offset + pfunc->len) ++ goto next; ++ + dest_insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc)); + if (!dest_insn) + break; +@@ -2045,6 +2053,7 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn, + alt->insn = dest_insn; + alt->next = insn->alts; + insn->alts = alt; ++next: + prev_offset = reloc_offset(reloc); + } + +-- +2.39.5 + diff --git a/queue-6.6/perf-x86-intel-use-better-start-period-for-frequency.patch b/queue-6.6/perf-x86-intel-use-better-start-period-for-frequency.patch new file mode 100644 index 0000000000..e2a5dd6d0a --- /dev/null +++ b/queue-6.6/perf-x86-intel-use-better-start-period-for-frequency.patch @@ -0,0 +1,150 @@ +From 46fda7490e73952430e77173e927f9a2ffd18eed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2025 07:19:13 -0800 +Subject: perf/x86/intel: Use better start period for frequency mode + +From: Kan Liang + +[ Upstream commit a26b24b2e21f6222635a95426b9ef9eec63d69b1 ] + +Freqency mode is the current default mode of Linux perf. A period of 1 is +used as a starting period. The period is auto-adjusted on each tick or an +overflow, to meet the frequency target. + +The start period of 1 is too low and may trigger some issues: + +- Many HWs do not support period 1 well. + https://lore.kernel.org/lkml/875xs2oh69.ffs@tglx/ + +- For an event that occurs frequently, period 1 is too far away from the + real period. Lots of samples are generated at the beginning. + The distribution of samples may not be even. + +- A low starting period for frequently occurring events also challenges + virtualization, which has a longer path to handle a PMI. + +The limit_period value only checks the minimum acceptable value for HW. +It cannot be used to set the start period, because some events may +need a very low period. The limit_period cannot be set too high. It +doesn't help with the events that occur frequently. + +It's hard to find a universal starting period for all events. The idea +implemented by this patch is to only give an estimate for the popular +HW and HW cache events. For the rest of the events, start from the lowest +possible recommended value. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250117151913.3043942-3-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/core.c | 85 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 85 insertions(+) + +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 61ac094e26bd7..b163817ad6daf 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3881,6 +3881,85 @@ static inline bool intel_pmu_has_cap(struct perf_event *event, int idx) + return test_bit(idx, (unsigned long *)&intel_cap->capabilities); + } + ++static u64 intel_pmu_freq_start_period(struct perf_event *event) ++{ ++ int type = event->attr.type; ++ u64 config, factor; ++ s64 start; ++ ++ /* ++ * The 127 is the lowest possible recommended SAV (sample after value) ++ * for a 4000 freq (default freq), according to the event list JSON file. ++ * Also, assume the workload is idle 50% time. ++ */ ++ factor = 64 * 4000; ++ if (type != PERF_TYPE_HARDWARE && type != PERF_TYPE_HW_CACHE) ++ goto end; ++ ++ /* ++ * The estimation of the start period in the freq mode is ++ * based on the below assumption. ++ * ++ * For a cycles or an instructions event, 1GHZ of the ++ * underlying platform, 1 IPC. The workload is idle 50% time. ++ * The start period = 1,000,000,000 * 1 / freq / 2. ++ * = 500,000,000 / freq ++ * ++ * Usually, the branch-related events occur less than the ++ * instructions event. According to the Intel event list JSON ++ * file, the SAV (sample after value) of a branch-related event ++ * is usually 1/4 of an instruction event. ++ * The start period of branch-related events = 125,000,000 / freq. ++ * ++ * The cache-related events occurs even less. The SAV is usually ++ * 1/20 of an instruction event. ++ * The start period of cache-related events = 25,000,000 / freq. ++ */ ++ config = event->attr.config & PERF_HW_EVENT_MASK; ++ if (type == PERF_TYPE_HARDWARE) { ++ switch (config) { ++ case PERF_COUNT_HW_CPU_CYCLES: ++ case PERF_COUNT_HW_INSTRUCTIONS: ++ case PERF_COUNT_HW_BUS_CYCLES: ++ case PERF_COUNT_HW_STALLED_CYCLES_FRONTEND: ++ case PERF_COUNT_HW_STALLED_CYCLES_BACKEND: ++ case PERF_COUNT_HW_REF_CPU_CYCLES: ++ factor = 500000000; ++ break; ++ case PERF_COUNT_HW_BRANCH_INSTRUCTIONS: ++ case PERF_COUNT_HW_BRANCH_MISSES: ++ factor = 125000000; ++ break; ++ case PERF_COUNT_HW_CACHE_REFERENCES: ++ case PERF_COUNT_HW_CACHE_MISSES: ++ factor = 25000000; ++ break; ++ default: ++ goto end; ++ } ++ } ++ ++ if (type == PERF_TYPE_HW_CACHE) ++ factor = 25000000; ++end: ++ /* ++ * Usually, a prime or a number with less factors (close to prime) ++ * is chosen as an SAV, which makes it less likely that the sampling ++ * period synchronizes with some periodic event in the workload. ++ * Minus 1 to make it at least avoiding values near power of twos ++ * for the default freq. ++ */ ++ start = DIV_ROUND_UP_ULL(factor, event->attr.sample_freq) - 1; ++ ++ if (start > x86_pmu.max_period) ++ start = x86_pmu.max_period; ++ ++ if (x86_pmu.limit_period) ++ x86_pmu.limit_period(event, &start); ++ ++ return start; ++} ++ + static int intel_pmu_hw_config(struct perf_event *event) + { + int ret = x86_pmu_hw_config(event); +@@ -3892,6 +3971,12 @@ static int intel_pmu_hw_config(struct perf_event *event) + if (ret) + return ret; + ++ if (event->attr.freq && event->attr.sample_freq) { ++ event->hw.sample_period = intel_pmu_freq_start_period(event); ++ event->hw.last_period = event->hw.sample_period; ++ local64_set(&event->hw.period_left, event->hw.sample_period); ++ } ++ + if (event->attr.precise_ip) { + if ((event->attr.config & INTEL_ARCH_EVENT_MASK) == INTEL_FIXED_VLBR_EVENT) + return -EINVAL; +-- +2.39.5 + diff --git a/queue-6.6/platform-x86-intel-pmc-fix-ltr-decode-in-pmc_core_lt.patch b/queue-6.6/platform-x86-intel-pmc-fix-ltr-decode-in-pmc_core_lt.patch new file mode 100644 index 0000000000..2aa3369c43 --- /dev/null +++ b/queue-6.6/platform-x86-intel-pmc-fix-ltr-decode-in-pmc_core_lt.patch @@ -0,0 +1,47 @@ +From e9cae873b7c79559b69a650734e9e3d2366500b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jan 2025 01:07:39 +0300 +Subject: platform/x86/intel: pmc: fix ltr decode in pmc_core_ltr_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Kandybka + +[ Upstream commit 583ef25bb2a094813351a727ddec38b35a15b9f8 ] + +In pmc_core_ltr_show(), promote 'val' to 'u64' to avoid possible integer +overflow. Values (10 bit) are multiplied by the scale, the result of +expression is in a range from 1 to 34,326,183,936 which is bigger then +UINT32_MAX. Compile tested only. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Kandybka +Reviewed-by: Rajneesh Bhardwaj +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20250123220739.68087-1-d.kandybka@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmc/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c +index 022afb97d531c..2fb73e924bd64 100644 +--- a/drivers/platform/x86/intel/pmc/core.c ++++ b/drivers/platform/x86/intel/pmc/core.c +@@ -620,8 +620,8 @@ static u32 convert_ltr_scale(u32 val) + static int pmc_core_ltr_show(struct seq_file *s, void *unused) + { + struct pmc_dev *pmcdev = s->private; +- u64 decoded_snoop_ltr, decoded_non_snoop_ltr; +- u32 ltr_raw_data, scale, val; ++ u64 decoded_snoop_ltr, decoded_non_snoop_ltr, val; ++ u32 ltr_raw_data, scale; + u16 snoop_ltr, nonsnoop_ltr; + int i, index, ltr_index = 0; + +-- +2.39.5 + diff --git a/queue-6.6/platform-x86-thinkpad_acpi-fix-invalid-fan-speed-on-.patch b/queue-6.6/platform-x86-thinkpad_acpi-fix-invalid-fan-speed-on-.patch new file mode 100644 index 0000000000..2c3eb4ac43 --- /dev/null +++ b/queue-6.6/platform-x86-thinkpad_acpi-fix-invalid-fan-speed-on-.patch @@ -0,0 +1,106 @@ +From 2a6fb58e0c7bf4163ff20649a129f7be45f9b951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2025 16:33:15 +0000 +Subject: platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sybil Isabel Dorsett + +[ Upstream commit 1046cac109225eda0973b898e053aeb3d6c10e1d ] + +On ThinkPad X120e, fan speed is reported in ticks per revolution +rather than RPM. + +Recalculate the fan speed value reported for ThinkPad X120e +to RPM based on a 22.5 kHz clock. + +Based on the information on +https://www.thinkwiki.org/wiki/How_to_control_fan_speed, +the same problem is highly likely to be relevant to at least Edge11, +but Edge11 is not addressed in this patch. + +Signed-off-by: Sybil Isabel Dorsett +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20250203163255.5525-1-sybdorsett@proton.me +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 692bd6fea3744..b11f5ac658e01 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -7961,6 +7961,7 @@ static struct ibm_struct volume_driver_data = { + + #define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */ + #define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */ ++#define FAN_CLOCK_TPM (22500*60) /* Ticks per minute for a 22.5 kHz clock */ + + enum { /* Fan control constants */ + fan_status_offset = 0x2f, /* EC register 0x2f */ +@@ -8014,6 +8015,7 @@ static int fan_watchdog_maxinterval; + + static bool fan_with_ns_addr; + static bool ecfw_with_fan_dec_rpm; ++static bool fan_speed_in_tpr; + + static struct mutex fan_mutex; + +@@ -8195,8 +8197,11 @@ static int fan_get_speed(unsigned int *speed) + !acpi_ec_read(fan_rpm_offset + 1, &hi))) + return -EIO; + +- if (likely(speed)) ++ if (likely(speed)) { + *speed = (hi << 8) | lo; ++ if (fan_speed_in_tpr && *speed != 0) ++ *speed = FAN_CLOCK_TPM / *speed; ++ } + break; + case TPACPI_FAN_RD_TPEC_NS: + if (!acpi_ec_read(fan_rpm_status_ns, &lo)) +@@ -8229,8 +8234,11 @@ static int fan2_get_speed(unsigned int *speed) + if (rc) + return -EIO; + +- if (likely(speed)) ++ if (likely(speed)) { + *speed = (hi << 8) | lo; ++ if (fan_speed_in_tpr && *speed != 0) ++ *speed = FAN_CLOCK_TPM / *speed; ++ } + break; + + case TPACPI_FAN_RD_TPEC_NS: +@@ -8758,6 +8766,7 @@ static const struct attribute_group fan_driver_attr_group = { + #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */ + #define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */ + #define TPACPI_FAN_DECRPM 0x0020 /* For ECFW's with RPM in register as decimal */ ++#define TPACPI_FAN_TPR 0x0040 /* Fan speed is in Ticks Per Revolution */ + + static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1), +@@ -8780,6 +8789,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/ + TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */ + TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */ ++ TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR), /* ThinkPad x120e */ + }; + + static int __init fan_init(struct ibm_init_struct *iibm) +@@ -8843,6 +8853,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) + + if (quirks & TPACPI_FAN_Q1) + fan_quirk1_setup(); ++ if (quirks & TPACPI_FAN_TPR) ++ fan_speed_in_tpr = true; + /* Try and probe the 2nd fan */ + tp_features.second_fan = 