From: Sasha Levin Date: Tue, 16 Jan 2024 10:42:04 +0000 (-0500) Subject: Fixes for 6.6 X-Git-Tag: v6.1.74~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4946c8fcfea1722118e94853fab98967e52b398;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch b/queue-6.6/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch new file mode 100644 index 00000000000..dea1bdec03b --- /dev/null +++ b/queue-6.6/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch @@ -0,0 +1,59 @@ +From bd1d50fe971218acc4dc330d86cd069ccf7bfc10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 20:09:23 +0300 +Subject: ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook + XPro + +From: Vasiliy Kovalev + +[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ] + +This patch corrected the speaker and headset mic pin config to the more +appropriate values. + +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index a9822d731ae0..2f367e8b399b 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7180,6 +7180,7 @@ enum { + ALC290_FIXUP_SUBWOOFER_HSJACK, + ALC269_FIXUP_THINKPAD_ACPI, + ALC269_FIXUP_DMIC_THINKPAD_ACPI, ++ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO, + ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, +@@ -7532,6 +7533,14 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_U7x7_headset_mic, + }, ++ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x03a19020 }, /* headset mic */ ++ { 0x1b, 0x90170150 }, /* speaker */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -10183,6 +10192,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), ++ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), + SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC), + SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch b/queue-6.6/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch new file mode 100644 index 00000000000..9cdb3c49efc --- /dev/null +++ b/queue-6.6/alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch @@ -0,0 +1,104 @@ +From b79acb779b34a53593b20b0d6ad754b9747c55e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 13:16:58 +0200 +Subject: ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps + format + +From: Peter Ujfalusi + +[ Upstream commit 7b4c93a50a2ebbbaf656cc4fa6aca74a6166d85b ] + +When looking up DMIC blob from the NHLT table and the format is 32 bits, +ignore the vbps matching for 32 bps for DMIC since some NHLT table have +the vbps as 24, some have it as 32. +The DMIC hardware supports only one type of 32 bit sample size, which is +24 bit sampling on the MSB side and bits[1:0] is used for indicating the +channel number. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20231127111658.17275-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-nhlt.c | 33 +++++++++++++++++++++++++++++---- + 1 file changed, 29 insertions(+), 4 deletions(-) + +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index 2c4dfc0b7e34..696a958d93e9 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -238,7 +238,7 @@ EXPORT_SYMBOL(intel_nhlt_ssp_mclk_mask); + + static struct nhlt_specific_cfg * + nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, +- u32 rate, u8 vbps, u8 bps) ++ u32 rate, u8 vbps, u8 bps, bool ignore_vbps) + { + struct nhlt_fmt_cfg *cfg = fmt->fmt_config; + struct wav_fmt *wfmt; +@@ -255,8 +255,12 @@ nhlt_get_specific_cfg(struct device *dev, struct nhlt_fmt *fmt, u8 num_ch, + dev_dbg(dev, "Endpoint format: ch=%d fmt=%d/%d rate=%d\n", + wfmt->channels, _vbps, _bps, wfmt->samples_per_sec); + ++ /* ++ * When looking for exact match of configuration ignore the vbps ++ * from NHLT table when ignore_vbps is true ++ */ + if (wfmt->channels == num_ch && wfmt->samples_per_sec == rate && +- vbps == _vbps && bps == _bps) ++ (ignore_vbps || vbps == _vbps) && bps == _bps) + return &cfg->config; + + cfg = (struct nhlt_fmt_cfg *)(cfg->config.caps + cfg->config.size); +@@ -289,6 +293,7 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + { + struct nhlt_specific_cfg *cfg; + struct nhlt_endpoint *epnt; ++ bool ignore_vbps = false; + struct nhlt_fmt *fmt; + int i; + +@@ -298,7 +303,26 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + dev_dbg(dev, "Looking for configuration:\n"); + dev_dbg(dev, " vbus_id=%d link_type=%d dir=%d, dev_type=%d\n", + bus_id, link_type, dir, dev_type); +- dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); ++ if (link_type == NHLT_LINK_DMIC && bps == 32 && (vbps == 24 || vbps == 32)) { ++ /* ++ * The DMIC hardware supports only one type of 32 bits sample ++ * size, which is 24 bit sampling on the MSB side and bits[1:0] ++ * are used for indicating the channel number. ++ * It has been observed that some NHLT tables have the vbps ++ * specified as 32 while some uses 24. ++ * The format these variations describe are identical, the ++ * hardware is configured and behaves the same way. ++ * Note: when the samples assumed to be vbps=32 then the 'noise' ++ * introduced by the lower two bits (channel number) have no ++ * real life implication on audio quality. ++ */ ++ dev_dbg(dev, ++ " ch=%d fmt=%d rate=%d (vbps is ignored for DMIC 32bit format)\n", ++ num_ch, bps, rate); ++ ignore_vbps = true; ++ } else { ++ dev_dbg(dev, " ch=%d fmt=%d/%d rate=%d\n", num_ch, vbps, bps, rate); ++ } + dev_dbg(dev, "Endpoint count=%d\n", nhlt->endpoint_count); + + epnt = (struct nhlt_endpoint *)nhlt->desc; +@@ -307,7 +331,8 @@ intel_nhlt_get_endpoint_blob(struct device *dev, struct nhlt_acpi_table *nhlt, + if (nhlt_check_ep_match(dev, epnt, bus_id, link_type, dir, dev_type)) { + fmt = (struct nhlt_fmt *)(epnt->config.caps + epnt->config.size); + +- cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, vbps, bps); ++ cfg = nhlt_get_specific_cfg(dev, fmt, num_ch, rate, ++ vbps, bps, ignore_vbps); + if (cfg) + return cfg; + } +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch b/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch new file mode 100644 index 00000000000..b700884475e --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch @@ -0,0 +1,51 @@ +From e27bc33e9bfc7b5d9ab0b303230da0e28dc2d1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 15:12:19 +0000 +Subject: ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models + +From: Stefan Binding + +[ Upstream commit 51d976079976c800ef19ed1b542602fcf63f0edb ] + +These models use 2xCS35L41amps with HDA using SPI and I2C. +Models use internal and external boost. +All models require DSD support to be added inside +cs35l41_hda_property.c + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20231218151221.388745-6-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2f367e8b399b..69b3df84e096 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9916,17 +9916,20 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), ++ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), +- SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), +-- +2.43.0 + diff --git a/queue-6.6/alsa-pcmtest-stop-timer-before-buffer-is-released.patch b/queue-6.6/alsa-pcmtest-stop-timer-before-buffer-is-released.patch new file mode 100644 index 00000000000..f4ed8c769a1 --- /dev/null +++ b/queue-6.6/alsa-pcmtest-stop-timer-before-buffer-is-released.patch @@ -0,0 +1,77 @@ +From fcbc68f60b9e9f4793419b8e0ffe734594b8aa34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 22:32:11 +0000 +Subject: ALSA: pcmtest: stop timer before buffer is released + +From: Ivan Orlov + +[ Upstream commit eb99b1b72a424a79f56c972e0fd7ad01fe93a008 ] + +Stop timer in the 'trigger' and 'sync_stop' callbacks since we want +the timer to be stopped before the DMA buffer is released. Otherwise, +it could trigger a kernel panic in some circumstances, for instance +when the DMA buffer is already released but the timer callback is +still running. + +Signed-off-by: Ivan Orlov +Link: https://lore.kernel.org/r/20231206223211.12761-1-ivan.orlov0322@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/drivers/pcmtest.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/drivers/pcmtest.c b/sound/drivers/pcmtest.c +index b59b78a09224..b8bff5522bce 100644 +--- a/sound/drivers/pcmtest.c ++++ b/sound/drivers/pcmtest.c +@@ -397,7 +397,6 @@ static int snd_pcmtst_pcm_close(struct snd_pcm_substream *substream) + struct pcmtst_buf_iter *v_iter = substream->runtime->private_data; + + timer_shutdown_sync(&v_iter->timer_instance); +- v_iter->substream = NULL; + playback_capture_test = !v_iter->is_buf_corrupted; + kfree(v_iter); + return 0; +@@ -435,6 +434,7 @@ static int snd_pcmtst_pcm_trigger(struct snd_pcm_substream *substream, int cmd) + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: + // We can't call timer_shutdown_sync here, as it is forbidden to sleep here + v_iter->suspend = true; ++ timer_delete(&v_iter->timer_instance); + break; + } + +@@ -512,12 +512,22 @@ static int snd_pcmtst_ioctl(struct snd_pcm_substream *substream, unsigned int cm + return snd_pcm_lib_ioctl(substream, cmd, arg); + } + ++static int snd_pcmtst_sync_stop(struct snd_pcm_substream *substream) ++{ ++ struct pcmtst_buf_iter *v_iter = substream->runtime->private_data; ++ ++ timer_delete_sync(&v_iter->timer_instance); ++ ++ return 0; ++} ++ + static const struct snd_pcm_ops snd_pcmtst_playback_ops = { + .open = snd_pcmtst_pcm_open, + .close = snd_pcmtst_pcm_close, + .trigger = snd_pcmtst_pcm_trigger, + .hw_params = snd_pcmtst_pcm_hw_params, + .ioctl = snd_pcmtst_ioctl, ++ .sync_stop = snd_pcmtst_sync_stop, + .hw_free = snd_pcmtst_pcm_hw_free, + .prepare = snd_pcmtst_pcm_prepare, + .pointer = snd_pcmtst_pcm_pointer, +@@ -530,6 +540,7 @@ static const struct snd_pcm_ops snd_pcmtst_capture_ops = { + .hw_params = snd_pcmtst_pcm_hw_params, + .hw_free = snd_pcmtst_pcm_hw_free, + .ioctl = snd_pcmtst_ioctl, ++ .sync_stop = snd_pcmtst_sync_stop, + .prepare = snd_pcmtst_pcm_prepare, + .pointer = snd_pcmtst_pcm_pointer, + }; +-- +2.43.0 + diff --git a/queue-6.6/arc-fix-smatch-warning.patch b/queue-6.6/arc-fix-smatch-warning.patch new file mode 100644 index 00000000000..c29340c77ec --- /dev/null +++ b/queue-6.6/arc-fix-smatch-warning.patch @@ -0,0 +1,43 @@ +From 53ee4e4a3cd250e6258e8453919acc8bbda793a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:25:23 -0800 +Subject: ARC: fix smatch warning + +From: Vineet Gupta + +[ Upstream commit 4eb69d00fe967699b9d93f7e74a990fe813e8d2b ] + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202311280906.VAIwEAfT-lkp@intel.com/ +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/setup.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c +index 4dcf8589b708..d08a5092c2b4 100644 +--- a/arch/arc/kernel/setup.c ++++ b/arch/arc/kernel/setup.c +@@ -153,7 +153,7 @@ static int arcv2_mumbojumbo(int c, struct cpuinfo_arc *info, char *buf, int len) + { + int n = 0; + #ifdef CONFIG_ISA_ARCV2 +- const char *release, *cpu_nm, *isa_nm = "ARCv2"; ++ const char *release = "", *cpu_nm = "HS38", *isa_nm = "ARCv2"; + int dual_issue = 0, dual_enb = 0, mpy_opt, present; + int bpu_full, bpu_cache, bpu_pred, bpu_ret_stk; + char mpy_nm[16], lpb_nm[32]; +@@ -172,8 +172,6 @@ static int arcv2_mumbojumbo(int c, struct cpuinfo_arc *info, char *buf, int len) + * releases only update it. + */ + +- cpu_nm = "HS38"; +- + if (info->arcver > 0x50 && info->arcver <= 0x53) { + release = arc_hs_rel[info->arcver - 0x51].str; + } else { +-- +2.43.0 + diff --git a/queue-6.6/arc-fix-spare-error.patch b/queue-6.6/arc-fix-spare-error.patch new file mode 100644 index 00000000000..b4d342a95fb --- /dev/null +++ b/queue-6.6/arc-fix-spare-error.patch @@ -0,0 +1,48 @@ +From 2130aa45cd83987a5683160c8e1e0bc8842c0e7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:57:07 -0800 +Subject: ARC: fix spare error + +From: Vineet Gupta + +[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/ +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c +index 0b3bb529d246..8f6f4a542964 100644 +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -62,7 +62,7 @@ struct rt_sigframe { + unsigned int sigret_magic; + }; + +-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +@@ -75,12 +75,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) + #else + v2abi.r58 = v2abi.r59 = 0; + #endif +- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); ++ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi)); + #endif + return err; + } + +-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +-- +2.43.0 + diff --git a/queue-6.6/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch b/queue-6.6/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch new file mode 100644 index 00000000000..d3e199540be --- /dev/null +++ b/queue-6.6/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch @@ -0,0 +1,49 @@ +From 7a7e6c32e3c12bd200af71f595c5f80a8dbd9025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 20:39:03 +0100 +Subject: ARM: sun9i: smp: fix return code check of of_property_match_string + +From: Stefan Wahren + +[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ] + +of_property_match_string returns an int; either an index from 0 or +greater if successful or negative on failure. Even it's very +unlikely that the DT CPU node contains multiple enable-methods +these checks should be fixed. + +This patch was inspired by the work of Nick Desaulniers. + +Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ +Cc: Nick Desaulniers +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/mc_smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c +index 6ec3445f3c72..277f6aa8e6c2 100644 +--- a/arch/arm/mach-sunxi/mc_smp.c ++++ b/arch/arm/mach-sunxi/mc_smp.c +@@ -803,12 +803,12 @@ static int __init sunxi_mc_smp_init(void) + for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) { + ret = of_property_match_string(node, "enable-method", + sunxi_mc_smp_data[i].enable_method); +- if (!ret) ++ if (ret >= 0) + break; + } + + of_node_put(node); +- if (ret) ++ if (ret < 0) + return -ENODEV; + + is_a83t = sunxi_mc_smp_data[i].is_a83t; +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch b/queue-6.6/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch new file mode 100644 index 00000000000..48cceb5992e --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch @@ -0,0 +1,78 @@ +From 47f51bbee66c49a828a77e213cb94d659c09fd25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 13:18:29 -0600 +Subject: arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru + +From: Rob Herring + +[ Upstream commit c13c823a78b77ea0e5f1f73112d910e259911101 ] + +The rk3399-gru PCI node addresses are wrong. + +In rk3399-gru-scarlet, the bus number in the address should be 0. This is +because bus number assignment is dynamic and not known up front. For FDT, +the bus number is simply ignored. + +In rk3399-gru-chromebook, the addresses are simply invalid. The first +"reg" entry must be the configuration space for the device. The entry +should be all 0s except for device/slot and function numbers. The existing +64-bit memory space (0x83000000) entries are not valid because they must +have the BAR address in the lower byte of the first cell. + +Warnings for these are enabled by adding the missing 'device_type = "pci"' +for the root port node. + +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20231130191830.2424361-1-robh@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +-- + arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 ++-- + arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +index 5c1929d41cc0..cacbad35cfc8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-chromebook.dtsi +@@ -509,8 +509,7 @@ wacky_spi_audio: spi2@0 { + &pci_rootport { + mvl_wifi: wifi@0,0 { + compatible = "pci1b4b,2b42"; +- reg = <0x83010000 0x0 0x00000000 0x0 0x00100000 +- 0x83010000 0x0 0x00100000 0x0 0x00100000>; ++ reg = <0x0000 0x0 0x0 0x0 0x0>; + interrupt-parent = <&gpio0>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts +index 853e88455e75..9e4b12ed62cb 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts +@@ -34,8 +34,8 @@ &mipi_panel { + &pci_rootport { + wifi@0,0 { + compatible = "qcom,ath10k"; +- reg = <0x00010000 0x0 0x00000000 0x0 0x00000000>, +- <0x03010010 0x0 0x00000000 0x0 0x00200000>; ++ reg = <0x00000000 0x0 0x00000000 0x0 0x00000000>, ++ <0x03000010 0x0 0x00000000 0x0 0x00200000>; + qcom,ath10k-calibration-variant = "GO_DUMO"; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index c9bf1d5c3a42..789fd0dcc88b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -489,6 +489,7 @@ pci_rootport: pcie@0,0 { + #address-cells = <3>; + #size-cells = <2>; + ranges; ++ device_type = "pci"; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.6/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch b/queue-6.6/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch new file mode 100644 index 00000000000..c1894480472 --- /dev/null +++ b/queue-6.6/arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch @@ -0,0 +1,37 @@ +From 2977500a31f7f2e7ed94ba8c58cbaab351f0257f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 16:38:34 +0100 +Subject: arm64: dts: rockchip: fix rk356x pcie msg interrupt name + +From: Heiko Stuebner + +[ Upstream commit 3cee9c635f27d1003d46f624d816f3455698b625 ] + +The expected name by the binding at this position is "msg" and the SoC's +manual also calls the interrupt in question "msg", so fix the rk356x dtsi +to use the correct name. + +Reviewed-by: Sebastian Reichel +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20231114153834.934978-1-heiko@sntech.de +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index abee88911982..b7e2b475f070 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -970,7 +970,7 @@ pcie2x1: pcie@fe260000 { + , + , + ; +- interrupt-names = "sys", "pmc", "msi", "legacy", "err"; ++ interrupt-names = "sys", "pmc", "msg", "legacy", "err"; + bus-range = <0x0 0xf>; + clocks = <&cru ACLK_PCIE20_MST>, <&cru ACLK_PCIE20_SLV>, + <&cru ACLK_PCIE20_DBI>, <&cru PCLK_PCIE20>, +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch b/queue-6.6/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch new file mode 100644 index 00000000000..d6d0d42b750 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch @@ -0,0 +1,41 @@ +From 0bd0a8139408add06e4c4fae2800c998c1e483ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 11:42:38 -0700 +Subject: ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 + +From: Jeremy Soller + +[ Upstream commit 19650c0f402f53abe48a55a1c49c8ed9576a088c ] + +Add pang13 quirk to enable the internal microphone. + +Signed-off-by: Jeremy Soller +Signed-off-by: Tim Crawford +Link: https://lore.kernel.org/r/20231127184237.32077-2-tcrawford@system76.