From: Sasha Levin Date: Tue, 16 Jan 2024 10:42:05 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v6.1.74~31 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4dddfe0ec42a4f87c3b13e55d6651aa2bca3eee1;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch b/queue-6.1/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch new file mode 100644 index 00000000000..10cac5cc80c --- /dev/null +++ b/queue-6.1/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch @@ -0,0 +1,59 @@ +From c66bafb08006361d5219e6484e95ec2ecfe6a872 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 20:09:23 +0300 +Subject: ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook + XPro + +From: Vasiliy Kovalev + +[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ] + +This patch corrected the speaker and headset mic pin config to the more +appropriate values. + +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1c8ffc5cf97f..beefb522a85d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7108,6 +7108,7 @@ enum { + ALC290_FIXUP_SUBWOOFER_HSJACK, + ALC269_FIXUP_THINKPAD_ACPI, + ALC269_FIXUP_DMIC_THINKPAD_ACPI, ++ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO, + ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, +@@ -7454,6 +7455,14 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_U7x7_headset_mic, + }, ++ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x03a19020 }, /* headset mic */ ++ { 0x1b, 0x90170150 }, /* speaker */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -10032,6 +10041,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), ++ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), + SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC), + SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), +-- +2.43.0 + diff --git a/queue-6.1/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch b/queue-6.1/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch new file mode 100644 index 00000000000..4d71b5cb9e4 --- /dev/null +++ b/queue-6.1/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch @@ -0,0 +1,104 @@ +From 04a4ecc72f96454f12db6b0f088ddaf090870cb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 13:16:58 +0200 +Subject: ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps + format + +From: Peter Ujfalusi + +[ Upstream commit 7b4c93a50a2ebbbaf656cc4fa6aca74a6166d85b ] + +When looking up DMIC blob from the NHLT table and the format is 32 bits, +ignore the vbps matching for 32 bps for DMIC since some NHLT table have +the vbps as 24, some have it as 32. +The DMIC hardware supports only one type of 32 bit sample size, which is +24 bit sampling on the MSB side and bits[1:0] is used for indicating the +channel number. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20231127111658.17275-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-nhlt.c | 33 +++++++++++++++++++++++++++++---- + 1 file changed, 29 insertions(+), 4 deletions(-) + +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 2c4dfc0b7e34..696a958d93e9 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -238,7 +238,7 @@ EXPORT_SYMBOL(intel_nhlt_ssp_mclk_mask); + + static struct nhlt_specific_cfg * + nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, +- u32 rate, u8 vbps, u8 bps) ++ u32 rate, u8 vbps, u8 bps, bool ignore_vbps) + { + struct nhlt_fmt_cfg *cfg = fmt->fmt_config; + struct wav_fmt *wfmt; +@@ -255,8 +255,12 @@ nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, + dev_dbg(dev, "Endpoint format: ch=%d fmt=%d/%d rate=%d\n", + wfmt->channels, _vbps, _bps, wfmt->samples_per_sec); + ++ /* ++ * When looking for exact match of configuration ignore the vbps ++ * from NHLT table when ignore_vbps is true ++ */ + if (wfmt->channels == num_ch && wfmt->samples_per_sec == rate && +- vbps == _vbps && bps == _bps) ++ (ignore_vbps || vbps == _vbps) && bps == _bps) + return &cfg->config; + + cfg = (struct nhlt_fmt_cfg *)(cfg->config.caps + cfg->config.size); +@@ -289,6 +293,7 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + { + struct nhlt_specific_cfg *cfg; + struct nhlt_endpoint *epnt; ++ bool ignore_vbps = false; + struct nhlt_fmt *fmt; + int i; + +@@ -298,7 +303,26 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + dev_dbg(dev, "Looking for configuration:\n"); + dev_dbg(dev, " vbus_id=%d link_type=%d dir=%d, dev_type=%d\n", + bus_id, link_type, dir, dev_type); +- dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); ++ if (link_type == NHLT_LINK_DMIC && bps == 32 && (vbps == 24 || vbps == 32)) { ++ /* ++ * The DMIC hardware supports only one type of 32 bits sample ++ * size, which is 24 bit sampling on the MSB side and bits[1:0] ++ * are used for indicating the channel number. ++ * It has been observed that some NHLT tables have the vbps ++ * specified as 32 while some uses 24. ++ * The format these variations describe are identical, the ++ * hardware is configured and behaves the same way. ++ * Note: when the samples assumed to be vbps=32 then the 'noise' ++ * introduced by the lower two bits (channel number) have no ++ * real life implication on audio quality. ++ */ ++ dev_dbg(dev, ++ " ch=%d fmt=%d rate=%d (vbps is ignored for DMIC 32bit format)\n", ++ num_ch, bps, rate); ++ ignore_vbps = true; ++ } else { ++ dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); ++ } + dev_dbg(dev, "Endpoint count=%d\n", nhlt->endpoint_count); + + epnt = (struct nhlt_endpoint *)nhlt->desc; +@@ -307,7 +331,8 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + if (nhlt_check_ep_match(dev, epnt, bus_id, link_type, dir, dev_type)) { + fmt = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); + +- cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, vbps, bps); ++ cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, ++ vbps, bps, ignore_vbps); + if (cfg) + return cfg; + } +-- +2.43.0 + diff --git a/queue-6.1/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch b/queue-6.1/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch new file mode 100644 index 00000000000..0332912e2ac --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch @@ -0,0 +1,51 @@ +From 38dfe4bb57ac2761aa5e23347d63030717b37410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 15:12:19 +0000 +Subject: ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models + +From: Stefan Binding + +[ Upstream commit 51d976079976c800ef19ed1b542602fcf63f0edb ] + +These models use 2xCS35L41amps with HDA using SPI and I2C. +Models use internal and external boost. +All models require DSD support to be added inside +cs35l41_hda_property.c + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20231218151221.388745-6-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index beefb522a85d..24f7f6d98922 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9779,17 +9779,20 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), ++ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), +- SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), +-- +2.43.0 + diff --git a/queue-6.1/arc-fix-spare-error.patch b/queue-6.1/arc-fix-spare-error.patch new file mode 100644 index 00000000000..9847aac8c9a --- /dev/null +++ b/queue-6.1/arc-fix-spare-error.patch @@ -0,0 +1,48 @@ +From 14e4a55dd36c78cc8366ab98161ce2d0b267f128 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:57:07 -0800 +Subject: ARC: fix spare error + +From: Vineet Gupta + +[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/ +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c +index 3c1590c27fae..723abcb10c80 100644 +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -61,7 +61,7 @@ struct rt_sigframe { + unsigned int sigret_magic; + }; + +-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) + #else + v2abi.r58 = v2abi.r59 = 0; + #endif +- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); ++ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi)); + #endif + return err; + } + +-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +-- +2.43.0 + diff --git a/queue-6.1/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch b/queue-6.1/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch new file mode 100644 index 00000000000..8c0bb25ecf8 --- /dev/null +++ b/queue-6.1/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch @@ -0,0 +1,49 @@ +From b368e5456d327666c850ec373fe9ce72a46921d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 20:39:03 +0100 +Subject: ARM: sun9i: smp: fix return code check of of_property_match_string + +From: Stefan Wahren + +[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ] + +of_property_match_string returns an int; either an index from 0 or +greater if successful or negative on failure. Even it's very +unlikely that the DT CPU node contains multiple enable-methods +these checks should be fixed. + +This patch was inspired by the work of Nick Desaulniers. + +Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ +Cc: Nick Desaulniers +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/mc_smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c +index b2f5f4f28705..f779e386b6e7 100644 +--- a/arch/arm/mach-sunxi/mc_smp.c ++++ b/arch/arm/mach-sunxi/mc_smp.c +@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void) + for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) { + ret = of_property_match_string(node, "enable-method", + sunxi_mc_smp_data[i].enable_method); +- if (!ret) ++ if (ret >= 0) + break; + } + + of_node_put(node); +- if (ret) ++ if (ret < 0) + return -ENODEV; + + is_a83t = sunxi_mc_smp_data[i].is_a83t; +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch b/queue-6.1/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch new file mode 100644 index 00000000000..1fc4d74b20e --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch @@ -0,0 +1,78 @@ +From 0fc0f4f9b4584ba76db608f584753a997f7e7975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 13:18:29 -0600 +Subject: arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru + +From: Rob Herring + +[ Upstream commit c13c823a78b77ea0e5f1f73112d910e259911101 ] + +The rk3399-gru PCI node addresses are wrong. + +In rk3399-gru-scarlet, the bus number in the address should be 0. This is +because bus number assignment is dynamic and not known up front. For FDT, +the bus number is simply ignored. + +In rk3399-gru-chromebook, the addresses are simply invalid. The first +"reg" entry must be the configuration space for the device. The entry +should be all 0s except for device/slot and function numbers. The existing +64-bit memory space (0x83000000) entries are not valid because they must +have the BAR address in the lower byte of the first cell. + +Warnings for these are enabled by adding the missing 'device_type = "pci"' +for the root port node. + +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20231130191830.2424361-1-robh@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +-- + arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 ++-- + arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index ee6095baba4d..7d9b8064ad2e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -510,8 +510,7 @@ wacky_spi_audio: spi2@0 { + &pci_rootport { + mvl_wifi: wifi@0,0 { + compatible = "pci1b4b,2b42"; +- reg = <0x83010000 0x0 0x00000000 0x0 0x00100000 +- 0x83010000 0x0 0x00100000 0x0 0x00100000>; ++ reg = <0x0000 0x0 0x0 0x0 0x0>; + interrupt-parent = <&gpio0>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts +index 853e88455e75..9e4b12ed62cb 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts +@@ -34,8 +34,8 @@ &mipi_panel { + &pci_rootport { + wifi@0,0 { + compatible = "qcom,ath10k"; +- reg = <0x00010000 0x0 0x00000000 0x0 0x00000000>, +- <0x03010010 0x0 0x00000000 0x0 0x00200000>; ++ reg = <0x00000000 0x0 0x00000000 0x0 0x00000000>, ++ <0x03000010 0x0 0x00000000 0x0 0x00200000>; + qcom,ath10k-calibration-variant = "GO_DUMO"; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index 23bfba86daab..7ba25315dd9a 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -489,6 +489,7 @@ pci_rootport: pcie@0,0 { + #address-cells = <3>; + #size-cells = <2>; + ranges; ++ device_type = "pci"; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch b/queue-6.1/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch new file mode 100644 index 00000000000..d63ac15c9a8 --- /dev/null +++ b/queue-6.1/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch @@ -0,0 +1,37 @@ +From 9eb887c1059ca7b4901d83d5fea20e0632ef4b76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 16:38:34 +0100 +Subject: arm64: dts: rockchip: fix rk356x pcie msg interrupt name + +From: Heiko Stuebner + +[ Upstream commit 3cee9c635f27d1003d46f624d816f3455698b625 ] + +The expected name by the binding at this position is "msg" and the SoC's +manual also calls the interrupt in question "msg", so fix the rk356x dtsi +to use the correct name. + +Reviewed-by: Sebastian Reichel +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20231114153834.934978-1-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index 234b5bbda120..f4d6dbbbddcd 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -958,7 +958,7 @@ pcie2x1: pcie@fe260000 { + , + , + ; +- interrupt-names = "sys", "pmc", "msi", "legacy", "err"; ++ interrupt-names = "sys", "pmc", "msg", "legacy", "err"; + bus-range = <0x0 0xf>; + clocks = <&cru ACLK_PCIE20_MST>, <&cru ACLK_PCIE20_SLV>, + <&cru ACLK_PCIE20_DBI>, <&cru PCLK_PCIE20>, +-- +2.43.0 + diff --git a/queue-6.1/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch b/queue-6.1/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch new file mode 100644 index 00000000000..50f8eca86d5 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch @@ -0,0 +1,41 @@ +From c8c25e2d88e9bd08d95167d5252ec26f898a75ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 11:42:38 -0700 +Subject: ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 + +From: Jeremy Soller + +[ Upstream commit 19650c0f402f53abe48a55a1c49c8ed9576a088c ] + +Add pang13 quirk to enable the internal microphone. + +Signed-off-by: Jeremy Soller +Signed-off-by: Tim Crawford +Link: https://lore.kernel.org/r/20231127184237.32077-2-tcrawford@system76.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 1dde1f3196ac..808d00282623 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -353,6 +353,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "System76"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "pang13"), ++ } ++ }, + {} + }; + +-- +2.43.0 + diff --git a/queue-6.1/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch b/queue-6.1/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch new file mode 100644 index 00000000000..8696463f8ae --- /dev/null +++ b/queue-6.1/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch @@ -0,0 +1,34 @@ +From 0d1a6a3582db9dd3d55ca5ffb8cccccc7f6559ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:39 +0000 +Subject: ASoC: cs43130: Fix incorrect frame delay configuration + +From: Maciej Strozek + +[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 1fcbf2ffccff..0b8ecd917a08 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -579,7 +579,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk, + break; + case SND_SOC_DAIFMT_LEFT_J: + hi_size = bitwidth_sclk; +- frm_delay = 2; ++ frm_delay = 0; + frm_phase = 1; + break; + case SND_SOC_DAIFMT_DSP_A: +-- +2.43.0 + diff --git a/queue-6.1/asoc-cs43130-fix-the-position-of-const-qualifier.patch b/queue-6.1/asoc-cs43130-fix-the-position-of-const-qualifier.patch new file mode 100644 index 00000000000..3f8214caa4d --- /dev/null +++ b/queue-6.1/asoc-cs43130-fix-the-position-of-const-qualifier.patch @@ -0,0 +1,43 @@ +From cce499605985cbd323ca2729f03091e5d06576d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:38 +0000 +Subject: ASoC: cs43130: Fix the position of const qualifier + +From: Maciej Strozek + +[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index db39abb2a31b..1fcbf2ffccff 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -1683,7 +1683,7 @@ static ssize_t hpload_dc_r_show(struct device *dev, + return cs43130_show_dc(dev, buf, HP_RIGHT); + } + +-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = { ++static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = { + 24, + 43, + 93, +@@ -2363,7 +2363,7 @@ static const struct regmap_config cs43130_regmap = { + .use_single_write = true, + }; + +-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { ++static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { + 50, + 120, + }; +-- +2.43.0 + diff --git a/queue-6.1/asoc-da7219-support-low-dc-impedance-headset.patch b/queue-6.1/asoc-da7219-support-low-dc-impedance-headset.patch new file mode 100644 index 00000000000..99fd719ffb3 --- /dev/null +++ b/queue-6.1/asoc-da7219-support-low-dc-impedance-headset.patch @@ -0,0 +1,36 @@ +From bbf4f922501d0946da2b974df903000154c193a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 12:29:33 +0800 +Subject: ASoC: da7219: Support low DC impedance headset + +From: David Rau + +[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ] + +Change the default MIC detection impedance threshold to 200ohm +to support low mic DC impedance headset. + +Signed-off-by: David Rau +Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 9251490548e8..c8410769188a 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -663,7 +663,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + aad_pdata->mic_det_thr = + da7219_aad_fw_mic_det_thr(dev, fw_val32); + else +- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; ++ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS; + + if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0) + aad_pdata->jack_ins_deb = +-- +2.43.0 + diff --git a/queue-6.1/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch b/queue-6.1/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch new file mode 100644 index 00000000000..c9f43e69233 --- /dev/null +++ b/queue-6.1/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch @@ -0,0 +1,95 @@ +From 146cae8686b3adc012508764b7933ab61d009c70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 14:39:14 +0200 +Subject: ASoC: hdac_hda: Conditionally register dais for HDMI and Analog + +From: Peter Ujfalusi + +[ Upstream commit a0575b4add21a243cc3257e75ad913cd5377d5f2 ] + +The current driver is registering the same dais for each hdev found in the +system which results duplicated widgets to be registered and the kernel +log contains similar prints: +snd_hda_codec_realtek ehdaudio0D0: ASoC: sink widget AIF1TX overwritten +snd_hda_codec_realtek ehdaudio0D0: ASoC: source widget AIF1RX overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi3 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi2 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Codec Output Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Codec Input Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Digital Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Alt Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Analog Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Digital Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Alt Analog Codec Capture overwritten + +To avoid such issue, split the dai array into HDMI and non HDMI array and +register them conditionally: +for HDMI hdev only register the dais needed for HDMI +for non HDMI hdev do not register the HDMI dais. + +Depends-on: 3d1dc8b1030d ("ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available") +Link: https://github.com/thesofproject/linux/issues/4509 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20231128123914.3986-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hda.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c +index 8af434e14bfb..21a00c86a139 100644 +--- a/sound/soc/codecs/hdac_hda.c ++++ b/sound/soc/codecs/hdac_hda.c +@@ -124,6 +124,9 @@ static struct snd_soc_dai_driver hdac_hda_dais[] = { + .sig_bits = 24, + }, + }, ++}; ++ ++static struct snd_soc_dai_driver hdac_hda_hdmi_dais[] = { + { + .id = HDAC_HDMI_0_DAI_ID, + .name = "intel-hdmi-hifi1", +@@ -578,8 +581,16 @@ static const struct snd_soc_component_driver hdac_hda_codec = { + .endianness = 1, + }; + ++static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { ++ .probe = hdac_hda_codec_probe, ++ .remove = hdac_hda_codec_remove, ++ .idle_bias_on = false, ++ .endianness = 1, ++}; ++ + static int hdac_hda_dev_probe(struct hdac_device *hdev) + { ++ struct hdac_hda_priv *hda_pvt = dev_get_drvdata(&hdev->dev); + struct hdac_ext_link *hlink; + int ret; + +@@ -592,9 +603,15 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) + snd_hdac_ext_bus_link_get(hdev->bus, hlink); + + /* ASoC specific initialization */ +- ret = devm_snd_soc_register_component(&hdev->dev, +- &hdac_hda_codec, hdac_hda_dais, +- ARRAY_SIZE(hdac_hda_dais)); ++ if (hda_pvt->need_display_power) ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_hdmi_codec, hdac_hda_hdmi_dais, ++ ARRAY_SIZE(hdac_hda_hdmi_dais)); ++ else ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_codec, hdac_hda_dais, ++ ARRAY_SIZE(hdac_hda_dais)); ++ + if (ret < 0) { + dev_err(&hdev->dev, "failed to register HDA codec %d\n", ret); + return ret; +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch b/queue-6.1/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch new file mode 100644 index 00000000000..db27b32816f --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch @@ -0,0 +1,104 @@ +From a6777bea92280af3b0093254bb3ab39343845cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 22:32:21 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk + +From: Hans de Goede + +[ Upstream commit b1b6131bca35a55a69fadc39d51577968fa2ee97 ] + +Some BYTCR x86 tablets with a rt5640 codec have the left and right channels +of their speakers swapped. + +Add a new BYT_RT5640_SWAPPED_SPEAKERS quirk for this which sets +cfg-spk:swapped in the components string to let userspace know +about the swapping so that the UCM profile can configure the mixer +to correct this. + +Enable this new quirk on the Medion Lifetab S10346 which has its +speakers swapped. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20231217213221.49424-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index b63c16c67898..797d0a48d606 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -83,6 +83,7 @@ enum { + #define BYT_RT5640_HSMIC2_ON_IN1 BIT(27) + #define BYT_RT5640_JD_HP_ELITEP_1000G2 BIT(28) + #define BYT_RT5640_USE_AMCR0F28 BIT(29) ++#define BYT_RT5640_SWAPPED_SPEAKERS BIT(30) + + #define BYTCR_INPUT_DEFAULTS \ + (BYT_RT5640_IN3_MAP | \ +@@ -157,6 +158,8 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk MONO_SPEAKER enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) + dev_info(dev, "quirk NO_SPEAKERS enabled\n"); ++ if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) ++ dev_info(dev, "quirk SWAPPED_SPEAKERS enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_LINEOUT) + dev_info(dev, "quirk LINEOUT enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_LINEOUT_AS_HP2) +@@ -893,6 +896,7 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SWAPPED_SPEAKERS | + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, +@@ -1621,11 +1625,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + const char *platform_name; + struct acpi_device *adev; + struct device *codec_dev; ++ const char *cfg_spk; + bool sof_parent; + int ret_val = 0; + int dai_index = 0; +- int i, cfg_spk; +- int aif; ++ int i, aif; + + is_bytcr = false; + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); +@@ -1785,13 +1789,16 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + } + + if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) { +- cfg_spk = 0; ++ cfg_spk = "0"; + spk_type = "none"; + } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) { +- cfg_spk = 1; ++ cfg_spk = "1"; + spk_type = "mono"; ++ } else if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) { ++ cfg_spk = "swapped"; ++ spk_type = "swapped"; + } else { +- cfg_spk = 2; ++ cfg_spk = "2"; + spk_type = "stereo"; + } + +@@ -1806,7 +1813,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + headset2_string = " cfg-hs2:in1"; + + snprintf(byt_rt5640_components, sizeof(byt_rt5640_components), +- "cfg-spk:%d cfg-mic:%s aif:%d%s%s", cfg_spk, ++ "cfg-spk:%s cfg-mic:%s aif:%d%s%s", cfg_spk, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)], aif, + lineout_string, headset2_string); + byt_rt5640_card.components = byt_rt5640_components; +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch b/queue-6.1/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch new file mode 100644 index 00000000000..1aa42cbff80 --- /dev/null +++ b/queue-6.1/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch @@ -0,0 +1,48 @@ +From 91b6547c962b65b8ff15ae46ec259d081574a2e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 22:32:20 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 + +From: Hans de Goede + +[ Upstream commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d ] + +Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20231217213221.49424-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 783c20125992..b63c16c67898 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -884,6 +884,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ /* Medion Lifetab S10346 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are much too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Mele PCG03 Mini PC */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"), +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch b/queue-6.1/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch new file mode 100644 index 00000000000..bfbf5347fbb --- /dev/null +++ b/queue-6.1/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch @@ -0,0 +1,44 @@ +From 286cc7ebeb523c681fdb9e512fdbf866aee85f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 14:40:15 +0200 +Subject: ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not + available + +From: Peter Ujfalusi + +[ Upstream commit 3d1dc8b1030df8ca0fdfd4905c88ee10db943bf8 ] + +When the HDMI is not present due to disabled display support +we will use dummy codec and the HDMI routes will refer to non existent +DAPM widgets. + +Trim the route list from the HDMI routes to be able to probe the card even +if the HDMI dais are not registered. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20231124124015.15878-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index 879ebba52832..463ffb85121d 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -157,6 +157,8 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params) + card->dapm_widgets = skl_hda_widgets; + card->num_dapm_widgets = ARRAY_SIZE(skl_hda_widgets); + if (!ctx->idisp_codec) { ++ card->dapm_routes = &skl_hda_map[IDISP_ROUTE_COUNT]; ++ num_route -= IDISP_ROUTE_COUNT; + for (i = 0; i < IDISP_DAI_COUNT; i++) { + skl_hda_be_dai_links[i].codecs = dummy_codec; + skl_hda_be_dai_links[i].num_codecs = +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch b/queue-6.1/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch new file mode 100644 index 00000000000..442d33ecbc0 --- /dev/null +++ b/queue-6.1/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch @@ -0,0 +1,59 @@ +From 56b54dc78a7f059a4b0f4bde21431e66af6f7a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:51:50 +0100 +Subject: ASoC: Intel: Skylake: Fix mem leak in few functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ] + +The resources should be freed when function return error. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 4 +++- + sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 1015716f9336..7ef004107513 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -251,8 +251,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream, + snd_pcm_set_sync(substream); + + mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream); +- if (!mconfig) ++ if (!mconfig) { ++ kfree(dma_params); + return -EINVAL; ++ } + + skl_tplg_d0i3_get(skl, mconfig->d0i3_caps); + +diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c +index 7a425271b08b..fd9624ad5f72 100644 +--- a/sound/soc/intel/skylake/skl-sst-ipc.c ++++ b/sound/soc/intel/skylake/skl-sst-ipc.c +@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, + + reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK; + buf = krealloc(reply.data, reply.size, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ kfree(reply.data); + return -ENOMEM; ++ } + *payload = buf; + *bytes = reply.size; + +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-skylake-mem-leak-in-skl-register-function.patch b/queue-6.1/asoc-intel-skylake-mem-leak-in-skl-register-function.patch new file mode 100644 index 00000000000..8a1c9c17e6a --- /dev/null +++ b/queue-6.1/asoc-intel-skylake-mem-leak-in-skl-register-function.patch @@ -0,0 +1,52 @@ +From c3083954675ada06a79c77df8b383134310f96fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 23:41:13 +0100 +Subject: ASoC: Intel: Skylake: mem leak in skl register function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ] + +skl_platform_register() uses krealloc. When krealloc is fail, +then previous memory is not freed. The leak is also when soc +component registration failed. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 7ef004107513..adee4be2dea7 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1473,6 +1473,7 @@ int skl_platform_register(struct device *dev) + dais = krealloc(skl->dais, sizeof(skl_fe_dai) + + sizeof(skl_platform_dai), GFP_KERNEL); + if (!dais) { ++ kfree(skl->dais); + ret = -ENOMEM; + goto err; + } +@@ -1485,8 +1486,10 @@ int skl_platform_register(struct device *dev) + + ret = devm_snd_soc_register_component(dev, &skl_component, + skl->dais, num_dais); +- if (ret) ++ if (ret) { ++ kfree(skl->dais); + dev_err(dev, "soc component registration failed %d\n", ret); ++ } + err: + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch b/queue-6.1/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch new file mode 100644 index 00000000000..0ac012831ab --- /dev/null +++ b/queue-6.1/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch @@ -0,0 +1,75 @@ +From 9ce0a2a1219f25c186cd780843147a5ebfc72202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 12:30:12 +0800 +Subject: ASoC: nau8822: Fix incorrect type in assignment and cast to + restricted __be16 + +From: David Lin + +[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ] + +This issue is reproduced when W=1 build in compiler gcc-12. +The following are sparse warnings: + +sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment +sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short +sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/ +Signed-off-by: David Lin +Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index 1aef281a9972..cd5053cfd521 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + struct soc_bytes_ext *params = (void *)kcontrol->private_value; + int i, reg; + u16 reg_val, *val; ++ __be16 tmp; + + val = (u16 *)ucontrol->value.bytes.data; + reg = NAU8822_REG_EQ1; +@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- reg_val = cpu_to_be16(reg_val); +- memcpy(val + i, ®_val, sizeof(reg_val)); ++ tmp = cpu_to_be16(reg_val); ++ memcpy(val + i, &tmp, sizeof(tmp)); + } + + return 0; +@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + void *data; + u16 *val, value; + int i, reg, ret; ++ __be16 *tmp; + + data = kmemdup(ucontrol->value.bytes.data, + params->max, GFP_KERNEL | GFP_DMA); +@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- value = be16_to_cpu(*(val + i)); ++ tmp = (__be16 *)(val + i); ++ value = be16_to_cpup(tmp); + ret = snd_soc_component_write(component, reg + i, value); + if (ret) { + dev_err(component->dev, +-- +2.43.0 + diff --git a/queue-6.1/asoc-ops-add-correct-range-check-for-limiting-volume.patch b/queue-6.1/asoc-ops-add-correct-range-check-for-limiting-volume.patch new file mode 100644 index 00000000000..f6eaba242d5 --- /dev/null +++ b/queue-6.1/asoc-ops-add-correct-range-check-for-limiting-volume.patch @@ -0,0 +1,40 @@ +From 1140f00030852680e19c085a933370f0d93848a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 12:47:35 +0000 +Subject: ASoC: ops: add correct range check for limiting volume + +From: Srinivas Kandagatla + +[ Upstream commit fb9ad24485087e0f00d84bee7a5914640b2b9024 ] + +Volume can have ranges that start with negative values, ex: -84dB to ++40dB. Apply correct range check in snd_soc_limit_volume before setting +the platform_max. Without this patch, for example setting a 0dB limit on +a volume range of -84dB to +40dB would fail. + +Signed-off-by: Srinivas Kandagatla +Tested-by: Johan Hovold +Reviewed-by: Johan Hovold +Link: https://lore.kernel.org/r/20231204124736.132185-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index 55b009d3c681..2d25748ca706 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -661,7 +661,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card, + kctl = snd_soc_card_get_kcontrol(card, name); + if (kctl) { + struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value; +- if (max <= mc->max) { ++ if (max <= mc->max - mc->min) { + mc->platform_max = max; + ret = 0; + } +-- +2.43.0 + diff --git a/queue-6.1/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch b/queue-6.1/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch new file mode 100644 index 00000000000..e8abae47907 --- /dev/null +++ b/queue-6.1/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch @@ -0,0 +1,79 @@ +From 8451638c0049b24278a231c5d952aa89361debc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 18:01:23 +0800 +Subject: ASoC: rt5650: add mutex to avoid the jack detection failure + +From: Shuming Fan + +[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ] + +This patch adds the jd_mutex to protect the jack detection control flow. +And only the headset type could check the button status. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index f86fc7cd104d..60518ee5a86e 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -448,6 +448,7 @@ struct rt5645_priv { + struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)]; + struct rt5645_eq_param_s *eq_param; + struct timer_list btn_check_timer; ++ struct mutex jd_mutex; + + int codec_type; + int sysclk; +@@ -3189,6 +3190,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + rt5645_enable_push_button_irq(component, true); + } + } else { ++ if (rt5645->en_button_func) ++ rt5645_enable_push_button_irq(component, false); + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; +@@ -3269,6 +3272,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + if (!rt5645->component) + return; + ++ mutex_lock(&rt5645->jd_mutex); ++ + switch (rt5645->pdata.jd_mode) { + case 0: /* Not using rt5645 JD */ + if (rt5645->gpiod_hp_det) { +@@ -3295,7 +3300,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) + + if (!val && (rt5645->jack_type == 0)) { /* jack in */ + report = rt5645_jack_detect(rt5645->component, 1); +- } else if (!val && rt5645->jack_type != 0) { ++ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) { + /* for push button and jack out */ + btn_type = 0; + if (snd_soc_component_read(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) { +@@ -3351,6 +3356,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + rt5645_jack_detect(rt5645->component, 0); + } + ++ mutex_unlock(&rt5645->jd_mutex); ++ + snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE); + snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + if (rt5645->en_button_func) +@@ -4119,6 +4126,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c) + } + timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0); + ++ mutex_init(&rt5645->jd_mutex); + INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); + INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work); + +-- +2.43.0 + diff --git a/queue-6.1/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch b/queue-6.1/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch new file mode 100644 index 00000000000..e64fc472cf5 --- /dev/null +++ b/queue-6.1/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch @@ -0,0 +1,37 @@ +From 152629176282853223e1768c312539ee0d847384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:44:54 +0100 +Subject: ASoC: SOF: mediatek: mt8186: Add Google Steelix topology compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit 505c83212da5bfca95109421b8f5d9f8c6cdfef2 ] + +Add the machine compatible and topology filename for the Google Steelix +MT8186 Chromebook to load the correct SOF topology file. + +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231123084454.20471-1-angelogioacchino.delregno@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/mediatek/mt8186/mt8186.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.c b/sound/soc/sof/mediatek/mt8186/mt8186.c +index 181189e00e02..76ce90e1f103 100644 +--- a/sound/soc/sof/mediatek/mt8186/mt8186.c ++++ b/sound/soc/sof/mediatek/mt8186/mt8186.c +@@ -596,6 +596,9 @@ static struct snd_sof_dsp_ops sof_mt8186_ops = { + + static struct snd_sof_of_mach sof_mt8186_machs[] = { + { ++ .compatible = "google,steelix", ++ .sof_tplg_filename = "sof-mt8186-google-steelix.tplg" ++ }, { + .compatible = "mediatek,mt8186", + .sof_tplg_filename = "sof-mt8186.tplg", + }, +-- +2.43.0 + diff --git a/queue-6.1/asoc-wm8974-correct-boost-mixer-inputs.patch b/queue-6.1/asoc-wm8974-correct-boost-mixer-inputs.patch new file mode 100644 index 00000000000..4f72439ec4e --- /dev/null +++ b/queue-6.1/asoc-wm8974-correct-boost-mixer-inputs.patch @@ -0,0 +1,49 @@ +From 69aae70780a98a347f1a6a098b604013f337190d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 15:59:16 +0000 +Subject: ASoC: wm8974: Correct boost mixer inputs + +From: Charles Keepax + +[ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ] + +Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls +the input PGA path, as can been seen from Figure 8 Input Boost Stage in +the datasheet. Update the naming of things in the driver to match this +and update the routing to also reflect this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 010a394c705c..1becbf2c6ffa 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0), + + /* Boost mixer */ + static const struct snd_kcontrol_new wm8974_boost_mixer[] = { +-SOC_DAPM_SINGLE("Aux Switch", WM8974_INPPGA, 6, 1, 1), ++SOC_DAPM_SINGLE("PGA Switch", WM8974_INPPGA, 6, 1, 1), + }; + + /* Input PGA */ +@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = { + + /* Boost Mixer */ + {"ADC", NULL, "Boost Mixer"}, +- {"Boost Mixer", "Aux Switch", "Aux Input"}, +- {"Boost Mixer", NULL, "Input PGA"}, ++ {"Boost Mixer", NULL, "Aux Input"}, ++ {"Boost Mixer", "PGA Switch", "Input PGA"}, + {"Boost Mixer", NULL, "MICP"}, + + /* Input PGA */ +-- +2.43.0 + diff --git a/queue-6.1/blk-mq-don-t-count-completed-flush-data-request-as-i.patch b/queue-6.1/blk-mq-don-t-count-completed-flush-data-request-as-i.patch new file mode 100644 index 00000000000..8f0fb88efc3 --- /dev/null +++ b/queue-6.1/blk-mq-don-t-count-completed-flush-data-request-as-i.patch @@ -0,0 +1,70 @@ +From 5581a6be039d56a93ca6e97fcccdc15d17fb65b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 16:56:05 +0800 +Subject: blk-mq: don't count completed flush data request as inflight in case + of quiesce + +From: Ming Lei + +[ Upstream commit 0e4237ae8d159e3d28f3cd83146a46f576ffb586 ] + +Request queue quiesce may interrupt flush sequence, and the original request +may have been marked as COMPLETE, but can't get finished because of +queue quiesce. + +This way is fine from driver viewpoint, because flush sequence is block +layer concept, and it isn't related with driver. + +However, driver(such as dm-rq) can call blk_mq_queue_inflight() to count & +drain inflight requests, then the wait & drain never gets done because +the completed & not-finished flush request is counted as inflight. + +Fix this issue by not counting completed flush data request as inflight in +case of quiesce. + +Cc: Mike Snitzer +Cc: David Jeffery +Cc: John Pittman +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20231201085605.577730-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 383d94615e50..368f1947c895 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1500,14 +1500,26 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q, + } + EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list); + ++static bool blk_is_flush_data_rq(struct request *rq) ++{ ++ return (rq->rq_flags & RQF_FLUSH_SEQ) && !is_flush_rq(rq); ++} ++ + static bool blk_mq_rq_inflight(struct request *rq, void *priv) + { + /* + * If we find a request that isn't idle we know the queue is busy + * as it's checked in the iter. + * Return false to stop the iteration. ++ * ++ * In case of queue quiesce, if one flush data request is completed, ++ * don't count it as inflight given the flush sequence is suspended, ++ * and the original flush data request is invisible to driver, just ++ * like other pending requests because of quiesce + */ +- if (blk_mq_request_started(rq)) { ++ if (blk_mq_request_started(rq) && !(blk_queue_quiesced(rq->q) && ++ blk_is_flush_data_rq(rq) && ++ blk_mq_request_completed(rq))) { + bool *busy = priv; + + *busy = true; +-- +2.43.0 + diff --git a/queue-6.1/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch b/queue-6.1/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch new file mode 100644 index 00000000000..b6c0c2f5839 --- /dev/null +++ b/queue-6.1/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch @@ -0,0 +1,35 @@ +From 5394374684ada5cec4dbe1ee0057820135c1e2f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 19:18:16 +0800 +Subject: clk: rockchip: rk3128: Fix HCLK_OTG gate register + +From: Weihao Li + +[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ] + +The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON. + +Signed-off-by: Weihao Li +Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3128.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c +index aa53797dbfc1..7782785a86e6 100644 +--- a/drivers/clk/rockchip/clk-rk3128.c ++++ b/drivers/clk/rockchip/clk-rk3128.c +@@ -490,7 +490,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS), + GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS), + GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS), +- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS), ++ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS), + GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS), + GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS), + GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS), +-- +2.43.0 + diff --git a/queue-6.1/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch b/queue-6.1/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch new file mode 100644 index 00000000000..0db19fd9f5e --- /dev/null +++ b/queue-6.1/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch @@ -0,0 +1,39 @@ +From 279baec9ae8d5218b38c153741605b3f6e34122b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 10:33:55 -0500 +Subject: clk: rockchip: rk3568: Add PLL rate for 292.5MHz + +From: Chris Morgan + +[ Upstream commit 1af27671f62ce919f1fb76082ed81f71cb090989 ] + +Add support for a PLL rate of 292.5MHz so that the Powkiddy RGB30 panel +can run at a requested 60hz (59.96, close enough). + +I have confirmed this rate fits with all the constraints +listed in the TRM for the VPLL (as an integer PLL) in Part 1 "Chapter +2 Clock & Reset Unit (CRU)." + +Signed-off-by: Chris Morgan +Link: https://lore.kernel.org/r/20231018153357.343142-2-macroalpha82@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3568.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/rockchip/clk-rk3568.c b/drivers/clk/rockchip/clk-rk3568.c +index 2f54f630c8b6..1ffb755feea4 100644 +--- a/drivers/clk/rockchip/clk-rk3568.c ++++ b/drivers/clk/rockchip/clk-rk3568.c +@@ -72,6 +72,7 @@ static struct rockchip_pll_rate_table rk3568_pll_rates[] = { + RK3036_PLL_RATE(408000000, 1, 68, 2, 2, 1, 0), + RK3036_PLL_RATE(312000000, 1, 78, 6, 1, 1, 0), + RK3036_PLL_RATE(297000000, 2, 99, 4, 1, 1, 0), ++ RK3036_PLL_RATE(292500000, 1, 195, 4, 4, 1, 0), + RK3036_PLL_RATE(241500000, 2, 161, 4, 2, 1, 0), + RK3036_PLL_RATE(216000000, 1, 72, 4, 2, 1, 0), + RK3036_PLL_RATE(200000000, 1, 100, 3, 4, 1, 0), +-- +2.43.0 + diff --git a/queue-6.1/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch b/queue-6.1/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch new file mode 100644 index 00000000000..1200d97fb68 --- /dev/null +++ b/queue-6.1/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch @@ -0,0 +1,118 @@ +From c480c858f191c09867b0dda2cb72301c4b4af22c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:25 +0100 +Subject: debugfs: annotate debugfs handlers vs. removal with lockdep + +From: Johannes Berg + +[ Upstream commit f4acfcd4deb158b96595250cc332901b282d15b0 ] + +When you take a lock in a debugfs handler but also try +to remove the debugfs file under that lock, things can +deadlock since the removal has to wait for all users +to finish. + +Add lockdep annotations in debugfs_file_get()/_put() +to catch such issues. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 10 ++++++++++ + fs/debugfs/inode.c | 12 ++++++++++++ + fs/debugfs/internal.h | 6 ++++++ + 3 files changed, 28 insertions(+) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index b38304b44476..375af381bf00 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -108,6 +108,12 @@ int debugfs_file_get(struct dentry *dentry) + kfree(fsd); + fsd = READ_ONCE(dentry->d_fsdata); + } ++#ifdef CONFIG_LOCKDEP ++ fsd->lock_name = kasprintf(GFP_KERNEL, "debugfs:%pd", dentry); ++ lockdep_register_key(&fsd->key); ++ lockdep_init_map(&fsd->lockdep_map, fsd->lock_name ?: "debugfs", ++ &fsd->key, 0); ++#endif + } + + /* +@@ -124,6 +130,8 @@ int debugfs_file_get(struct dentry *dentry) + if (!refcount_inc_not_zero(&fsd->active_users)) + return -EIO; + ++ lock_map_acquire_read(&fsd->lockdep_map); ++ + return 0; + } + EXPORT_SYMBOL_GPL(debugfs_file_get); +@@ -141,6 +149,8 @@ void debugfs_file_put(struct dentry *dentry) + { + struct debugfs_fsdata *fsd = READ_ONCE(dentry->d_fsdata); + ++ lock_map_release(&fsd->lockdep_map); ++ + if (refcount_dec_and_test(&fsd->active_users)) + complete(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index 08ef685167ec..8fc470aa6782 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -242,6 +242,14 @@ static void debugfs_release_dentry(struct dentry *dentry) + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; + ++ /* check it wasn't a dir (no fsdata) or automount (no real_fops) */ ++ if (fsd && fsd->real_fops) { ++#ifdef CONFIG_LOCKDEP ++ lockdep_unregister_key(&fsd->key); ++ kfree(fsd->lock_name); ++#endif ++ } ++ + kfree(fsd); + } + +@@ -745,6 +753,10 @@ static void __debugfs_file_removed(struct dentry *dentry) + fsd = READ_ONCE(dentry->d_fsdata); + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; ++ ++ lock_map_acquire(&fsd->lockdep_map); ++ lock_map_release(&fsd->lockdep_map); ++ + if (!refcount_dec_and_test(&fsd->active_users)) + wait_for_completion(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index f7c489b5a368..c7d61cfc97d2 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -7,6 +7,7 @@ + + #ifndef _DEBUGFS_INTERNAL_H_ + #define _DEBUGFS_INTERNAL_H_ ++#include + + struct file_operations; + +@@ -23,6 +24,11 @@ struct debugfs_fsdata { + struct { + refcount_t active_users; + struct completion active_users_drained; ++#ifdef CONFIG_LOCKDEP ++ struct lockdep_map lockdep_map; ++ struct lock_class_key key; ++ char *lock_name; ++#endif + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.1/debugfs-fix-automount-d_fsdata-usage.patch b/queue-6.1/debugfs-fix-automount-d_fsdata-usage.patch new file mode 100644 index 00000000000..38e50ad5ce4 --- /dev/null +++ b/queue-6.1/debugfs-fix-automount-d_fsdata-usage.patch @@ -0,0 +1,149 @@ +From df7c72cc4b1a51ceb68fde54cce7229a648db725 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:24 +0100 +Subject: debugfs: fix automount d_fsdata usage + +From: Johannes Berg + +[ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ] + +debugfs_create_automount() stores a function pointer in d_fsdata, +but since commit 7c8d469877b1 ("debugfs: add support for more +elaborate ->d_fsdata") debugfs_release_dentry() will free it, now +conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not +set for the function pointer in automount. As a result, removing +an automount dentry would attempt to free the function pointer. +Luckily, the only user of this (tracing) never removes it. + +Nevertheless, it's safer if we just handle the fsdata in one way, +namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus, +change the automount to allocate it, and use the real_fops in the +data to indicate whether or not automount is filled, rather than +adding a type tag. At least for now this isn't actually needed, +but the next changes will require it. + +Also check in debugfs_file_get() that it gets only called +on regular files, just to make things clearer. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 8 ++++++++ + fs/debugfs/inode.c | 27 ++++++++++++++++++++------- + fs/debugfs/internal.h | 10 ++++++++-- + 3 files changed, 36 insertions(+), 9 deletions(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index b54f470e0d03..b38304b44476 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry) + struct debugfs_fsdata *fsd; + void *d_fsd; + ++ /* ++ * This could only happen if some debugfs user erroneously calls ++ * debugfs_file_get() on a dentry that isn't even a file, let ++ * them know about it. ++ */ ++ if (WARN_ON(!d_is_reg(dentry))) ++ return -EINVAL; ++ + d_fsd = READ_ONCE(dentry->d_fsdata); + if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) { + fsd = d_fsd; +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index 2e8e112b1993..08ef685167ec 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -237,17 +237,19 @@ static const struct super_operations debugfs_super_operations = { + + static void debugfs_release_dentry(struct dentry *dentry) + { +- void *fsd = dentry->d_fsdata; ++ struct debugfs_fsdata *fsd = dentry->d_fsdata; + +- if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) +- kfree(dentry->d_fsdata); ++ if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) ++ return; ++ ++ kfree(fsd); + } + + static struct vfsmount *debugfs_automount(struct path *path) + { +- debugfs_automount_t f; +- f = (debugfs_automount_t)path->dentry->d_fsdata; +- return f(path->dentry, d_inode(path->dentry)->i_private); ++ struct debugfs_fsdata *fsd = path->dentry->d_fsdata; ++ ++ return fsd->automount(path->dentry, d_inode(path->dentry)->i_private); + } + + static const struct dentry_operations debugfs_dops = { +@@ -635,13 +637,23 @@ struct dentry *debugfs_create_automount(const char *name, + void *data) + { + struct dentry *dentry = start_creating(name, parent); ++ struct debugfs_fsdata *fsd; + struct inode *inode; + + if (IS_ERR(dentry)) + return dentry; + ++ fsd = kzalloc(sizeof(*fsd), GFP_KERNEL); ++ if (!fsd) { ++ failed_creating(dentry); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ fsd->automount = f; ++ + if (!(debugfs_allow & DEBUGFS_ALLOW_API)) { + failed_creating(dentry); ++ kfree(fsd); + return ERR_PTR(-EPERM); + } + +@@ -649,13 +661,14 @@ struct dentry *debugfs_create_automount(const char *name, + if (unlikely(!inode)) { + pr_err("out of free dentries, can not create automount '%s'\n", + name); ++ kfree(fsd); + return failed_creating(dentry); + } + + make_empty_dir_inode(inode); + inode->i_flags |= S_AUTOMOUNT; + inode->i_private = data; +- dentry->d_fsdata = (void *)f; ++ dentry->d_fsdata = fsd; + /* directory inodes start off with i_nlink == 2 (for "." entry) */ + inc_nlink(inode); + d_instantiate(dentry, inode); +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index 92af8ae31313..f7c489b5a368 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations; + + struct debugfs_fsdata { + const struct file_operations *real_fops; +- refcount_t active_users; +- struct completion active_users_drained; ++ union { ++ /* automount_fn is used when real_fops is NULL */ ++ debugfs_automount_t automount; ++ struct { ++ refcount_t active_users; ++ struct completion active_users_drained; ++ }; ++ }; + }; + + /* +-- +2.43.0 + diff --git a/queue-6.1/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch b/queue-6.1/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch new file mode 100644 index 00000000000..18489f78851 --- /dev/null +++ b/queue-6.1/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch @@ -0,0 +1,30 @@ +From a4901842cd2699b969448ec2eb7bad34199a04d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 14:46:19 -0500 +Subject: dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM + +From: Mike Snitzer + +[ Upstream commit 6849302fdff126997765d16df355b73231f130d4 ] + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig +index 662d219c39bf..db0e97020256 100644 +--- a/drivers/md/Kconfig ++++ b/drivers/md/Kconfig +@@ -650,6 +650,7 @@ config DM_ZONED + + config DM_AUDIT + bool "DM audit events" ++ depends on BLK_DEV_DM + depends on AUDIT + help + Generate audit events for device-mapper. +-- +2.43.0 + diff --git a/queue-6.1/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch b/queue-6.1/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch new file mode 100644 index 00000000000..f1c65c687a8 --- /dev/null +++ b/queue-6.1/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch @@ -0,0 +1,83 @@ +From 663dc440cd1ddcf2277f1f780b4eeec4a5e406bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 17:14:48 -0500 +Subject: drm/amd/display: get dprefclk ss info from integration info table + +From: Charlene Liu + +[ Upstream commit 51e7b64690776a9981355428b537af9048308a95 ] + +[why & how] +we have two SSC_En: +we get ssc_info from dce_info for MPLL_SSC_EN. +we used to call VBIOS cmdtbl's smu_info's SS persentage for DPRECLK SS info, +is used for DP AUDIO and VBIOS' smu_info table was from systemIntegrationInfoTable. + +since dcn35 VBIOS removed smu_info, driver need to use integrationInfotable directly. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Wayne Lin +Signed-off-by: Charlene Liu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/bios/bios_parser2.c | 19 ++++++++++++++----- + .../display/include/grph_object_ctrl_defs.h | 2 ++ + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index 72891d69afb6..c37fb66ec208 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -1018,13 +1018,20 @@ static enum bp_result get_ss_info_v4_5( + DC_LOG_BIOS("AS_SIGNAL_TYPE_HDMI ss_percentage: %d\n", ss_info->spread_spectrum_percentage); + break; + case AS_SIGNAL_TYPE_DISPLAY_PORT: +- ss_info->spread_spectrum_percentage = ++ if (bp->base.integrated_info) { ++ DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", bp->base.integrated_info->gpuclk_ss_percentage); ++ ss_info->spread_spectrum_percentage = ++ bp->base.integrated_info->gpuclk_ss_percentage; ++ ss_info->type.CENTER_MODE = ++ bp->base.integrated_info->gpuclk_ss_type; ++ } else { ++ ss_info->spread_spectrum_percentage = + disp_cntl_tbl->dp_ss_percentage; +- ss_info->spread_spectrum_range = ++ ss_info->spread_spectrum_range = + disp_cntl_tbl->dp_ss_rate_10hz * 10; +- if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) +- ss_info->type.CENTER_MODE = true; +- ++ if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) ++ ss_info->type.CENTER_MODE = true; ++ } + DC_LOG_BIOS("AS_SIGNAL_TYPE_DISPLAY_PORT ss_percentage: %d\n", ss_info->spread_spectrum_percentage); + break; + case AS_SIGNAL_TYPE_GPU_PLL: +@@ -2836,6 +2843,8 @@ static enum bp_result get_integrated_info_v2_2( + info->ma_channel_number = info_v2_2->umachannelnumber; + info->dp_ss_control = + le16_to_cpu(info_v2_2->reserved1); ++ info->gpuclk_ss_percentage = info_v2_2->gpuclk_ss_percentage; ++ info->gpuclk_ss_type = info_v2_2->gpuclk_ss_type; + + for (i = 0; i < NUMBER_OF_UCHAR_FOR_GUID; ++i) { + info->ext_disp_conn_info.gu_id[i] = +diff --git a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h +index bc96d0211360..813463ffe15c 100644 +--- a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h ++++ b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h +@@ -417,6 +417,8 @@ struct integrated_info { + /* V2.1 */ + struct edp_info edp1_info; + struct edp_info edp2_info; ++ uint32_t gpuclk_ss_percentage; ++ uint32_t gpuclk_ss_type; + }; + + /* +-- +2.43.0 + diff --git a/queue-6.1/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch b/queue-6.1/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch new file mode 100644 index 00000000000..ad7240b284f --- /dev/null +++ b/queue-6.1/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch @@ -0,0 +1,65 @@ +From 77b747357a079c694c8f9a5f2cedfcb104a38b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 14:55:37 -0400 +Subject: drm/amd/display: update dcn315 lpddr pstate latency + +From: Dmytro Laktyushkin + +[ Upstream commit c92da0403d373c03ea5c65c0260c7db6762013b0 ] + +[WHY/HOW] +Increase the pstate latency to improve ac/dc transition + +Reviewed-by: Charlene Liu +Acked-by: Tom Chung +Signed-off-by: Dmytro Laktyushkin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index 893991a0eb97..28b83133db91 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -324,7 +324,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_A, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -332,7 +332,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_B, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -340,7 +340,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_C, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -348,7 +348,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_D, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +-- +2.43.0 + diff --git a/queue-6.1/drm-amd-display-use-channel_width-2-for-vram-table-3.patch b/queue-6.1/drm-amd-display-use-channel_width-2-for-vram-table-3.patch new file mode 100644 index 00000000000..db13816df90 --- /dev/null +++ b/queue-6.1/drm-amd-display-use-channel_width-2-for-vram-table-3.patch @@ -0,0 +1,45 @@ +From ab7e61464f35014234d5e303c425968123d0ad13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 06:25:07 -0700 +Subject: drm/amd/display: Use channel_width = 2 for vram table 3.0 + +From: Alvin Lee + +[ Upstream commit fec05adc40c25a028c9dfa9d540f800a2d433f80 ] + +VBIOS has suggested to use channel_width=2 for any ASIC that uses vram +info 3.0. This is because channel_width in the vram table no longer +represents the memory width + +Tested-by: Daniel Wheeler +Reviewed-by: Samson Tam +Acked-by: Rodrigo Siqueira +Signed-off-by: Alvin Lee +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index e507d2e1410b..72891d69afb6 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -2402,7 +2402,13 @@ static enum bp_result get_vram_info_v30( + return BP_RESULT_BADBIOSTABLE; + + info->num_chans = info_v30->channel_num; +- info->dram_channel_width_bytes = (1 << info_v30->channel_width) / 8; ++ /* As suggested by VBIOS we should always use ++ * dram_channel_width_bytes = 2 when using VRAM ++ * table version 3.0. This is because the channel_width ++ * param in the VRAM info table is changed in 7000 series and ++ * no longer represents the memory channel width. ++ */ ++ info->dram_channel_width_bytes = 2; + + return result; + } +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-add-null-checks-for-function-pointers.patch b/queue-6.1/drm-amdgpu-add-null-checks-for-function-pointers.patch new file mode 100644 index 00000000000..c8e3e96a2de --- /dev/null +++ b/queue-6.1/drm-amdgpu-add-null-checks-for-function-pointers.patch @@ -0,0 +1,55 @@ +From 4f0a9034ee589a8a0616924b87ea2ea548375e26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 12:37:34 +0530 +Subject: drm/amdgpu: Add NULL checks for function pointers + +From: Lijo Lazar + +[ Upstream commit 81577503efb49f4ad76af22f9941d72900ef4aab ] + +Check if function is implemented before making the call. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 2eddd7f6cd41..811dd3ea6362 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1411,9 +1411,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) + if (amdgpu_sriov_vf(adev)) + *flags = 0; + +- adev->nbio.funcs->get_clockgating_state(adev, flags); ++ if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state) ++ adev->nbio.funcs->get_clockgating_state(adev, flags); + +- adev->hdp.funcs->get_clock_gating_state(adev, flags); ++ if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state) ++ adev->hdp.funcs->get_clock_gating_state(adev, flags); + + if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(13, 0, 2)) { + +@@ -1429,9 +1431,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) + } + + /* AMD_CG_SUPPORT_ROM_MGCG */ +- adev->smuio.funcs->get_clock_gating_state(adev, flags); ++ if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state) ++ adev->smuio.funcs->get_clock_gating_state(adev, flags); + +- adev->df.funcs->get_clockgating_state(adev, flags); ++ if (adev->df.funcs && adev->df.funcs->get_clockgating_state) ++ adev->df.funcs->get_clockgating_state(adev, flags); + } + + static int soc15_common_set_powergating_state(void *handle, +-- +2.43.0 + diff --git a/queue-6.1/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch b/queue-6.1/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch new file mode 100644 index 00000000000..9656cc61106 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch @@ -0,0 +1,56 @@ +From 88dd169f257cfce5a4f25371f0c5cc31426ac776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:22:34 +0800 +Subject: drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null + pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lu Yao + +[ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ] + +For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init +'didt_rreg' and 'didt_wreg' to 'NULL'. But in func +'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' +lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use +these two definitions won't be added for 'AMDGPU_FAMILY_SI'. + +So, add null pointer judgment before calling. + +Reviewed-by: Christian König +Signed-off-by: Lu Yao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index fd796574f87a..8123feb1a116 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -479,6 +479,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_rreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +@@ -535,6 +538,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_wreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +-- +2.43.0 + diff --git a/queue-6.1/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch b/queue-6.1/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch new file mode 100644 index 00000000000..1b68049b146 --- /dev/null +++ b/queue-6.1/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch @@ -0,0 +1,79 @@ +From 4dedd4d506ad348b76fa0f5c465a3ce948e46315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 09:14:46 -0700 +Subject: drm/crtc: Fix uninit-value bug in drm_mode_setcrtc + +From: Ziqi Zhao + +[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] + +The connector_set contains uninitialized values when allocated with +kmalloc_array. However, in the "out" branch, the logic assumes that any +element in connector_set would be equal to NULL if failed to +initialize, which causes the bug reported by Syzbot. The fix is to use +an extra variable to keep track of how many connectors are initialized +indeed, and use that variable to decrease any refcounts in the "out" +branch. + +Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Signed-off-by: Ziqi Zhao +Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Tested-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index df9bf3c9206e..d718c17ab1e9 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -715,8 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret; +- int i; ++ int ret, i, num_connectors; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -851,6 +850,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + ++ num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +@@ -871,6 +871,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + connector->name); + + connector_set[i] = connector; ++ num_connectors++; + } + } + +@@ -879,7 +880,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + set.y = crtc_req->y; + set.mode = mode; + set.connectors = connector_set; +- set.num_connectors = crtc_req->count_connectors; ++ set.num_connectors = num_connectors; + set.fb = fb; + + if (drm_drv_uses_atomic_modeset(dev)) +@@ -892,7 +893,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + drm_framebuffer_put(fb); + + if (connector_set) { +- for (i = 0; i < crtc_req->count_connectors; i++) { ++ for (i = 0; i < num_connectors; i++) { + if (connector_set[i]) + drm_connector_put(connector_set[i]); + } +-- +2.43.0 + diff --git a/queue-6.1/drm-crtc-fix-uninitialized-variable-use.patch b/queue-6.1/drm-crtc-fix-uninitialized-variable-use.patch new file mode 100644 index 00000000000..4fe2efee35c --- /dev/null +++ b/queue-6.1/drm-crtc-fix-uninitialized-variable-use.patch @@ -0,0 +1,54 @@ +From 000aa40a783d48036cbc5b81eeaff840d12e2cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:12:38 +0200 +Subject: drm/crtc: fix uninitialized variable use + +From: Jani Nikula + +[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ] + +Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in +drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, +but introduced another. + +num_connectors is only initialized if crtc_req->count_connectors > 0, +but it's used regardless. Fix it. + +Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") +Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Cc: Ziqi Zhao +Cc: Maxime Ripard +Cc: Maarten Lankhorst +Cc: Thomas Zimmermann +Signed-off-by: Jani Nikula +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index d718c17ab1e9..cb90e70d85e8 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -715,7 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret, i, num_connectors; ++ int ret, i, num_connectors = 0; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -850,7 +850,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + +- num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +-- +2.43.0 + diff --git a/queue-6.1/drm-exynos-fix-a-potential-error-pointer-dereference.patch b/queue-6.1/drm-exynos-fix-a-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..b8509c71a58 --- /dev/null +++ b/queue-6.1/drm-exynos-fix-a-potential-error-pointer-dereference.patch @@ -0,0 +1,40 @@ +From 64dd8c6445a9d5b5596259b738fb4b1310d42f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 14:27:48 +0800 +Subject: drm/exynos: fix a potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ] + +Smatch reports the warning below: +drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind() +error: 'crtc' dereferencing possible ERR_PTR() + +The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), +which can not be used directly. Fix this by checking the return value +before using it. + +Signed-off-by: Xiang Yang +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index b7c11bdce2c8..1a7194a653ae 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1861,6 +1861,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data) + return ret; + + crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI); ++ if (IS_ERR(crtc)) ++ return PTR_ERR(crtc); + crtc->pipe_clk = &hdata->phy_clk; + + ret = hdmi_create_connector(encoder); +-- +2.43.0 + diff --git a/queue-6.1/drm-exynos-fix-a-wrong-error-checking.patch b/queue-6.1/drm-exynos-fix-a-wrong-error-checking.patch new file mode 100644 index 00000000000..2abb16a865b --- /dev/null +++ b/queue-6.1/drm-exynos-fix-a-wrong-error-checking.patch @@ -0,0 +1,62 @@ +From 19ee370b12dc5d74abfbc3a3a26ea8cf4929f6ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 18:36:51 +0900 +Subject: drm/exynos: fix a wrong error checking + +From: Inki Dae + +[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ] + +Fix a wrong error checking in exynos_drm_dma.c module. + +In the exynos_drm_register_dma function, both arm_iommu_create_mapping() +and iommu_get_domain_for_dev() functions are expected to return NULL as +an error. + +However, the error checking is performed using the statement +if(IS_ERR(mapping)), which doesn't provide a suitable error value. +So check if 'mapping' is NULL, and if it is, return -ENODEV. + +This issue[1] was reported by Dan. + +Changelog v1: +- fix build warning. + +[1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ + +Reported-by : Dan Carpenter +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c +index a971590b8132..e2c7373f20c6 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c +@@ -107,18 +107,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, + return 0; + + if (!priv->mapping) { +- void *mapping; ++ void *mapping = NULL; + + if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) + mapping = arm_iommu_create_mapping(&platform_bus_type, + EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); + else if (IS_ENABLED(CONFIG_IOMMU_DMA)) + mapping = iommu_get_domain_for_dev(priv->dma_dev); +- else +- mapping = ERR_PTR(-ENODEV); + +- if (IS_ERR(mapping)) +- return PTR_ERR(mapping); ++ if (!mapping) ++ return -ENODEV; + priv->mapping = mapping; + } + +-- +2.43.0 + diff --git a/queue-6.1/hid-nintendo-fix-initializer-element-is-not-constant.patch b/queue-6.1/hid-nintendo-fix-initializer-element-is-not-constant.patch new file mode 100644 index 00000000000..27006822726 --- /dev/null +++ b/queue-6.1/hid-nintendo-fix-initializer-element-is-not-constant.patch @@ -0,0 +1,81 @@ +From de3970d5efdc636d092677a5e0195660fa15ae1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 09:25:41 -0800 +Subject: HID: nintendo: fix initializer element is not constant error + +From: Ryan McClelland + +[ Upstream commit 0b7dd38c1c520b650a889a81919838671b689eb9 ] + +With gcc-7 builds, an error happens with the controller button values being +defined as const. Change to a define. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312141227.C2h1IzfI-lkp@intel.com/ + +Signed-off-by: Ryan McClelland +Reviewed-by: Daniel J. Ogorchock +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 44 +++++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index 8a8a3dd8af0c..907c9b574e3b 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -325,28 +325,28 @@ struct joycon_imu_cal { + * All the controller's button values are stored in a u32. + * They can be accessed with bitwise ANDs. + */ +-static const u32 JC_BTN_Y = BIT(0); +-static const u32 JC_BTN_X = BIT(1); +-static const u32 JC_BTN_B = BIT(2); +-static const u32 JC_BTN_A = BIT(3); +-static const u32 JC_BTN_SR_R = BIT(4); +-static const u32 JC_BTN_SL_R = BIT(5); +-static const u32 JC_BTN_R = BIT(6); +-static const u32 JC_BTN_ZR = BIT(7); +-static const u32 JC_BTN_MINUS = BIT(8); +-static const u32 JC_BTN_PLUS = BIT(9); +-static const u32 JC_BTN_RSTICK = BIT(10); +-static const u32 JC_BTN_LSTICK = BIT(11); +-static const u32 JC_BTN_HOME = BIT(12); +-static const u32 JC_BTN_CAP = BIT(13); /* capture button */ +-static const u32 JC_BTN_DOWN = BIT(16); +-static const u32 JC_BTN_UP = BIT(17); +-static const u32 JC_BTN_RIGHT = BIT(18); +-static const u32 JC_BTN_LEFT = BIT(19); +-static const u32 JC_BTN_SR_L = BIT(20); +-static const u32 JC_BTN_SL_L = BIT(21); +-static const u32 JC_BTN_L = BIT(22); +-static const u32 JC_BTN_ZL = BIT(23); ++#define JC_BTN_Y BIT(0) ++#define JC_BTN_X BIT(1) ++#define JC_BTN_B BIT(2) ++#define JC_BTN_A BIT(3) ++#define JC_BTN_SR_R BIT(4) ++#define JC_BTN_SL_R BIT(5) ++#define JC_BTN_R BIT(6) ++#define JC_BTN_ZR BIT(7) ++#define JC_BTN_MINUS BIT(8) ++#define JC_BTN_PLUS BIT(9) ++#define JC_BTN_RSTICK BIT(10) ++#define JC_BTN_LSTICK BIT(11) ++#define JC_BTN_HOME BIT(12) ++#define JC_BTN_CAP BIT(13) /* capture button */ ++#define JC_BTN_DOWN BIT(16) ++#define JC_BTN_UP BIT(17) ++#define JC_BTN_RIGHT BIT(18) ++#define JC_BTN_LEFT BIT(19) ++#define JC_BTN_SR_L BIT(20) ++#define JC_BTN_SL_L BIT(21) ++#define JC_BTN_L BIT(22) ++#define JC_BTN_ZL BIT(23) + + enum joycon_msg_type { + JOYCON_MSG_TYPE_NONE, +-- +2.43.0 + diff --git a/queue-6.1/hid-nintendo-prevent-divide-by-zero-on-code.patch b/queue-6.1/hid-nintendo-prevent-divide-by-zero-on-code.patch new file mode 100644 index 00000000000..f7a280013cb --- /dev/null +++ b/queue-6.1/hid-nintendo-prevent-divide-by-zero-on-code.patch @@ -0,0 +1,102 @@ +From b51cfd2a226fef306b59eb54199fe3c8e1301c26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 18:15:51 -0300 +Subject: HID: nintendo: Prevent divide-by-zero on code + +From: Guilherme G. Piccoli + +[ Upstream commit 6eb04ca8c52e3f8c8ea7102ade81d642eee87f4a ] + +It was reported [0] that adding a generic joycon to the system caused +a kernel crash on Steam Deck, with the below panic spew: + +divide error: 0000 [#1] PREEMPT SMP NOPTI +[...] +Hardware name: Valve Jupiter/Jupiter, BIOS F7A0119 10/24/2023 +RIP: 0010:nintendo_hid_event+0x340/0xcc1 [hid_nintendo] +[...] +Call Trace: + [...] + ? exc_divide_error+0x38/0x50 + ? nintendo_hid_event+0x340/0xcc1 [hid_nintendo] + ? asm_exc_divide_error+0x1a/0x20 + ? nintendo_hid_event+0x307/0xcc1 [hid_nintendo] + hid_input_report+0x143/0x160 + hidp_session_run+0x1ce/0x700 [hidp] + +Since it's a divide-by-0 error, by tracking the code for potential +denominator issues, we've spotted 2 places in which this could happen; +so let's guard against the possibility and log in the kernel if the +condition happens. This is specially useful since some data that +fills some denominators are read from the joycon HW in some cases, +increasing the potential for flaws. + +[0] https://github.com/ValveSoftware/SteamOS/issues/1070 + +Signed-off-by: Guilherme G. Piccoli +Tested-by: Sam Lantinga +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index 907c9b574e3b..df07e3ae0ffb 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -859,14 +859,27 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr) + */ + static void joycon_calc_imu_cal_divisors(struct joycon_ctlr *ctlr) + { +- int i; ++ int i, divz = 0; + + for (i = 0; i < 3; i++) { + ctlr->imu_cal_accel_divisor[i] = ctlr->accel_cal.scale[i] - + ctlr->accel_cal.offset[i]; + ctlr->imu_cal_gyro_divisor[i] = ctlr->gyro_cal.scale[i] - + ctlr->gyro_cal.offset[i]; ++ ++ if (ctlr->imu_cal_accel_divisor[i] == 0) { ++ ctlr->imu_cal_accel_divisor[i] = 1; ++ divz++; ++ } ++ ++ if (ctlr->imu_cal_gyro_divisor[i] == 0) { ++ ctlr->imu_cal_gyro_divisor[i] = 1; ++ divz++; ++ } + } ++ ++ if (divz) ++ hid_warn(ctlr->hdev, "inaccurate IMU divisors (%d)\n", divz); + } + + static const s16 DFLT_ACCEL_OFFSET /*= 0*/; +@@ -1095,16 +1108,16 @@ static void joycon_parse_imu_report(struct joycon_ctlr *ctlr, + JC_IMU_SAMPLES_PER_DELTA_AVG) { + ctlr->imu_avg_delta_ms = ctlr->imu_delta_samples_sum / + ctlr->imu_delta_samples_count; +- /* don't ever want divide by zero shenanigans */ +- if (ctlr->imu_avg_delta_ms == 0) { +- ctlr->imu_avg_delta_ms = 1; +- hid_warn(ctlr->hdev, +- "calculated avg imu delta of 0\n"); +- } + ctlr->imu_delta_samples_count = 0; + ctlr->imu_delta_samples_sum = 0; + } + ++ /* don't ever want divide by zero shenanigans */ ++ if (ctlr->imu_avg_delta_ms == 0) { ++ ctlr->imu_avg_delta_ms = 1; ++ hid_warn(ctlr->hdev, "calculated avg imu delta of 0\n"); ++ } ++ + /* useful for debugging IMU sample rate */ + hid_dbg(ctlr->hdev, + "imu_report: ms=%u last_ms=%u delta=%u avg_delta=%u\n", +-- +2.43.0 + diff --git a/queue-6.1/hwmon-corsair-psu-fix-probe-when-built-in.patch b/queue-6.1/hwmon-corsair-psu-fix-probe-when-built-in.patch new file mode 100644 index 00000000000..06ea7b00981 --- /dev/null +++ b/queue-6.1/hwmon-corsair-psu-fix-probe-when-built-in.patch @@ -0,0 +1,57 @@ +From 249ff2a8be9beeb22cebedd33920a96994f2c821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 22:07:23 +0100 +Subject: hwmon: (corsair-psu) Fix probe when built-in + +From: Armin Wolf + +[ Upstream commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e ] + +It seems that when the driver is built-in, the HID bus is +initialized after the driver is loaded, which whould cause +module_hid_driver() to fail. +Fix this by registering the driver after the HID bus using +late_initcall() in accordance with other hwmon HID drivers. + +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231207210723.222552-1-W_Armin@gmx.de +[groeck: Dropped "compile tested" comment; the patch has been tested + but the tester did not provide a Tested-by: tag] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/corsair-psu.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c +index 2210aa62e3d0..ec7f27a6ce01 100644 +--- a/drivers/hwmon/corsair-psu.c ++++ b/drivers/hwmon/corsair-psu.c +@@ -837,7 +837,23 @@ static struct hid_driver corsairpsu_driver = { + .reset_resume = corsairpsu_resume, + #endif + }; +-module_hid_driver(corsairpsu_driver); ++ ++static int __init corsair_init(void) ++{ ++ return hid_register_driver(&corsairpsu_driver); ++} ++ ++static void __exit corsair_exit(void) ++{ ++ hid_unregister_driver(&corsairpsu_driver); ++} ++ ++/* ++ * With module_init() the driver would load before the HID bus when ++ * built-in, so use late_initcall() instead. ++ */ ++late_initcall(corsair_init); ++module_exit(corsair_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Wilken Gottwalt "); +-- +2.43.0 + diff --git a/queue-6.1/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch b/queue-6.1/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch new file mode 100644 index 00000000000..456cfa94077 --- /dev/null +++ b/queue-6.1/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch @@ -0,0 +1,38 @@ +From 2af0856742825c581bb6dcb02a3f6dc89ae0414f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 16:47:30 +0800 +Subject: hwtracing: hisi_ptt: Don't try to attach a task + +From: Yicong Yang + +[ Upstream commit aff787f64ad7cbb54614b51b82c682fe06411ef3 ] + +PTT is an uncore PMU and shouldn't be attached to any task. Block +the usage in pmu::event_init(). + +Signed-off-by: Yicong Yang +Acked-by: Jonathan Cameron +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20231010084731.30450-5-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 11f26ef709c9..8d8fa8e8afe0 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -659,6 +659,9 @@ static int hisi_ptt_pmu_event_init(struct perf_event *event) + return -EOPNOTSUPP; + } + ++ if (event->attach_state & PERF_ATTACH_TASK) ++ return -EOPNOTSUPP; ++ + if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type) + return -ENOENT; + +-- +2.43.0 + diff --git a/queue-6.1/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch b/queue-6.1/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch new file mode 100644 index 00000000000..e3d8f4490cc --- /dev/null +++ b/queue-6.1/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch @@ -0,0 +1,50 @@ +From f167ff4d22ab1862a942696f1a21d06061057743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 16:47:28 +0800 +Subject: hwtracing: hisi_ptt: Handle the interrupt in hardirq context + +From: Yicong Yang + +[ Upstream commit e0dd27ad8af00f147ac3c9de88e0687986afc3ea ] + +Handle the trace interrupt in the hardirq context, make sure the irq +core won't threaded it by declaring IRQF_NO_THREAD and userspace won't +balance it by declaring IRQF_NOBALANCING. Otherwise we may violate the +synchronization requirements of the perf core, referenced to the +change of arm-ccn PMU + commit 0811ef7e2f54 ("bus: arm-ccn: fix PMU interrupt flags"). + +In the interrupt handler we mainly doing 2 things: +- Copy the data from the local DMA buffer to the AUX buffer +- Commit the data in the AUX buffer + +Signed-off-by: Yicong Yang +Acked-by: Jonathan Cameron +[ Fixed commit description to suppress checkpatch warning ] +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20231010084731.30450-3-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 016220ba0add..11f26ef709c9 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -342,9 +342,9 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) + return ret; + + hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ); +- ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq, +- NULL, hisi_ptt_isr, 0, +- DRV_NAME, hisi_ptt); ++ ret = devm_request_irq(&pdev->dev, hisi_ptt->trace_irq, hisi_ptt_isr, ++ IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, ++ hisi_ptt); + if (ret) { + pci_err(pdev, "failed to request irq %d, ret = %d\n", + hisi_ptt->trace_irq, ret); +-- +2.43.0 + diff --git a/queue-6.1/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch b/queue-6.1/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch new file mode 100644 index 00000000000..1293099a9ca --- /dev/null +++ b/queue-6.1/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch @@ -0,0 +1,84 @@ +From 2ca91f74fb80f06fd0807e03fdd125e5e60a9eda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:21:59 +0800 +Subject: i2c: rk3x: fix potential spinlock recursion on poll + +From: Jensen Huang + +[ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ] + +Possible deadlock scenario (on reboot): +rk3x_i2c_xfer_common(polling) + -> rk3x_i2c_wait_xfer_poll() + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); + ... + + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); (deadlock here) + +Store the IRQ number and disable/enable it around the polling transfer. +This patch has been tested on NanoPC-T4. + +Signed-off-by: Jensen Huang +Reviewed-by: Heiko Stuebner +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index b31cf4f18f85..6aa4f1f06240 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data { + * @clk: function clk for rk3399 or function & Bus clks for others + * @pclk: Bus clk for rk3399 + * @clk_rate_nb: i2c clk rate change notify ++ * @irq: irq number + * @t: I2C known timing information + * @lock: spinlock for the i2c bus + * @wait: the waitqueue to wait for i2c transfer +@@ -200,6 +201,7 @@ struct rk3x_i2c { + struct clk *clk; + struct clk *pclk; + struct notifier_block clk_rate_nb; ++ int irq; + + /* Settings */ + struct i2c_timings t; +@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap, + + spin_unlock_irqrestore(&i2c->lock, flags); + +- rk3x_i2c_start(i2c); +- + if (!polling) { ++ rk3x_i2c_start(i2c); ++ + timeout = wait_event_timeout(i2c->wait, !i2c->busy, + msecs_to_jiffies(WAIT_TIMEOUT)); + } else { ++ disable_irq(i2c->irq); ++ rk3x_i2c_start(i2c); ++ + timeout = rk3x_i2c_wait_xfer_poll(i2c); ++ ++ enable_irq(i2c->irq); + } + + spin_lock_irqsave(&i2c->lock, flags); +@@ -1310,6 +1317,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev) + return ret; + } + ++ i2c->irq = irq; ++ + platform_set_drvdata(pdev, i2c); + + if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) { +-- +2.43.0 + diff --git a/queue-6.1/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch b/queue-6.1/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch new file mode 100644 index 00000000000..e13aedb6d95 --- /dev/null +++ b/queue-6.1/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch @@ -0,0 +1,99 @@ +From 704eac5599c3ab32f5490364bfe934c85caaa018 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 16:53:57 +0000 +Subject: ida: Fix crash in ida_free when the bitmap is empty + +From: Matthew Wilcox (Oracle) + +[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ] + +The IDA usually detects double-frees, but that detection failed to +consider the case when there are no nearby IDs allocated and so we have a +NULL bitmap rather than simply having a clear bit. Add some tests to the +test-suite to be sure we don't inadvertently reintroduce this problem. +Unfortunately they're quite noisy so include a message to disregard +the warnings. + +Reported-by: Zhenghan Wang +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/idr.c | 2 +- + lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/lib/idr.c b/lib/idr.c +index 13f2758c2377..da36054c3ca0 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) + goto delete; + xas_store(&xas, xa_mk_value(v)); + } else { +- if (!test_bit(bit, bitmap->bitmap)) ++ if (!bitmap || !test_bit(bit, bitmap->bitmap)) + goto err; + __clear_bit(bit, bitmap->bitmap); + xas_set_mark(&xas, XA_FREE_MARK); +diff --git a/lib/test_ida.c b/lib/test_ida.c +index b06880625961..55105baa19da 100644 +--- a/lib/test_ida.c ++++ b/lib/test_ida.c +@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) + IDA_BUG_ON(ida, !ida_is_empty(ida)); + } + ++/* ++ * Check various situations where we attempt to free an ID we don't own. ++ */ ++static void ida_check_bad_free(struct ida *ida) ++{ ++ unsigned long i; ++ ++ printk("vvv Ignore \"not allocated\" warnings\n"); ++ /* IDA is empty; all of these will fail */ ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single value entry */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single bitmap */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a tree */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ printk("^^^ \"not allocated\" warnings over\n"); ++ ++ ida_free(ida, 3); ++ ida_free(ida, 1023); ++ ida_free(ida, (1 << 20) - 1); ++ ++ IDA_BUG_ON(ida, !ida_is_empty(ida)); ++} ++ + static DEFINE_IDA(ida); + + static int ida_checks(void) +@@ -162,6 +201,7 @@ static int ida_checks(void) + ida_check_leaf(&ida, 1024 * 64); + ida_check_max(&ida); + ida_check_conv(&ida); ++ ida_check_bad_free(&ida); + + printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); + return (tests_run != tests_passed) ? 0 : -EINVAL; +-- +2.43.0 + diff --git a/queue-6.1/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch b/queue-6.1/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch new file mode 100644 index 00000000000..ceecd7c515e --- /dev/null +++ b/queue-6.1/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch @@ -0,0 +1,126 @@ +From 1a532929db83997b82ad0a7f943dc98cb9bbde87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:59:24 -0800 +Subject: Input: atkbd - skip ATKBD_CMD_GETID in translated mode + +From: Hans de Goede + +[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ] + +There have been multiple reports of keyboard issues on recent laptop models +which can be worked around by setting i8042.dumbkbd, with the downside +being this breaks the capslock LED. + +It seems that these issues are caused by recent laptops getting confused by +ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for +this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode. + +The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 +mice/touchpads and those are never used in translated mode. + +Examples of laptop models which benefit from skipping ATKBD_CMD_GETID: + +* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" + models the kbd stops working for the first 2 - 5 minutes after boot + (waiting for EC watchdog reset?) + +* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard + +* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see: + https://github.com/yescallop/atkbd-nogetid + +This has been tested on: + +1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not + in translated mode when no keyboard is plugged in and with a ps/2 kbd + a "AT Translated Set 2 keyboard" /dev/input/event# node shows up + +2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard) + +Reported-by: Shang Ye +Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/ +Closes: https://github.com/yescallop/atkbd-nogetid +Reported-by: gurevitch +Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/ +Reported-by: Egor Ignatov +Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/ +Reported-by: Anton Zhilyaev +Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/ +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- + 1 file changed, 42 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index 246958795f60..e1e4f1133296 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -746,6 +746,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) + ps2dev->serio->phys); + } + ++#ifdef CONFIG_X86 ++static bool atkbd_is_portable_device(void) ++{ ++ static const char * const chassis_types[] = { ++ "8", /* Portable */ ++ "9", /* Laptop */ ++ "10", /* Notebook */ ++ "14", /* Sub-Notebook */ ++ "31", /* Convertible */ ++ "32", /* Detachable */ ++ }; ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(chassis_types); i++) ++ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i])) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops ++ * the controller is always in translated mode. In this mode mice/touchpads will ++ * not work. So in this case simply assume a keyboard is connected to avoid ++ * confusing some laptop keyboards. ++ * ++ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is ++ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in ++ * translated mode that is a no-op. ++ */ ++static bool atkbd_skip_getid(struct atkbd *atkbd) ++{ ++ return atkbd->translated && atkbd_is_portable_device(); ++} ++#else ++static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; } ++#endif ++ + /* + * atkbd_probe() probes for an AT keyboard on a serio port. + */ +@@ -775,12 +813,12 @@ static int atkbd_probe(struct atkbd *atkbd) + */ + + param[0] = param[1] = 0xa5; /* initialize with invalid values */ +- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { ++ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { + + /* +- * If the get ID command failed, we check if we can at least set the LEDs on +- * the keyboard. This should work on every keyboard out there. It also turns +- * the LEDs off, which we want anyway. ++ * If the get ID command was skipped or failed, we check if we can at least set ++ * the LEDs on the keyboard. This should work on every keyboard out there. ++ * It also turns the LEDs off, which we want anyway. + */ + param[0] = 0; + if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) +-- +2.43.0 + diff --git a/queue-6.1/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch b/queue-6.1/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch new file mode 100644 index 00000000000..6d2f6545dde --- /dev/null +++ b/queue-6.1/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch @@ -0,0 +1,45 @@ +From 34282635c9c8349ae01ddbba73c18bcfb27e6657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 19:56:19 +0000 +Subject: Input: i8042 - add nomux quirk for Acer P459-G2-M + +From: Esther Shimanovich + +[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ] + +After the laptop lid is opened, and the device resumes from S3 deep +sleep, if the user presses a keyboard key while the screen is still black, +the mouse and keyboard become unusable. + +Enabling this quirk prevents this behavior from occurring. + +Signed-off-by: Esther Shimanovich +Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index 9c39553d30fa..b585b1dab870 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -360,6 +360,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK) + }, ++ { ++ /* Acer TravelMate P459-G2-M */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Amoi M636/A737 */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.1/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch b/queue-6.1/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch new file mode 100644 index 00000000000..1bc9aaf6f04 --- /dev/null +++ b/queue-6.1/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch @@ -0,0 +1,49 @@ +From cd2c30f255ae6c5982414bd4964643131e5c3117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:50:23 +0000 +Subject: Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Pekkarinen + +[ Upstream commit c1f342f35f820b33390571293498c3e2e9bc77ec ] + +Observed on dmesg of my laptop I see the following +output: + +[ 19.898700] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694] +[ 19.936057] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..] +[ 19.936076] psmouse serio1: synaptics: Your touchpad (PNP: LEN0411 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org. +[ 20.008901] psmouse serio1: synaptics: Touchpad model: 1, fw: 10.32, id: 0x1e2a1, caps: 0xf014a3/0x940300/0x12e800/0x500000, board id: 3471, fw id: 2909640 +[ 20.008925] psmouse serio1: synaptics: serio: Synaptics pass-through port at isa0060/serio1/input0 +[ 20.053344] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio1/input/input7 +[ 20.397608] mousedev: PS/2 mouse device common for all mice + +This patch will add its pnp id to the smbus list to +produce the setup of intertouch for the device. + +Signed-off-by: José Pekkarinen +Link: https://lore.kernel.org/r/20231114063607.71772-1-jose.pekkarinen@foxhound.fi +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index e43e93ac2798..b6749af46262 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -183,6 +183,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN009b", /* T580 */ + "LEN0402", /* X1 Extreme Gen 2 / P1 Gen 2 */ + "LEN040f", /* P1 Gen 3 */ ++ "LEN0411", /* L14 Gen 1 */ + "LEN200f", /* T450s */ + "LEN2044", /* L470 */ + "LEN2054", /* E480 */ +-- +2.43.0 + diff --git a/queue-6.1/input-xpad-add-razer-wolverine-v2-support.patch b/queue-6.1/input-xpad-add-razer-wolverine-v2-support.patch new file mode 100644 index 00000000000..42ec59db644 --- /dev/null +++ b/queue-6.1/input-xpad-add-razer-wolverine-v2-support.patch @@ -0,0 +1,34 @@ +From d9597bf89a224699f1de164e5dc562de1002d27b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 17:22:15 +0100 +Subject: Input: xpad - add Razer Wolverine V2 support + +From: Luca Weiss + +[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ] + +Add the VID and PID of Razer Wolverine V2 to xpad_device. + +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 8404286302b0..e8011d70d079 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -286,6 +286,7 @@ static const struct xpad_device { + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, +-- +2.43.0 + diff --git a/queue-6.1/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch b/queue-6.1/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch new file mode 100644 index 00000000000..e5b606af0b4 --- /dev/null +++ b/queue-6.1/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch @@ -0,0 +1,41 @@ +From f81a50717da73173f3c90cb2cba57aa2d96374ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:39 +0800 +Subject: jbd2: correct the printing of write_flags in jbd2_write_superblock() + +From: Zhang Yi + +[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ] + +The write_flags print in the trace of jbd2_write_superblock() is not +real, so move the modification before the trace. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 2696f43e7239..611337b0b5ad 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1620,9 +1620,11 @@ static int jbd2_write_superblock(journal_t *journal, blk_opf_t write_flags) + return -EIO; + } + +- trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); ++ ++ trace_jbd2_write_superblock(journal, write_flags); ++ + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +-- +2.43.0 + diff --git a/queue-6.1/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch b/queue-6.1/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch new file mode 100644 index 00000000000..cfa2fc348b5 --- /dev/null +++ b/queue-6.1/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch @@ -0,0 +1,82 @@ +From 3563e286e49740e817c2bfb5fc1c1bbc40814da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:25:44 +0800 +Subject: jbd2: fix soft lockup in journal_finish_inode_data_buffers() + +From: Ye Bin + +[ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ] + +There's issue when do io test: +WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] +CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xb0/0x100 + watchdog_timer_fn+0x254/0x3f8 + __hrtimer_run_queues+0x11c/0x380 + hrtimer_interrupt+0xfc/0x2f8 + arch_timer_handler_phys+0x38/0x58 + handle_percpu_devid_irq+0x90/0x248 + generic_handle_irq+0x3c/0x58 + __handle_domain_irq+0x68/0xc0 + gic_handle_irq+0x90/0x320 + el1_irq+0xcc/0x180 + queued_spin_lock_slowpath+0x1d8/0x320 + jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] + kjournald2+0xec/0x2f0 [jbd2] + kthread+0x134/0x138 + ret_from_fork+0x10/0x18 + +Analyzed informations from vmcore as follows: +(1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; +(2) Now is processing the 855th jbd2_inode; +(3) JBD2 task has TIF_NEED_RESCHED flag; +(4) There's no pags in address_space around the 855th jbd2_inode; +(5) There are some process is doing drop caches; +(6) Mounted with 'nodioread_nolock' option; +(7) 128 CPUs; + +According to informations from vmcore we know 'journal->j_list_lock' spin lock +competition is fierce. So journal_finish_inode_data_buffers() maybe process +slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). +However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, +will not call cond_resched(). So may lead to soft lockup. +journal_finish_inode_data_buffers + filemap_fdatawait_range_keep_errors + __filemap_fdatawait_range + while (index <= end) + nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); + if (!nr_pages) + break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() + for (i = 0; i < nr_pages; i++) + wait_on_page_writeback(page); + cond_resched(); + +To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 447c6972a6d3..556b259a00ba 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, + if (!ret) + ret = err; + } ++ cond_resched(); + spin_lock(&journal->j_list_lock); + jinode->i_flags &= ~JI_COMMIT_RUNNING; + smp_mb(); +-- +2.43.0 + diff --git a/queue-6.1/jbd2-increase-the-journal-io-s-priority.patch b/queue-6.1/jbd2-increase-the-journal-io-s-priority.patch new file mode 100644 index 00000000000..bab04d6d400 --- /dev/null +++ b/queue-6.1/jbd2-increase-the-journal-io-s-priority.patch @@ -0,0 +1,160 @@ +From 0f4b2be795406499acf90629966091b9028243d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:40 +0800 +Subject: jbd2: increase the journal IO's priority + +From: Zhang Yi + +[ Upstream commit 6a3afb6ac6dfab158ebdd4b87941178f58c8939f ] + +Current jbd2 only add REQ_SYNC for descriptor block, metadata log +buffer, commit buffer and superblock buffer, the submitted IO could be +throttled by writeback throttle in block layer, that could lead to +priority inversion in some cases. The log IO looks like a kind of high +priority metadata IO, so it should not be throttled by WBT like QOS +policies in block layer, let's add REQ_SYNC | REQ_IDLE to exempt from +writeback throttle, and also add REQ_META together indicates it's a +metadata IO. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 9 +++++---- + fs/jbd2/journal.c | 20 +++++++++++--------- + include/linux/jbd2.h | 3 +++ + 3 files changed, 19 insertions(+), 13 deletions(-) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index f1d9db6686e3..447c6972a6d3 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -123,7 +123,7 @@ static int journal_submit_commit_record(journal_t *journal, + struct commit_header *tmp; + struct buffer_head *bh; + struct timespec64 now; +- blk_opf_t write_flags = REQ_OP_WRITE | REQ_SYNC; ++ blk_opf_t write_flags = REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS; + + *cbh = NULL; + +@@ -429,8 +429,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + */ + jbd2_journal_update_sb_log_tail(journal, + journal->j_tail_sequence, +- journal->j_tail, +- REQ_SYNC); ++ journal->j_tail, 0); + mutex_unlock(&journal->j_checkpoint_mutex); + } else { + jbd2_debug(3, "superblock not updated\n"); +@@ -749,6 +748,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + + for (i = 0; i < bufs; i++) { + struct buffer_head *bh = wbuf[i]; ++ + /* + * Compute checksum. + */ +@@ -761,7 +761,8 @@ void jbd2_journal_commit_transaction(journal_t *journal) + clear_buffer_dirty(bh); + set_buffer_uptodate(bh); + bh->b_end_io = journal_end_buffer_io_sync; +- submit_bh(REQ_OP_WRITE | REQ_SYNC, bh); ++ submit_bh(REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS, ++ bh); + } + cond_resched(); + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 611337b0b5ad..3df45e4699f1 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1109,8 +1109,7 @@ int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- ret = jbd2_journal_update_sb_log_tail(journal, tid, block, +- REQ_SYNC | REQ_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, REQ_FUA); + if (ret) + goto out; + +@@ -1597,8 +1596,7 @@ static int journal_reset(journal_t *journal) + */ + jbd2_journal_update_sb_log_tail(journal, + journal->j_tail_sequence, +- journal->j_tail, +- REQ_SYNC | REQ_FUA); ++ journal->j_tail, REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + return jbd2_journal_start_thread(journal); +@@ -1620,6 +1618,11 @@ static int jbd2_write_superblock(journal_t *journal, blk_opf_t write_flags) + return -EIO; + } + ++ /* ++ * Always set high priority flags to exempt from block layer's ++ * QOS policies, e.g. writeback throttle. ++ */ ++ write_flags |= JBD2_JOURNAL_REQ_FLAGS; + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); + +@@ -1873,7 +1876,7 @@ void jbd2_journal_update_sb_errno(journal_t *journal) + jbd2_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); + sb->s_errno = cpu_to_be32(errcode); + +- jbd2_write_superblock(journal, REQ_SYNC | REQ_FUA); ++ jbd2_write_superblock(journal, REQ_FUA); + } + EXPORT_SYMBOL(jbd2_journal_update_sb_errno); + +@@ -2178,8 +2181,7 @@ int jbd2_journal_destroy(journal_t *journal) + ++journal->j_transaction_sequence; + write_unlock(&journal->j_state_lock); + +- jbd2_mark_journal_empty(journal, +- REQ_SYNC | REQ_PREFLUSH | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_PREFLUSH | REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -2488,7 +2490,7 @@ int jbd2_journal_flush(journal_t *journal, unsigned int flags) + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_FUA); + + if (flags) + err = __jbd2_journal_erase(journal, flags); +@@ -2538,7 +2540,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + if (write) { + /* Lock to make assertions happy... */ + mutex_lock_io(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index ebb1608d9dcd..6611af5f1d0c 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1374,6 +1374,9 @@ JBD2_FEATURE_INCOMPAT_FUNCS(csum2, CSUM_V2) + JBD2_FEATURE_INCOMPAT_FUNCS(csum3, CSUM_V3) + JBD2_FEATURE_INCOMPAT_FUNCS(fast_commit, FAST_COMMIT) + ++/* Journal high priority write IO operation flags */ ++#define JBD2_JOURNAL_REQ_FLAGS (REQ_META | REQ_SYNC | REQ_IDLE) ++ + /* + * Journal flag definitions + */ +-- +2.43.0 + diff --git a/queue-6.1/kselftest-alsa-fixed-a-print-formatting-warning.patch b/queue-6.1/kselftest-alsa-fixed-a-print-formatting-warning.patch new file mode 100644 index 00000000000..cc1e1a79ac9 --- /dev/null +++ b/queue-6.1/kselftest-alsa-fixed-a-print-formatting-warning.patch @@ -0,0 +1,37 @@ +From bbd0daffb93dea5837e1b54d90875199d223c384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 13:30:19 +0530 +Subject: kselftest: alsa: fixed a print formatting warning + +From: Ghanshyam Agrawal + +[ Upstream commit 13d605e32e4cfdedcecdf3d98d21710ffe887708 ] + +A statement used %d print formatter where %s should have +been used. The same has been fixed in this commit. + +Signed-off-by: Ghanshyam Agrawal +Link: 5aaf9efffc57 ("kselftest: alsa: Add simplistic test for ALSA mixer controls kselftest") +Link: https://lore.kernel.org/r/20231217080019.1063476-1-ghanshyam1898@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/alsa/mixer-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c +index a38b89c28030..37da902545a4 100644 +--- a/tools/testing/selftests/alsa/mixer-test.c ++++ b/tools/testing/selftests/alsa/mixer-test.c +@@ -177,7 +177,7 @@ static void find_controls(void) + err = snd_ctl_elem_info(card_data->handle, + ctl_data->info); + if (err < 0) { +- ksft_print_msg("%s getting info for %d\n", ++ ksft_print_msg("%s getting info for %s\n", + snd_strerror(err), + ctl_data->name); + } +-- +2.43.0 + diff --git a/queue-6.1/loongarch-preserve-syscall-nr-across-execve.patch b/queue-6.1/loongarch-preserve-syscall-nr-across-execve.patch new file mode 100644 index 00000000000..7184693cbe8 --- /dev/null +++ b/queue-6.1/loongarch-preserve-syscall-nr-across-execve.patch @@ -0,0 +1,50 @@ +From 1ca24a1f8d915f6f402eace76ad3d8ac9a7121f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 15:49:15 +0800 +Subject: LoongArch: Preserve syscall nr across execve() + +From: Hengqi Chen + +[ Upstream commit d6c5f06e46a836e6a70c7cfd95bb38a67d9252ec ] + +Currently, we store syscall nr in pt_regs::regs[11] and syscall execve() +accidentally overrides it during its execution: + + sys_execve() + -> do_execve() + -> do_execveat_common() + -> bprm_execve() + -> exec_binprm() + -> search_binary_handler() + -> load_elf_binary() + -> ELF_PLAT_INIT() + +ELF_PLAT_INIT() reset regs[11] to 0, so in syscall_exit_to_user_mode() +we later get a wrong syscall nr. This breaks tools like execsnoop since +it relies on execve() tracepoints. + +Skip pt_regs::regs[11] reset in ELF_PLAT_INIT() to fix the issue. + +Signed-off-by: Hengqi Chen +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/elf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h +index b9a4ab54285c..9b16a3b8e706 100644 +--- a/arch/loongarch/include/asm/elf.h ++++ b/arch/loongarch/include/asm/elf.h +@@ -293,7 +293,7 @@ extern const char *__elf_platform; + #define ELF_PLAT_INIT(_r, load_addr) do { \ + _r->regs[1] = _r->regs[2] = _r->regs[3] = _r->regs[4] = 0; \ + _r->regs[5] = _r->regs[6] = _r->regs[7] = _r->regs[8] = 0; \ +- _r->regs[9] = _r->regs[10] = _r->regs[11] = _r->regs[12] = 0; \ ++ _r->regs[9] = _r->regs[10] /* syscall n */ = _r->regs[12] = 0; \ + _r->regs[13] = _r->regs[14] = _r->regs[15] = _r->regs[16] = 0; \ + _r->regs[17] = _r->regs[18] = _r->regs[19] = _r->regs[20] = 0; \ + _r->regs[21] = _r->regs[22] = _r->regs[23] = _r->regs[24] = 0; \ +-- +2.43.0 + diff --git a/queue-6.1/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch b/queue-6.1/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch new file mode 100644 index 00000000000..2fc55ca488f --- /dev/null +++ b/queue-6.1/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch @@ -0,0 +1,57 @@ +From 3cbe44715a5d60bd282815d81457ddef3f01d702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:33:54 +0800 +Subject: MIPS: dts: loongson: drop incorrect dwmac fallback compatible + +From: Krzysztof Kozlowski + +[ Upstream commit 4907a3f54b12b8209864572a312cf967befcae80 ] + +Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, +so checking for some other compatible does not make sense. It cannot be +bound to unsupported platform. + +Drop useless, incorrect (space in between) and undocumented compatible. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Yanteng Si +Reviewed-by: Conor Dooley +Acked-by: Jiaxun Yang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +-- + arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +index 8143a61111e3..c16b521308cb 100644 +--- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi ++++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +@@ -123,8 +123,7 @@ gmac@3,0 { + compatible = "pci0014,7a03.0", + "pci0014,7a03", + "pciclass0c0320", +- "pciclass0c03", +- "loongson, pci-gmac"; ++ "pciclass0c03"; + + reg = <0x1800 0x0 0x0 0x0 0x0>; + interrupts = <12 IRQ_TYPE_LEVEL_LOW>, +diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +index 2f45fce2cdc4..ed99ee316feb 100644 +--- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi ++++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +@@ -186,8 +186,7 @@ gmac@3,0 { + compatible = "pci0014,7a03.0", + "pci0014,7a03", + "pciclass020000", +- "pciclass0200", +- "loongson, pci-gmac"; ++ "pciclass0200"; + + reg = <0x1800 0x0 0x0 0x0 0x0>; + interrupts = <12 IRQ_TYPE_LEVEL_HIGH>, +-- +2.43.0 + diff --git a/queue-6.1/mips-smp-call-rcutree_report_cpu_starting-earlier.patch b/queue-6.1/mips-smp-call-rcutree_report_cpu_starting-earlier.patch new file mode 100644 index 00000000000..fef1a3efb4f --- /dev/null +++ b/queue-6.1/mips-smp-call-rcutree_report_cpu_starting-earlier.patch @@ -0,0 +1,77 @@ +From fa72fe0c3f7d0714a04c69fa5f9f24e9ce41f1ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 13:12:07 +0100 +Subject: mips/smp: Call rcutree_report_cpu_starting() earlier + +From: Stefan Wiehler + +[ Upstream commit 55702ec9603ebeffb15e6f7b113623fe1d8872f4 ] + +rcutree_report_cpu_starting() must be called before +clockevents_register_device() to avoid the following lockdep splat triggered by +calling list_add() when CONFIG_PROVE_RCU_LIST=y: + + WARNING: suspicious RCU usage + ... + ----------------------------- + kernel/locking/lockdep.c:3680 RCU-list traversed in non-reader section!! + + other info that might help us debug this: + + RCU used illegally from offline CPU! + rcu_scheduler_active = 1, debug_locks = 1 + no locks held by swapper/1/0. + ... + Call Trace: + [] show_stack+0x64/0x158 + [] dump_stack_lvl+0x90/0xc4 + [] __lock_acquire+0x1404/0x2940 + [] lock_acquire+0x14c/0x448 + [] _raw_spin_lock_irqsave+0x50/0x88 + [] clockevents_register_device+0x60/0x1e8 + [] r4k_clockevent_init+0x220/0x3a0 + [] start_secondary+0x50/0x3b8 + +raw_smp_processor_id() is required in order to avoid calling into lockdep +before RCU has declared the CPU to be watched for readers. + +See also commit 29368e093921 ("x86/smpboot: Move rcu_cpu_starting() earlier"), +commit de5d9dae150c ("s390/smp: move rcu_cpu_starting() earlier") and commit +99f070b62322 ("powerpc/smp: Call rcu_cpu_starting() earlier"). + +Signed-off-by: Stefan Wiehler +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 1d93b85271ba..b951ce3a53ab 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -333,10 +333,11 @@ early_initcall(mips_smp_ipi_init); + */ + asmlinkage void start_secondary(void) + { +- unsigned int cpu; ++ unsigned int cpu = raw_smp_processor_id(); + + cpu_probe(); + per_cpu_trap_init(false); ++ rcutree_report_cpu_starting(cpu); + mips_clockevent_init(); + mp_ops->init_secondary(); + cpu_report(); +@@ -348,7 +349,6 @@ asmlinkage void start_secondary(void) + */ + + calibrate_delay(); +- cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + + set_cpu_sibling_map(cpu); +-- +2.43.0 + diff --git a/queue-6.1/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch b/queue-6.1/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch new file mode 100644 index 00000000000..408a80c7bf4 --- /dev/null +++ b/queue-6.1/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch @@ -0,0 +1,35 @@ +From 89bb911b80d91a612099cf95a3974fc7500e0596 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:23:39 +0800 +Subject: mptcp: fix uninit-value in mptcp_incoming_options + +From: Edward Adam Davis + +[ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ] + +Added initialization use_ack to mptcp_parse_option(). + +Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 0c786ceda5ee..74027bb5b429 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -103,6 +103,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, + mp_opt->suboptions |= OPTION_MPTCP_DSS; + mp_opt->use_map = 1; + mp_opt->mpc_map = 1; ++ mp_opt->use_ack = 0; + mp_opt->data_len = get_unaligned_be16(ptr); + ptr += 2; + } +-- +2.43.0 + diff --git a/queue-6.1/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch b/queue-6.1/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch new file mode 100644 index 00000000000..af70b627528 --- /dev/null +++ b/queue-6.1/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch @@ -0,0 +1,64 @@ +From e530568d4553733825e720fac44177bbc48f7685 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 03:38:33 +0000 +Subject: neighbour: Don't let neigh_forced_gc() disable preemption for long + +From: Judy Hsiao + +[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ] + +We are seeing cases where neigh_cleanup_and_release() is called by +neigh_forced_gc() many times in a row with preemption turned off. +When running on a low powered CPU at a low CPU frequency, this has +been measured to keep preemption off for ~10 ms. That's not great on a +system with HZ=1000 which expects tasks to be able to schedule in +with ~1ms latency. + +Suggested-by: Douglas Anderson +Signed-off-by: Judy Hsiao +Reviewed-by: David Ahern +Reviewed-by: Eric Dumazet +Reviewed-by: Douglas Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 41daa47d0393..c842f150c304 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -253,9 +253,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) + { + int max_clean = atomic_read(&tbl->gc_entries) - + READ_ONCE(tbl->gc_thresh2); ++ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC; + unsigned long tref = jiffies - 5 * HZ; + struct neighbour *n, *tmp; + int shrunk = 0; ++ int loop = 0; + + NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs); + +@@ -278,11 +280,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) + shrunk++; + if (shrunk >= max_clean) + break; ++ if (++loop == 16) { ++ if (ktime_get_ns() > tmax) ++ goto unlock; ++ loop = 0; ++ } + } + } + + WRITE_ONCE(tbl->last_flush, jiffies); +- ++unlock: + write_unlock_bh(&tbl->lock); + + return shrunk; +-- +2.43.0 + diff --git a/queue-6.1/net-qrtr-ns-return-0-if-server-port-is-not-present.patch b/queue-6.1/net-qrtr-ns-return-0-if-server-port-is-not-present.patch new file mode 100644 index 00000000000..86338c711ad --- /dev/null +++ b/queue-6.1/net-qrtr-ns-return-0-if-server-port-is-not-present.patch @@ -0,0 +1,45 @@ +From 09f97ae40fdcf0de2cfcc5ec2288b3e4a7dfaaa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 15:36:51 +0530 +Subject: net: qrtr: ns: Return 0 if server port is not present + +From: Sarannya S + +[ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ] + +When a 'DEL_CLIENT' message is received from the remote, the corresponding +server port gets deleted. A DEL_SERVER message is then announced for this +server. As part of handling the subsequent DEL_SERVER message, the name- +server attempts to delete the server port which results in a '-ENOENT' error. +The return value from server_del() is then propagated back to qrtr_ns_worker, +causing excessive error prints. +To address this, return 0 from control_cmd_del_server() without checking the +return value of server_del(), since the above scenario is not an error case +and hence server_del() doesn't have any other error return value. + +Signed-off-by: Sarannya Sasikumar +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index 3e40a1ba48f7..4a13b9f7abb4 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -569,7 +569,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from, + if (!node) + return -ENOENT; + +- return server_del(node, port, true); ++ server_del(node, port, true); ++ ++ return 0; + } + + static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, +-- +2.43.0 + diff --git a/queue-6.1/net-tg3-fix-race-condition-in-tg3_reset_task.patch b/queue-6.1/net-tg3-fix-race-condition-in-tg3_reset_task.patch new file mode 100644 index 00000000000..a81c2a5cf25 --- /dev/null +++ b/queue-6.1/net-tg3-fix-race-condition-in-tg3_reset_task.patch @@ -0,0 +1,94 @@ +From 9098912cbf39ebb4fd0ac1ad9f646e50d452e208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 18:19:11 -0600 +Subject: net/tg3: fix race condition in tg3_reset_task() + +From: Thinh Tran + +[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] + +When an EEH error is encountered by a PCI adapter, the EEH driver +modifies the PCI channel's state as shown below: + + enum { + /* I/O channel is in normal state */ + pci_channel_io_normal = (__force pci_channel_state_t) 1, + + /* I/O to channel is blocked */ + pci_channel_io_frozen = (__force pci_channel_state_t) 2, + + /* PCI card is dead */ + pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, + }; + +If the same EEH error then causes the tg3 driver's transmit timeout +logic to execute, the tg3_tx_timeout() function schedules a reset +task via tg3_reset_task_schedule(), which may cause a race condition +between the tg3 and EEH driver as both attempt to recover the HW via +a reset action. + +EEH driver gets error event +--> eeh_set_channel_state() + and set device to one of + error state above scheduler: tg3_reset_task() get + returned error from tg3_init_hw() + --> dev_close() shuts down the interface +tg3_io_slot_reset() and +tg3_io_resume() fail to +reset/resume the device + +To resolve this issue, we avoid the race condition by checking the PCI +channel state in the tg3_reset_task() function and skip the tg3 driver +initiated reset when the PCI channel is not in the normal state. (The +driver has no access to tg3 device registers at this point and cannot +even complete the reset task successfully without external assistance.) +We'll leave the reset procedure to be managed by the EEH driver which +calls the tg3_io_error_detected(), tg3_io_slot_reset() and +tg3_io_resume() functions as appropriate. + +Adding the same checking in tg3_dump_state() to avoid dumping all +device registers when the PCI channel is not in the normal state. + +Signed-off-by: Thinh Tran +Tested-by: Venkata Sai Duggi +Reviewed-by: David Christensen +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index f60a16de565e..0c694ab3c110 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6447,6 +6447,14 @@ static void tg3_dump_state(struct tg3 *tp) + int i; + u32 *regs; + ++ /* If it is a PCI error, all registers will be 0xffff, ++ * we don't dump them out, just report the error and return ++ */ ++ if (tp->pdev->error_state != pci_channel_io_normal) { ++ netdev_err(tp->dev, "PCI channel ERROR!\n"); ++ return; ++ } ++ + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); + if (!regs) + return; +@@ -11184,7 +11192,8 @@ static void tg3_reset_task(struct work_struct *work) + rtnl_lock(); + tg3_full_lock(tp, 0); + +- if (tp->pcierr_recovery || !netif_running(tp->dev)) { ++ if (tp->pcierr_recovery || !netif_running(tp->dev) || ++ tp->pdev->error_state != pci_channel_io_normal) { + tg3_flag_clear(tp, RESET_TASK_PENDING); + tg3_full_unlock(tp); + rtnl_unlock(); +-- +2.43.0 + diff --git a/queue-6.1/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch b/queue-6.1/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch new file mode 100644 index 00000000000..8f98759f2ee --- /dev/null +++ b/queue-6.1/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch @@ -0,0 +1,38 @@ +From 45512af5bca304ddc826e0d04823b6dba0f3acfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 11:08:52 +1000 +Subject: nouveau/tu102: flush all pdbs on vmm flush + +From: Dave Airlie + +[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ] + +This is a hack around a bug exposed with the GSP code, I'm not sure +what is happening exactly, but it appears some of our flushes don't +result in proper tlb invalidation for out BAR2 and we get a BAR2 +fault from GSP and it all dies. + +Signed-off-by: Dave Airlie +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +index 6cb5eefa45e9..5a08458fe1b7 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +@@ -31,7 +31,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) + + type |= 0x00000001; /* PAGE_ALL */ + if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR])) +- type |= 0x00000004; /* HUB_ONLY */ ++ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */ + + mutex_lock(&vmm->mmu->mutex); + +-- +2.43.0 + diff --git a/queue-6.1/nvme-core-check-for-too-small-lba-shift.patch b/queue-6.1/nvme-core-check-for-too-small-lba-shift.patch new file mode 100644 index 00000000000..c9b182a9d21 --- /dev/null +++ b/queue-6.1/nvme-core-check-for-too-small-lba-shift.patch @@ -0,0 +1,42 @@ +From 81a6cbe1e59884355e7b7c2749f660381d20b01a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 09:36:04 -0800 +Subject: nvme-core: check for too small lba shift + +From: Keith Busch + +[ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ] + +The block layer doesn't support logical block sizes smaller than 512 +bytes. The nvme spec doesn't support that small either, but the driver +isn't checking to make sure the device responded with usable data. +Failing to catch this will result in a kernel bug, either from a +division by zero when stacking, or a zero length bio. + +Reviewed-by: Jens Axboe +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 67c893934c80..0c088db94470 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1925,9 +1925,10 @@ static void nvme_update_disk_info(struct gendisk *disk, + + /* + * The block layer can't support LBA sizes larger than the page size +- * yet, so catch this early and don't allow block I/O. ++ * or smaller than a sector size yet, so catch this early and don't ++ * allow block I/O. + */ +- if (ns->lba_shift > PAGE_SHIFT) { ++ if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { + capacity = 0; + bs = (1 << 9); + } +-- +2.43.0 + diff --git a/queue-6.1/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch b/queue-6.1/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch new file mode 100644 index 00000000000..7c7da2f2221 --- /dev/null +++ b/queue-6.1/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch @@ -0,0 +1,50 @@ +From 45a2ccb8295890c2845682bc108fc937a6e6f8ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:07:41 +0100 +Subject: nvme-core: fix a memory leak in nvme_ns_info_from_identify() + +From: Maurizio Lombardi + +[ Upstream commit e3139cef8257fcab1725441e2fd5fd0ccb5481b1 ] + +In case of error, free the nvme_id_ns structure that was allocated +by nvme_identify_ns(). + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: Kanchan Joshi +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 5b906dbb1096..67c893934c80 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1511,7 +1511,8 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, + if (id->ncap == 0) { + /* namespace not allocated or attached */ + info->is_removed = true; +- return -ENODEV; ++ ret = -ENODEV; ++ goto error; + } + + info->anagrpid = id->anagrpid; +@@ -1529,8 +1530,10 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, + !memchr_inv(ids->nguid, 0, sizeof(ids->nguid))) + memcpy(ids->nguid, id->nguid, sizeof(ids->nguid)); + } ++ ++error: + kfree(id); +- return 0; ++ return ret; + } + + static int nvme_ns_info_from_id_cs_indep(struct nvme_ctrl *ctrl, +-- +2.43.0 + diff --git a/queue-6.1/nvme-introduce-helper-function-to-get-ctrl-state.patch b/queue-6.1/nvme-introduce-helper-function-to-get-ctrl-state.patch new file mode 100644 index 00000000000..849bad404e3 --- /dev/null +++ b/queue-6.1/nvme-introduce-helper-function-to-get-ctrl-state.patch @@ -0,0 +1,40 @@ +From a831c730bc86794df94fbe605a1397529c73c1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 08:13:09 -0700 +Subject: nvme: introduce helper function to get ctrl state + +From: Keith Busch + +[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ] + +The controller state is typically written by another CPU, so reading it +should ensure no optimizations are taken. This is a repeated pattern in +the driver, so start with adding a convenience function that returns the +controller state with READ_ONCE(). + +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/nvme.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 118bf08a708b..a892d679e338 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -382,6 +382,11 @@ struct nvme_ctrl { + enum nvme_dctype dctype; + }; + ++static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl) ++{ ++ return READ_ONCE(ctrl->state); ++} ++ + enum nvme_iopolicy { + NVME_IOPOLICY_NUMA, + NVME_IOPOLICY_RR, +-- +2.43.0 + diff --git a/queue-6.1/nvme-prevent-potential-spectre-v1-gadget.patch b/queue-6.1/nvme-prevent-potential-spectre-v1-gadget.patch new file mode 100644 index 00000000000..2d82f2adbd8 --- /dev/null +++ b/queue-6.1/nvme-prevent-potential-spectre-v1-gadget.patch @@ -0,0 +1,54 @@ +From c6d53a1cad59b2e764dd47f8fcb20426198cc4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 17:59:57 +0530 +Subject: nvme: prevent potential spectre v1 gadget + +From: Nitesh Shetty + +[ Upstream commit 20dc66f2d76b4a410df14e4675e373b718babc34 ] + +This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn: +potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)" +Prevent the contents of kernel memory from being leaked to user space +via speculative execution by using array_index_nospec. + +Signed-off-by: Nitesh Shetty +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 6a2816f3b4e8..73ae16059a1c 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -16,6 +16,7 @@ + #endif + #include + #include ++#include + + #include "nvmet.h" + +@@ -508,6 +509,7 @@ static ssize_t nvmet_ns_ana_grpid_store(struct config_item *item, + + down_write(&nvmet_ana_sem); + oldgrpid = ns->anagrpid; ++ newgrpid = array_index_nospec(newgrpid, NVMET_MAX_ANAGRPS); + nvmet_ana_group_enabled[newgrpid]++; + ns->anagrpid = newgrpid; + nvmet_ana_group_enabled[oldgrpid]--; +@@ -1580,6 +1582,7 @@ static struct config_group *nvmet_ana_groups_make_group( + grp->grpid = grpid; + + down_write(&nvmet_ana_sem); ++ grpid = array_index_nospec(grpid, NVMET_MAX_ANAGRPS); + nvmet_ana_group_enabled[grpid]++; + up_write(&nvmet_ana_sem); + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-cy8c95x0-fix-get_pincfg.patch b/queue-6.1/pinctrl-cy8c95x0-fix-get_pincfg.patch new file mode 100644 index 00000000000..5e232a78b68 --- /dev/null +++ b/queue-6.1/pinctrl-cy8c95x0-fix-get_pincfg.patch @@ -0,0 +1,36 @@ +From e58649ee03a4bdee4689d5c554c3b5f8cbec6715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:51:18 +0100 +Subject: pinctrl: cy8c95x0: Fix get_pincfg + +From: Patrick Rudolph + +[ Upstream commit 94c71705cc49092cef60ece13a28680809096fd4 ] + +Invert the register value for PIN_CONFIG_OUTPUT_ENABLE to return +the opposite of PIN_CONFIG_INPUT_ENABLE. + +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20231219125120.4028862-3-patrick.rudolph@9elements.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-cy8c95x0.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c +index 99c3fe4ca518..5abab6bc763a 100644 +--- a/drivers/pinctrl/pinctrl-cy8c95x0.c ++++ b/drivers/pinctrl/pinctrl-cy8c95x0.c +@@ -749,6 +749,8 @@ static int cy8c95x0_gpio_get_pincfg(struct cy8c95x0_pinctrl *chip, + ret = regmap_read(chip->regmap, reg, ®_val); + if (reg_val & bit) + arg = 1; ++ if (param == PIN_CONFIG_OUTPUT_ENABLE) ++ arg = !arg; + + *config = pinconf_to_config_packed(param, (u16)arg); + out: +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-cy8c95x0-fix-typo.patch b/queue-6.1/pinctrl-cy8c95x0-fix-typo.patch new file mode 100644 index 00000000000..00aa2f2a9c4 --- /dev/null +++ b/queue-6.1/pinctrl-cy8c95x0-fix-typo.patch @@ -0,0 +1,35 @@ +From 7aaf1e6bacdb0498e7c4a3898fccfca08079d152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:51:16 +0100 +Subject: pinctrl: cy8c95x0: Fix typo + +From: Patrick Rudolph + +[ Upstream commit 47b1fa48116238208c1b1198dba10f56fc1b6eb2 ] + +Fix typo to make pinctrl-cy8c95x compile again. + +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20231219125120.4028862-1-patrick.rudolph@9elements.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c +index 68509a2301b8..99c3fe4ca518 100644 +--- a/drivers/pinctrl/pinctrl-cy8c95x0.c ++++ b/drivers/pinctrl/pinctrl-cy8c95x0.c +@@ -857,7 +857,7 @@ static int cy8c95x0_setup_gpiochip(struct cy8c95x0_pinctrl *chip) + gc->get_direction = cy8c95x0_gpio_get_direction; + gc->get_multiple = cy8c95x0_gpio_get_multiple; + gc->set_multiple = cy8c95x0_gpio_set_multiple; +- gc->set_config = gpiochip_generic_config, ++ gc->set_config = gpiochip_generic_config; + gc->can_sleep = true; + gc->add_pin_ranges = cy8c95x0_add_pin_ranges; + +-- +2.43.0 + diff --git a/queue-6.1/pinctrl-lochnagar-don-t-build-on-mips.patch b/queue-6.1/pinctrl-lochnagar-don-t-build-on-mips.patch new file mode 100644 index 00000000000..eea8531dd6e --- /dev/null +++ b/queue-6.1/pinctrl-lochnagar-don-t-build-on-mips.patch @@ -0,0 +1,42 @@ +From 9d115f1c5363e2f0793944dcc7b355e9127fad4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:28:53 +0000 +Subject: pinctrl: lochnagar: Don't build on MIPS + +From: Charles Keepax + +[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ] + +MIPS appears to define a RST symbol at a high level, which clashes +with some register naming in the driver. Since there is currently +no case for running this driver on MIPS devices simply cut off the +build of this driver on MIPS. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/ +Suggested-by: Linus Walleij +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/cirrus/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig +index 530426a74f75..b3cea8d56c4f 100644 +--- a/drivers/pinctrl/cirrus/Kconfig ++++ b/drivers/pinctrl/cirrus/Kconfig +@@ -1,7 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0-only + config PINCTRL_LOCHNAGAR + tristate "Cirrus Logic Lochnagar pinctrl driver" +- depends on MFD_LOCHNAGAR ++ # Avoid clash caused by MIPS defining RST, which is used in the driver ++ depends on MFD_LOCHNAGAR && !MIPS + select GPIOLIB + select PINMUX + select PINCONF +-- +2.43.0 + diff --git a/queue-6.1/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch b/queue-6.1/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch new file mode 100644 index 00000000000..ca79803899b --- /dev/null +++ b/queue-6.1/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch @@ -0,0 +1,99 @@ +From 38698c9f1f263253a03840e2cf47e4d801d5701f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 16:06:01 +0100 +Subject: platform/x86: intel-vbtn: Fix missing tablet-mode-switch events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f ] + +2 issues have been reported on the Dell Inspiron 7352: + +1. Sometimes the tablet-mode-switch stops reporting tablet-mode + change events. + + Add a "VBDL" call to notify_handler() to work around this. + +2. Sometimes the tablet-mode is incorrect after suspend/resume + + Add a detect_tablet_mode() to resume() to fix this. + +Reported-by: Arnold Gozum +Closes: https://lore.kernel.org/platform-driver-x86/87271a74-c831-4eec-b7a4-1371d0e42471@gmail.com/ +Tested-by: Arnold Gozum +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20231204150601.46976-1-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/vbtn.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c +index c5e4e35c8d20..8e2b07ed2ce9 100644 +--- a/drivers/platform/x86/intel/vbtn.c ++++ b/drivers/platform/x86/intel/vbtn.c +@@ -73,10 +73,10 @@ struct intel_vbtn_priv { + bool wakeup_mode; + }; + +-static void detect_tablet_mode(struct platform_device *device) ++static void detect_tablet_mode(struct device *dev) + { +- struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); +- acpi_handle handle = ACPI_HANDLE(&device->dev); ++ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); ++ acpi_handle handle = ACPI_HANDLE(dev); + unsigned long long vgbs; + acpi_status status; + int m; +@@ -89,6 +89,8 @@ static void detect_tablet_mode(struct platform_device *device) + input_report_switch(priv->switches_dev, SW_TABLET_MODE, m); + m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0; + input_report_switch(priv->switches_dev, SW_DOCK, m); ++ ++ input_sync(priv->switches_dev); + } + + /* +@@ -134,7 +136,7 @@ static int intel_vbtn_input_setup(struct platform_device *device) + priv->switches_dev->id.bustype = BUS_HOST; + + if (priv->has_switches) { +- detect_tablet_mode(device); ++ detect_tablet_mode(&device->dev); + + ret = input_register_device(priv->switches_dev); + if (ret) +@@ -198,6 +200,9 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + autorelease = val && (!ke_rel || ke_rel->type == KE_IGNORE); + + sparse_keymap_report_event(input_dev, event, val, autorelease); ++ ++ /* Some devices need this to report further events */ ++ acpi_evaluate_object(handle, "VBDL", NULL, NULL); + } + + /* +@@ -358,7 +363,13 @@ static void intel_vbtn_pm_complete(struct device *dev) + + static int intel_vbtn_pm_resume(struct device *dev) + { ++ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); ++ + intel_vbtn_pm_complete(dev); ++ ++ if (priv->has_switches) ++ detect_tablet_mode(dev); ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch b/queue-6.1/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch new file mode 100644 index 00000000000..897a74ccc29 --- /dev/null +++ b/queue-6.1/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch @@ -0,0 +1,252 @@ +From 9264e20faf71ed11722a8ee949bc4040e97e0977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 22:47:02 +0900 +Subject: platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some + ThinkPad systems +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vishnu Sankar + +[ Upstream commit 66e92e23a72761f5b53f970aeb1badc5fd92fc74 ] + +Some ThinkPad systems ECFW use non-standard addresses for fan control +and reporting. This patch adds support for such ECFW so that it can report +the correct fan values. +Tested on Thinkpads L13 Yoga Gen 2 and X13 Yoga Gen 2. + +Suggested-by: Mark Pearson +Signed-off-by: Vishnu Sankar +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20231214134702.166464-1-vishnuocv@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 98 ++++++++++++++++++++++++---- + 1 file changed, 85 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 05a55bc31c79..6edd2e294750 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -8149,8 +8149,19 @@ static struct ibm_struct volume_driver_data = { + * TPACPI_FAN_WR_TPEC is also available and should be used to + * command the fan. The X31/X40/X41 seems to have 8 fan levels, + * but the ACPI tables just mention level 7. ++ * ++ * TPACPI_FAN_RD_TPEC_NS: ++ * This mode is used for a few ThinkPads (L13 Yoga Gen2, X13 Yoga Gen2 etc.) ++ * that are using non-standard EC locations for reporting fan speeds. ++ * Currently these platforms only provide fan rpm reporting. ++ * + */ + ++#define FAN_RPM_CAL_CONST 491520 /* FAN RPM calculation offset for some non-standard ECFW */ ++ ++#define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */ ++#define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */ ++ + enum { /* Fan control constants */ + fan_status_offset = 0x2f, /* EC register 0x2f */ + fan_rpm_offset = 0x84, /* EC register 0x84: LSB, 0x85 MSB (RPM) +@@ -8158,6 +8169,11 @@ enum { /* Fan control constants */ + fan_select_offset = 0x31, /* EC register 0x31 (Firmware 7M) + bit 0 selects which fan is active */ + ++ fan_status_offset_ns = 0x93, /* Special status/control offset for non-standard EC Fan1 */ ++ fan2_status_offset_ns = 0x96, /* Special status/control offset for non-standard EC Fan2 */ ++ fan_rpm_status_ns = 0x95, /* Special offset for Fan1 RPM status for non-standard EC */ ++ fan2_rpm_status_ns = 0x98, /* Special offset for Fan2 RPM status for non-standard EC */ ++ + TP_EC_FAN_FULLSPEED = 0x40, /* EC fan mode: full speed */ + TP_EC_FAN_AUTO = 0x80, /* EC fan mode: auto fan control */ + +@@ -8168,6 +8184,7 @@ enum fan_status_access_mode { + TPACPI_FAN_NONE = 0, /* No fan status or control */ + TPACPI_FAN_RD_ACPI_GFAN, /* Use ACPI GFAN */ + TPACPI_FAN_RD_TPEC, /* Use ACPI EC regs 0x2f, 0x84-0x85 */ ++ TPACPI_FAN_RD_TPEC_NS, /* Use non-standard ACPI EC regs (eg: L13 Yoga gen2 etc.) */ + }; + + enum fan_control_access_mode { +@@ -8195,6 +8212,8 @@ static u8 fan_control_desired_level; + static u8 fan_control_resume_level; + static int fan_watchdog_maxinterval; + ++static bool fan_with_ns_addr; ++ + static struct mutex fan_mutex; + + static void fan_watchdog_fire(struct work_struct *ignored); +@@ -8325,6 +8344,15 @@ static int fan_get_status(u8 *status) + } + + break; ++ case TPACPI_FAN_RD_TPEC_NS: ++ /* Default mode is AUTO which means controlled by EC */ ++ if (!acpi_ec_read(fan_status_offset_ns, &s)) ++ return -EIO; ++ ++ if (status) ++ *status = s; ++ ++ break; + + default: + return -ENXIO; +@@ -8341,7 +8369,8 @@ static int fan_get_status_safe(u8 *status) + if (mutex_lock_killable(&fan_mutex)) + return -ERESTARTSYS; + rc = fan_get_status(&s); +- if (!rc) ++ /* NS EC doesn't have register with level settings */ ++ if (!rc && !fan_with_ns_addr) + fan_update_desired_level(s); + mutex_unlock(&fan_mutex); + +@@ -8368,7 +8397,13 @@ static int fan_get_speed(unsigned int *speed) + + if (likely(speed)) + *speed = (hi << 8) | lo; ++ break; ++ case TPACPI_FAN_RD_TPEC_NS: ++ if (!acpi_ec_read(fan_rpm_status_ns, &lo)) ++ return -EIO; + ++ if (speed) ++ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; + break; + + default: +@@ -8380,7 +8415,7 @@ static int fan_get_speed(unsigned int *speed) + + static int fan2_get_speed(unsigned int *speed) + { +- u8 hi, lo; ++ u8 hi, lo, status; + bool rc; + + switch (fan_status_access_mode) { +@@ -8396,7 +8431,21 @@ static int fan2_get_speed(unsigned int *speed) + + if (likely(speed)) + *speed = (hi << 8) | lo; ++ break; + ++ case TPACPI_FAN_RD_TPEC_NS: ++ rc = !acpi_ec_read(fan2_status_offset_ns, &status); ++ if (rc) ++ return -EIO; ++ if (!