1; /* needed for get_speed to work */ + res = fan2_get_speed(&speed); +-- +2.39.5 + diff --git a/queue-6.6/platform-x86-thinkpad_acpi-support-for-v9-dytc-platf.patch b/queue-6.6/platform-x86-thinkpad_acpi-support-for-v9-dytc-platf.patch new file mode 100644 index 0000000000..b9bda1c872 --- /dev/null +++ b/queue-6.6/platform-x86-thinkpad_acpi-support-for-v9-dytc-platf.patch @@ -0,0 +1,122 @@ +From 3cc6ab3eb03acbd4e9f29ea6b5a4a928b03361db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2025 14:39:41 -0500 +Subject: platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mark Pearson + +[ Upstream commit 9cff907cbf8c7fb5345918dbcc7b74a01656f34f ] + +Newer Thinkpad AMD platforms are using V9 DYTC and this changes the +profiles used for PSC mode. Add support for this update. +Tested on P14s G5 AMD + +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20250206193953.58365-1-mpearson-lenovo@squebb.ca +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 34 ++++++++++++++++++---------- + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index b11f5ac658e01..cde5f845cf255 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -10283,6 +10283,10 @@ static struct ibm_struct proxsensor_driver_data = { + #define DYTC_MODE_PSC_BALANCE 5 /* Default mode aka balanced */ + #define DYTC_MODE_PSC_PERFORM 7 /* High power mode aka performance */ + ++#define DYTC_MODE_PSCV9_LOWPOWER 1 /* Low power mode */ ++#define DYTC_MODE_PSCV9_BALANCE 3 /* Default mode aka balanced */ ++#define DYTC_MODE_PSCV9_PERFORM 4 /* High power mode aka performance */ ++ + #define DYTC_ERR_MASK 0xF /* Bits 0-3 in cmd result are the error result */ + #define DYTC_ERR_SUCCESS 1 /* CMD completed successful */ + +@@ -10303,6 +10307,10 @@ static int dytc_capabilities; + static bool dytc_mmc_get_available; + static int profile_force; + ++static int platform_psc_profile_lowpower = DYTC_MODE_PSC_LOWPOWER; ++static int platform_psc_profile_balanced = DYTC_MODE_PSC_BALANCE; ++static int platform_psc_profile_performance = DYTC_MODE_PSC_PERFORM; ++ + static int convert_dytc_to_profile(int funcmode, int dytcmode, + enum platform_profile_option *profile) + { +@@ -10324,19 +10332,15 @@ static int convert_dytc_to_profile(int funcmode, int dytcmode, + } + return 0; + case DYTC_FUNCTION_PSC: +- switch (dytcmode) { +- case DYTC_MODE_PSC_LOWPOWER: ++ if (dytcmode == platform_psc_profile_lowpower) + *profile = PLATFORM_PROFILE_LOW_POWER; +- break; +- case DYTC_MODE_PSC_BALANCE: ++ else if (dytcmode == platform_psc_profile_balanced) + *profile = PLATFORM_PROFILE_BALANCED; +- break; +- case DYTC_MODE_PSC_PERFORM: ++ else if (dytcmode == platform_psc_profile_performance) + *profile = PLATFORM_PROFILE_PERFORMANCE; +- break; +- default: /* Unknown mode */ ++ else + return -EINVAL; +- } ++ + return 0; + case DYTC_FUNCTION_AMT: + /* For now return balanced. It's the closest we have to 'auto' */ +@@ -10357,19 +10361,19 @@ static int convert_profile_to_dytc(enum platform_profile_option profile, int *pe + if (dytc_capabilities & BIT(DYTC_FC_MMC)) + *perfmode = DYTC_MODE_MMC_LOWPOWER; + else if (dytc_capabilities & BIT(DYTC_FC_PSC)) +- *perfmode = DYTC_MODE_PSC_LOWPOWER; ++ *perfmode = platform_psc_profile_lowpower; + break; + case PLATFORM_PROFILE_BALANCED: + if (dytc_capabilities & BIT(DYTC_FC_MMC)) + *perfmode = DYTC_MODE_MMC_BALANCE; + else if (dytc_capabilities & BIT(DYTC_FC_PSC)) +- *perfmode = DYTC_MODE_PSC_BALANCE; ++ *perfmode = platform_psc_profile_balanced; + break; + case PLATFORM_PROFILE_PERFORMANCE: + if (dytc_capabilities & BIT(DYTC_FC_MMC)) + *perfmode = DYTC_MODE_MMC_PERFORM; + else if (dytc_capabilities & BIT(DYTC_FC_PSC)) +- *perfmode = DYTC_MODE_PSC_PERFORM; ++ *perfmode = platform_psc_profile_performance; + break; + default: /* Unknown profile */ + return -EOPNOTSUPP; +@@ -10558,6 +10562,7 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) + if (output & BIT(DYTC_QUERY_ENABLE_BIT)) + dytc_version = (output >> DYTC_QUERY_REV_BIT) & 0xF; + ++ dbg_printk(TPACPI_DBG_INIT, "DYTC version %d\n", dytc_version); + /* Check DYTC is enabled and supports mode setting */ + if (dytc_version < 5) + return -ENODEV; +@@ -10596,6 +10601,11 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm) + } + } else if (dytc_capabilities & BIT(DYTC_FC_PSC)) { /* PSC MODE */ + pr_debug("PSC is supported\n"); ++ if (dytc_version >= 9) { /* update profiles for DYTC 9 and up */ ++ platform_psc_profile_lowpower = DYTC_MODE_PSCV9_LOWPOWER; ++ platform_psc_profile_balanced = DYTC_MODE_PSCV9_BALANCE; ++ platform_psc_profile_performance = DYTC_MODE_PSCV9_PERFORM; ++ } + } else { + dbg_printk(TPACPI_DBG_INIT, "No DYTC support available\n"); + return -ENODEV; +-- +2.39.5 + diff --git a/queue-6.6/powercap-call-put_device-on-an-error-path-in-powerca.patch b/queue-6.6/powercap-call-put_device-on-an-error-path-in-powerca.patch new file mode 100644 index 0000000000..4120dcbebf --- /dev/null +++ b/queue-6.6/powercap-call-put_device-on-an-error-path-in-powerca.patch @@ -0,0 +1,46 @@ +From 6e3cf43e895df4590cbd9d456a8b7101a8167a08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 10:05:54 +0900 +Subject: powercap: call put_device() on an error path in + powercap_register_control_type() + +From: Joe Hattori + +[ Upstream commit 93c66fbc280747ea700bd6199633d661e3c819b3 ] + +powercap_register_control_type() calls device_register(), but does not +release the refcount of the device when it fails. + +Call put_device() before returning an error to balance the refcount. + +Since the kfree(control_type) will be done by powercap_release(), remove +the lines in powercap_register_control_type() before returning the error. + +This bug was found by an experimental verifier that I am developing. + +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20250110010554.1583411-1-joe@pf.is.s.u-tokyo.ac.jp +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/powercap_sys.