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index a3424d880019..d83cb6e4c62a 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -395,6 +395,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "System76"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "pang13"), ++ } ++ }, + {} + }; + +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-add-hp-255-g10-into-quirk-table.patch b/queue-6.6/asoc-amd-yc-add-hp-255-g10-into-quirk-table.patch new file mode 100644 index 00000000000..d5f9b873cb3 --- /dev/null +++ b/queue-6.6/asoc-amd-yc-add-hp-255-g10-into-quirk-table.patch @@ -0,0 +1,41 @@ +From fc2a074ae09b6c0a2c4894fe18d78bf0b46611a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Nov 2023 17:54:04 +0100 +Subject: ASoC: amd: yc: Add HP 255 G10 into quirk table + +From: Matus Malych + +[ Upstream commit 0c6498a59fbbcbf3d0a58c282dd6f0bca0eed92a ] + +HP 255 G10's internal microphone array can be made +to work by adding it to the quirk table. + +Signed-off-by: Matus Malych +Link: https://lore.kernel.org/r/20231112165403.3221-1-matus@malych.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 3babb17a56bb..a3424d880019 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -374,6 +374,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "8A3E"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"), ++ DMI_MATCH(DMI_BOARD_NAME, "8B2F"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs35l45-prevent-irq-handling-when-suspending-re.patch b/queue-6.6/asoc-cs35l45-prevent-irq-handling-when-suspending-re.patch new file mode 100644 index 00000000000..4546a201794 --- /dev/null +++ b/queue-6.6/asoc-cs35l45-prevent-irq-handling-when-suspending-re.patch @@ -0,0 +1,85 @@ +From e051bdb297e7e37570fd993100c89b80a52f562a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 10:03:17 -0600 +Subject: ASoC: cs35l45: Prevent IRQ handling when suspending/resuming + +From: Ricardo Rivera-Matos + +[ Upstream commit c3c8b088949b9ccb88da2f84d3c3cc06580a6a43 ] + +Use the SYSTEM_SLEEP_PM_OPS handlers to prevent handling an IRQ +when the system is in the middle of suspending or resuming. + +Signed-off-by: Ricardo Rivera-Matos +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231206160318.1255034-3-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 43 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index b1d0f2c8f2ca..310747b7689d 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -854,6 +854,46 @@ static int cs35l45_runtime_resume(struct device *dev) + return ret; + } + ++static int cs35l45_sys_suspend(struct device *dev) ++{ ++ struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); ++ ++ dev_dbg(cs35l45->dev, "System suspend, disabling IRQ\n"); ++ disable_irq(cs35l45->irq); ++ ++ return 0; ++} ++ ++static int cs35l45_sys_suspend_noirq(struct device *dev) ++{ ++ struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); ++ ++ dev_dbg(cs35l45->dev, "Late system suspend, reenabling IRQ\n"); ++ enable_irq(cs35l45->irq); ++ ++ return 0; ++} ++ ++static int cs35l45_sys_resume_noirq(struct device *dev) ++{ ++ struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); ++ ++ dev_dbg(cs35l45->dev, "Early system resume, disabling IRQ\n"); ++ disable_irq(cs35l45->irq); ++ ++ return 0; ++} ++ ++static int cs35l45_sys_resume(struct device *dev) ++{ ++ struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); ++ ++ dev_dbg(cs35l45->dev, "System resume, reenabling IRQ\n"); ++ enable_irq(cs35l45->irq); ++ ++ return 0; ++} ++ + static int cs35l45_apply_property_config(struct cs35l45_private *cs35l45) + { + struct device_node *node = cs35l45->dev->of_node; +@@ -1291,6 +1331,9 @@ EXPORT_SYMBOL_NS_GPL(cs35l45_remove, SND_SOC_CS35L45); + + EXPORT_GPL_DEV_PM_OPS(cs35l45_pm_ops) = { + RUNTIME_PM_OPS(cs35l45_runtime_suspend, cs35l45_runtime_resume, NULL) ++ ++ SYSTEM_SLEEP_PM_OPS(cs35l45_sys_suspend, cs35l45_sys_resume) ++ NOIRQ_SYSTEM_SLEEP_PM_OPS(cs35l45_sys_suspend_noirq, cs35l45_sys_resume_noirq) + }; + + MODULE_DESCRIPTION("ASoC CS35L45 driver"); +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs35l45-prevents-spinning-during-runtime-suspen.patch b/queue-6.6/asoc-cs35l45-prevents-spinning-during-runtime-suspen.patch new file mode 100644 index 00000000000..1840eec9080 --- /dev/null +++ b/queue-6.6/asoc-cs35l45-prevents-spinning-during-runtime-suspen.patch @@ -0,0 +1,52 @@ +From f12fe3fea105eeba974cb8f9f2d4ac91825c255f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 10:03:18 -0600 +Subject: ASoC: cs35l45: Prevents spinning during runtime suspend + +From: Ricardo Rivera-Matos + +[ Upstream commit a0ffa8115e1ea9786b03edc3f431d2f4ef3e7a2e ] + +Masks the "DSP Virtual Mailbox 2 write" interrupt when before +issuing the hibernate command to the DSP. The interrupt is +unmasked when exiting runtime suspend as it is required for +DSP operation. + +Without this change the DSP fires an interrupt when hibernating +causing the system spin between runtime suspend and runtime +resume. + +Signed-off-by: Ricardo Rivera-Matos +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231206160318.1255034-4-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index 310747b7689d..9b9fc2d49108 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -775,6 +775,8 @@ static int cs35l45_enter_hibernate(struct cs35l45_private *cs35l45) + + cs35l45_setup_hibernate(cs35l45); + ++ regmap_set_bits(cs35l45->regmap, CS35L45_IRQ1_MASK_2, CS35L45_DSP_VIRT2_MBOX_MASK); ++ + // Don't wait for ACK since bus activity would wake the device + regmap_write(cs35l45->regmap, CS35L45_DSP_VIRT1_MBOX_1, CSPL_MBOX_CMD_HIBERNATE); + +@@ -795,6 +797,8 @@ static int cs35l45_exit_hibernate(struct cs35l45_private *cs35l45) + CSPL_MBOX_CMD_OUT_OF_HIBERNATE); + if (!ret) { + dev_dbg(cs35l45->dev, "Wake success at cycle: %d\n", j); ++ regmap_clear_bits(cs35l45->regmap, CS35L45_IRQ1_MASK_2, ++ CS35L45_DSP_VIRT2_MBOX_MASK); + return 0; + } + usleep_range(100, 200); +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs35l45-use-modern-pm_ops.patch b/queue-6.6/asoc-cs35l45-use-modern-pm_ops.patch new file mode 100644 index 00000000000..2e910349f33 --- /dev/null +++ b/queue-6.6/asoc-cs35l45-use-modern-pm_ops.patch @@ -0,0 +1,94 @@ +From 44ff61ac0dea33ad76a278db6bc08eaff1079a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 10:03:16 -0600 +Subject: ASoC: cs35l45: Use modern pm_ops + +From: Ricardo Rivera-Matos + +[ Upstream commit 12e102b1bd22ee00361559d57a5876445bcb2407 ] + +Make use of the recently introduced EXPORT_GPL_DEV_PM_OPS() macro, to +conditionally export the runtime/system PM functions. + +Replace the old SET_{RUNTIME,SYSTEM_SLEEP,NOIRQ_SYSTEM_SLEEP}_PM_OPS() +helpers with their modern alternatives and get rid of the now +unnecessary '__maybe_unused' annotations on all PM functions. + +Additionally, use the pm_ptr() macro to fix the following errors when +building with CONFIG_PM disabled: + +Signed-off-by: Ricardo Rivera-Matos +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231206160318.1255034-2-rriveram@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l45-i2c.c | 2 +- + sound/soc/codecs/cs35l45-spi.c | 2 +- + sound/soc/codecs/cs35l45.c | 9 ++++----- + 3 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/codecs/cs35l45-i2c.c b/sound/soc/codecs/cs35l45-i2c.c +index 77e0f8750f37..bc2af1ed0fe9 100644 +--- a/sound/soc/codecs/cs35l45-i2c.c ++++ b/sound/soc/codecs/cs35l45-i2c.c +@@ -62,7 +62,7 @@ static struct i2c_driver cs35l45_i2c_driver = { + .driver = { + .name = "cs35l45", + .of_match_table = cs35l45_of_match, +- .pm = &cs35l45_pm_ops, ++ .pm = pm_ptr(&cs35l45_pm_ops), + }, + .id_table = cs35l45_id_i2c, + .probe = cs35l45_i2c_probe, +diff --git a/sound/soc/codecs/cs35l45-spi.c b/sound/soc/codecs/cs35l45-spi.c +index 5efb77530cc3..39e203a5f060 100644 +--- a/sound/soc/codecs/cs35l45-spi.c ++++ b/sound/soc/codecs/cs35l45-spi.c +@@ -64,7 +64,7 @@ static struct spi_driver cs35l45_spi_driver = { + .driver = { + .name = "cs35l45", + .of_match_table = cs35l45_of_match, +- .pm = &cs35l45_pm_ops, ++ .pm = pm_ptr(&cs35l45_pm_ops), + }, + .id_table = cs35l45_id_spi, + .probe = cs35l45_spi_probe, +diff --git a/sound/soc/codecs/cs35l45.c b/sound/soc/codecs/cs35l45.c +index be4f4229576c..b1d0f2c8f2ca 100644 +--- a/sound/soc/codecs/cs35l45.c ++++ b/sound/soc/codecs/cs35l45.c +@@ -810,7 +810,7 @@ static int cs35l45_exit_hibernate(struct cs35l45_private *cs35l45) + return -ETIMEDOUT; + } + +-static int __maybe_unused cs35l45_runtime_suspend(struct device *dev) ++static int cs35l45_runtime_suspend(struct device *dev) + { + struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); + +@@ -827,7 +827,7 @@ static int __maybe_unused cs35l45_runtime_suspend(struct device *dev) + return 0; + } + +-static int __maybe_unused cs35l45_runtime_resume(struct device *dev) ++static int cs35l45_runtime_resume(struct device *dev) + { + struct cs35l45_private *cs35l45 = dev_get_drvdata(dev); + int ret; +@@ -1289,10 +1289,9 @@ void cs35l45_remove(struct cs35l45_private *cs35l45) + } + EXPORT_SYMBOL_NS_GPL(cs35l45_remove, SND_SOC_CS35L45); + +-const struct dev_pm_ops cs35l45_pm_ops = { +- SET_RUNTIME_PM_OPS(cs35l45_runtime_suspend, cs35l45_runtime_resume, NULL) ++EXPORT_GPL_DEV_PM_OPS(cs35l45_pm_ops) = { ++ RUNTIME_PM_OPS(cs35l45_runtime_suspend, cs35l45_runtime_resume, NULL) + }; +-EXPORT_SYMBOL_NS_GPL(cs35l45_pm_ops, SND_SOC_CS35L45); + + MODULE_DESCRIPTION("ASoC CS35L45 driver"); + MODULE_AUTHOR("James Schulman, Cirrus Logic Inc, "); +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch b/queue-6.6/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch new file mode 100644 index 00000000000..446b821b38c --- /dev/null +++ b/queue-6.6/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch @@ -0,0 +1,34 @@ +From acb4ef9ee6c2728300668f1c0a0b1ef2e41f46c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:39 +0000 +Subject: ASoC: cs43130: Fix incorrect frame delay configuration + +From: Maciej Strozek + +[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 778a62e57d45..206008bdecac 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -579,7 +579,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk, + break; + case SND_SOC_DAIFMT_LEFT_J: + hi_size = bitwidth_sclk; +- frm_delay = 2; ++ frm_delay = 0; + frm_phase = 1; + break; + case SND_SOC_DAIFMT_DSP_A: +-- +2.43.0 + diff --git a/queue-6.6/asoc-cs43130-fix-the-position-of-const-qualifier.patch b/queue-6.6/asoc-cs43130-fix-the-position-of-const-qualifier.patch new file mode 100644 index 00000000000..f8e9ff713c4 --- /dev/null +++ b/queue-6.6/asoc-cs43130-fix-the-position-of-const-qualifier.patch @@ -0,0 +1,43 @@ +From 89ccd233679cd4910619cf3200a0286e29c49707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:38 +0000 +Subject: ASoC: cs43130: Fix the position of const qualifier + +From: Maciej Strozek + +[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 3292405024bc..778a62e57d45 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -1683,7 +1683,7 @@ static ssize_t hpload_dc_r_show(struct device *dev, + return cs43130_show_dc(dev, buf, HP_RIGHT); + } + +-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = { ++static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = { + 24, + 43, + 93, +@@ -2363,7 +2363,7 @@ static const struct regmap_config cs43130_regmap = { + .use_single_write = true, + }; + +-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { ++static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { + 50, + 120, + }; +-- +2.43.0 + diff --git a/queue-6.6/asoc-da7219-support-low-dc-impedance-headset.patch b/queue-6.6/asoc-da7219-support-low-dc-impedance-headset.patch new file mode 100644 index 00000000000..fc27c136020 --- /dev/null +++ b/queue-6.6/asoc-da7219-support-low-dc-impedance-headset.patch @@ -0,0 +1,36 @@ +From ba3280f48527a3c27baff71bfcea29ff51c04681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 12:29:33 +0800 +Subject: ASoC: da7219: Support low DC impedance headset + +From: David Rau + +[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ] + +Change the default MIC detection impedance threshold to 200ohm +to support low mic DC impedance headset. + +Signed-off-by: David Rau +Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 3bbe85091649..8537c96307a9 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -696,7 +696,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + aad_pdata->mic_det_thr = + da7219_aad_fw_mic_det_thr(dev, fw_val32); + else +- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; ++ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS; + + if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0) + aad_pdata->jack_ins_deb = +-- +2.43.0 + diff --git a/queue-6.6/asoc-fsl_xcvr-enable-2-tx-bit-clock-for-spdif-only-c.patch b/queue-6.6/asoc-fsl_xcvr-enable-2-tx-bit-clock-for-spdif-only-c.patch new file mode 100644 index 00000000000..0fa223ca7b2 --- /dev/null +++ b/queue-6.6/asoc-fsl_xcvr-enable-2-tx-bit-clock-for-spdif-only-c.patch @@ -0,0 +1,48 @@ +From b42aec0dd89e0a7f2a2292c092ce072f15e4700a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 09:42:53 +0800 +Subject: ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case + +From: Shengjiu Wang + +[ Upstream commit c33fd110424dfcb544cf55a1b312f43fe1918235 ] + +The bit 10 in TX_DPTH_CTRL register controls the TX clock rate. +If this bit is set, TX datapath clock should be = 2* TX bit rate. +If this bit is not set, TX datapath clock should be 10* TX bit rate. + +As the spdif only case, we always use 2 * TX bit clock, so +this bit need to be set. + +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1700617373-6472-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index fa0a15263c66..77f8e2394bf9 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -414,6 +414,16 @@ static int fsl_xcvr_prepare(struct snd_pcm_substream *substream, + + switch (xcvr->mode) { + case FSL_XCVR_MODE_SPDIF: ++ if (xcvr->soc_data->spdif_only && tx) { ++ ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_TX_DPTH_CTRL_SET, ++ FSL_XCVR_TX_DPTH_CTRL_BYPASS_FEM, ++ FSL_XCVR_TX_DPTH_CTRL_BYPASS_FEM); ++ if (ret < 0) { ++ dev_err(dai->dev, "Failed to set bypass fem: %d\n", ret); ++ return ret; ++ } ++ } ++ fallthrough; + case FSL_XCVR_MODE_ARC: + if (tx) { + ret = fsl_xcvr_en_aud_pll(xcvr, fout); +-- +2.43.0 + diff --git a/queue-6.6/asoc-fsl_xcvr-refine-the-requested-phy-clock-frequen.patch b/queue-6.6/asoc-fsl_xcvr-refine-the-requested-phy-clock-frequen.patch new file mode 100644 index 00000000000..412ce8b05cd --- /dev/null +++ b/queue-6.6/asoc-fsl_xcvr-refine-the-requested-phy-clock-frequen.patch @@ -0,0 +1,55 @@ +From 30e0c8549b61b79a4b72431f11d564e67f436cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:14:53 +0800 +Subject: ASoC: fsl_xcvr: refine the requested phy clock frequency + +From: Shengjiu Wang + +[ Upstream commit 347ecf29a68cc8958fbcbd26ef410d07fe9d82f4 ] + +As the input phy clock frequency will divided by 2 by default +on i.MX8MP with the implementation of clk-imx8mp-audiomix driver, +So the requested frequency need to be updated. + +The relation of phy clock is: + sai_pll_ref_sel + sai_pll + sai_pll_bypass + sai_pll_out + sai_pll_out_div2 + earc_phy_cg + +Signed-off-by: Shengjiu Wang +Reviewed-by: Iuliana Prodan +Link: https://lore.kernel.org/r/1700702093-8008-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 77f8e2394bf9..f0fb33d719c2 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -358,7 +358,7 @@ static int fsl_xcvr_en_aud_pll(struct fsl_xcvr *xcvr, u32 freq) + struct device *dev = &xcvr->pdev->dev; + int ret; + +- freq = xcvr->soc_data->spdif_only ? freq / 10 : freq; ++ freq = xcvr->soc_data->spdif_only ? freq / 5 : freq; + clk_disable_unprepare(xcvr->phy_clk); + ret = clk_set_rate(xcvr->phy_clk, freq); + if (ret < 0) { +@@ -409,7 +409,7 @@ static int fsl_xcvr_prepare(struct snd_pcm_substream *substream, + bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; + u32 m_ctl = 0, v_ctl = 0; + u32 r = substream->runtime->rate, ch = substream->runtime->channels; +- u32 fout = 32 * r * ch * 10 * 2; ++ u32 fout = 32 * r * ch * 10; + int ret = 0; + + switch (xcvr->mode) { +-- +2.43.0 + diff --git a/queue-6.6/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch b/queue-6.6/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch new file mode 100644 index 00000000000..8881cc07c7c --- /dev/null +++ b/queue-6.6/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch @@ -0,0 +1,95 @@ +From 1c79bbc09a5260fd2c97ab7d991f25599f1cc1ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 14:39:14 +0200 +Subject: ASoC: hdac_hda: Conditionally register dais for HDMI and Analog + +From: Peter Ujfalusi + +[ Upstream commit a0575b4add21a243cc3257e75ad913cd5377d5f2 ] + +The current driver is registering the same dais for each hdev found in the +system which results duplicated widgets to be registered and the kernel +log contains similar prints: +snd_hda_codec_realtek ehdaudio0D0: ASoC: sink widget AIF1TX overwritten +snd_hda_codec_realtek ehdaudio0D0: ASoC: source widget AIF1RX overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi3 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi2 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Codec Output Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Codec Input Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Digital Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Alt Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Analog Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Digital Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Alt Analog Codec Capture overwritten + +To avoid such issue, split the dai array into HDMI and non HDMI array and +register them conditionally: +for HDMI hdev only register the dais needed for HDMI +for non HDMI hdev do not register the HDMI dais. + +Depends-on: 3d1dc8b1030d ("ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available") +Link: https://github.com/thesofproject/linux/issues/4509 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20231128123914.3986-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hda.