(status & FAN_NS_CTRL_STATUS)) { ++ pr_info("secondary fan control not supported\n"); ++ return -EIO; ++ } ++ rc = !acpi_ec_read(fan2_rpm_status_ns, &lo); ++ if (rc) ++ return -EIO; ++ if (speed) ++ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; + break; + + default: +@@ -8899,6 +8948,7 @@ static const struct attribute_group fan_driver_attr_group = { + #define TPACPI_FAN_2FAN 0x0002 /* EC 0x31 bit 0 selects fan2 */ + #define TPACPI_FAN_2CTL 0x0004 /* selects fan2 control */ + #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */ ++#define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */ + + static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1), +@@ -8917,6 +8967,8 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */ + TPACPI_Q_LNV3('N', '3', '0', TPACPI_FAN_2CTL), /* P15 (1st gen) / P15v (1st gen) */ + TPACPI_Q_LNV3('N', '3', '7', TPACPI_FAN_2CTL), /* T15g (2nd gen) */ ++ TPACPI_Q_LNV3('R', '1', 'F', TPACPI_FAN_NS), /* L13 Yoga Gen 2 */ ++ TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/ + TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */ + }; + +@@ -8951,18 +9003,27 @@ static int __init fan_init(struct ibm_init_struct *iibm) + return -ENODEV; + } + ++ if (quirks & TPACPI_FAN_NS) { ++ pr_info("ECFW with non-standard fan reg control found\n"); ++ fan_with_ns_addr = 1; ++ /* Fan ctrl support from host is undefined for now */ ++ tp_features.fan_ctrl_status_undef = 1; ++ } ++ + if (gfan_handle) { + /* 570, 600e/x, 770e, 770x */ + fan_status_access_mode = TPACPI_FAN_RD_ACPI_GFAN; + } else { + /* all other ThinkPads: note that even old-style + * ThinkPad ECs supports the fan control register */ +- if (likely(acpi_ec_read(fan_status_offset, +- &fan_control_initial_status))) { ++ if (fan_with_ns_addr || ++ likely(acpi_ec_read(fan_status_offset, &fan_control_initial_status))) { + int res; + unsigned int speed; + +- fan_status_access_mode = TPACPI_FAN_RD_TPEC; ++ fan_status_access_mode = fan_with_ns_addr ? ++ TPACPI_FAN_RD_TPEC_NS : TPACPI_FAN_RD_TPEC; ++ + if (quirks & TPACPI_FAN_Q1) + fan_quirk1_setup(); + /* Try and probe the 2nd fan */ +@@ -8971,7 +9032,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) + if (res >= 0 && speed != FAN_NOT_PRESENT) { + /* It responded - so let's assume it's there */ + tp_features.second_fan = 1; +- tp_features.second_fan_ctl = 1; ++ /* fan control not currently available for ns ECFW */ ++ tp_features.second_fan_ctl = !fan_with_ns_addr; + pr_info("secondary fan control detected & enabled\n"); + } else { + /* Fan not auto-detected */ +@@ -9146,6 +9208,7 @@ static int fan_read(struct seq_file *m) + str_enabled_disabled(status), status); + break; + ++ case TPACPI_FAN_RD_TPEC_NS: + case TPACPI_FAN_RD_TPEC: + /* all except 570, 600e/x, 770e, 770x */ + rc = fan_get_status_safe(&status); +@@ -9160,13 +9223,22 @@ static int fan_read(struct seq_file *m) + + seq_printf(m, "speed:\t\t%d\n", speed); + +- if (status & TP_EC_FAN_FULLSPEED) +- /* Disengaged mode takes precedence */ +- seq_printf(m, "level:\t\tdisengaged\n"); +- else if (status & TP_EC_FAN_AUTO) +- seq_printf(m, "level:\t\tauto\n"); +- else +- seq_printf(m, "level:\t\t%d\n", status); ++ if (fan_status_access_mode == TPACPI_FAN_RD_TPEC_NS) { ++ /* ++ * No full speed bit in NS EC ++ * EC Auto mode is set by default. ++ * No other levels settings available ++ */ ++ seq_printf(m, "level:\t\t%s\n", status & FAN_NS_CTRL ? "unknown" : "auto"); ++ } else { ++ if (status & TP_EC_FAN_FULLSPEED) ++ /* Disengaged mode takes precedence */ ++ seq_printf(m, "level:\t\tdisengaged\n"); ++ else if (status & TP_EC_FAN_AUTO) ++ seq_printf(m, "level:\t\tauto\n"); ++ else ++ seq_printf(m, "level:\t\t%d\n", status); ++ } + break; + + case TPACPI_FAN_NONE: +-- +2.43.0 + diff --git a/queue-6.1/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch b/queue-6.1/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch new file mode 100644 index 00000000000..a882dfa4b6f --- /dev/null +++ b/queue-6.1/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch @@ -0,0 +1,38 @@ +From f3e93529af0d895d6b4ce4d51a46953d4ba3bfc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 11:13:00 +0200 +Subject: reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning + +From: Krzysztof Kozlowski + +[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ] + +'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 +causes: + + hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/hisilicon/hi6220_reset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c +index 5ca145b64e63..30951914afac 100644 +--- a/drivers/reset/hisilicon/hi6220_reset.c ++++ b/drivers/reset/hisilicon/hi6220_reset.c +@@ -164,7 +164,7 @@ static int hi6220_reset_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + +- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev); ++ type = (uintptr_t)of_device_get_match_data(dev); + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { +-- +2.43.0 + diff --git a/queue-6.1/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch b/queue-6.1/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch new file mode 100644 index 00000000000..ca5c2528e38 --- /dev/null +++ b/queue-6.1/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch @@ -0,0 +1,45 @@ +From 499f788795c748a53c60d6dd18e7ffa34703b074 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 17:54:03 -0500 +Subject: ring-buffer: Do not record in NMI if the arch does not support + cmpxchg in NMI + +From: Steven Rostedt (Google) + +[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ] + +As the ring buffer recording requires cmpxchg() to work, if the +architecture does not support cmpxchg in NMI, then do not do any recording +within an NMI. + +Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 71cad4f1323c..1285e7fb597e 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3644,6 +3644,12 @@ rb_reserve_next_event(struct trace_buffer *buffer, + int nr_loops = 0; + int add_ts_default; + ++ /* ring buffer does cmpxchg, make sure it is safe in NMI context */ ++ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) && ++ (unlikely(in_nmi()))) { ++ return NULL; ++ } ++ + rb_start_commit(cpu_buffer); + /* The commit page can not change after this */ + +-- +2.43.0 + diff --git a/queue-6.1/s390-scm-fix-virtual-vs-physical-address-confusion.patch b/queue-6.1/s390-scm-fix-virtual-vs-physical-address-confusion.patch new file mode 100644 index 00000000000..e10e047f954 --- /dev/null +++ b/queue-6.1/s390-scm-fix-virtual-vs-physical-address-confusion.patch @@ -0,0 +1,59 @@ +From f1b479ae14d87fb92bc948175ea61f5e519a524f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 22:52:53 +0100 +Subject: s390/scm: fix virtual vs physical address confusion + +From: Vineeth Vijayan + +[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ] + +Fix virtual vs physical address confusion (which currently are the same). + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Acked-by: Alexander Gordeev +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/block/scm_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c +index 0c1df1d5f1ac..a165b1a59fde 100644 +--- a/drivers/s390/block/scm_blk.c ++++ b/drivers/s390/block/scm_blk.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include "scm_blk.h" + +@@ -130,7 +131,7 @@ static void scm_request_done(struct scm_request *scmrq) + + for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) { + msb = &scmrq->aob->msb[i]; +- aidaw = msb->data_addr; ++ aidaw = (u64)phys_to_virt(msb->data_addr); + + if ((msb->flags & MSB_FLAG_IDA) && aidaw && + IS_ALIGNED(aidaw, PAGE_SIZE)) +@@ -195,12 +196,12 @@ static int scm_request_prepare(struct scm_request *scmrq) + msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9); + msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE; + msb->flags |= MSB_FLAG_IDA; +- msb->data_addr = (u64) aidaw; ++ msb->data_addr = (u64)virt_to_phys(aidaw); + + rq_for_each_segment(bv, req, iter) { + WARN_ON(bv.bv_offset); + msb->blk_count += bv.bv_len >> 12; +- aidaw->data_addr = (u64) page_address(bv.bv_page); ++ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page)); + aidaw++; + } + +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 4c6ad7e1923..bf6161614d1 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1 +1,84 @@ f2fs-explicitly-null-terminate-the-xattr-list.patch +pinctrl-lochnagar-don-t-build-on-mips.patch +alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch +mptcp-fix-uninit-value-in-mptcp_incoming_options.patch +wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch +wifi-avoid-offset-calculation-on-null-pointer.patch +wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch +debugfs-fix-automount-d_fsdata-usage.patch +debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch +alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch +nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch +drm-amd-display-update-dcn315-lpddr-pstate-latency.patch +drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch +smb-client-common-fix-fortify-warnings.patch +blk-mq-don-t-count-completed-flush-data-request-as-i.patch +nvme-core-check-for-too-small-lba-shift.patch +hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch +hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch +asoc-wm8974-correct-boost-mixer-inputs.patch +arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch +asoc-intel-skylake-fix-mem-leak-in-few-functions.patch +asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch +asoc-intel-skylake-mem-leak-in-skl-register-function.patch +asoc-cs43130-fix-the-position-of-const-qualifier.patch +asoc-cs43130-fix-incorrect-frame-delay-configuration.patch +asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch +asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch +asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch +nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch +asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch +asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch +net-tg3-fix-race-condition-in-tg3_reset_task.patch +asoc-da7219-support-low-dc-impedance-headset.patch +asoc-ops-add-correct-range-check-for-limiting-volume.patch +nvme-introduce-helper-function-to-get-ctrl-state.patch +nvme-prevent-potential-spectre-v1-gadget.patch +arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch +mips-smp-call-rcutree_report_cpu_starting-earlier.patch +drm-amd-display-use-channel_width-2-for-vram-table-3.patch +drm-amdgpu-add-null-checks-for-function-pointers.patch +drm-exynos-fix-a-potential-error-pointer-dereference.patch +drm-exynos-fix-a-wrong-error-checking.patch +hwmon-corsair-psu-fix-probe-when-built-in.patch +loongarch-preserve-syscall-nr-across-execve.patch +clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch +clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch +jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch +jbd2-increase-the-journal-io-s-priority.patch +drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch +neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch +platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch +jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch +tracing-have-large-events-show-up-as-line-too-big-in.patch +tracing-add-size-check-when-printing-trace_marker-ou.patch +stmmac-dwmac-loongson-drop-useless-check-for-compati.patch +mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch +tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch +ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch +input-psmouse-enable-synaptics-intertouch-for-thinkp.patch +reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch +input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch +input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch +s390-scm-fix-virtual-vs-physical-address-confusion.patch +arc-fix-spare-error.patch +wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch +input-xpad-add-razer-wolverine-v2-support.patch +kselftest-alsa-fixed-a-print-formatting-warning.patch +hid-nintendo-fix-initializer-element-is-not-constant.patch +platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch +asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch +alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch +dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch +hid-nintendo-prevent-divide-by-zero-on-code.patch +smb-client-fix-potential-oob-in-smb2_dump_detail.patch +i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch +drm-amd-display-get-dprefclk-ss-info-from-integratio.patch +pinctrl-cy8c95x0-fix-typo.patch +pinctrl-cy8c95x0-fix-get_pincfg.patch +ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch +virtio_blk-fix-snprintf-truncation-compiler-warning.patch +net-qrtr-ns-return-0-if-server-port-is-not-present.patch +arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch +drm-crtc-fix-uninitialized-variable-use.patch diff --git a/queue-6.1/smb-client-common-fix-fortify-warnings.patch b/queue-6.1/smb-client-common-fix-fortify-warnings.patch new file mode 100644 index 00000000000..309b50fe330 --- /dev/null +++ b/queue-6.1/smb-client-common-fix-fortify-warnings.patch @@ -0,0 +1,217 @@ +From d8fcead15b1df96a6d93206f75b962fcd7c59679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 13:53:47 +0300 +Subject: smb: client, common: fix fortify warnings + +From: Dmitry Antipov + +[ Upstream commit 0015eb6e12384ff1c589928e84deac2ad1ceb236 ] + +When compiling with gcc version 14.0.0 20231126 (experimental) +and CONFIG_FORTIFY_SOURCE=y, I've noticed the following: + +In file included from ./include/linux/string.h:295, + from ./include/linux/bitmap.h:12, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/paravirt.h:17, + from ./arch/x86/include/asm/cpuid.h:62, + from ./arch/x86/include/asm/processor.h:19, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:60, + from ./arch/x86/include/asm/preempt.h:9, + from ./include/linux/preempt.h:79, + from ./include/linux/spinlock.h:56, + from ./include/linux/wait.h:9, + from ./include/linux/wait_bit.h:8, + from ./include/linux/fs.h:6, + from fs/smb/client/smb2pdu.c:18: +In function 'fortify_memcpy_chk', + inlined from '__SMB2_close' at fs/smb/client/smb2pdu.c:3480:4: +./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' +declared with attribute warning: detected read beyond size of field (2nd parameter); +maybe use struct_group()? [-Wattribute-warning] + 588 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +and: + +In file included from ./include/linux/string.h:295, + from ./include/linux/bitmap.h:12, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/paravirt.h:17, + from ./arch/x86/include/asm/cpuid.h:62, + from ./arch/x86/include/asm/processor.h:19, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:60, + from ./arch/x86/include/asm/preempt.h:9, + from ./include/linux/preempt.h:79, + from ./include/linux/spinlock.h:56, + from ./include/linux/wait.h:9, + from ./include/linux/wait_bit.h:8, + from ./include/linux/fs.h:6, + from fs/smb/client/cifssmb.c:17: +In function 'fortify_memcpy_chk', + inlined from 'CIFS_open' at fs/smb/client/cifssmb.c:1248:3: +./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' +declared with attribute warning: detected read beyond size of field (2nd parameter); +maybe use struct_group()? [-Wattribute-warning] + 588 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +In both cases, the fortification logic inteprets calls to 'memcpy()' as an +attempts to copy an amount of data which exceeds the size of the specified +field (i.e. more than 8 bytes from __le64 value) and thus issues an overread +warning. Both of these warnings may be silenced by using the convenient +'struct_group()' quirk. + +Signed-off-by: Dmitry Antipov +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifspdu.h | 24 ++++++++++++++---------- + fs/smb/client/cifssmb.c | 6 ++++-- + fs/smb/client/smb2pdu.c | 8 +++----- + fs/smb/client/smb2pdu.h | 16 +++++++++------- + fs/smb/common/smb2pdu.h | 17 ++++++++++------- + 5 files changed, 40 insertions(+), 31 deletions(-) + +diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h +index c403816d0b6c..97bb1838555b 100644 +--- a/fs/smb/client/cifspdu.h ++++ b/fs/smb/client/cifspdu.h +@@ -882,11 +882,13 @@ typedef struct smb_com_open_rsp { + __u8 OplockLevel; + __u16 Fid; + __le32 CreateAction; +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le32 FileAttributes; ++ struct_group(common_attributes, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le32 FileAttributes; ++ ); + __le64 AllocationSize; + __le64 EndOfFile; + __le16 FileType; +@@ -2268,11 +2270,13 @@ typedef struct { + /* QueryFileInfo/QueryPathinfo (also for SetPath/SetFile) data buffer formats */ + /******************************************************************************/ + typedef struct { /* data block encoding of response to level 263 QPathInfo */ +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le32 Attributes; ++ struct_group(common_attributes, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le32 Attributes; ++ ); + __u32 Pad1; + __le64 AllocationSize; + __le64 EndOfFile; /* size ie offset to first free byte in file */ +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index c90d4ec9292c..67c5fc2b2db9 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -1234,8 +1234,10 @@ CIFS_open(const unsigned int xid, struct cifs_open_parms *oparms, int *oplock, + *oplock |= CIFS_CREATE_ACTION; + + if (buf) { +- /* copy from CreationTime to Attributes */ +- memcpy((char *)buf, (char *)&rsp->CreationTime, 36); ++ /* copy commonly used attributes */ ++ memcpy(&buf->common_attributes, ++ &rsp->common_attributes, ++ sizeof(buf->common_attributes)); + /* the file_info buf is endian converted by caller */ + buf->AllocationSize = rsp->AllocationSize; + buf->EndOfFile = rsp->EndOfFile; +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 2dfbf1b23cfa..e65f998ea4cf 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -3429,12 +3429,10 @@ __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, + } else { + trace_smb3_close_done(xid, persistent_fid, tcon->tid, + ses->Suid); +- /* +- * Note that have to subtract 4 since struct network_open_info +- * has a final 4 byte pad that close response does not have +- */ + if (pbuf) +- memcpy(pbuf, (char *)&rsp->CreationTime, sizeof(*pbuf) - 4); ++ memcpy(&pbuf->network_open_info, ++ &rsp->network_open_info, ++ sizeof(pbuf->network_open_info)); + } + + atomic_dec(&tcon->num_remote_opens); +diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h +index a5773a06aba8..8d011fedecd0 100644 +--- a/fs/smb/client/smb2pdu.h ++++ b/fs/smb/client/smb2pdu.h +@@ -339,13 +339,15 @@ struct smb2_file_reparse_point_info { + } __packed; + + struct smb2_file_network_open_info { +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le64 AllocationSize; +- __le64 EndOfFile; +- __le32 Attributes; ++ struct_group(network_open_info, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le64 AllocationSize; ++ __le64 EndOfFile; ++ __le32 Attributes; ++ ); + __le32 