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c +index 52c32dcbf7d84..4112a00973382 100644 +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -627,8 +627,7 @@ struct powercap_control_type *powercap_register_control_type( + dev_set_name(&control_type->dev, "%s", name); + result = device_register(&control_type->dev); + if (result) { +- if (control_type->allocated) +- kfree(control_type); ++ put_device(&control_type->dev); + return ERR_PTR(result); + } + idr_init(&control_type->idr); +-- +2.39.5 + diff --git a/queue-6.6/s390-cio-fix-chpid-configure-attribute-caching.patch b/queue-6.6/s390-cio-fix-chpid-configure-attribute-caching.patch new file mode 100644 index 0000000000..27b34a9da8 --- /dev/null +++ b/queue-6.6/s390-cio-fix-chpid-configure-attribute-caching.patch @@ -0,0 +1,60 @@ +From e05bbbae8def31b5ee68db8254434fb1becd1344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jan 2025 12:02:55 +0100 +Subject: s390/cio: Fix CHPID "configure" attribute caching + +From: Peter Oberparleiter + +[ Upstream commit 32ae4a2992529e2c7934e422035fad1d9b0f1fb5 ] + +In some environments, the SCLP firmware interface used to query a +CHPID's configured state is not supported. On these environments, +rapidly reading the corresponding sysfs attribute produces inconsistent +results: + + $ cat /sys/devices/css0/chp0.00/configure + cat: /sys/devices/css0/chp0.00/configure: Operation not supported + $ cat /sys/devices/css0/chp0.00/configure + 3 + +This occurs for example when Linux is run as a KVM guest. The +inconsistency is a result of CIO using cached results for generating +the value of the "configure" attribute while failing to handle the +situation where no data was returned by SCLP. + +Fix this by not updating the cache-expiration timestamp when SCLP +returns no data. With the fix applied, the system response is +consistent: + + $ cat /sys/devices/css0/chp0.00/configure + cat: /sys/devices/css0/chp0.00/configure: Operation not supported + $ cat /sys/devices/css0/chp0.00/configure + cat: /sys/devices/css0/chp0.00/configure: Operation not supported + +Reviewed-by: Vineeth Vijayan +Reviewed-by: Eric Farman +Tested-by: Eric Farman +Signed-off-by: Peter Oberparleiter +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/chp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c +index 5440f285f3494..7e00c061538db 100644 +--- a/drivers/s390/cio/chp.c ++++ b/drivers/s390/cio/chp.c +@@ -661,7 +661,8 @@ static int info_update(void) + if (time_after(jiffies, chp_info_expires)) { + /* Data is too old, update. */ + rc = sclp_chp_read_info(&chp_info); +- chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL ; ++ if (!rc) ++ chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL; + } + mutex_unlock(&info_lock); + +-- +2.39.5 + diff --git a/queue-6.6/sched-clarify-wake_up_q-s-write-to-task-wake_q.next.patch b/queue-6.6/sched-clarify-wake_up_q-s-write-to-task-wake_q.next.patch new file mode 100644 index 0000000000..b6ec397c8d --- /dev/null +++ b/queue-6.6/sched-clarify-wake_up_q-s-write-to-task-wake_q.next.patch @@ -0,0 +1,41 @@ +From cd54862d6c50326ba7733d09f972488ee2aeb037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 20:53:03 +0100 +Subject: sched: Clarify wake_up_q()'s write to task->wake_q.next + +From: Jann Horn + +[ Upstream commit bcc6244e13b4d4903511a1ea84368abf925031c0 ] + +Clarify that wake_up_q() does an atomic write to task->wake_q.next, after +which a concurrent __wake_q_add() can immediately overwrite +task->wake_q.next again. + +Signed-off-by: Jann Horn +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20250129-sched-wakeup-prettier-v1-1-2f51f5f663fa@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 3d6dc03e4a7d3..942734bf7347d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1019,9 +1019,10 @@ void wake_up_q(struct wake_q_head *head) + struct task_struct *task; + + task = container_of(node, struct task_struct, wake_q); +- /* Task can safely be re-inserted now: */ + node = node->next; +- task->wake_q.next = NULL; ++ /* pairs with cmpxchg_relaxed() in __wake_q_add() */ ++ WRITE_ONCE(task->wake_q.next, NULL); ++ /* Task can safely be re-inserted now. */ + + /* + * wake_up_process() executes a full barrier, which pairs with +-- +2.39.5 + diff --git a/queue-6.6/sched-debug-provide-slice-length-for-fair-tasks.patch b/queue-6.6/sched-debug-provide-slice-length-for-fair-tasks.patch new file mode 100644 index 0000000000..93bf25f798 --- /dev/null +++ b/queue-6.6/sched-debug-provide-slice-length-for-fair-tasks.patch @@ -0,0 +1,44 @@ +From f8d769827f33523e1069bd14823cb4e243750b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 17:59:44 +0000 +Subject: sched/debug: Provide slice length for fair tasks + +From: Christian Loehle + +[ Upstream commit 9065ce69754dece78606c8bbb3821449272e56bf ] + +Since commit: + + 857b158dc5e8 ("sched/eevdf: Use sched_attr::sched_runtime to set request/slice suggestion") + +... we have the userspace per-task tunable slice length, which is +a key parameter that is otherwise difficult to obtain, so provide +it in /proc/$PID/sched. + +[ mingo: Clarified the changelog. ] + +Signed-off-by: Christian Loehle +Signed-off-by: Ingo Molnar +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/453349b1-1637-42f5-a7b2-2385392b5956@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/debug.