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c +index be66853afbe2..d59d38ce5657 100644 +--- a/sound/soc/codecs/hdac_hda.c ++++ b/sound/soc/codecs/hdac_hda.c +@@ -124,6 +124,9 @@ static struct snd_soc_dai_driver hdac_hda_dais[] = { + .sig_bits = 24, + }, + }, ++}; ++ ++static struct snd_soc_dai_driver hdac_hda_hdmi_dais[] = { + { + .id = HDAC_HDMI_0_DAI_ID, + .name = "intel-hdmi-hifi1", +@@ -578,8 +581,16 @@ static const struct snd_soc_component_driver hdac_hda_codec = { + .endianness = 1, + }; + ++static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { ++ .probe = hdac_hda_codec_probe, ++ .remove = hdac_hda_codec_remove, ++ .idle_bias_on = false, ++ .endianness = 1, ++}; ++ + static int hdac_hda_dev_probe(struct hdac_device *hdev) + { ++ struct hdac_hda_priv *hda_pvt = dev_get_drvdata(&hdev->dev); + struct hdac_ext_link *hlink; + int ret; + +@@ -592,9 +603,15 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) + snd_hdac_ext_bus_link_get(hdev->bus, hlink); + + /* ASoC specific initialization */ +- ret = devm_snd_soc_register_component(&hdev->dev, +- &hdac_hda_codec, hdac_hda_dais, +- ARRAY_SIZE(hdac_hda_dais)); ++ if (hda_pvt->need_display_power) ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_hdmi_codec, hdac_hda_hdmi_dais, ++ ARRAY_SIZE(hdac_hda_hdmi_dais)); ++ else ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_codec, hdac_hda_dais, ++ ARRAY_SIZE(hdac_hda_dais)); ++ + if (ret < 0) { + dev_err(&hdev->dev, "failed to register HDA codec %d\n", ret); + return ret; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch b/queue-6.6/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch new file mode 100644 index 00000000000..25dc3d91389 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch @@ -0,0 +1,104 @@ +From e8ee1b437b06e24ad12d34b157556d7dc1ef3536 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 22:32:21 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk + +From: Hans de Goede + +[ Upstream commit b1b6131bca35a55a69fadc39d51577968fa2ee97 ] + +Some BYTCR x86 tablets with a rt5640 codec have the left and right channels +of their speakers swapped. + +Add a new BYT_RT5640_SWAPPED_SPEAKERS quirk for this which sets +cfg-spk:swapped in the components string to let userspace know +about the swapping so that the UCM profile can configure the mixer +to correct this. + +Enable this new quirk on the Medion Lifetab S10346 which has its +speakers swapped. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20231217213221.49424-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index f184d23deaa0..6b631a608ae8 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -83,6 +83,7 @@ enum { + #define BYT_RT5640_HSMIC2_ON_IN1 BIT(27) + #define BYT_RT5640_JD_HP_ELITEP_1000G2 BIT(28) + #define BYT_RT5640_USE_AMCR0F28 BIT(29) ++#define BYT_RT5640_SWAPPED_SPEAKERS BIT(30) + + #define BYTCR_INPUT_DEFAULTS \ + (BYT_RT5640_IN3_MAP | \ +@@ -157,6 +158,8 @@ static void log_quirks(struct device *dev) + dev_info(dev, "quirk MONO_SPEAKER enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) + dev_info(dev, "quirk NO_SPEAKERS enabled\n"); ++ if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) ++ dev_info(dev, "quirk SWAPPED_SPEAKERS enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_LINEOUT) + dev_info(dev, "quirk LINEOUT enabled\n"); + if (byt_rt5640_quirk & BYT_RT5640_LINEOUT_AS_HP2) +@@ -903,6 +906,7 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), + }, + .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SWAPPED_SPEAKERS | + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, +@@ -1631,11 +1635,11 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + const char *platform_name; + struct acpi_device *adev; + struct device *codec_dev; ++ const char *cfg_spk; + bool sof_parent; + int ret_val = 0; + int dai_index = 0; +- int i, cfg_spk; +- int aif; ++ int i, aif; + + is_bytcr = false; + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); +@@ -1795,13 +1799,16 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + } + + if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) { +- cfg_spk = 0; ++ cfg_spk = "0"; + spk_type = "none"; + } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) { +- cfg_spk = 1; ++ cfg_spk = "1"; + spk_type = "mono"; ++ } else if (byt_rt5640_quirk & BYT_RT5640_SWAPPED_SPEAKERS) { ++ cfg_spk = "swapped"; ++ spk_type = "swapped"; + } else { +- cfg_spk = 2; ++ cfg_spk = "2"; + spk_type = "stereo"; + } + +@@ -1816,7 +1823,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev) + headset2_string = " cfg-hs2:in1"; + + snprintf(byt_rt5640_components, sizeof(byt_rt5640_components), +- "cfg-spk:%d cfg-mic:%s aif:%d%s%s", cfg_spk, ++ "cfg-spk:%s cfg-mic:%s aif:%d%s%s", cfg_spk, + map_name[BYT_RT5640_MAP(byt_rt5640_quirk)], aif, + lineout_string, headset2_string); + byt_rt5640_card.components = byt_rt5640_components; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch b/queue-6.6/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch new file mode 100644 index 00000000000..59e1e612556 --- /dev/null +++ b/queue-6.6/asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch @@ -0,0 +1,48 @@ +From 9d7c311e5c7368d303f5f5f44844692cf2a249f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 22:32:20 +0100 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 + +From: Hans de Goede + +[ Upstream commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d ] + +Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20231217213221.49424-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 630784b6cb6d..f184d23deaa0 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -894,6 +894,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ /* Medion Lifetab S10346 */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are much too generic, also match on BIOS date */ ++ DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Mele PCG03 Mini PC */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"), +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch b/queue-6.6/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch new file mode 100644 index 00000000000..c1d0561c02f --- /dev/null +++ b/queue-6.6/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch @@ -0,0 +1,44 @@ +From 54a2f67b4495c54bacc1a2ea4f8ca4395d528667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 14:40:15 +0200 +Subject: ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not + available + +From: Peter Ujfalusi + +[ Upstream commit 3d1dc8b1030df8ca0fdfd4905c88ee10db943bf8 ] + +When the HDMI is not present due to disabled display support +we will use dummy codec and the HDMI routes will refer to non existent +DAPM widgets. + +Trim the route list from the HDMI routes to be able to probe the card even +if the HDMI dais are not registered. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20231124124015.15878-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index a06e05154ae1..70c806cc5b2e 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -154,6 +154,8 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params) + card->dapm_widgets = skl_hda_widgets; + card->num_dapm_widgets = ARRAY_SIZE(skl_hda_widgets); + if (!ctx->idisp_codec) { ++ card->dapm_routes = &skl_hda_map[IDISP_ROUTE_COUNT]; ++ num_route -= IDISP_ROUTE_COUNT; + for (i = 0; i < IDISP_DAI_COUNT; i++) { + skl_hda_be_dai_links[i].codecs = &asoc_dummy_dlc; + skl_hda_be_dai_links[i].num_codecs = 1; +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch b/queue-6.6/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch new file mode 100644 index 00000000000..b616dbc5a57 --- /dev/null +++ b/queue-6.6/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch @@ -0,0 +1,59 @@ +From 8d4283763d8acee3f8a5a4005761aed546bd2b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:51:50 +0100 +Subject: ASoC: Intel: Skylake: Fix mem leak in few functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ] + +The resources should be freed when function return error. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 4 +++- + sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index ac3dc8c63c26..29a03ee3d7f7 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -252,8 +252,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream, + snd_pcm_set_sync(substream); + + mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream); +- if (!mconfig) ++ if (!mconfig) { ++ kfree(dma_params); + return -EINVAL; ++ } + + skl_tplg_d0i3_get(skl, mconfig->d0i3_caps); + +diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c +index 7a425271b08b..fd9624ad5f72 100644 +--- a/sound/soc/intel/skylake/skl-sst-ipc.c ++++ b/sound/soc/intel/skylake/skl-sst-ipc.c +@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, + + reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK; + buf = krealloc(reply.data, reply.size, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ kfree(reply.data); + return -ENOMEM; ++ } + *payload = buf; + *bytes = reply.size; + +-- +2.43.0 + diff --git a/queue-6.6/asoc-intel-skylake-mem-leak-in-skl-register-function.patch b/queue-6.6/asoc-intel-skylake-mem-leak-in-skl-register-function.patch new file mode 100644 index 00000000000..39e9fd2c36b --- /dev/null +++ b/queue-6.6/asoc-intel-skylake-mem-leak-in-skl-register-function.patch @@ -0,0 +1,52 @@ +From 72def06b8ebbac6435917016e9a6c6feac10e47b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 23:41:13 +0100 +Subject: ASoC: Intel: Skylake: mem leak in skl register function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ] + +skl_platform_register() uses krealloc. When krealloc is fail, +then previous memory is not freed. The leak is also when soc +component registration failed. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 29a03ee3d7f7..c602275fcf71 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1473,6 +1473,7 @@ int skl_platform_register(struct device *dev) + dais = krealloc(skl->dais, sizeof(skl_fe_dai) + + sizeof(skl_platform_dai), GFP_KERNEL); + if (!dais) { ++ kfree(skl->dais); + ret = -ENOMEM; + goto err; + } +@@ -1485,8 +1486,10 @@ int skl_platform_register(struct device *dev) + + ret = devm_snd_soc_register_component(dev, &skl_component, + skl->dais, num_dais); +- if (ret) ++ if (ret) { ++ kfree(skl->dais); + dev_err(dev, "soc component registration failed %d\n", ret); ++ } + err: + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch b/queue-6.6/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch new file mode 100644 index 00000000000..de936b42c37 --- /dev/null +++ b/queue-6.6/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch @@ -0,0 +1,75 @@ +From 04042164fab11ed5216a627a3cb79efbf97a8090 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 12:30:12 +0800 +Subject: ASoC: nau8822: Fix incorrect type in assignment and cast to + restricted __be16 + +From: David Lin + +[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ] + +This issue is reproduced when W=1 build in compiler gcc-12. +The following are sparse warnings: + +sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment +sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short +sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/ +Signed-off-by: David Lin +Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index ff3024899f45..7199d734c79f 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + struct soc_bytes_ext *params = (void *)kcontrol->private_value; + int i, reg; + u16 reg_val, *val; ++ __be16 tmp; + + val = (u16 *)ucontrol->value.bytes.data; + reg = NAU8822_REG_EQ1; +@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- reg_val = cpu_to_be16(reg_val); +- memcpy(val + i, ®_val, sizeof(reg_val)); ++ tmp = cpu_to_be16(reg_val); ++ memcpy(val + i, &tmp, sizeof(tmp)); + } + + return 0; +@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + void *data; + u16 *val, value; + int i, reg, ret; ++ __be16 *tmp; + + data = kmemdup(ucontrol->value.bytes.data, + params->max, GFP_KERNEL | GFP_DMA); +@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- value = be16_to_cpu(*(val + i)); ++ tmp = (__be16 *)(val + i); ++ value = be16_to_cpup(tmp); + ret = snd_soc_component_write(component, reg + i, value); + if (ret) { + dev_err(component->dev, +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch b/queue-6.6/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch new file mode 100644 index 00000000000..f223d7bdb51 --- /dev/null +++ b/queue-6.6/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch @@ -0,0 +1,79 @@ +From 9153fb72a0b898fa37dc78c9ce55bf8d5a03ed0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 18:01:23 +0800 +Subject: ASoC: rt5650: add mutex to avoid the jack detection failure + +From: Shuming Fan + +[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ] + +This patch adds the jd_mutex to protect the jack detection control flow. +And only the headset type could check the button status. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 7938b52d741d..a0d01d71d8b5 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -448,6 +448,7 @@ struct rt5645_priv { + struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)]; + struct rt5645_eq_param_s *eq_param; + struct timer_list btn_check_timer; ++ struct mutex jd_mutex; + + int codec_type; + int sysclk; +@@ -3193,6 +3194,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + rt5645_enable_push_button_irq(component, true); + } + } else { ++ if (rt5645->en_button_func) ++ rt5645_enable_push_button_irq(component, false); + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; +@@ -3295,6 +3298,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + if (!rt5645->component) + return; + ++ mutex_lock(&rt5645->jd_mutex); ++ + switch (rt5645->pdata.jd_mode) { + case 0: /* Not using rt5645 JD */ + if (rt5645->gpiod_hp_det) { +@@ -3321,7 +3326,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) + + if (!val && (rt5645->jack_type == 0)) { /* jack in */ + report = rt5645_jack_detect(rt5645->component, 1); +- } else if (!val && rt5645->jack_type != 0) { ++ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) { + /* for push button and jack out */ + btn_type = 0; + if (snd_soc_component_read(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) { +@@ -3377,6 +3382,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + rt5645_jack_detect(rt5645->component, 0); + } + ++ mutex_unlock(&rt5645->jd_mutex); ++ + snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE); + snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + if (rt5645->en_button_func) +@@ -4150,6 +4157,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c) + } + timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0); + ++ mutex_init(&rt5645->jd_mutex); + INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); + INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work); + +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-ipc4-topology-add-core_mask-in-struct-snd_s.patch b/queue-6.6/asoc-sof-ipc4-topology-add-core_mask-in-struct-snd_s.patch new file mode 100644 index 00000000000..4cf842479d0 --- /dev/null +++ b/queue-6.6/asoc-sof-ipc4-topology-add-core_mask-in-struct-snd_s.patch @@ -0,0 +1,131 @@ +From 46115d98bb8ebb1a6fe10a86db89bfec6a2f698c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 15:57:42 +0200 +Subject: ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ranjani Sridharan + +[ Upstream commit 0376b995bb7a65fb0c056f3adc5e9695ad0c1805 ] + +With IPC4, a pipeline may contain multiple modules in the data +processing domain and they can be scheduled to run on different cores. +Add a new field in struct snd_sof_pipeline to keep track of all the +cores that are associated with the modules in the pipeline. Set the +pipeline core mask for IPC3 when initializing the pipeline widget IPC +structure. For IPC4, set the core mark when initializing the pipeline +widget and initializing processing modules in the data processing domain. + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20231124135743.24674-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3-topology.c | 2 ++ + sound/soc/sof/ipc4-topology.c | 9 +++++++++ + sound/soc/sof/sof-audio.h | 2 ++ + 3 files changed, 13 insertions(+) + +diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c +index ba4ef290b634..2c7a5e7a364c 100644 +--- a/sound/soc/sof/ipc3-topology.c ++++ b/sound/soc/sof/ipc3-topology.c +@@ -493,6 +493,7 @@ static int sof_ipc3_widget_setup_comp_mixer(struct snd_sof_widget *swidget) + static int sof_ipc3_widget_setup_comp_pipeline(struct snd_sof_widget *swidget) + { + struct snd_soc_component *scomp = swidget->scomp; ++ struct snd_sof_pipeline *spipe = swidget->spipe; + struct sof_ipc_pipe_new *pipeline; + struct snd_sof_widget *comp_swidget; + int ret; +@@ -545,6 +546,7 @@ static int sof_ipc3_widget_setup_comp_pipeline(struct snd_sof_widget *swidget) + swidget->dynamic_pipeline_widget); + + swidget->core = pipeline->core; ++ spipe->core_mask |= BIT(pipeline->core); + + return 0; + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index c9c1d2ec7af2..05c3b1153a91 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -654,6 +654,7 @@ static int sof_ipc4_widget_setup_comp_pipeline(struct snd_sof_widget *swidget) + { + struct snd_soc_component *scomp = swidget->scomp; + struct sof_ipc4_pipeline *pipeline; ++ struct snd_sof_pipeline *spipe = swidget->spipe; + int ret; + + pipeline = kzalloc(sizeof(*pipeline), GFP_KERNEL); +@@ -668,6 +669,7 @@ static int sof_ipc4_widget_setup_comp_pipeline(struct snd_sof_widget *swidget) + } + + swidget->core = pipeline->core_id; ++ spipe->core_mask |= BIT(pipeline->core_id); + + if (pipeline->use_chain_dma) { + dev_dbg(scomp->dev, "Set up chain DMA for %s\n", swidget->widget->name); +@@ -798,6 +800,7 @@ static int sof_ipc4_widget_setup_comp_mixer(struct snd_sof_widget *swidget) + static int sof_ipc4_widget_setup_comp_src(struct snd_sof_widget *swidget) + { + struct snd_soc_component *scomp = swidget->scomp; ++ struct snd_sof_pipeline *spipe = swidget->spipe; + struct sof_ipc4_src *src; + int ret; + +@@ -820,6 +823,8 @@ static int sof_ipc4_widget_setup_comp_src(struct snd_sof_widget *swidget) + goto err; + } + ++ spipe->core_mask |= BIT(swidget->core); ++ + dev_dbg(scomp->dev, "SRC sink rate %d\n", src->sink_rate); + + ret = sof_ipc4_widget_setup_msg(swidget, &src->msg); +@@ -865,6 +870,7 @@ static int sof_ipc4_widget_setup_comp_process(struct snd_sof_widget *swidget) + { + struct snd_soc_component *scomp = swidget->scomp; + struct sof_ipc4_fw_module *fw_module; ++ struct snd_sof_pipeline *spipe = swidget->spipe; + struct sof_ipc4_process *process; + void *cfg; + int ret; +@@ -921,6 +927,9 @@ static int sof_ipc4_widget_setup_comp_process(struct snd_sof_widget *swidget) + + sof_ipc4_widget_update_kcontrol_module_id(swidget); + ++ /* set pipeline core mask to keep track of the core the module is scheduled to run on */ ++ spipe->core_mask |= BIT(swidget->core); ++ + return 0; + free_base_cfg_ext: + kfree(process->base_config_ext); +diff --git a/sound/soc/sof/sof-audio.h b/sound/soc/sof/sof-audio.h +index 5d5eeb1a1a6f..a6d6bcd00cee 100644 +--- a/sound/soc/sof/sof-audio.h ++++ b/sound/soc/sof/sof-audio.h +@@ -480,6 +480,7 @@ struct snd_sof_widget { + * @paused_count: Count of number of PCM's that have started and have currently paused this + pipeline + * @complete: flag used to indicate that pipeline set up is complete. ++ * @core_mask: Mask containing target cores for all modules in the pipeline + * @list: List item in sdev pipeline_list + */ + struct snd_sof_pipeline { +@@ -487,6 +488,7 @@ struct snd_sof_pipeline { + int started_count; + int paused_count; + int complete; ++ unsigned long core_mask; + struct list_head list; + }; + +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch b/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch new file mode 100644 index 00000000000..69667d95942 --- /dev/null +++ b/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch @@ -0,0 +1,142 @@ +From ef5858d59144afd299ee385129ce983906b30bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 15:14:10 +0200 +Subject: ASoC: SOF: ipc4-topology: Correct data structures for the SRC module + +From: Peter Ujfalusi + +[ Upstream commit c447636970e3409ac39f0bb8c2dcff6b726f36b0 ] + +Separate the IPC message part as struct sof_ipc4_src_data. This struct +describes the message payload passed to the firmware via the mailbox. + +It is not wise to be 'clever' and try to use the first part of a struct +as IPC message without marking the message section as packed and aligned. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20231129131411.27516-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.c | 21 +++++++++++---------- + sound/soc/sof/ipc4-topology.h | 16 ++++++++++++---- + 2 files changed, 23 insertions(+), 14 deletions(-) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 05c3b1153a91..42f6a99935d1 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -139,7 +139,7 @@ static const struct sof_topology_token gain_tokens[] = { + /* SRC */ + static const struct sof_topology_token src_tokens[] = { + {SOF_TKN_SRC_RATE_OUT, SND_SOC_TPLG_TUPLE_TYPE_WORD, get_token_u32, +- offsetof(struct sof_ipc4_src, sink_rate)}, ++ offsetof(struct sof_ipc4_src_data, sink_rate)}, + }; + + static const struct sof_token_info ipc4_token_list[SOF_TOKEN_COUNT] = { +@@ -812,11 +812,12 @@ static int sof_ipc4_widget_setup_comp_src(struct snd_sof_widget *swidget) + + swidget->private = src; + +- ret = sof_ipc4_get_audio_fmt(scomp, swidget, &src->available_fmt, &src->base_config); ++ ret = sof_ipc4_get_audio_fmt(scomp, swidget, &src->available_fmt, ++ &src->data.base_config); + if (ret) + goto err; + +- ret = sof_update_ipc_object(scomp, src, SOF_SRC_TOKENS, swidget->tuples, ++ ret = sof_update_ipc_object(scomp, &src->data, SOF_SRC_TOKENS, swidget->tuples, + swidget->num_tuples, sizeof(*src), 1); + if (ret) { + dev_err(scomp->dev, "Parsing SRC tokens failed\n"); +@@ -825,7 +826,7 @@ static int sof_ipc4_widget_setup_comp_src(struct snd_sof_widget *swidget) + + spipe->core_mask |= BIT(swidget->core); + +- dev_dbg(scomp->dev, "SRC sink rate %d\n", src->sink_rate); ++ dev_dbg(scomp->dev, "SRC sink rate %d\n", src->data.sink_rate); + + ret = sof_ipc4_widget_setup_msg(swidget, &src->msg); + if (ret) +@@ -1896,7 +1897,7 @@ static int sof_ipc4_prepare_src_module(struct snd_sof_widget *swidget, + u32 out_ref_rate, out_ref_channels, out_ref_valid_bits; + int output_format_index, input_format_index; + +- input_format_index = sof_ipc4_init_input_audio_fmt(sdev, swidget, &src->base_config, ++ input_format_index = sof_ipc4_init_input_audio_fmt(sdev, swidget, &src->data.base_config, + pipeline_params, available_fmt); + if (input_format_index < 0) + return input_format_index; +@@ -1926,7 +1927,7 @@ static int sof_ipc4_prepare_src_module(struct snd_sof_widget *swidget, + */ + out_ref_rate = params_rate(fe_params); + +- output_format_index = sof_ipc4_init_output_audio_fmt(sdev, &src->base_config, ++ output_format_index = sof_ipc4_init_output_audio_fmt(sdev, &src->data.base_config, + available_fmt, out_ref_rate, + out_ref_channels, out_ref_valid_bits); + if (output_format_index < 0) { +@@ -1936,10 +1937,10 @@ static int sof_ipc4_prepare_src_module(struct snd_sof_widget *swidget, + } + + /* update pipeline memory usage */ +- sof_ipc4_update_resource_usage(sdev, swidget, &src->base_config); ++ sof_ipc4_update_resource_usage(sdev, swidget, &src->data.base_config); + + out_audio_fmt = &available_fmt->output_pin_fmts[output_format_index].audio_fmt; +- src->sink_rate = out_audio_fmt->sampling_frequency; ++ src->data.sink_rate = out_audio_fmt->sampling_frequency; + + /* update pipeline_params for sink widgets */ + return sof_ipc4_update_hw_params(sdev, pipeline_params, out_audio_fmt); +@@ -2297,8 +2298,8 @@ static int sof_ipc4_widget_setup(struct snd_sof_dev *sdev, struct snd_sof_widget + { + struct sof_ipc4_src *src = swidget->private; + +- ipc_size = sizeof(struct sof_ipc4_base_module_cfg) + sizeof(src->sink_rate); +- ipc_data = src; ++ ipc_size = sizeof(src->data); ++ ipc_data = &src->data; + + msg = &src->msg; + break; +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index d75f17f4749c..f96536dbaee5 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -387,16 +387,24 @@ struct sof_ipc4_mixer { + struct sof_ipc4_msg msg; + }; + +-/** +- * struct sof_ipc4_src SRC config data ++/* ++ * struct sof_ipc4_src_data - IPC data for SRC + * @base_config: IPC base config data + * @sink_rate: Output rate for sink module ++ */ ++struct sof_ipc4_src_data { ++ struct sof_ipc4_base_module_cfg base_config; ++ uint32_t sink_rate; ++} __packed __aligned(4); ++ ++/** ++ * struct sof_ipc4_src - SRC config data ++ * @data: IPC base config data + * @available_fmt: Available audio format + * @msg: IPC4 message struct containing header and data info + */ + struct sof_ipc4_src { +- struct sof_ipc4_base_module_cfg base_config; +- uint32_t sink_rate; ++ struct sof_ipc4_src_data data; + struct sof_ipc4_available_audio_format available_fmt; + struct sof_ipc4_msg msg; + }; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch-24694 b/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch-24694 new file mode 100644 index 00000000000..a4896a6beb0 --- /dev/null +++ b/queue-6.6/asoc-sof-ipc4-topology-correct-data-structures-for-t.patch-24694 @@ -0,0 +1,215 @@ +From 031e89e9f730874e50a6d6c5bf90577e4962d8ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 15:14:11 +0200 +Subject: ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module + +From: Peter Ujfalusi + +[ Upstream commit e238b68e6dc89ddab52bd98216fe5623e94792b1 ] + +Move the base_cfg to struct sof_ipc4_gain_data. This struct +describes the message payload passed to the firmware via the mailbox. + +It is not wise to be 'clever' and try to use the first part of a struct +as IPC message without marking the message section as packed and aligned. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20231129131411.27516-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-control.c | 20 ++++++++++---------- + sound/soc/sof/ipc4-topology.c | 31 +++++++++++++++---------------- + sound/soc/sof/ipc4-topology.h | 18 +++++++++++++----- + 3 files changed, 38 insertions(+), 31 deletions(-) + +diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c +index c6d404d44097..e4ce1b53fba6 100644 +--- a/sound/soc/sof/ipc4-control.c ++++ b/sound/soc/sof/ipc4-control.c +@@ -89,7 +89,7 @@ sof_ipc4_set_volume_data(struct snd_sof_dev *sdev, struct snd_sof_widget *swidge + struct sof_ipc4_control_data *cdata = scontrol->ipc_control_data; + struct sof_ipc4_gain *gain = swidget->private; + struct sof_ipc4_msg *msg = &cdata->msg; +- struct sof_ipc4_gain_data data; ++ struct sof_ipc4_gain_params params; + bool all_channels_equal = true; + u32 value; + int ret, i; +@@ -109,20 +109,20 @@ sof_ipc4_set_volume_data(struct snd_sof_dev *sdev, struct snd_sof_widget *swidge + */ + for (i = 0; i < scontrol->num_channels; i++) { + if (all_channels_equal) { +- data.channels = SOF_IPC4_GAIN_ALL_CHANNELS_MASK; +- data.init_val = cdata->chanv[0].value; ++ params.channels = SOF_IPC4_GAIN_ALL_CHANNELS_MASK; ++ params.init_val = cdata->chanv[0].value; + } else { +- data.channels = cdata->chanv[i].channel; +- data.init_val = cdata->chanv[i].value; ++ params.channels = cdata->chanv[i].channel; ++ params.init_val = cdata->chanv[i].value; + } + + /* set curve type and duration from topology */ +- data.curve_duration_l = gain->data.curve_duration_l; +- data.curve_duration_h = gain->data.curve_duration_h; +- data.curve_type = gain->data.curve_type; ++ params.curve_duration_l = gain->data.params.curve_duration_l; ++ params.curve_duration_h = gain->data.params.curve_duration_h; ++ params.curve_type = gain->data.params.curve_type; + +- msg->data_ptr = &data; +- msg->data_size = sizeof(data); ++ msg->data_ptr = ¶ms; ++ msg->data_size = sizeof(params); + + ret = sof_ipc4_set_get_kcontrol_data(scontrol, true, lock); + msg->data_ptr = NULL; +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 42f6a99935d1..2c075afd237c 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -128,12 +128,12 @@ static const struct sof_topology_token comp_ext_tokens[] = { + + static const struct sof_topology_token gain_tokens[] = { + {SOF_TKN_GAIN_RAMP_TYPE, SND_SOC_TPLG_TUPLE_TYPE_WORD, +- get_token_u32, offsetof(struct sof_ipc4_gain_data, curve_type)}, ++ get_token_u32, offsetof(struct sof_ipc4_gain_params, curve_type)}, + {SOF_TKN_GAIN_RAMP_DURATION, + SND_SOC_TPLG_TUPLE_TYPE_WORD, get_token_u32, +- offsetof(struct sof_ipc4_gain_data, curve_duration_l)}, ++ offsetof(struct sof_ipc4_gain_params, curve_duration_l)}, + {SOF_TKN_GAIN_VAL, SND_SOC_TPLG_TUPLE_TYPE_WORD, +- get_token_u32, offsetof(struct sof_ipc4_gain_data, init_val)}, ++ get_token_u32, offsetof(struct sof_ipc4_gain_params, init_val)}, + }; + + /* SRC */ +@@ -721,15 +721,15 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget) + + swidget->private = gain; + +- gain->data.channels = SOF_IPC4_GAIN_ALL_CHANNELS_MASK; +- gain->data.init_val = SOF_IPC4_VOL_ZERO_DB; ++ gain->data.params.channels = SOF_IPC4_GAIN_ALL_CHANNELS_MASK; ++ gain->data.params.init_val = SOF_IPC4_VOL_ZERO_DB; + +- ret = sof_ipc4_get_audio_fmt(scomp, swidget, &gain->available_fmt, &gain->base_config); ++ ret = sof_ipc4_get_audio_fmt(scomp, swidget, &gain->available_fmt, &gain->data.base_config); + if (ret) + goto err; + +- ret = sof_update_ipc_object(scomp, &gain->data, SOF_GAIN_TOKENS, swidget->tuples, +- swidget->num_tuples, sizeof(gain->data), 1); ++ ret = sof_update_ipc_object(scomp, &gain->data.params, SOF_GAIN_TOKENS, ++ swidget->tuples, swidget->num_tuples, sizeof(gain->data), 1); + if (ret) { + dev_err(scomp->dev, "Parsing gain tokens failed\n"); + goto err; +@@ -737,8 +737,8 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget) + + dev_dbg(scomp->dev, + "pga widget %s: ramp type: %d, ramp duration %d, initial gain value: %#x\n", +- swidget->widget->name, gain->data.curve_type, gain->data.curve_duration_l, +- gain->data.init_val); ++ swidget->widget->name, gain->data.params.curve_type, ++ gain->data.params.curve_duration_l, gain->data.params.init_val); + + ret = sof_ipc4_widget_setup_msg(swidget, &gain->msg); + if (ret) +@@ -1822,7 +1822,7 @@ static int sof_ipc4_prepare_gain_module(struct snd_sof_widget *swidget, + u32 out_ref_rate, out_ref_channels, out_ref_valid_bits; + int ret; + +- ret = sof_ipc4_init_input_audio_fmt(sdev, swidget, &gain->base_config, ++ ret = sof_ipc4_init_input_audio_fmt(sdev, swidget, &gain->data.base_config, + pipeline_params, available_fmt); + if (ret < 0) + return ret; +@@ -1832,7 +1832,7 @@ static int sof_ipc4_prepare_gain_module(struct snd_sof_widget *swidget, + out_ref_channels = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(in_fmt->fmt_cfg); + out_ref_valid_bits = SOF_IPC4_AUDIO_FORMAT_CFG_V_BIT_DEPTH(in_fmt->fmt_cfg); + +- ret = sof_ipc4_init_output_audio_fmt(sdev, &gain->base_config, available_fmt, ++ ret = sof_ipc4_init_output_audio_fmt(sdev, &gain->data.base_config, available_fmt, + out_ref_rate, out_ref_channels, out_ref_valid_bits); + if (ret < 0) { + dev_err(sdev->dev, "Failed to initialize output format for %s", +@@ -1841,7 +1841,7 @@ static int sof_ipc4_prepare_gain_module(struct snd_sof_widget *swidget, + } + + /* update pipeline memory usage */ +- sof_ipc4_update_resource_usage(sdev, swidget, &gain->base_config); ++ sof_ipc4_update_resource_usage(sdev, swidget, &gain->data.base_config); + + return 0; + } +@@ -2277,9 +2277,8 @@ static int sof_ipc4_widget_setup(struct snd_sof_dev *sdev, struct snd_sof_widget + { + struct sof_ipc4_gain *gain = swidget->private; + +- ipc_size = sizeof(struct sof_ipc4_base_module_cfg) + +- sizeof(struct sof_ipc4_gain_data); +- ipc_data = gain; ++ ipc_size = sizeof(gain->data); ++ ipc_data = &gain->data; + + msg = &gain->msg; + break; +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index f96536dbaee5..21436657ad85 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -344,7 +344,7 @@ struct sof_ipc4_control_data { + }; + + /** +- * struct sof_ipc4_gain_data - IPC gain blob ++ * struct sof_ipc4_gain_params - IPC gain parameters + * @channels: Channels + * @init_val: Initial value + * @curve_type: Curve type +@@ -352,24 +352,32 @@ struct sof_ipc4_control_data { + * @curve_duration_l: Curve duration low part + * @curve_duration_h: Curve duration high part + */ +-struct sof_ipc4_gain_data { ++struct sof_ipc4_gain_params { + uint32_t channels; + uint32_t init_val; + uint32_t curve_type; + uint32_t reserved; + uint32_t curve_duration_l; + uint32_t curve_duration_h; +-} __aligned(8); ++} __packed __aligned(4); + + /** +- * struct sof_ipc4_gain - gain config data ++ * struct sof_ipc4_gain_data - IPC gain init blob + * @base_config: IPC base config data ++ * @params: Initial parameters for the gain module ++ */ ++struct sof_ipc4_gain_data { ++ struct sof_ipc4_base_module_cfg base_config; ++ struct sof_ipc4_gain_params params; ++} __packed __aligned(4); ++ ++/** ++ * struct sof_ipc4_gain - gain config data + * @data: IPC gain blob + * @available_fmt: Available audio format + * @msg: message structure for gain + */ + struct sof_ipc4_gain { +- struct sof_ipc4_base_module_cfg base_config; + struct sof_ipc4_gain_data data; + struct sof_ipc4_available_audio_format available_fmt; + struct sof_ipc4_msg msg; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch b/queue-6.6/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch new file mode 100644 index 00000000000..10a1c86b46a --- /dev/null +++ b/queue-6.6/asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch @@ -0,0 +1,37 @@ +From 89a2397d1a8f976604ede4478f42444ea8465726 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:44:54 +0100 +Subject: ASoC: SOF: mediatek: mt8186: Add Google Steelix topology compatible + +From: AngeloGioacchino Del Regno + +[ Upstream commit 505c83212da5bfca95109421b8f5d9f8c6cdfef2 ] + +Add the machine compatible and topology filename for the Google Steelix +MT8186 Chromebook to load the correct SOF topology file. + +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20231123084454.20471-1-angelogioacchino.delregno@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/mediatek/mt8186/mt8186.