Reserved; + } __packed; /* level 34 Query also similar returned in close rsp and open rsp */ + +diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h +index 5593bb49954c..a3936ff53d9d 100644 +--- a/fs/smb/common/smb2pdu.h ++++ b/fs/smb/common/smb2pdu.h +@@ -699,13 +699,16 @@ struct smb2_close_rsp { + __le16 StructureSize; /* 60 */ + __le16 Flags; + __le32 Reserved; +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le64 AllocationSize; /* Beginning of FILE_STANDARD_INFO equivalent */ +- __le64 EndOfFile; +- __le32 Attributes; ++ struct_group(network_open_info, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ /* Beginning of FILE_STANDARD_INFO equivalent */ ++ __le64 AllocationSize; ++ __le64 EndOfFile; ++ __le32 Attributes; ++ ); + } __packed; + + +-- +2.43.0 + diff --git a/queue-6.1/smb-client-fix-potential-oob-in-smb2_dump_detail.patch b/queue-6.1/smb-client-fix-potential-oob-in-smb2_dump_detail.patch new file mode 100644 index 00000000000..b3d096b6cb3 --- /dev/null +++ b/queue-6.1/smb-client-fix-potential-oob-in-smb2_dump_detail.patch @@ -0,0 +1,93 @@ +From 7942e9034f4356374377f1ec1e380c1628cecb82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:10:31 -0300 +Subject: smb: client: fix potential OOB in smb2_dump_detail() + +From: Paulo Alcantara + +[ Upstream commit 567320c46a60a3c39b69aa1df802d753817a3f86 ] + +Validate SMB message with ->check_message() before calling +->calc_smb_size(). + +This fixes CVE-2023-6610. + +Reported-by: j51569436@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219 +Cc; stable@vger.kernel.org +Signed-off-by: Paulo Alcantara +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2misc.c | 30 +++++++++++++++--------------- + fs/smb/client/smb2ops.c | 6 ++++-- + 2 files changed, 19 insertions(+), 17 deletions(-) + +diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c +index fdf7a7f188c5..15fa022e7999 100644 +--- a/fs/smb/client/smb2misc.c ++++ b/fs/smb/client/smb2misc.c +@@ -173,6 +173,21 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) + } + + mid = le64_to_cpu(shdr->MessageId); ++ if (check_smb2_hdr(shdr, mid)) ++ return 1; ++ ++ if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { ++ cifs_dbg(VFS, "Invalid structure size %u\n", ++ le16_to_cpu(shdr->StructureSize)); ++ return 1; ++ } ++ ++ command = le16_to_cpu(shdr->Command); ++ if (command >= NUMBER_OF_SMB2_COMMANDS) { ++ cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); ++ return 1; ++ } ++ + if (len < pdu_size) { + if ((len >= hdr_size) + && (shdr->Status != 0)) { +@@ -193,21 +208,6 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) + return 1; + } + +- if (check_smb2_hdr(shdr, mid)) +- return 1; +- +- if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { +- cifs_dbg(VFS, "Invalid structure size %u\n", +- le16_to_cpu(shdr->StructureSize)); +- return 1; +- } +- +- command = le16_to_cpu(shdr->Command); +- if (command >= NUMBER_OF_SMB2_COMMANDS) { +- cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); +- return 1; +- } +- + if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { + if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || + pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) { +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 4596d2dfdec3..5a157000bdfe 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -398,8 +398,10 @@ smb2_dump_detail(void *buf, struct TCP_Server_Info *server) + cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", + shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, + shdr->Id.SyncId.ProcessId); +- cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, +- server->ops->calc_smb_size(buf)); ++ if (!server->ops->check_message(buf, server->total_read, server)) { ++ cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, ++ server->ops->calc_smb_size(buf)); ++ } + #endif + } + +-- +2.43.0 + diff --git a/queue-6.1/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch b/queue-6.1/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch new file mode 100644 index 00000000000..0d7267fdd80 --- /dev/null +++ b/queue-6.1/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch @@ -0,0 +1,44 @@ +From f6221fe01f2d7e7ac229e91e65838f5906686a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:33:53 +0800 +Subject: stmmac: dwmac-loongson: drop useless check for compatible fallback + +From: Krzysztof Kozlowski + +[ Upstream commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd ] + +Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, +so checking for some other compatible does not make sense. It cannot be +bound to unsupported platform. + +Drop useless, incorrect (space in between) and undocumented compatible. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Yanteng Si +Reviewed-by: Conor Dooley +Acked-by: Jiaxun Yang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +index 49c7aa86faaa..e129ee1020f0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +@@ -59,11 +59,6 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id + return -ENODEV; + } + +- if (!of_device_is_compatible(np, "loongson, pci-gmac")) { +- pr_info("dwmac_loongson_pci: Incompatible OF node\n"); +- return -ENODEV; +- } +- + plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); + if (!plat) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.1/tracing-add-size-check-when-printing-trace_marker-ou.patch b/queue-6.1/tracing-add-size-check-when-printing-trace_marker-ou.patch new file mode 100644 index 00000000000..0d0014c79d4 --- /dev/null +++ b/queue-6.1/tracing-add-size-check-when-printing-trace_marker-ou.patch @@ -0,0 +1,67 @@ +From b578b796bb14ae8602eeeba0ec7d9dc25c3b48b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 08:44:44 -0500 +Subject: tracing: Add size check when printing trace_marker output + +From: Steven Rostedt (Google) + +[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ] + +If for some reason the trace_marker write does not have a nul byte for the +string, it will overflow the print: + + trace_seq_printf(s, ": %s", field->buf); + +The field->buf could be missing the nul byte. To prevent overflow, add the +max size that the buf can be by using the event size and the field +location. + + int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_seq_printf(s, ": %*.s", max, field->buf); + +Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_output.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c +index 5cd4fb656306..bf1965b18099 100644 +--- a/kernel/trace/trace_output.c ++++ b/kernel/trace/trace_output.c +@@ -1445,11 +1445,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, + { + struct print_entry *field; + struct trace_seq *s = &iter->seq; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + + seq_print_ip_sym(s, field->ip, flags); +- trace_seq_printf(s, ": %s", field->buf); ++ trace_seq_printf(s, ": %.*s", max, field->buf); + + return trace_handle_return(s); + } +@@ -1458,10 +1459,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, + struct trace_event *event) + { + struct print_entry *field; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + +- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf); ++ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf); + + return trace_handle_return(&iter->seq); + } +-- +2.43.0 + diff --git a/queue-6.1/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch b/queue-6.1/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch new file mode 100644 index 00000000000..94f6761cdb5 --- /dev/null +++ b/queue-6.1/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch @@ -0,0 +1,180 @@ +From f6747be005421d6d871ad57463349e5c51eb6177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 09:21:53 +0800 +Subject: tracing: Fix uaf issue when open the hist or hist_debug file + +From: Zheng Yejian + +[ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ] + +KASAN report following issue. The root cause is when opening 'hist' +file of an instance and accessing 'trace_event_file' in hist_show(), +but 'trace_event_file' has been freed due to the instance being removed. +'hist_debug' file has the same problem. To fix it, call +tracing_{open,release}_file_tr() in file_operations callback to have +the ref count and avoid 'trace_event_file' being freed. + + BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 + Read of size 8 at addr ffff242541e336b8 by task head/190 + + CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x98/0xf8 + show_stack+0x1c/0x30 + dump_stack_lvl+0x44/0x58 + print_report+0xf0/0x5a0 + kasan_report+0x80/0xc0 + __asan_report_load8_noabort+0x1c/0x28 + hist_show+0x11e0/0x1278 + seq_read_iter+0x344/0xd78 + seq_read+0x128/0x1c0 + vfs_read+0x198/0x6c8 + ksys_read+0xf4/0x1e0 + __arm64_sys_read+0x70/0xa8 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + + Allocated by task 188: + kasan_save_stack+0x28/0x50 + kasan_set_track+0x28/0x38 + kasan_save_alloc_info+0x20/0x30 + __kasan_slab_alloc+0x6c/0x80 + kmem_cache_alloc+0x15c/0x4a8 + trace_create_new_event+0x84/0x348 + __trace_add_new_event+0x18/0x88 + event_trace_add_tracer+0xc4/0x1a0 + trace_array_create_dir+0x6c/0x100 + trace_array_create+0x2e8/0x568 + instance_mkdir+0x48/0x80 + tracefs_syscall_mkdir+0x90/0xe8 + vfs_mkdir+0x3c4/0x610 + do_mkdirat+0x144/0x200 + __arm64_sys_mkdirat+0x8c/0xc0 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + + Freed by task 191: + kasan_save_stack+0x28/0x50 + kasan_set_track+0x28/0x38 + kasan_save_free_info+0x34/0x58 + __kasan_slab_free+0xe4/0x158 + kmem_cache_free+0x19c/0x508 + event_file_put+0xa0/0x120 + remove_event_file_dir+0x180/0x320 + event_trace_del_tracer+0xb0/0x180 + __remove_instance+0x224/0x508 + instance_rmdir+0x44/0x78 + tracefs_syscall_rmdir+0xbc/0x140 + vfs_rmdir+0x1cc/0x4c8 + do_rmdir+0x220/0x2b8 + __arm64_sys_unlinkat+0xc0/0x100 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + +Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyejian1@huawei.com + +Suggested-by: Steven Rostedt +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 ++++++ + kernel/trace/trace.h | 1 + + kernel/trace/trace_events_hist.c | 12 ++++++++---- + 3 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index b751c2ce9a34..2b3c4cd8382b 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4916,6 +4916,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp) + return 0; + } + ++int tracing_single_release_file_tr(struct inode *inode, struct file *filp) ++{ ++ tracing_release_file_tr(inode, filp); ++ return single_release(inode, filp); ++} ++ + static int tracing_mark_open(struct inode *inode, struct file *filp) + { + stream_open(inode, filp); +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 10aaafa2936d..aad7fcd84617 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -592,6 +592,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp); + int tracing_open_generic_tr(struct inode *inode, struct file *filp); + int tracing_open_file_tr(struct inode *inode, struct file *filp); + int tracing_release_file_tr(struct inode *inode, struct file *filp); ++int tracing_single_release_file_tr(struct inode *inode, struct file *filp); + bool tracing_is_disabled(void); + bool tracer_tracing_is_on(struct trace_array *tr); + void tracer_tracing_on(struct trace_array *tr); +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 1470af219073..3b0da1bddf63 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -5532,10 +5532,12 @@ static int event_hist_open(struct inode *inode, struct file *file) + { + int ret; + +- ret = security_locked_down(LOCKDOWN_TRACEFS); ++ ret = tracing_open_file_tr(inode, file); + if (ret) + return ret; + ++ /* Clear private_data to avoid warning in single_open() */ ++ file->private_data = NULL; + return single_open(file, hist_show, file); + } + +@@ -5543,7 +5545,7 @@ const struct file_operations event_hist_fops = { + .open = event_hist_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = single_release, ++ .release = tracing_single_release_file_tr, + }; + + #ifdef CONFIG_HIST_TRIGGERS_DEBUG +@@ -5809,10 +5811,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) + { + int ret; + +- ret = security_locked_down(LOCKDOWN_TRACEFS); ++ ret = tracing_open_file_tr(inode, file); + if (ret) + return ret; + ++ /* Clear private_data to avoid warning in single_open() */ ++ file->private_data = NULL; + return single_open(file, hist_debug_show, file); + } + +@@ -5820,7 +5824,7 @@ const struct file_operations event_hist_debug_fops = { + .open = event_hist_debug_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = single_release, ++ .release = tracing_single_release_file_tr, + }; + #endif + +-- +2.43.0 + diff --git a/queue-6.1/tracing-have-large-events-show-up-as-line-too-big-in.patch b/queue-6.1/tracing-have-large-events-show-up-as-line-too-big-in.patch new file mode 100644 index 00000000000..8768779356b --- /dev/null +++ b/queue-6.1/tracing-have-large-events-show-up-as-line-too-big-in.patch @@ -0,0 +1,79 @@ +From d22f56b325bb422a15de1d572650b3004120579e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 17:10:58 -0500 +Subject: tracing: Have large events show up as '[LINE TOO BIG]' instead of + nothing + +From: Steven Rostedt (Google) + +[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ] + +If a large event was added to the ring buffer that is larger than what the +trace_seq can handle, it just drops the output: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234 + +Instead, catch this case and add some context: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG] + <...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234 + +This now emulates the same output as trace_pipe. + +Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index deae65af76ec..b751c2ce9a34 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4679,7 +4679,11 @@ static int s_show(struct seq_file *m, void *v) + iter->leftover = ret; + + } else { +- print_trace_line(iter); ++ ret = print_trace_line(iter); ++ if (ret == TRACE_TYPE_PARTIAL_LINE) { ++ iter->seq.full = 0; ++ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n"); ++ } + ret = trace_print_seq(m, &iter->seq); + /* + * If we overflow the seq_file buffer, then it will +-- +2.43.0 + diff --git a/queue-6.1/virtio_blk-fix-snprintf-truncation-compiler-warning.patch b/queue-6.1/virtio_blk-fix-snprintf-truncation-compiler-warning.patch new file mode 100644 index 00000000000..35dd2c5ab49 --- /dev/null +++ b/queue-6.1/virtio_blk-fix-snprintf-truncation-compiler-warning.patch @@ -0,0 +1,83 @@ +From a5a7055c360143d1c204c9b64844af41fe902396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 09:07:43 -0500 +Subject: virtio_blk: fix snprintf truncation compiler warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Hajnoczi + +[ Upstream commit b8e0792449928943c15d1af9f63816911d139267 ] + +Commit 4e0400525691 ("virtio-blk: support polling I/O") triggers the +following gcc 13 W=1 warnings: + +drivers/block/virtio_blk.c: In function ‘init_vq’: +drivers/block/virtio_blk.c:1077:68: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 7 [-Wformat-truncation=] + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~ +drivers/block/virtio_blk.c:1077:58: note: directive argument in the range [-2147483648, 65534] + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~~~~~~~~~~~~ +drivers/block/virtio_blk.c:1077:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16 + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This is a false positive because the lower bound -2147483648 is +incorrect. The true range of i is [0, num_vqs - 1] where 0 < num_vqs < +65536. + +The code mixes int, unsigned short, and unsigned int types in addition +to using "%d" for an unsigned value. Use unsigned short and "%u" +consistently to solve the compiler warning. + +Cc: Suwan Kim +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312041509.DIyvEt9h-lkp@intel.com/ +Signed-off-by: Stefan Hajnoczi +Message-Id: <20231204140743.1487843-1-stefanha@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index efa5535a8e1d..3124837aa406 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -609,12 +609,12 @@ static void virtblk_config_changed(struct virtio_device *vdev) + static int init_vq(struct virtio_blk *vblk) + { + int err; +- int i; ++ unsigned short i; + vq_callback_t **callbacks; + const char **names; + struct virtqueue **vqs; + unsigned short num_vqs; +- unsigned int num_poll_vqs; ++ unsigned short num_poll_vqs; + struct virtio_device *vdev = vblk->vdev; + struct irq_affinity desc = { 0, }; + +@@ -658,13 +658,13 @@ static int init_vq(struct virtio_blk *vblk) + + for (i = 0; i < num_vqs - num_poll_vqs; i++) { + callbacks[i] = virtblk_done; +- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%d", i); ++ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%u", i); + names[i] = vblk->vqs[i].name; + } + + for (; i < num_vqs; i++) { + callbacks[i] = NULL; +- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); ++ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%u", i); + names[i] = vblk->vqs[i].name; + } + +-- +2.43.0 + diff --git a/queue-6.1/wifi-avoid-offset-calculation-on-null-pointer.patch b/queue-6.1/wifi-avoid-offset-calculation-on-null-pointer.patch new file mode 100644 index 00000000000..6cd2ff3e2da --- /dev/null +++ b/queue-6.1/wifi-avoid-offset-calculation-on-null-pointer.patch @@ -0,0 +1,45 @@ +From 56bcdf89854675bdc904140605e5a05f752d5cd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 11:02:37 +0800 +Subject: wifi: avoid offset calculation on NULL pointer + +From: Michael-CY Lee + +[ Upstream commit ef5828805842204dd0259ecfc132b5916c8a77ae ] + +ieee80211_he_6ghz_oper() can be passed a NULL pointer +and checks for that, but already did the calculation +to inside of it before. Move it after the check. + +Signed-off-by: Michael-CY Lee +Link: https://lore.kernel.org/r/20231122030237.31276-1-michael-cy.lee@mediatek.com +[rewrite commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index 870ae4cd8202..dce105f67b4d 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -2658,12 +2658,14 @@ ieee80211_he_oper_size(const u8 *he_oper_ie) + static inline const struct ieee80211_he_6ghz_oper * + ieee80211_he_6ghz_oper(const struct ieee80211_he_operation *he_oper) + { +- const u8 *ret = (const void *)&he_oper->optional; ++ const u8 *ret; + u32 he_oper_params; + + if (!he_oper) + return NULL; + ++ ret = (const void *)&he_oper->optional; ++ + he_oper_params = le32_to_cpu(he_oper->he_oper_params); + + if (!(he_oper_params & IEEE80211_HE_OPERATION_6GHZ_OP_INFO)) +-- +2.43.0 + diff --git a/queue-6.1/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch b/queue-6.1/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch new file mode 100644 index 00000000000..c98ca77cf62 --- /dev/null +++ b/queue-6.1/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch @@ -0,0 +1,36 @@ +From fb72563587ac71a96a10b47620291fce3150a92b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 13:41:25 +0100 +Subject: wifi: cfg80211: lock wiphy mutex for rfkill poll + +From: Johannes Berg + +[ Upstream commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 ] + +We want to guarantee the mutex is held for pretty much +all operations, so ensure that here as well. + +Reported-by: syzbot+7e59a5bfc7a897247e18@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 63d75fecc2c5..8809e668ed91 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -216,7 +216,9 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data) + { + struct cfg80211_registered_device *rdev = data; + ++ wiphy_lock(&rdev->wiphy); + rdev_rfkill_poll(rdev); ++ wiphy_unlock(&rdev->wiphy); + } + + void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev, +-- +2.43.0 + diff --git a/queue-6.1/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch b/queue-6.1/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..5847f92cf7c --- /dev/null +++ b/queue-6.1/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 120053f158574f737ef9891c2dce3dc3b61d60ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 04:50:17 +0200 +Subject: wifi: iwlwifi: pcie: avoid a NULL pointer dereference + +From: Avraham Stern + +[ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ] + +It possible that while the rx rb is being handled, the transport has +been stopped and re-started. In this case the tx queue pointer is not +yet initialized, which will lead to a NULL pointer dereference. +Fix it. + +Signed-off-by: Avraham Stern +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index 57a11ee05bc3..91b73e7a4113 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1381,7 +1381,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, + * if it is true then one of the handlers took the page. + */ + +- if (reclaim) { ++ if (reclaim && txq) { + u16 sequence = le16_to_cpu(pkt->hdr.sequence); + int index = SEQ_TO_INDEX(sequence); + int cmd_index = iwl_txq_get_cmd_index(txq, index); +-- +2.43.0 + diff --git a/queue-6.1/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch b/queue-6.1/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch new file mode 100644 index 00000000000..0f5ae4fba27 --- /dev/null +++ b/queue-6.1/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch @@ -0,0 +1,37 @@ +From 9f414af383c5814f0d24e9f0e571561fc84a31d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 10:22:01 -0800 +Subject: wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap + +From: Ben Greear + +[ Upstream commit 00f7d153f3358a7c7e35aef66fcd9ceb95d90430 ] + +The new 320 MHz channel width wasn't handled, so connecting +a station to a 320 MHz AP would limit the station to 20 MHz +(on HT) after a warning, handle 320 MHz to fix that. + +Signed-off-by: Ben Greear +Link: https://lore.kernel.org/r/20231109182201.495381-1-greearb@candelatech.com +[write a proper commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/ht.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c +index ae42e956eff5..9bfe128ada47 100644 +--- a/net/mac80211/ht.c ++++ b/net/mac80211/ht.c +@@ -271,6 +271,7 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata, + case NL80211_CHAN_WIDTH_80: + case NL80211_CHAN_WIDTH_80P80: + case NL80211_CHAN_WIDTH_160: ++ case NL80211_CHAN_WIDTH_320: + bw = ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ? + IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20; + break; +-- +2.43.0 +