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 4c3d0d9f3db63..115e266db76bf 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -1089,6 +1089,8 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns, + if (task_has_dl_policy(p)) { + P(dl.runtime); + P(dl.deadline); ++ } else if (fair_policy(p->policy)) { ++ P(se.slice); + } + #undef PN_SCHEDSTAT + #undef P_SCHEDSTAT +-- +2.39.5 + diff --git a/queue-6.6/scsi-core-use-gfp_noio-to-avoid-circular-locking-dep.patch b/queue-6.6/scsi-core-use-gfp_noio-to-avoid-circular-locking-dep.patch new file mode 100644 index 0000000000..2998897976 --- /dev/null +++ b/queue-6.6/scsi-core-use-gfp_noio-to-avoid-circular-locking-dep.patch @@ -0,0 +1,59 @@ +From 57866eaa6224b800e83779f1a92ae82ca61407e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 16:35:39 -0500 +Subject: scsi: core: Use GFP_NOIO to avoid circular locking dependency +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rik van Riel + +[ Upstream commit 5363ee9d110e139584c2d92a0b640bc210588506 ] + +Filesystems can write to disk from page reclaim with __GFP_FS +set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in +page reclaim with GFP_KERNEL, where it could try to take filesystem +locks again, leading to a deadlock. + +WARNING: possible circular locking dependency detected +6.13.0 #1 Not tainted +------------------------------------------------------ +kswapd0/70 is trying to acquire lock: +ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0 + +but task is already holding lock: +ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760 + +The full lockdep splat can be found in Marc's report: + +https://lkml.org/lkml/2025/1/24/1101 + +Avoid the potential deadlock by doing the allocation with GFP_NOIO, which +prevents both filesystem and block layer recursion. + +Reported-by: Marc Aurèle La France +Signed-off-by: Rik van Riel +Link: https://lore.kernel.org/r/20250129104525.0ae8421e@fangorn +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index ca99be7341d9b..cead0fbbe5dbd 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -245,7 +245,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev, + } + ret = sbitmap_init_node(&sdev->budget_map, + scsi_device_max_queue_depth(sdev), +- new_shift, GFP_KERNEL, ++ new_shift, GFP_NOIO, + sdev->request_queue->node, false, true); + if (!ret) + sbitmap_resize(&sdev->budget_map, depth); +-- +2.39.5 + diff --git a/queue-6.6/scsi-qla1280-fix-kernel-oops-when-debug-level-2.patch b/queue-6.6/scsi-qla1280-fix-kernel-oops-when-debug-level-2.patch new file mode 100644 index 0000000000..713cc66c3a --- /dev/null +++ b/queue-6.6/scsi-qla1280-fix-kernel-oops-when-debug-level-2.patch @@ -0,0 +1,38 @@ +From 1044860add7513da1e181f56b8cef00db4a96f36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jan 2025 10:49:22 +0100 +Subject: scsi: qla1280: Fix kernel oops when debug level > 2 + +From: Magnus Lindholm + +[ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ] + +A null dereference or oops exception will eventually occur when qla1280.c +driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I +think its clear from the code that the intention here is sg_dma_len(s) not +length of sg_next(s) when printing the debug info. + +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla1280.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c +index 6e5e89aaa283b..74b23c43af3ea 100644 +--- a/drivers/scsi/qla1280.c ++++ b/drivers/scsi/qla1280.c +@@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp) + dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n", + cpu_to_le32(upper_32_bits(dma_handle)), + cpu_to_le32(lower_32_bits(dma_handle)), +- cpu_to_le32(sg_dma_len(sg_next(s)))); ++ cpu_to_le32(sg_dma_len(s))); + remseg--; + } + dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather " +-- +2.39.5 + diff --git a/queue-6.6/scsi-ufs-core-fix-error-return-with-query-response.patch b/queue-6.6/scsi-ufs-core-fix-error-return-with-query-response.patch new file mode 100644 index 0000000000..d4583d1f96 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-error-return-with-query-response.patch @@ -0,0 +1,44 @@ +From 45fe091d7d4cf29307d735f05e7a4a83e90548c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jan 2025 11:38:08 +0900 +Subject: scsi: ufs: core: Fix error return with query response + +From: Seunghui Lee + +[ Upstream commit 1a78a56ea65252bb089e0daace989167227f2d31 ] + +There is currently no mechanism to return error from query responses. +Return the error and print the corresponding error message with it. + +Signed-off-by: Seunghui Lee +Link: https://lore.kernel.org/r/20250118023808.24726-1-sh043.lee@samsung.com +Reviewed-by: Bean Huo +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 6d53dd7d411a8..cb5611cbf4547 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -3027,8 +3027,13 @@ ufshcd_dev_cmd_completion(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) + case UPIU_TRANSACTION_QUERY_RSP: { + u8 response = lrbp->ucd_rsp_ptr->header.response; + +- if (response == 0) ++ if (response == 0) { + err = ufshcd_copy_query_response(hba, lrbp); ++ } else { ++ err = -EINVAL; ++ dev_err(hba->dev, "%s: unexpected response in Query RSP: %x\n", ++ __func__, response); ++ } + break; + } + case UPIU_TRANSACTION_REJECT_UPIU: +-- +2.39.5 + diff --git a/queue-6.6/sctp-fix-undefined-behavior-in-left-shift-operation.patch b/queue-6.6/sctp-fix-undefined-behavior-in-left-shift-operation.patch new file mode 100644 index 0000000000..d1426656ce --- /dev/null +++ b/queue-6.6/sctp-fix-undefined-behavior-in-left-shift-operation.patch @@ -0,0 +1,43 @@ +From 25502991a3a29d92742a8e28b30af8818314dba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2025 16:12:16 +0800 +Subject: sctp: Fix undefined behavior in left shift operation + +From: Yu-Chun Lin + +[ Upstream commit 606572eb22c1786a3957d24307f5760bb058ca19 ] + +According to the C11 standard (ISO/IEC 9899:2011, 6.5.7): +"If E1 has a signed type and E1 x 2^E2 is not representable in the result +type, the behavior is undefined." + +Shifting 1 << 31 causes signed integer overflow, which leads to undefined +behavior. + +Fix this by explicitly using '1U << 31' to ensure the shift operates on +an unsigned type, avoiding undefined behavior. + +Signed-off-by: Yu-Chun Lin +Link: https://patch.msgid.link/20250218081217.3468369-1-eleanor15x@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sctp/stream.c b/net/sctp/stream.c +index c241cc552e8d5..bfcff6d6a4386 100644 +--- a/net/sctp/stream.c ++++ b/net/sctp/stream.c +@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq( + * value SHOULD be the smallest TSN not acknowledged by the + * receiver of the request plus 2^31. + */ +- init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1 << 31); ++ init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1U << 31); + sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL, + init_tsn, GFP_ATOMIC); + +-- +2.39.5 + diff --git a/queue-6.6/selftests-bpf-fix-invalid-flag-of-recv.patch b/queue-6.6/selftests-bpf-fix-invalid-flag-of-recv.patch new file mode 100644 index 0000000000..ee72b2128e --- /dev/null +++ b/queue-6.6/selftests-bpf-fix-invalid-flag-of-recv.patch @@ -0,0 +1,49 @@ +From 5480a06c50a81de6f229b3ba95de784109f68f61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 18:09:16 +0800 +Subject: selftests/bpf: Fix invalid flag of recv() + +From: Jiayuan Chen + +[ Upstream commit a0c11149509aa905aeec10cf9998091443472b0b ] + +SOCK_NONBLOCK flag is only effective during socket creation, not during +recv. Use MSG_DONTWAIT instead. + +Signed-off-by: Jiayuan Chen +Signed-off-by: Martin KaFai Lau +Acked-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://patch.msgid.link/20250122100917.49845-5-mrpre@163.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +index dda7060e86a09..b16d765a153a9 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c ++++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +@@ -402,8 +402,8 @@ static void test_sockmap_skb_verdict_shutdown(void) + if (!ASSERT_EQ(err, 1, "epoll_wait(fd)")) + goto out_close; + +- n = recv(c1, &b, 1, SOCK_NONBLOCK); +- ASSERT_EQ(n, 0, "recv_timeout(fin)"); ++ n = recv(c1, &b, 1, MSG_DONTWAIT); ++ ASSERT_EQ(n, 0, "recv(fin)"); + out_close: + close(c1); + close(p1); +@@ -459,7 +459,7 @@ static void test_sockmap_skb_verdict_fionread(bool pass_prog) + ASSERT_EQ(avail, expected, "ioctl(FIONREAD)"); + /* On DROP test there will be no data to read */ + if (pass_prog) { +- recvd = recv_timeout(c1, &buf, sizeof(buf), SOCK_NONBLOCK, IO_TIMEOUT_SEC); ++ recvd = recv_timeout(c1, &buf, sizeof(buf), MSG_DONTWAIT, IO_TIMEOUT_SEC); + ASSERT_EQ(recvd, sizeof(buf), "recv_timeout(c0)"); + } + +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series index 0280207055..97f1e6badf 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -40,3 +40,61 @@ net-openvswitch-remove-misbehaving-actions-length-ch.patch net-mlx5-lag-check-shared-fdb-before-creating-multip.patch net-mlx5-bridge-fix-the-crash-caused-by-lag-state-ch.patch net-mlx5e-prevent-bridge-link-show-failure-for-non-e.patch +nvme-fc-go-straight-to-connecting-state-when-initial.patch +nvme-fc-do-not-ignore-connectivity-loss-during-conne.patch +hrtimers-mark-is_migration_base-with-__always_inline.patch +powercap-call-put_device-on-an-error-path-in-powerca.patch +iscsi_ibft-fix-ubsan-shift-out-of-bounds-warning-in-.patch +sched-debug-provide-slice-length-for-fair-tasks.patch +platform-x86-intel-pmc-fix-ltr-decode-in-pmc_core_lt.patch +scsi-core-use-gfp_noio-to-avoid-circular-locking-dep.patch +scsi-ufs-core-fix-error-return-with-query-response.patch +scsi-qla1280-fix-kernel-oops-when-debug-level-2.patch +acpi-resource-irq-override-for-eluktronics-mech-17.patch +smb-client-fix-noisy-when-tree-connecting-to-dfs-int.patch +alpha-elf-fix-misc-setarch-test-of-util-linux-by-rem.patch +vboxsf-fix-building-with-gcc-15.patch +hid-intel-ish-hid-fix-the-length-of-mng_sync_fw_cloc.patch +hid-intel-ish-hid-send-clock-sync-message-immediatel.patch +hid-ignore-non-functional-sensor-in-hp-5mp-camera.patch +usb-phy-generic-use-proper-helper-for-property-detec.patch +hid-topre-fix-n-key-rollover-on-realforce-r3s-tkl-bo.patch +hid-hid-apple-apple-magic-keyboard-a3203-usb-c-suppo.patch +hid-apple-fix-up-the-f6-key-on-the-omoton-kb066-keyb.patch +objtool-ignore-dangling-jump-table-entries.patch +sched-clarify-wake_up_q-s-write-to-task-wake_q.next.patch +platform-x86-thinkpad_acpi-fix-invalid-fan-speed-on-.patch +platform-x86-thinkpad_acpi-support-for-v9-dytc-platf.patch +s390-cio-fix-chpid-configure-attribute-caching.patch +thermal-cpufreq_cooling-remove-structure-member-docu.patch +xen-swiotlb-mark-xen_swiotlb_fixup-__init.patch +bluetooth-l2cap-fix-slab-use-after-free-read-in-l2ca.patch +selftests-bpf-fix-invalid-flag-of-recv.patch +asoc-simple-card-utils.c-add-missing-dlc-of_node.patch +alsa-hda-realtek-limit-mic-boost-on-positivo-arn50.patch +asoc-rsnd-indicate-unsupported-clock-rate.patch +asoc-rsnd-don-t-indicate-warning-on-rsnd_kctrl_accep.patch +asoc-rsnd-adjust-convert-rate-limitation.patch +asoc-arizona-madera-use-fsleep-in-up-down-dapm-event.patch +asoc-sof-intel-hda-add-softdep-pre-to-snd-hda-codec-.patch +asoc-sof-amd-handle-ipc-replies-before-fw_boot_compl.patch +net-wwan-mhi_wwan_mbim-silence-sequence-number-glitc.patch +io-wq-backoff-when-retrying-worker-creation.patch +nvme-pci-quirk-acer-fa100-for-non-uniqueue-identifie.patch +nvme-tcp-add-basic-support-for-the-c2htermreq-pdu.patch +nvmet-rdma-recheck-queue-state-is-live-in-state-lock.patch +apple-nvme-release-power-domains-when-probe-fails.patch +cifs-treat-unhandled-directory-name-surrogate-repars.patch +sctp-fix-undefined-behavior-in-left-shift-operation.patch +nvme-only-allow-entering-live-from-connecting-state.patch +asoc-tas2770-fix-volume-scale.patch +asoc-tas2764-fix-power-control-mask.patch +asoc-tas2764-set-the-sdout-polarity-correctly.patch +fuse-don-t-truncate-cached-mutated-symlink.patch +drm-vkms-round-fixp2int-conversion-in-lerp_u16.patch +perf-x86-intel-use-better-start-period-for-frequency.patch +x86-irq-define-trace-events-conditionally.patch +mptcp-safety-check-before-fallback.patch +drm-nouveau-do-not-override-forced-connector-status.patch +net-handle-napi_schedule-calls-from-non-interrupt.patch +block-fix-kmem_cache-of-name-bio-108-already-exists.patch diff --git a/queue-6.6/smb-client-fix-noisy-when-tree-connecting-to-dfs-int.patch b/queue-6.6/smb-client-fix-noisy-when-tree-connecting-to-dfs-int.patch new file mode 100644 index 0000000000..5f1074ba34 --- /dev/null +++ b/queue-6.6/smb-client-fix-noisy-when-tree-connecting-to-dfs-int.patch @@ -0,0 +1,44 @@ +From 55ef2035d6e2ebc4f324aaf20a291cc6c2238c99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 13:22:11 -0300 +Subject: smb: client: fix noisy when tree connecting to DFS interlink targets + +From: Paulo Alcantara + +[ Upstream commit 773dc23ff81838b6f74d7fabba5a441cc6a93982 ] + +When the client attempts to tree connect to a domain-based DFS +namespace from a DFS interlink target, the server will return +STATUS_BAD_NETWORK_NAME and the following will appear on dmesg: + + CIFS: VFS: BAD_NETWORK_NAME: \\dom\dfs + +Since a DFS share might contain several DFS interlinks and they expire +after 10 minutes, the above message might end up being flooded on +dmesg when mounting or accessing them. + +Print this only once per share. + +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 24b1738a35a15..1b6cb533f5b87 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -2162,7 +2162,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + + tcon_error_exit: + if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) +- cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); ++ cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree); + goto tcon_exit; + } + +-- +2.39.5 + diff --git a/queue-6.6/thermal-cpufreq_cooling-remove-structure-member-docu.patch b/queue-6.6/thermal-cpufreq_cooling-remove-structure-member-docu.patch new file mode 100644 index 0000000000..92183ca51b --- /dev/null +++ b/queue-6.6/thermal-cpufreq_cooling-remove-structure-member-docu.patch @@ -0,0 +1,41 @@ +From f571261532d3f91d93b752505f0fe2a29f457965 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2025 09:47:11 +0100 +Subject: thermal/cpufreq_cooling: Remove structure member documentation + +From: Daniel Lezcano + +[ Upstream commit a6768c4f92e152265590371975d44c071a5279c7 ] + +The structure member documentation refers to a member which does not +exist any more. Remove it. + +Link: https://lore.kernel.org/all/202501220046.h3PMBCti-lkp@intel.com/ +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202501220046.h3PMBCti-lkp@intel.com/ +Signed-off-by: Daniel Lezcano +Acked-by: Viresh Kumar +Link: https://patch.msgid.link/20250211084712.2746705-1-daniel.lezcano@linaro.org +[ rjw: Minor changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/cpufreq_cooling.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c +index e2cc7bd308620..874b4838d2c92 100644 +--- a/drivers/thermal/cpufreq_cooling.c ++++ b/drivers/thermal/cpufreq_cooling.c +@@ -57,8 +57,6 @@ struct time_in_idle { + * @max_level: maximum cooling level. One less than total number of valid + * cpufreq frequencies. + * @em: Reference on the Energy Model of the device +- * @cdev: thermal_cooling_device pointer to keep track of the +- * registered cooling device. + * @policy: cpufreq policy. + * @cooling_ops: cpufreq callbacks to thermal cooling device ops + * @idle_time: idle time stats +-- +2.39.5 + diff --git a/queue-6.6/usb-phy-generic-use-proper-helper-for-property-detec.patch b/queue-6.6/usb-phy-generic-use-proper-helper-for-property-detec.patch new file mode 100644 index 0000000000..6ad7b3e089 --- /dev/null +++ b/queue-6.6/usb-phy-generic-use-proper-helper-for-property-detec.patch @@ -0,0 +1,38 @@ +From 8e16b773236f0251ae817a8e670179af5e417a40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 15:42:51 +0100 +Subject: usb: phy: generic: Use proper helper for property detection + +From: Alexander Stein + +[ Upstream commit 309005e448c1f3e4b81e4416406991b7c3339c1d ] + +Since commit c141ecc3cecd7 ("of: Warn when