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sof/mediatek/mt8186/mt8186.c b/sound/soc/sof/mediatek/mt8186/mt8186.c +index f587edf9e0a7..35f5c2cfb6e4 100644 +--- a/sound/soc/sof/mediatek/mt8186/mt8186.c ++++ b/sound/soc/sof/mediatek/mt8186/mt8186.c +@@ -599,6 +599,9 @@ static struct snd_sof_dsp_ops sof_mt8186_ops = { + + static struct snd_sof_of_mach sof_mt8186_machs[] = { + { ++ .compatible = "google,steelix", ++ .sof_tplg_filename = "sof-mt8186-google-steelix.tplg" ++ }, { + .compatible = "mediatek,mt8186", + .sof_tplg_filename = "sof-mt8186.tplg", + }, +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-sof-audio-modify-logic-for-enabling-disabli.patch b/queue-6.6/asoc-sof-sof-audio-modify-logic-for-enabling-disabli.patch new file mode 100644 index 00000000000..4fb2834db2e --- /dev/null +++ b/queue-6.6/asoc-sof-sof-audio-modify-logic-for-enabling-disabli.patch @@ -0,0 +1,161 @@ +From 4c262ff8d76408c15f0bcc2b4f60b28c1e785a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 15:57:43 +0200 +Subject: ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology + cores +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ranjani Sridharan + +[ Upstream commit 31ed8da1c8e5e504710bb36863700e3389f8fc81 ] + +In the current code, we enable a widget core when it is set up and +disable it when it is freed. This is problematic with IPC4 because +widget free is essentially a NOP and all widgets are freed in the +firmware when the pipeline is deleted. This results in a crash during +pipeline deletion when one of it's widgets is scheduled to run on a +secondary core and is powered off when widget is freed. So, change the +logic to enable all cores needed by all the modules in a pipeline when +the pipeline widget is set up and disable them after the pipeline +widget is freed. + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20231124135743.24674-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/sof-audio.c | 65 ++++++++++++++++++++++++--------------- + 1 file changed, 41 insertions(+), 24 deletions(-) + +diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c +index 563fe6f7789f..77cc64ac7113 100644 +--- a/sound/soc/sof/sof-audio.c ++++ b/sound/soc/sof/sof-audio.c +@@ -46,6 +46,7 @@ static int sof_widget_free_unlocked(struct snd_sof_dev *sdev, + struct snd_sof_widget *swidget) + { + const struct sof_ipc_tplg_ops *tplg_ops = sof_ipc_get_ops(sdev, tplg); ++ struct snd_sof_pipeline *spipe = swidget->spipe; + struct snd_sof_widget *pipe_widget; + int err = 0; + int ret; +@@ -87,15 +88,22 @@ static int sof_widget_free_unlocked(struct snd_sof_dev *sdev, + } + + /* +- * disable widget core. continue to route setup status and complete flag +- * even if this fails and return the appropriate error ++ * decrement ref count for cores associated with all modules in the pipeline and clear ++ * the complete flag + */ +- ret = snd_sof_dsp_core_put(sdev, swidget->core); +- if (ret < 0) { +- dev_err(sdev->dev, "error: failed to disable target core: %d for widget %s\n", +- swidget->core, swidget->widget->name); +- if (!err) +- err = ret; ++ if (swidget->id == snd_soc_dapm_scheduler) { ++ int i; ++ ++ for_each_set_bit(i, &spipe->core_mask, sdev->num_cores) { ++ ret = snd_sof_dsp_core_put(sdev, i); ++ if (ret < 0) { ++ dev_err(sdev->dev, "failed to disable target core: %d for pipeline %s\n", ++ i, swidget->widget->name); ++ if (!err) ++ err = ret; ++ } ++ } ++ swidget->spipe->complete = 0; + } + + /* +@@ -108,10 +116,6 @@ static int sof_widget_free_unlocked(struct snd_sof_dev *sdev, + err = ret; + } + +- /* clear pipeline complete */ +- if (swidget->id == snd_soc_dapm_scheduler) +- swidget->spipe->complete = 0; +- + if (!err) + dev_dbg(sdev->dev, "widget %s freed\n", swidget->widget->name); + +@@ -134,8 +138,10 @@ static int sof_widget_setup_unlocked(struct snd_sof_dev *sdev, + struct snd_sof_widget *swidget) + { + const struct sof_ipc_tplg_ops *tplg_ops = sof_ipc_get_ops(sdev, tplg); ++ struct snd_sof_pipeline *spipe = swidget->spipe; + bool use_count_decremented = false; + int ret; ++ int i; + + /* skip if there is no private data */ + if (!swidget->private) +@@ -166,19 +172,23 @@ static int sof_widget_setup_unlocked(struct snd_sof_dev *sdev, + goto use_count_dec; + } + +- /* enable widget core */ +- ret = snd_sof_dsp_core_get(sdev, swidget->core); +- if (ret < 0) { +- dev_err(sdev->dev, "error: failed to enable target core for widget %s\n", +- swidget->widget->name); +- goto pipe_widget_free; ++ /* update ref count for cores associated with all modules in the pipeline */ ++ if (swidget->id == snd_soc_dapm_scheduler) { ++ for_each_set_bit(i, &spipe->core_mask, sdev->num_cores) { ++ ret = snd_sof_dsp_core_get(sdev, i); ++ if (ret < 0) { ++ dev_err(sdev->dev, "failed to enable target core %d for pipeline %s\n", ++ i, swidget->widget->name); ++ goto pipe_widget_free; ++ } ++ } + } + + /* setup widget in the DSP */ + if (tplg_ops && tplg_ops->widget_setup) { + ret = tplg_ops->widget_setup(sdev, swidget); + if (ret < 0) +- goto core_put; ++ goto pipe_widget_free; + } + + /* send config for DAI components */ +@@ -208,15 +218,22 @@ static int sof_widget_setup_unlocked(struct snd_sof_dev *sdev, + return 0; + + widget_free: +- /* widget use_count and core ref_count will both be decremented by sof_widget_free() */ ++ /* widget use_count will be decremented by sof_widget_free() */ + sof_widget_free_unlocked(sdev, swidget); + use_count_decremented = true; +-core_put: +- if (!use_count_decremented) +- snd_sof_dsp_core_put(sdev, swidget->core); + pipe_widget_free: +- if (swidget->id != snd_soc_dapm_scheduler) ++ if (swidget->id != snd_soc_dapm_scheduler) { + sof_widget_free_unlocked(sdev, swidget->spipe->pipe_widget); ++ } else { ++ int j; ++ ++ /* decrement ref count for all cores that were updated previously */ ++ for_each_set_bit(j, &spipe->core_mask, sdev->num_cores) { ++ if (j >= i) ++ break; ++ snd_sof_dsp_core_put(sdev, j); ++ } ++ } + use_count_dec: + if (!use_count_decremented) + swidget->use_count--; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-topology-fix-mem-leak-in-sof_dai_load.patch b/queue-6.6/asoc-sof-topology-fix-mem-leak-in-sof_dai_load.patch new file mode 100644 index 00000000000..4135a7c5bc9 --- /dev/null +++ b/queue-6.6/asoc-sof-topology-fix-mem-leak-in-sof_dai_load.patch @@ -0,0 +1,40 @@ +From ceadf743cdaf9ab2cc28befa1b935108bfbc225f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 22:39:17 +0100 +Subject: ASoC: SOF: topology: Fix mem leak in sof_dai_load() + +From: Kamil Duljas + +[ Upstream commit 31e721fbd194d5723722eaa21df1d14cee7e12b5 ] + +The function has multiple return points at which it is not released +previously allocated memory. + +Signed-off-by: Kamil Duljas +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20231116213926.2034-2-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/topology.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c +index a3a3af252259..37ec671a2d76 100644 +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -1736,8 +1736,10 @@ static int sof_dai_load(struct snd_soc_component *scomp, int index, + /* perform pcm set op */ + if (ipc_pcm_ops && ipc_pcm_ops->pcm_setup) { + ret = ipc_pcm_ops->pcm_setup(sdev, spcm); +- if (ret < 0) ++ if (ret < 0) { ++ kfree(spcm); + return ret; ++ } + } + + dai_drv->dobj.private = spcm; +-- +2.43.0 + diff --git a/queue-6.6/asoc-wm8974-correct-boost-mixer-inputs.patch b/queue-6.6/asoc-wm8974-correct-boost-mixer-inputs.patch new file mode 100644 index 00000000000..268dbd404e6 --- /dev/null +++ b/queue-6.6/asoc-wm8974-correct-boost-mixer-inputs.patch @@ -0,0 +1,49 @@ +From 89c802fcb621bf3e1847f232e67925a350eba431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 15:59:16 +0000 +Subject: ASoC: wm8974: Correct boost mixer inputs + +From: Charles Keepax + +[ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ] + +Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls +the input PGA path, as can been seen from Figure 8 Input Boost Stage in +the datasheet. Update the naming of things in the driver to match this +and update the routing to also reflect this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index 044b6f604c09..260bac695b20 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0), + + /* Boost mixer */ + static const struct snd_kcontrol_new wm8974_boost_mixer[] = { +-SOC_DAPM_SINGLE("Aux Switch", WM8974_INPPGA, 6, 1, 1), ++SOC_DAPM_SINGLE("PGA Switch", WM8974_INPPGA, 6, 1, 1), + }; + + /* Input PGA */ +@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = { + + /* Boost Mixer */ + {"ADC", NULL, "Boost Mixer"}, +- {"Boost Mixer", "Aux Switch", "Aux Input"}, +- {"Boost Mixer", NULL, "Input PGA"}, ++ {"Boost Mixer", NULL, "Aux Input"}, ++ {"Boost Mixer", "PGA Switch", "Input PGA"}, + {"Boost Mixer", NULL, "MICP"}, + + /* Input PGA */ +-- +2.43.0 + diff --git a/queue-6.6/blk-mq-don-t-count-completed-flush-data-request-as-i.patch b/queue-6.6/blk-mq-don-t-count-completed-flush-data-request-as-i.patch new file mode 100644 index 00000000000..dbc386da913 --- /dev/null +++ b/queue-6.6/blk-mq-don-t-count-completed-flush-data-request-as-i.patch @@ -0,0 +1,70 @@ +From 12a126a876bfcbf809017ff78b8f0556203f4492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 16:56:05 +0800 +Subject: blk-mq: don't count completed flush data request as inflight in case + of quiesce + +From: Ming Lei + +[ Upstream commit 0e4237ae8d159e3d28f3cd83146a46f576ffb586 ] + +Request queue quiesce may interrupt flush sequence, and the original request +may have been marked as COMPLETE, but can't get finished because of +queue quiesce. + +This way is fine from driver viewpoint, because flush sequence is block +layer concept, and it isn't related with driver. + +However, driver(such as dm-rq) can call blk_mq_queue_inflight() to count & +drain inflight requests, then the wait & drain never gets done because +the completed & not-finished flush request is counted as inflight. + +Fix this issue by not counting completed flush data request as inflight in +case of quiesce. + +Cc: Mike Snitzer +Cc: David Jeffery +Cc: John Pittman +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20231201085605.577730-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 6ab7f360ff2a..20ecd0ab616f 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1511,14 +1511,26 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q, + } + EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list); + ++static bool blk_is_flush_data_rq(struct request *rq) ++{ ++ return (rq->rq_flags & RQF_FLUSH_SEQ) && !is_flush_rq(rq); ++} ++ + static bool blk_mq_rq_inflight(struct request *rq, void *priv) + { + /* + * If we find a request that isn't idle we know the queue is busy + * as it's checked in the iter. + * Return false to stop the iteration. ++ * ++ * In case of queue quiesce, if one flush data request is completed, ++ * don't count it as inflight given the flush sequence is suspended, ++ * and the original flush data request is invisible to driver, just ++ * like other pending requests because of quiesce + */ +- if (blk_mq_request_started(rq)) { ++ if (blk_mq_request_started(rq) && !(blk_queue_quiesced(rq->q) && ++ blk_is_flush_data_rq(rq) && ++ blk_mq_request_completed(rq))) { + bool *busy = priv; + + *busy = true; +-- +2.43.0 + diff --git a/queue-6.6/block-warn-once-for-each-partition-in-bio_check_ro.patch b/queue-6.6/block-warn-once-for-each-partition-in-bio_check_ro.patch new file mode 100644 index 00000000000..8e0295530c2 --- /dev/null +++ b/queue-6.6/block-warn-once-for-each-partition-in-bio_check_ro.patch @@ -0,0 +1,64 @@ +From a42b154b67f4efc255111fa598554628b22a31f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 20:30:27 +0800 +Subject: block: warn once for each partition in bio_check_ro() + +From: Yu Kuai + +[ Upstream commit 67d995e069535c32829f5d368d919063492cec6e ] + +Commit 1b0a151c10a6 ("blk-core: use pr_warn_ratelimited() in +bio_check_ro()") fix message storm by limit the rate, however, there +will still be lots of message in the long term. Fix it better by warn +once for each partition. + +Signed-off-by: Yu Kuai +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231128123027.971610-3-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 14 +++++++++++--- + include/linux/blk_types.h | 1 + + 2 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index fdf25b8d6e78..2eca76ccf4ee 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -501,9 +501,17 @@ static inline void bio_check_ro(struct bio *bio) + if (op_is_write(bio_op(bio)) && bdev_read_only(bio->bi_bdev)) { + if (op_is_flush(bio->bi_opf) && !bio_sectors(bio)) + return; +- pr_warn_ratelimited("Trying to write to read-only block-device %pg\n", +- bio->bi_bdev); +- /* Older lvm-tools actually trigger this */ ++ ++ if (bio->bi_bdev->bd_ro_warned) ++ return; ++ ++ bio->bi_bdev->bd_ro_warned = true; ++ /* ++ * Use ioctl to set underlying disk of raid/dm to read-only ++ * will trigger this. ++ */ ++ pr_warn("Trying to write to read-only block-device %pg\n", ++ bio->bi_bdev); + } + } + +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index d5c5e59ddbd2..92c8997b1938 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -69,6 +69,7 @@ struct block_device { + #ifdef CONFIG_FAIL_MAKE_REQUEST + bool bd_make_it_fail; + #endif ++ bool bd_ro_warned; + /* + * keep this out-of-line as it's both big and not needed in the fast + * path +-- +2.43.0 + diff --git a/queue-6.6/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch b/queue-6.6/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch new file mode 100644 index 00000000000..95fafb27e5f --- /dev/null +++ b/queue-6.6/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch @@ -0,0 +1,35 @@ +From b1b97acb2e46f056808530ab0d97cc6b0de7fa71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 19:18:16 +0800 +Subject: clk: rockchip: rk3128: Fix HCLK_OTG gate register + +From: Weihao Li + +[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ] + +The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON. + +Signed-off-by: Weihao Li +Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3128.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c +index 22e752236030..75071e0cd321 100644 +--- a/drivers/clk/rockchip/clk-rk3128.c ++++ b/drivers/clk/rockchip/clk-rk3128.c +@@ -484,7 +484,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS), + GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS), + GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS), +- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS), ++ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS), + GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS), + GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS), + GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS), +-- +2.43.0 + diff --git a/queue-6.6/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch b/queue-6.6/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch new file mode 100644 index 00000000000..6aa795694da --- /dev/null +++ b/queue-6.6/clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch @@ -0,0 +1,39 @@ +From a67c98d0ee46910809c3248b948db2fd9f097dde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 10:33:55 -0500 +Subject: clk: rockchip: rk3568: Add PLL rate for 292.5MHz + +From: Chris Morgan + +[ Upstream commit 1af27671f62ce919f1fb76082ed81f71cb090989 ] + +Add support for a PLL rate of 292.5MHz so that the Powkiddy RGB30 panel +can run at a requested 60hz (59.96, close enough). + +I have confirmed this rate fits with all the constraints +listed in the TRM for the VPLL (as an integer PLL) in Part 1 "Chapter +2 Clock & Reset Unit (CRU)." + +Signed-off-by: Chris Morgan +Link: https://lore.kernel.org/r/20231018153357.343142-2-macroalpha82@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3568.