of_property_read_bool() is +used on non-boolean properties") a warning is raised if this function +is used for property detection. of_property_present() is the correct +helper for this. + +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20250120144251.580981-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c +index 770081b828a42..2b4d2cbafe748 100644 +--- a/drivers/usb/phy/phy-generic.c ++++ b/drivers/usb/phy/phy-generic.c +@@ -217,7 +217,7 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop) + if (of_property_read_u32(node, "clock-frequency", &clk_rate)) + clk_rate = 0; + +- needs_clk = of_property_read_bool(node, "clocks"); ++ needs_clk = of_property_present(node, "clocks"); + } + nop->gpiod_reset = devm_gpiod_get_optional(dev, "reset", + GPIOD_ASIS); +-- +2.39.5 + diff --git a/queue-6.6/vboxsf-fix-building-with-gcc-15.patch b/queue-6.6/vboxsf-fix-building-with-gcc-15.patch new file mode 100644 index 0000000000..fa9def57de --- /dev/null +++ b/queue-6.6/vboxsf-fix-building-with-gcc-15.patch @@ -0,0 +1,51 @@ +From 364cb9b3309cec45d8a783f104be2c194a13601e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 21:56:48 +0530 +Subject: vboxsf: fix building with GCC 15 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brahmajit Das + +[ Upstream commit 4e7487245abcbc5a1a1aea54e4d3b33c53804bda ] + +Building with GCC 15 results in build error +fs/vboxsf/super.c:24:54: error: initializer-string for array of ‘unsigned char’ is too long [-Werror=unterminated-string-initialization] + 24 | static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375"; + | ^~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +Due to GCC having enabled -Werror=unterminated-string-initialization[0] +by default. Separately initializing each array element of +VBSF_MOUNT_SIGNATURE to ensure NUL termination, thus satisfying GCC 15 +and fixing the build error. + +[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wno-unterminated-string-initialization + +Signed-off-by: Brahmajit Das +Link: https://lore.kernel.org/r/20250121162648.1408743-1-brahmajit.xyz@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/vboxsf/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c +index 9848af78215bf..6e9ebf2321230 100644 +--- a/fs/vboxsf/super.c ++++ b/fs/vboxsf/super.c +@@ -21,7 +21,8 @@ + + #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */ + +-static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375"; ++static const unsigned char VBSF_MOUNT_SIGNATURE[4] = { '\000', '\377', '\376', ++ '\375' }; + + static int follow_symlinks; + module_param(follow_symlinks, int, 0444); +-- +2.39.5 + diff --git a/queue-6.6/x86-irq-define-trace-events-conditionally.patch b/queue-6.6/x86-irq-define-trace-events-conditionally.patch new file mode 100644 index 0000000000..064c003d6f --- /dev/null +++ b/queue-6.6/x86-irq-define-trace-events-conditionally.patch @@ -0,0 +1,48 @@ +From 7d8984920863036413ba04e51098edccf0af84c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2025 22:32:33 +0100 +Subject: x86/irq: Define trace events conditionally + +From: Arnd Bergmann + +[ Upstream commit 9de7695925d5d2d2085681ba935857246eb2817d ] + +When both of X86_LOCAL_APIC and X86_THERMAL_VECTOR are disabled, +the irq tracing produces a W=1 build warning for the tracing +definitions: + + In file included from include/trace/trace_events.h:27, + from include/trace/define_trace.h:113, + from arch/x86/include/asm/trace/irq_vectors.h:383, + from arch/x86/kernel/irq.c:29: + include/trace/stages/init.h:2:23: error: 'str__irq_vectors__trace_system_name' defined but not used [-Werror=unused-const-variable=] + +Make the tracepoints conditional on the same symbosl that guard +their usage. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20250225213236.3141752-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/irq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index 11761c1245453..6573678c4bf4b 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -23,8 +23,10 @@ + #include + #include + ++#if defined(CONFIG_X86_LOCAL_APIC) || defined(CONFIG_X86_THERMAL_VECTOR) + #define CREATE_TRACE_POINTS + #include ++#endif + + DEFINE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat); + EXPORT_PER_CPU_SYMBOL(irq_stat); +-- +2.39.5 + diff --git a/queue-6.6/xen-swiotlb-mark-xen_swiotlb_fixup-__init.patch b/queue-6.6/xen-swiotlb-mark-xen_swiotlb_fixup-__init.patch new file mode 100644 index 0000000000..0097468ca3 --- /dev/null +++ b/queue-6.6/xen-swiotlb-mark-xen_swiotlb_fixup-__init.patch @@ -0,0 +1,37 @@ +From 4a82a492306ab5f2e86d0f1de5ae1175aae44163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Feb 2025 16:14:38 +0100 +Subject: Xen/swiotlb: mark xen_swiotlb_fixup() __init + +From: Jan Beulich + +[ Upstream commit 75ad02318af2e4ae669e26a79f001bd5e1f97472 ] + +It's sole user (pci_xen_swiotlb_init()) is __init, too. + +Signed-off-by: Jan Beulich +Reviewed-by: Stefano Stabellini + +Message-ID: +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/swiotlb-xen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index b6e54ab3b6f3b..0b3bd9a7575e5 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -112,7 +112,7 @@ static int is_xen_swiotlb_buffer(struct device *dev, dma_addr_t dma_addr) + } + + #ifdef CONFIG_X86 +-int xen_swiotlb_fixup(void *buf, unsigned long nslabs) ++int __init xen_swiotlb_fixup(void *buf, unsigned long nslabs) + { + int rc; + unsigned int order = get_order(IO_TLB_SEGSIZE << IO_TLB_SHIFT); +-- +2.39.5 +