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/rockchip/clk-rk3568.c b/drivers/clk/rockchip/clk-rk3568.c +index 16dabe2b9c47..db713e1526cd 100644 +--- a/drivers/clk/rockchip/clk-rk3568.c ++++ b/drivers/clk/rockchip/clk-rk3568.c +@@ -72,6 +72,7 @@ static struct rockchip_pll_rate_table rk3568_pll_rates[] = { + RK3036_PLL_RATE(408000000, 1, 68, 2, 2, 1, 0), + RK3036_PLL_RATE(312000000, 1, 78, 6, 1, 1, 0), + RK3036_PLL_RATE(297000000, 2, 99, 4, 1, 1, 0), ++ RK3036_PLL_RATE(292500000, 1, 195, 4, 4, 1, 0), + RK3036_PLL_RATE(241500000, 2, 161, 4, 2, 1, 0), + RK3036_PLL_RATE(216000000, 1, 72, 4, 2, 1, 0), + RK3036_PLL_RATE(200000000, 1, 100, 3, 4, 1, 0), +-- +2.43.0 + diff --git a/queue-6.6/connector-fix-proc_event_num_listeners-count-not-cle.patch b/queue-6.6/connector-fix-proc_event_num_listeners-count-not-cle.patch new file mode 100644 index 00000000000..7c2a116197c --- /dev/null +++ b/queue-6.6/connector-fix-proc_event_num_listeners-count-not-cle.patch @@ -0,0 +1,43 @@ +From fcab208cbdd59a825a27cf561aca82029865955c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Dec 2023 14:50:32 +0800 +Subject: connector: Fix proc_event_num_listeners count not cleared + +From: wangkeqi + +[ Upstream commit c46bfba1337d301661dbb23cfd905d4cb51f27ca ] + +When we register a cn_proc listening event, the proc_event_num_listener +variable will be incremented by one, but if PROC_CN_MCAST_IGNORE is +not called, the count will not decrease. +This will cause the proc_*_connector function to take the wrong path. +It will reappear when the forkstat tool exits via ctrl + c. +We solve this problem by determining whether +there are still listeners to clear proc_event_num_listener. + +Signed-off-by: wangkeqi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/connector/cn_proc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c +index 44b19e696176..3d5e6d705fc6 100644 +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -108,8 +108,9 @@ static inline void send_msg(struct cn_msg *msg) + filter_data[1] = 0; + } + +- cn_netlink_send_mult(msg, msg->len, 0, CN_IDX_PROC, GFP_NOWAIT, +- cn_filter, (void *)filter_data); ++ if (cn_netlink_send_mult(msg, msg->len, 0, CN_IDX_PROC, GFP_NOWAIT, ++ cn_filter, (void *)filter_data) == -ESRCH) ++ atomic_set(&proc_event_num_listeners, 0); + + local_unlock(&local_event.lock); + } +-- +2.43.0 + diff --git a/queue-6.6/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch b/queue-6.6/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch new file mode 100644 index 00000000000..4052605c925 --- /dev/null +++ b/queue-6.6/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch @@ -0,0 +1,118 @@ +From d8b036111f04e13f2096fa146212b20b9814a52e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:25 +0100 +Subject: debugfs: annotate debugfs handlers vs. removal with lockdep + +From: Johannes Berg + +[ Upstream commit f4acfcd4deb158b96595250cc332901b282d15b0 ] + +When you take a lock in a debugfs handler but also try +to remove the debugfs file under that lock, things can +deadlock since the removal has to wait for all users +to finish. + +Add lockdep annotations in debugfs_file_get()/_put() +to catch such issues. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 10 ++++++++++ + fs/debugfs/inode.c | 12 ++++++++++++ + fs/debugfs/internal.h | 6 ++++++ + 3 files changed, 28 insertions(+) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index e40229c47fe5..bd9e6284d0a8 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -108,6 +108,12 @@ int debugfs_file_get(struct dentry *dentry) + kfree(fsd); + fsd = READ_ONCE(dentry->d_fsdata); + } ++#ifdef CONFIG_LOCKDEP ++ fsd->lock_name = kasprintf(GFP_KERNEL, "debugfs:%pd", dentry); ++ lockdep_register_key(&fsd->key); ++ lockdep_init_map(&fsd->lockdep_map, fsd->lock_name ?: "debugfs", ++ &fsd->key, 0); ++#endif + } + + /* +@@ -124,6 +130,8 @@ int debugfs_file_get(struct dentry *dentry) + if (!refcount_inc_not_zero(&fsd->active_users)) + return -EIO; + ++ lock_map_acquire_read(&fsd->lockdep_map); ++ + return 0; + } + EXPORT_SYMBOL_GPL(debugfs_file_get); +@@ -141,6 +149,8 @@ void debugfs_file_put(struct dentry *dentry) + { + struct debugfs_fsdata *fsd = READ_ONCE(dentry->d_fsdata); + ++ lock_map_release(&fsd->lockdep_map); ++ + if (refcount_dec_and_test(&fsd->active_users)) + complete(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index dcde4199a625..80f4f000dcc1 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -241,6 +241,14 @@ static void debugfs_release_dentry(struct dentry *dentry) + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; + ++ /* check it wasn't a dir (no fsdata) or automount (no real_fops) */ ++ if (fsd && fsd->real_fops) { ++#ifdef CONFIG_LOCKDEP ++ lockdep_unregister_key(&fsd->key); ++ kfree(fsd->lock_name); ++#endif ++ } ++ + kfree(fsd); + } + +@@ -744,6 +752,10 @@ static void __debugfs_file_removed(struct dentry *dentry) + fsd = READ_ONCE(dentry->d_fsdata); + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; ++ ++ lock_map_acquire(&fsd->lockdep_map); ++ lock_map_release(&fsd->lockdep_map); ++ + if (!refcount_dec_and_test(&fsd->active_users)) + wait_for_completion(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index f7c489b5a368..c7d61cfc97d2 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -7,6 +7,7 @@ + + #ifndef _DEBUGFS_INTERNAL_H_ + #define _DEBUGFS_INTERNAL_H_ ++#include + + struct file_operations; + +@@ -23,6 +24,11 @@ struct debugfs_fsdata { + struct { + refcount_t active_users; + struct completion active_users_drained; ++#ifdef CONFIG_LOCKDEP ++ struct lockdep_map lockdep_map; ++ struct lock_class_key key; ++ char *lock_name; ++#endif + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.6/debugfs-fix-automount-d_fsdata-usage.patch b/queue-6.6/debugfs-fix-automount-d_fsdata-usage.patch new file mode 100644 index 00000000000..7c78e224d89 --- /dev/null +++ b/queue-6.6/debugfs-fix-automount-d_fsdata-usage.patch @@ -0,0 +1,149 @@ +From 79c863d381ed134ff51da78c5a5aeb443bd0c7d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:24 +0100 +Subject: debugfs: fix automount d_fsdata usage + +From: Johannes Berg + +[ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ] + +debugfs_create_automount() stores a function pointer in d_fsdata, +but since commit 7c8d469877b1 ("debugfs: add support for more +elaborate ->d_fsdata") debugfs_release_dentry() will free it, now +conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not +set for the function pointer in automount. As a result, removing +an automount dentry would attempt to free the function pointer. +Luckily, the only user of this (tracing) never removes it. + +Nevertheless, it's safer if we just handle the fsdata in one way, +namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus, +change the automount to allocate it, and use the real_fops in the +data to indicate whether or not automount is filled, rather than +adding a type tag. At least for now this isn't actually needed, +but the next changes will require it. + +Also check in debugfs_file_get() that it gets only called +on regular files, just to make things clearer. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 8 ++++++++ + fs/debugfs/inode.c | 27 ++++++++++++++++++++------- + fs/debugfs/internal.h | 10 ++++++++-- + 3 files changed, 36 insertions(+), 9 deletions(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index c45e8c2d62e1..e40229c47fe5 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry) + struct debugfs_fsdata *fsd; + void *d_fsd; + ++ /* ++ * This could only happen if some debugfs user erroneously calls ++ * debugfs_file_get() on a dentry that isn't even a file, let ++ * them know about it. ++ */ ++ if (WARN_ON(!d_is_reg(dentry))) ++ return -EINVAL; ++ + d_fsd = READ_ONCE(dentry->d_fsdata); + if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) { + fsd = d_fsd; +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index 83e57e9f9fa0..dcde4199a625 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -236,17 +236,19 @@ static const struct super_operations debugfs_super_operations = { + + static void debugfs_release_dentry(struct dentry *dentry) + { +- void *fsd = dentry->d_fsdata; ++ struct debugfs_fsdata *fsd = dentry->d_fsdata; + +- if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) +- kfree(dentry->d_fsdata); ++ if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) ++ return; ++ ++ kfree(fsd); + } + + static struct vfsmount *debugfs_automount(struct path *path) + { +- debugfs_automount_t f; +- f = (debugfs_automount_t)path->dentry->d_fsdata; +- return f(path->dentry, d_inode(path->dentry)->i_private); ++ struct debugfs_fsdata *fsd = path->dentry->d_fsdata; ++ ++ return fsd->automount(path->dentry, d_inode(path->dentry)->i_private); + } + + static const struct dentry_operations debugfs_dops = { +@@ -634,13 +636,23 @@ struct dentry *debugfs_create_automount(const char *name, + void *data) + { + struct dentry *dentry = start_creating(name, parent); ++ struct debugfs_fsdata *fsd; + struct inode *inode; + + if (IS_ERR(dentry)) + return dentry; + ++ fsd = kzalloc(sizeof(*fsd), GFP_KERNEL); ++ if (!fsd) { ++ failed_creating(dentry); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ fsd->automount = f; ++ + if (!(debugfs_allow & DEBUGFS_ALLOW_API)) { + failed_creating(dentry); ++ kfree(fsd); + return ERR_PTR(-EPERM); + } + +@@ -648,13 +660,14 @@ struct dentry *debugfs_create_automount(const char *name, + if (unlikely(!inode)) { + pr_err("out of free dentries, can not create automount '%s'\n", + name); ++ kfree(fsd); + return failed_creating(dentry); + } + + make_empty_dir_inode(inode); + inode->i_flags |= S_AUTOMOUNT; + inode->i_private = data; +- dentry->d_fsdata = (void *)f; ++ dentry->d_fsdata = fsd; + /* directory inodes start off with i_nlink == 2 (for "." entry) */ + inc_nlink(inode); + d_instantiate(dentry, inode); +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index 92af8ae31313..f7c489b5a368 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations; + + struct debugfs_fsdata { + const struct file_operations *real_fops; +- refcount_t active_users; +- struct completion active_users_drained; ++ union { ++ /* automount_fn is used when real_fops is NULL */ ++ debugfs_automount_t automount; ++ struct { ++ refcount_t active_users; ++ struct completion active_users_drained; ++ }; ++ }; + }; + + /* +-- +2.43.0 + diff --git a/queue-6.6/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch b/queue-6.6/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch new file mode 100644 index 00000000000..97dd72bd2ac --- /dev/null +++ b/queue-6.6/dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch @@ -0,0 +1,30 @@ +From abc49bbf199f088919bea1156eabc65e549fa698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 14:46:19 -0500 +Subject: dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM + +From: Mike Snitzer + +[ Upstream commit 6849302fdff126997765d16df355b73231f130d4 ] + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig +index 2a8b081bce7d..3ff87cb4dc49 100644 +--- a/drivers/md/Kconfig ++++ b/drivers/md/Kconfig +@@ -660,6 +660,7 @@ config DM_ZONED + + config DM_AUDIT + bool "DM audit events" ++ depends on BLK_DEV_DM + depends on AUDIT + help + Generate audit events for device-mapper. +-- +2.43.0 + diff --git a/queue-6.6/driver-core-add-a-guard-definition-for-the-device_lo.patch b/queue-6.6/driver-core-add-a-guard-definition-for-the-device_lo.patch new file mode 100644 index 00000000000..2581fbad5aa --- /dev/null +++ b/queue-6.6/driver-core-add-a-guard-definition-for-the-device_lo.patch @@ -0,0 +1,48 @@ +From b5ac245d6d1e0c03e3fc7a9626a486bd3e4d0a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 15:02:35 -0800 +Subject: driver core: Add a guard() definition for the device_lock() + +From: Dan Williams + +[ Upstream commit 134c6eaa6087d78c0e289931ca15ae7a5007670d ] + +At present there are ~200 usages of device_lock() in the kernel. Some of +those usages lead to "goto unlock;" patterns which have proven to be +error prone. Define a "device" guard() definition to allow for those to +be cleaned up and prevent new ones from appearing. + +Link: http://lore.kernel.org/r/657897453dda8_269bd29492@dwillia2-mobl3.amr.corp.intel.com.notmuch +Link: http://lore.kernel.org/r/6577b0c2a02df_a04c5294bb@dwillia2-xfh.jf.intel.com.notmuch +Cc: Vishal Verma +Cc: Ira Weiny +Cc: Peter Zijlstra +Cc: Greg Kroah-Hartman +Cc: Andrew Morton +Signed-off-by: Dan Williams +Reviewed-by: Ira Weiny +Reviewed-by: Dave Jiang +Reviewed-by: Vishal Verma +Link: https://lore.kernel.org/r/170250854466.1522182.17555361077409628655.stgit@dwillia2-xfh.jf.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/device.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/device.h b/include/linux/device.h +index 56d93a1ffb7b..99496a0a5ddb 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -1007,6 +1007,8 @@ static inline void device_unlock(struct device *dev) + mutex_unlock(&dev->mutex); + } + ++DEFINE_GUARD(device, struct device *, device_lock(_T), device_unlock(_T)) ++ + static inline void device_lock_assert(struct device *dev) + { + lockdep_assert_held(&dev->mutex); +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-add-case-for-dcn35-to-support-usb4-d.patch b/queue-6.6/drm-amd-display-add-case-for-dcn35-to-support-usb4-d.patch new file mode 100644 index 00000000000..1233252f5da --- /dev/null +++ b/queue-6.6/drm-amd-display-add-case-for-dcn35-to-support-usb4-d.patch @@ -0,0 +1,67 @@ +From b8b9df84a2c4c2f02af6b222365d506a9173e78b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 14:55:31 +0800 +Subject: drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event + +From: Wayne Lin + +[ Upstream commit 989824589f793120833bef13aa4e21f5a836a707 ] + +[Why & how] +Refactor dc_is_dmub_outbox_supported() a bit and add case for dcn35 to +register dmub outbox notification irq to handle usb4 relevant hpd event. + +Reviewed-by: Roman Li +Reviewed-by: Jun Lei +Signed-off-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 26 ++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index a1be93f6385c..8cdf380bf366 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -4865,18 +4865,28 @@ void dc_mclk_switch_using_fw_based_vblank_stretch_shut_down(struct dc *dc) + */ + bool dc_is_dmub_outbox_supported(struct dc *dc) + { +- /* DCN31 B0 USB4 DPIA needs dmub notifications for interrupts */ +- if (dc->ctx->asic_id.chip_family == FAMILY_YELLOW_CARP && +- dc->ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0 && +- !dc->debug.dpia_debug.bits.disable_dpia) +- return true; ++ switch (dc->ctx->asic_id.chip_family) { + +- if (dc->ctx->asic_id.chip_family == AMDGPU_FAMILY_GC_11_0_1 && +- !dc->debug.dpia_debug.bits.disable_dpia) +- return true; ++ case FAMILY_YELLOW_CARP: ++ /* DCN31 B0 USB4 DPIA needs dmub notifications for interrupts */ ++ if (dc->ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0 && ++ !dc->debug.dpia_debug.bits.disable_dpia) ++ return true; ++ break; ++ ++ case AMDGPU_FAMILY_GC_11_0_1: ++ case AMDGPU_FAMILY_GC_11_5_0: ++ if (!dc->debug.dpia_debug.bits.disable_dpia) ++ return true; ++ break; ++ ++ default: ++ break; ++ } + + /* dmub aux needs dmub notifications to be enabled */ + return dc->debug.enable_dmub_aux_for_legacy_ddc; ++ + } + + /** +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-add-monitor-patch-for-specific-edp.patch b/queue-6.6/drm-amd-display-add-monitor-patch-for-specific-edp.patch new file mode 100644 index 00000000000..7fee4bc784d --- /dev/null +++ b/queue-6.6/drm-amd-display-add-monitor-patch-for-specific-edp.patch @@ -0,0 +1,48 @@ +From 6bb575d3eef0dc7085f134fd69df93edc84dd485 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 06:25:16 -0700 +Subject: drm/amd/display: Add monitor patch for specific eDP + +From: Ivan Lipski + +[ Upstream commit 3d71a8726e05a35beb9de394e86ce896d69e563f ] + +[WHY] +Some eDP panels's ext caps don't write initial value cause the value of +dpcd_addr(0x317) is random. It means that sometimes the eDP will +clarify it is OLED, miniLED...etc cause the backlight control interface +is incorrect. + +[HOW] +Add a new panel patch to remove sink ext caps(HDR,OLED...etc) + +Tested-by: Daniel Wheeler +Reviewed-by: Sun peng Li +Acked-by: Rodrigo Siqueira +Signed-off-by: Ivan Lipski +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +index 4b230933b28e..87a1000b8572 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c +@@ -63,6 +63,12 @@ static void apply_edid_quirks(struct edid *edid, struct dc_edid_caps *edid_caps) + DRM_DEBUG_DRIVER("Disabling FAMS on monitor with panel id %X\n", panel_id); + edid_caps->panel_patch.disable_fams = true; + break; ++ /* Workaround for some monitors that do not clear DPCD 0x317 if FreeSync is unsupported */ ++ case drm_edid_encode_panel_id('A', 'U', 'O', 0xA7AB): ++ case drm_edid_encode_panel_id('A', 'U', 'O', 0xE69B): ++ DRM_DEBUG_DRIVER("Clearing DPCD 0x317 on monitor with panel id %X\n", panel_id); ++ edid_caps->panel_patch.remove_sink_ext_caps = true; ++ break; + default: + return; + } +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch b/queue-6.6/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch new file mode 100644 index 00000000000..399d39d3015 --- /dev/null +++ b/queue-6.6/drm-amd-display-get-dprefclk-ss-info-from-integratio.patch @@ -0,0 +1,83 @@ +From b840a17697f348adef33a1c3aea0b6869781ca92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 17:14:48 -0500 +Subject: drm/amd/display: get dprefclk ss info from integration info table + +From: Charlene Liu + +[ Upstream commit 51e7b64690776a9981355428b537af9048308a95 ] + +[why & how] +we have two SSC_En: +we get ssc_info from dce_info for MPLL_SSC_EN. +we used to call VBIOS cmdtbl's smu_info's SS persentage for DPRECLK SS info, +is used for DP AUDIO and VBIOS' smu_info table was from systemIntegrationInfoTable. + +since dcn35 VBIOS removed smu_info, driver need to use integrationInfotable directly. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Wayne Lin +Signed-off-by: Charlene Liu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/bios/bios_parser2.c | 19 ++++++++++++++----- + .../display/include/grph_object_ctrl_defs.h | 2 ++ + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index c52356147148..95d65b48c456 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -1015,13 +1015,20 @@ static enum bp_result get_ss_info_v4_5( + DC_LOG_BIOS("AS_SIGNAL_TYPE_HDMI ss_percentage: %d\n", ss_info->spread_spectrum_percentage); + break; + case AS_SIGNAL_TYPE_DISPLAY_PORT: +- ss_info->spread_spectrum_percentage = ++ if (bp->base.integrated_info) { ++ DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", bp->base.integrated_info->gpuclk_ss_percentage); ++ ss_info->spread_spectrum_percentage = ++ bp->base.integrated_info->gpuclk_ss_percentage; ++ ss_info->type.CENTER_MODE = ++ bp->base.integrated_info->gpuclk_ss_type; ++ } else { ++ ss_info->spread_spectrum_percentage = + disp_cntl_tbl->dp_ss_percentage; +- ss_info->spread_spectrum_range = ++ ss_info->spread_spectrum_range = + disp_cntl_tbl->dp_ss_rate_10hz * 10; +- if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) +- ss_info->type.CENTER_MODE = true; +- ++ if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE) ++ ss_info->type.CENTER_MODE = true; ++ } + DC_LOG_BIOS("AS_SIGNAL_TYPE_DISPLAY_PORT ss_percentage: %d\n", ss_info->spread_spectrum_percentage); + break; + case AS_SIGNAL_TYPE_GPU_PLL: +@@ -2832,6 +2839,8 @@ static enum bp_result get_integrated_info_v2_2( + info->ma_channel_number = info_v2_2->umachannelnumber; + info->dp_ss_control = + le16_to_cpu(info_v2_2->reserved1); ++ info->gpuclk_ss_percentage = info_v2_2->gpuclk_ss_percentage; ++ info->gpuclk_ss_type = info_v2_2->gpuclk_ss_type; + + for (i = 0; i < NUMBER_OF_UCHAR_FOR_GUID; ++i) { + info->ext_disp_conn_info.gu_id[i] = +diff --git a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h +index bc96d0211360..813463ffe15c 100644 +--- a/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h ++++ b/drivers/gpu/drm/amd/display/include/grph_object_ctrl_defs.h +@@ -417,6 +417,8 @@ struct integrated_info { + /* V2.1 */ + struct edp_info edp1_info; + struct edp_info edp2_info; ++ uint32_t gpuclk_ss_percentage; ++ uint32_t gpuclk_ss_type; + }; + + /* +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch b/queue-6.6/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch new file mode 100644 index 00000000000..a9c622f3f78 --- /dev/null +++ b/queue-6.6/drm-amd-display-update-dcn315-lpddr-pstate-latency.patch @@ -0,0 +1,65 @@ +From 2658f6bceffacd5551a453637d7921059a0ce575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 14:55:37 -0400 +Subject: drm/amd/display: update dcn315 lpddr pstate latency + +From: Dmytro Laktyushkin + +[ Upstream commit c92da0403d373c03ea5c65c0260c7db6762013b0 ] + +[WHY/HOW] +Increase the pstate latency to improve ac/dc transition + +Reviewed-by: Charlene Liu +Acked-by: Tom Chung +Signed-off-by: Dmytro Laktyushkin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +index b2c4f97afc8b..8776055bbeaa 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c +@@ -334,7 +334,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_A, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -342,7 +342,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_B, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -350,7 +350,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_C, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +@@ -358,7 +358,7 @@ static struct wm_table lpddr5_wm_table = { + { + .wm_inst = WM_D, + .wm_type = WM_TYPE_PSTATE_CHG, +- .pstate_latency_us = 11.65333, ++ .pstate_latency_us = 129.0, + .sr_exit_time_us = 11.5, + .sr_enter_plus_exit_time_us = 14.5, + .valid = true, +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-use-channel_width-2-for-vram-table-3.patch b/queue-6.6/drm-amd-display-use-channel_width-2-for-vram-table-3.patch new file mode 100644 index 00000000000..cd7a1585f9f --- /dev/null +++ b/queue-6.6/drm-amd-display-use-channel_width-2-for-vram-table-3.patch @@ -0,0 +1,45 @@ +From be1194a9929832d5e1bd0fdcd2925fb785ae6dab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 06:25:07 -0700 +Subject: drm/amd/display: Use channel_width = 2 for vram table 3.0 + +From: Alvin Lee + +[ Upstream commit fec05adc40c25a028c9dfa9d540f800a2d433f80 ] + +VBIOS has suggested to use channel_width=2 for any ASIC that uses vram +info 3.0. This is because channel_width in the vram table no longer +represents the memory width + +Tested-by: Daniel Wheeler +Reviewed-by: Samson Tam +Acked-by: Rodrigo Siqueira +Signed-off-by: Alvin Lee +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +index 484d62bcf2c2..c52356147148 100644 +--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c ++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +@@ -2398,7 +2398,13 @@ static enum bp_result get_vram_info_v30( + return BP_RESULT_BADBIOSTABLE; + + info->num_chans = info_v30->channel_num; +- info->dram_channel_width_bytes = (1 << info_v30->channel_width) / 8; ++ /* As suggested by VBIOS we should always use ++ * dram_channel_width_bytes = 2 when using VRAM ++ * table version 3.0. This is because the channel_width ++ * param in the VRAM info table is changed in 7000 series and ++ * no longer represents the memory channel width. ++ */ ++ info->dram_channel_width_bytes = 2; + + return result; + } +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-add-null-checks-for-function-pointers.patch b/queue-6.6/drm-amdgpu-add-null-checks-for-function-pointers.patch new file mode 100644 index 00000000000..8ac659941ba --- /dev/null +++ b/queue-6.6/drm-amdgpu-add-null-checks-for-function-pointers.patch @@ -0,0 +1,55 @@ +From 8330ed31030e0d36c3fb6ca78e75073e33fae569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 12:37:34 +0530 +Subject: drm/amdgpu: Add NULL checks for function pointers + +From: Lijo Lazar + +[ Upstream commit 81577503efb49f4ad76af22f9941d72900ef4aab ] + +Check if function is implemented before making the call. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 9abfe4c28cea..3667f9a54841 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1422,9 +1422,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) + if (amdgpu_sriov_vf(adev)) + *flags = 0; + +- adev->nbio.funcs->get_clockgating_state(adev, flags); ++ if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state) ++ adev->nbio.funcs->get_clockgating_state(adev, flags); + +- adev->hdp.funcs->get_clock_gating_state(adev, flags); ++ if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state) ++ adev->hdp.funcs->get_clock_gating_state(adev, flags); + + if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(13, 0, 2)) { + +@@ -1440,9 +1442,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags) + } + + /* AMD_CG_SUPPORT_ROM_MGCG */ +- adev->smuio.funcs->get_clock_gating_state(adev, flags); ++ if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state) ++ adev->smuio.funcs->get_clock_gating_state(adev, flags); + +- adev->df.funcs->get_clockgating_state(adev, flags); ++ if (adev->df.funcs && adev->df.funcs->get_clockgating_state) ++ adev->df.funcs->get_clockgating_state(adev, flags); + } + + static int soc15_common_set_powergating_state(void *handle, +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-do-not-issue-gpu-reset-from-nbio-v7_9-bif.patch b/queue-6.6/drm-amdgpu-do-not-issue-gpu-reset-from-nbio-v7_9-bif.patch new file mode 100644 index 00000000000..a078922a97c --- /dev/null +++ b/queue-6.6/drm-amdgpu-do-not-issue-gpu-reset-from-nbio-v7_9-bif.patch @@ -0,0 +1,38 @@ +From 026256e5795c7ecdda341a0bd9924c6319d3bb66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 10:14:21 +0800 +Subject: drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt + +From: Hawking Zhang + +[ Upstream commit 884e9b0827e889a8742e203ccd052101fb0b945d ] + +In nbio v7_9, host driver should not issu gpu reset + +Signed-off-by: Hawking Zhang +Reviewed-by: Stanley Yang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +index f85eec05d218..ae45656eb877 100644 +--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c ++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c +@@ -604,11 +604,6 @@ static void nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device + + dev_info(adev->dev, "RAS controller interrupt triggered " + "by NBIF error\n"); +- +- /* ras_controller_int is dedicated for nbif ras error, +- * not the global interrupt for sync flood +- */ +- amdgpu_ras_reset_gpu(adev); + } + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch b/queue-6.6/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch new file mode 100644 index 00000000000..fa3566afcbd --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch @@ -0,0 +1,56 @@ +From 55e858e7c56ee722dde722c3841886347d462434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:22:34 +0800 +Subject: drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null + pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lu Yao + +[ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ] + +For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init +'didt_rreg' and 'didt_wreg' to 'NULL'. But in func +'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' +lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use +these two definitions won't be added for 'AMDGPU_FAMILY_SI'. + +So, add null pointer judgment before calling. + +Reviewed-by: Christian König +Signed-off-by: Lu Yao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 05405da51e7a..3f2126f99923 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -638,6 +638,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_rreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +@@ -694,6 +697,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_wreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-use-another-offset-for-gc-9.4.3-remap.patch b/queue-6.6/drm-amdgpu-use-another-offset-for-gc-9.4.3-remap.patch new file mode 100644 index 00000000000..dfc0cf119bd --- /dev/null +++ b/queue-6.6/drm-amdgpu-use-another-offset-for-gc-9.4.3-remap.patch @@ -0,0 +1,39 @@ +From 397b5bc0ca16d7bf17052286b1e1846edc41daa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 16:47:14 +0530 +Subject: drm/amdgpu: Use another offset for GC 9.4.3 remap + +From: Lijo Lazar + +[ Upstream commit ed6e4f0a27ebafffbd12bf3878ab004787685d8a ] + +The legacy region at 0x7F000 maps to valid registers in GC 9.4.3 SOCs. +Use 0x1A000 offset instead as MMIO register remap region. + +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 28094cd7d9c2..9abfe4c28cea 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1160,6 +1160,11 @@ static int soc15_common_early_init(void *handle) + AMD_PG_SUPPORT_VCN_DPG | + AMD_PG_SUPPORT_JPEG; + adev->external_rev_id = adev->rev_id + 0x46; ++ /* GC 9.4.3 uses MMIO register region hole at a different offset */ ++ if (!amdgpu_sriov_vf(adev)) { ++ adev->rmmio_remap.reg_offset = 0x1A000; ++ adev->rmmio_remap.bus_addr = adev->rmmio_base + 0x1A000; ++ } + break; + default: + /* FIXME: not supported yet */ +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-free-gang_ctx_bo-and-wptr_bo-in-pqm_unini.patch b/queue-6.6/drm-amdkfd-free-gang_ctx_bo-and-wptr_bo-in-pqm_unini.patch new file mode 100644 index 00000000000..593f2a03b73 --- /dev/null +++ b/queue-6.6/drm-amdkfd-free-gang_ctx_bo-and-wptr_bo-in-pqm_unini.patch @@ -0,0 +1,107 @@ +From 588efd1b1de5d1f7bcc19270c9c3a1ca77c4c250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 18:07:51 +0800 +Subject: drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit + +From: ZhenGuo Yin + +[ Upstream commit 72838777aa38352e20301e123b97110c456cd38e ] + +[Why] +Memory leaks of gang_ctx_bo and wptr_bo. + +[How] +Free gang_ctx_bo and wptr_bo in pqm_uninit. + +v2: add a common function pqm_clean_queue_resource to +free queue's resources. +v3: reset pdd->pqd.num_gws when destorying GWS queue. + +Reviewed-by: Felix Kuehling +Signed-off-by: ZhenGuo Yin +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/amdkfd/kfd_process_queue_manager.c | 54 +++++++++++-------- + 1 file changed, 33 insertions(+), 21 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +index 77649392e233..77f493262e05 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -169,16 +169,43 @@ int pqm_init(struct process_queue_manager *pqm, struct kfd_process *p) + return 0; + } + ++static void pqm_clean_queue_resource(struct process_queue_manager *pqm, ++ struct process_queue_node *pqn) ++{ ++ struct kfd_node *dev; ++ struct kfd_process_device *pdd; ++ ++ dev = pqn->q->device; ++ ++ pdd = kfd_get_process_device_data(dev, pqm->process); ++ if (!pdd) { ++ pr_err("Process device data doesn't exist\n"); ++ return; ++ } ++ ++ if (pqn->q->gws) { ++ if (KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) && ++ !dev->kfd->shared_resources.enable_mes) ++ amdgpu_amdkfd_remove_gws_from_process( ++ pqm->process->kgd_process_info, pqn->q->gws); ++ pdd->qpd.num_gws = 0; ++ } ++ ++ if (dev->kfd->shared_resources.enable_mes) { ++ amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->gang_ctx_bo); ++ if (pqn->q->wptr_bo) ++ amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo); ++ } ++} ++ + void pqm_uninit(struct process_queue_manager *pqm) + { + struct process_queue_node *pqn, *next; + + list_for_each_entry_safe(pqn, next, &pqm->queues, process_queue_list) { +- if (pqn->q && pqn->q->gws && +- KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) && +- !pqn->q->device->kfd->shared_resources.enable_mes) +- amdgpu_amdkfd_remove_gws_from_process(pqm->process->kgd_process_info, +- pqn->q->gws); ++ if (pqn->q) ++ pqm_clean_queue_resource(pqm, pqn); ++ + kfd_procfs_del_queue(pqn->q); + uninit_queue(pqn->q); + list_del(&pqn->process_queue_list); +@@ -461,22 +488,7 @@ int pqm_destroy_queue(struct process_queue_manager *pqm, unsigned int qid) + goto err_destroy_queue; + } + +- if (pqn->q->gws) { +- if (KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) && +- !dev->kfd->shared_resources.enable_mes) +- amdgpu_amdkfd_remove_gws_from_process( +- pqm->process->kgd_process_info, +- pqn->q->gws); +- pdd->qpd.num_gws = 0; +- } +- +- if (dev->kfd->shared_resources.enable_mes) { +- amdgpu_amdkfd_free_gtt_mem(dev->adev, +- pqn->q->gang_ctx_bo); +- if (pqn->q->wptr_bo) +- amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo); +- +- } ++ pqm_clean_queue_resource(pqm, pqn); + uninit_queue(pqn->q); + } + +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-svm-range-always-mapped-flag-not-working-.patch b/queue-6.6/drm-amdkfd-svm-range-always-mapped-flag-not-working-.patch new file mode 100644 index 00000000000..d9be29fec03 --- /dev/null +++ b/queue-6.6/drm-amdkfd-svm-range-always-mapped-flag-not-working-.patch @@ -0,0 +1,70 @@ +From a18c2b7969d79f45e44ecfed585cc24899b28977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 09:42:03 -0500 +Subject: drm/amdkfd: svm range always mapped flag not working on APU + +From: Philip Yang + +[ Upstream commit ebab8c3eb6a6515dc14cd93fc29dd287709da6d3 ] + +On gfx943 APU there is no VRAM and page migration, queue CWSR area, svm +range with always mapped flag, is not mapped to GPU correctly. This +works fine if retry fault on CWSR area can be recovered, but could cause +deadlock if there is another retry fault recover waiting for CWSR to +finish. + +Fix this by mapping svm range with always mapped flag to GPU with ACCESS +attribute if XNACK ON. + +There is side effect, because all GPUs have ACCESS attribute by default +on new svm range with XNACK on, the CWSR area will be mapped to all GPUs +after this change. This side effect will be fixed with Thunk change to +set CWSR svm range with ACCESS_IN_PLACE attribute on the GPU that user +queue is created. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 63ce30ea6891..8e368e4659fd 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -1632,18 +1632,24 @@ static int svm_range_validate_and_map(struct mm_struct *mm, + if (test_bit(gpuidx, prange->bitmap_access)) + bitmap_set(ctx->bitmap, gpuidx, 1); + } ++ ++ /* ++ * If prange is already mapped or with always mapped flag, ++ * update mapping on GPUs with ACCESS attribute ++ */ ++ if (bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) { ++ if (prange->mapped_to_gpu || ++ prange->flags & KFD_IOCTL_SVM_FLAG_GPU_ALWAYS_MAPPED) ++ bitmap_copy(ctx->bitmap, prange->bitmap_access, MAX_GPU_INSTANCE); ++ } + } else { + bitmap_or(ctx->bitmap, prange->bitmap_access, + prange->bitmap_aip, MAX_GPU_INSTANCE); + } + + if (bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) { +- bitmap_copy(ctx->bitmap, prange->bitmap_access, MAX_GPU_INSTANCE); +- if (!prange->mapped_to_gpu || +- bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) { +- r = 0; +- goto free_ctx; +- } ++ r = 0; ++ goto free_ctx; + } + + if (prange->actual_loc && !prange->ttm_res) { +-- +2.43.0 + diff --git a/queue-6.6/drm-amdkfd-use-common-function-for-ip-version-check.patch b/queue-6.6/drm-amdkfd-use-common-function-for-ip-version-check.patch new file mode 100644 index 00000000000..7d76bd4276c --- /dev/null +++ b/queue-6.6/drm-amdkfd-use-common-function-for-ip-version-check.patch @@ -0,0 +1,37 @@ +From 8d8836db154375245977c13db2830c6226d4fc48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 15:17:22 -0500 +Subject: drm/amdkfd: Use common function for IP version check + +From: Mukul Joshi + +[ Upstream commit 2f86bf79b63dbe6963ebc647b77a5f576a906b40 ] + +KFD_GC_VERSION was recently updated to use a new function +for IP version checks. As a result, use KFD_GC_VERSION as +the common function for all IP version checks in KFD. + +Signed-off-by: Mukul Joshi +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index fa24e1852493..df7a5cdb8693 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -1128,7 +1128,7 @@ static inline struct kfd_node *kfd_node_by_irq_ids(struct amdgpu_device *adev, + struct kfd_dev *dev = adev->kfd.dev; + uint32_t i; + +- if (adev->ip_versions[GC_HWIP][0] != IP_VERSION(9, 4, 3)) ++ if (KFD_GC_VERSION(dev) != IP_VERSION(9, 4, 3)) + return dev->nodes[0]; + + for (i = 0; i < dev->num_nodes; i++) +-- +2.43.0 + diff --git a/queue-6.6/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch b/queue-6.6/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch new file mode 100644 index 00000000000..d96b9ca7792 --- /dev/null +++ b/queue-6.6/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch @@ -0,0 +1,79 @@ +From 5b3d73a001a44deadaadb682e29e0efd83fddf3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 09:14:46 -0700 +Subject: drm/crtc: Fix uninit-value bug in drm_mode_setcrtc + +From: Ziqi Zhao + +[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] + +The connector_set contains uninitialized values when allocated with +kmalloc_array. However, in the "out" branch, the logic assumes that any +element in connector_set would be equal to NULL if failed to +initialize, which causes the bug reported by Syzbot. The fix is to use +an extra variable to keep track of how many connectors are initialized +indeed, and use that variable to decrease any refcounts in the "out" +branch. + +Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Signed-off-by: Ziqi Zhao +Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Tested-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index df9bf3c9206e..d718c17ab1e9 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -715,8 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret; +- int i; ++ int ret, i, num_connectors; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -851,6 +850,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + ++ num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +@@ -871,6 +871,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + connector->name); + + connector_set[i] = connector; ++ num_connectors++; + } + } + +@@ -879,7 +880,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + set.y = crtc_req->y; + set.mode = mode; + set.connectors = connector_set; +- set.num_connectors = crtc_req->count_connectors; ++ set.num_connectors = num_connectors; + set.fb = fb; + + if (drm_drv_uses_atomic_modeset(dev)) +@@ -892,7 +893,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + drm_framebuffer_put(fb); + + if (connector_set) { +- for (i = 0; i < crtc_req->count_connectors; i++) { ++ for (i = 0; i < num_connectors; i++) { + if (connector_set[i]) + drm_connector_put(connector_set[i]); + } +-- +2.43.0 + diff --git a/queue-6.6/drm-crtc-fix-uninitialized-variable-use.patch b/queue-6.6/drm-crtc-fix-uninitialized-variable-use.patch new file mode 100644 index 00000000000..5f076fbef33 --- /dev/null +++ b/queue-6.6/drm-crtc-fix-uninitialized-variable-use.patch @@ -0,0 +1,54 @@ +From 26045440067bbc0bfcab048cda518493549298e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:12:38 +0200 +Subject: drm/crtc: fix uninitialized variable use + +From: Jani Nikula + +[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ] + +Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in +drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, +but introduced another. + +num_connectors is only initialized if crtc_req->count_connectors > 0, +but it's used regardless. Fix it. + +Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") +Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Cc: Ziqi Zhao +Cc: Maxime Ripard +Cc: Maarten Lankhorst +Cc: Thomas Zimmermann +Signed-off-by: Jani Nikula +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index d718c17ab1e9..cb90e70d85e8 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -715,7 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret, i, num_connectors; ++ int ret, i, num_connectors = 0; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -850,7 +850,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + +- num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +-- +2.43.0 + diff --git a/queue-6.6/drm-exynos-fix-a-potential-error-pointer-dereference.patch b/queue-6.6/drm-exynos-fix-a-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..bba2e35661f --- /dev/null +++ b/queue-6.6/drm-exynos-fix-a-potential-error-pointer-dereference.patch @@ -0,0 +1,40 @@ +From 79a0866327606667005a27570bf1ff0446ddfb90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 14:27:48 +0800 +Subject: drm/exynos: fix a potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ] + +Smatch reports the warning below: +drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind() +error: 'crtc' dereferencing possible ERR_PTR() + +The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), +which can not be used directly. Fix this by checking the return value +before using it. + +Signed-off-by: Xiang Yang +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index f3aaa4ea3e68..dd9903eab563 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1861,6 +1861,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data) + return ret; + + crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI); ++ if (IS_ERR(crtc)) ++ return PTR_ERR(crtc); + crtc->pipe_clk = &hdata->phy_clk; + + ret = hdmi_create_connector(encoder); +-- +2.43.0 + diff --git a/queue-6.6/drm-exynos-fix-a-wrong-error-checking.patch b/queue-6.6/drm-exynos-fix-a-wrong-error-checking.patch new file mode 100644 index 00000000000..2db329a3c1f --- /dev/null +++ b/queue-6.6/drm-exynos-fix-a-wrong-error-checking.patch @@ -0,0 +1,62 @@ +From 68fde602a9a661d729156ae2d8dacd4f0aa90c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 18:36:51 +0900 +Subject: drm/exynos: fix a wrong error checking + +From: Inki Dae + +[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ] + +Fix a wrong error checking in exynos_drm_dma.c module. + +In the exynos_drm_register_dma function, both arm_iommu_create_mapping() +and iommu_get_domain_for_dev() functions are expected to return NULL as +an error. + +However, the error checking is performed using the statement +if(IS_ERR(mapping)), which doesn't provide a suitable error value. +So check if 'mapping' is NULL, and if it is, return -ENODEV. + +This issue[1] was reported by Dan. + +Changelog v1: +- fix build warning. + +[1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ + +Reported-by : Dan Carpenter +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c +index a971590b8132..e2c7373f20c6 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c +@@ -107,18 +107,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, + return 0; + + if (!priv->mapping) { +- void *mapping; ++ void *mapping = NULL; + + if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) + mapping = arm_iommu_create_mapping(&platform_bus_type, + EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); + else if (IS_ENABLED(CONFIG_IOMMU_DMA)) + mapping = iommu_get_domain_for_dev(priv->dma_dev); +- else +- mapping = ERR_PTR(-ENODEV); + +- if (IS_ERR(mapping)) +- return PTR_ERR(mapping); ++ if (!mapping) ++ return -ENODEV; + priv->mapping = mapping; + } + +-- +2.43.0 + diff --git a/queue-6.6/efi-loongarch-use-load-address-to-calculate-kernel-e.patch b/queue-6.6/efi-loongarch-use-load-address-to-calculate-kernel-e.patch new file mode 100644 index 00000000000..356d264953b --- /dev/null +++ b/queue-6.6/efi-loongarch-use-load-address-to-calculate-kernel-e.patch @@ -0,0 +1,79 @@ +From 5c886c94da3e2fd9161dfdd6a64f15eda753675c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 08:24:27 +0800 +Subject: efi/loongarch: Use load address to calculate kernel entry address + +From: Wang Yao + +[ Upstream commit 271f2a4a9576b87ed1f8584909d6d270039e52ea ] + +The efi_relocate_kernel() may load the PIE kernel to anywhere, the +loaded address may not be equal to link address or +EFI_KIMG_PREFERRED_ADDRESS. + +Acked-by: Huacai Chen +Signed-off-by: Wang Yao +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/efi.h | 2 +- + drivers/firmware/efi/libstub/loongarch-stub.c | 4 ++-- + drivers/firmware/efi/libstub/loongarch.c | 6 +++--- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/loongarch/include/asm/efi.h b/arch/loongarch/include/asm/efi.h +index 091897d40b03..91d81f9730ab 100644 +--- a/arch/loongarch/include/asm/efi.h ++++ b/arch/loongarch/include/asm/efi.h +@@ -32,6 +32,6 @@ static inline unsigned long efi_get_kimg_min_align(void) + + #define EFI_KIMG_PREFERRED_ADDRESS PHYSADDR(VMLINUX_LOAD_ADDRESS) + +-unsigned long kernel_entry_address(void); ++unsigned long kernel_entry_address(unsigned long kernel_addr); + + #endif /* _ASM_LOONGARCH_EFI_H */ +diff --git a/drivers/firmware/efi/libstub/loongarch-stub.c b/drivers/firmware/efi/libstub/loongarch-stub.c +index 72c71ae201f0..d6ec5d4b8dbe 100644 +--- a/drivers/firmware/efi/libstub/loongarch-stub.c ++++ b/drivers/firmware/efi/libstub/loongarch-stub.c +@@ -35,9 +35,9 @@ efi_status_t handle_kernel_image(unsigned long *image_addr, + return status; + } + +-unsigned long kernel_entry_address(void) ++unsigned long kernel_entry_address(unsigned long kernel_addr) + { + unsigned long base = (unsigned long)&kernel_offset - kernel_offset; + +- return (unsigned long)&kernel_entry - base + VMLINUX_LOAD_ADDRESS; ++ return (unsigned long)&kernel_entry - base + kernel_addr; + } +diff --git a/drivers/firmware/efi/libstub/loongarch.c b/drivers/firmware/efi/libstub/loongarch.c +index 807cba2693fc..0e0aa6cda73f 100644 +--- a/drivers/firmware/efi/libstub/loongarch.c ++++ b/drivers/firmware/efi/libstub/loongarch.c +@@ -37,9 +37,9 @@ static efi_status_t exit_boot_func(struct efi_boot_memmap *map, void *priv) + return EFI_SUCCESS; + } + +-unsigned long __weak kernel_entry_address(void) ++unsigned long __weak kernel_entry_address(unsigned long kernel_addr) + { +- return *(unsigned long *)(PHYSADDR(VMLINUX_LOAD_ADDRESS) + 8); ++ return *(unsigned long *)(kernel_addr + 8) - VMLINUX_LOAD_ADDRESS + kernel_addr; + } + + efi_status_t efi_boot_kernel(void *handle, efi_loaded_image_t *image, +@@ -73,7 +73,7 @@ efi_status_t efi_boot_kernel(void *handle, efi_loaded_image_t *image, + csr_write64(CSR_DMW0_INIT, LOONGARCH_CSR_DMWIN0); + csr_write64(CSR_DMW1_INIT, LOONGARCH_CSR_DMWIN1); + +- real_kernel_entry = (void *)kernel_entry_address(); ++ real_kernel_entry = (void *)kernel_entry_address(kernel_addr); + + real_kernel_entry(true, (unsigned long)cmdline_ptr, + (unsigned long)efi_system_table); +-- +2.43.0 + diff --git a/queue-6.6/hid-nintendo-fix-initializer-element-is-not-constant.patch b/queue-6.6/hid-nintendo-fix-initializer-element-is-not-constant.patch new file mode 100644 index 00000000000..8698b31c929 --- /dev/null +++ b/queue-6.6/hid-nintendo-fix-initializer-element-is-not-constant.patch @@ -0,0 +1,81 @@ +From f83a06b3e34b7cd52474682f8ef02d4131af0331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 09:25:41 -0800 +Subject: HID: nintendo: fix initializer element is not constant error + +From: Ryan McClelland + +[ Upstream commit 0b7dd38c1c520b650a889a81919838671b689eb9 ] + +With gcc-7 builds, an error happens with the controller button values being +defined as const. Change to a define. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312141227.C2h1IzfI-lkp@intel.com/ + +Signed-off-by: Ryan McClelland +Reviewed-by: Daniel J. Ogorchock +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 44 +++++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index 10468f727e5b..7644edee996a 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -325,28 +325,28 @@ struct joycon_imu_cal { + * All the controller's button values are stored in a u32. + * They can be accessed with bitwise ANDs. + */ +-static const u32 JC_BTN_Y = BIT(0); +-static const u32 JC_BTN_X = BIT(1); +-static const u32 JC_BTN_B = BIT(2); +-static const u32 JC_BTN_A = BIT(3); +-static const u32 JC_BTN_SR_R = BIT(4); +-static const u32 JC_BTN_SL_R = BIT(5); +-static const u32 JC_BTN_R = BIT(6); +-static const u32 JC_BTN_ZR = BIT(7); +-static const u32 JC_BTN_MINUS = BIT(8); +-static const u32 JC_BTN_PLUS = BIT(9); +-static const u32 JC_BTN_RSTICK = BIT(10); +-static const u32 JC_BTN_LSTICK = BIT(11); +-static const u32 JC_BTN_HOME = BIT(12); +-static const u32 JC_BTN_CAP = BIT(13); /* capture button */ +-static const u32 JC_BTN_DOWN = BIT(16); +-static const u32 JC_BTN_UP = BIT(17); +-static const u32 JC_BTN_RIGHT = BIT(18); +-static const u32 JC_BTN_LEFT = BIT(19); +-static const u32 JC_BTN_SR_L = BIT(20); +-static const u32 JC_BTN_SL_L = BIT(21); +-static const u32 JC_BTN_L = BIT(22); +-static const u32 JC_BTN_ZL = BIT(23); ++#define JC_BTN_Y BIT(0) ++#define JC_BTN_X BIT(1) ++#define JC_BTN_B BIT(2) ++#define JC_BTN_A BIT(3) ++#define JC_BTN_SR_R BIT(4) ++#define JC_BTN_SL_R BIT(5) ++#define JC_BTN_R BIT(6) ++#define JC_BTN_ZR BIT(7) ++#define JC_BTN_MINUS BIT(8) ++#define JC_BTN_PLUS BIT(9) ++#define JC_BTN_RSTICK BIT(10) ++#define JC_BTN_LSTICK BIT(11) ++#define JC_BTN_HOME BIT(12) ++#define JC_BTN_CAP BIT(13) /* capture button */ ++#define JC_BTN_DOWN BIT(16) ++#define JC_BTN_UP BIT(17) ++#define JC_BTN_RIGHT BIT(18) ++#define JC_BTN_LEFT BIT(19) ++#define JC_BTN_SR_L BIT(20) ++#define JC_BTN_SL_L BIT(21) ++#define JC_BTN_L BIT(22) ++#define JC_BTN_ZL BIT(23) + + enum joycon_msg_type { + JOYCON_MSG_TYPE_NONE, +-- +2.43.0 + diff --git a/queue-6.6/hid-nintendo-prevent-divide-by-zero-on-code.patch b/queue-6.6/hid-nintendo-prevent-divide-by-zero-on-code.patch new file mode 100644 index 00000000000..d721fcbeda9 --- /dev/null +++ b/queue-6.6/hid-nintendo-prevent-divide-by-zero-on-code.patch @@ -0,0 +1,102 @@ +From c1e8fa5c5aa43fee037836ffc1b149cd1fb8fa7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 18:15:51 -0300 +Subject: HID: nintendo: Prevent divide-by-zero on code + +From: Guilherme G. Piccoli + +[ Upstream commit 6eb04ca8c52e3f8c8ea7102ade81d642eee87f4a ] + +It was reported [0] that adding a generic joycon to the system caused +a kernel crash on Steam Deck, with the below panic spew: + +divide error: 0000 [#1] PREEMPT SMP NOPTI +[...] +Hardware name: Valve Jupiter/Jupiter, BIOS F7A0119 10/24/2023 +RIP: 0010:nintendo_hid_event+0x340/0xcc1 [hid_nintendo] +[...] +Call Trace: + [...] + ? exc_divide_error+0x38/0x50 + ? nintendo_hid_event+0x340/0xcc1 [hid_nintendo] + ? asm_exc_divide_error+0x1a/0x20 + ? nintendo_hid_event+0x307/0xcc1 [hid_nintendo] + hid_input_report+0x143/0x160 + hidp_session_run+0x1ce/0x700 [hidp] + +Since it's a divide-by-0 error, by tracking the code for potential +denominator issues, we've spotted 2 places in which this could happen; +so let's guard against the possibility and log in the kernel if the +condition happens. This is specially useful since some data that +fills some denominators are read from the joycon HW in some cases, +increasing the potential for flaws. + +[0] https://github.com/ValveSoftware/SteamOS/issues/1070 + +Signed-off-by: Guilherme G. Piccoli +Tested-by: Sam Lantinga +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-nintendo.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c +index 7644edee996a..4850e915a57d 100644 +--- a/drivers/hid/hid-nintendo.c ++++ b/drivers/hid/hid-nintendo.c +@@ -896,14 +896,27 @@ static int joycon_request_calibration(struct joycon_ctlr *ctlr) + */ + static void joycon_calc_imu_cal_divisors(struct joycon_ctlr *ctlr) + { +- int i; ++ int i, divz = 0; + + for (i = 0; i < 3; i++) { + ctlr->imu_cal_accel_divisor[i] = ctlr->accel_cal.scale[i] - + ctlr->accel_cal.offset[i]; + ctlr->imu_cal_gyro_divisor[i] = ctlr->gyro_cal.scale[i] - + ctlr->gyro_cal.offset[i]; ++ ++ if (ctlr->imu_cal_accel_divisor[i] == 0) { ++ ctlr->imu_cal_accel_divisor[i] = 1; ++ divz++; ++ } ++ ++ if (ctlr->imu_cal_gyro_divisor[i] == 0) { ++ ctlr->imu_cal_gyro_divisor[i] = 1; ++ divz++; ++ } + } ++ ++ if (divz) ++ hid_warn(ctlr->hdev, "inaccurate IMU divisors (%d)\n", divz); + } + + static const s16 DFLT_ACCEL_OFFSET /*= 0*/; +@@ -1132,16 +1145,16 @@ static void joycon_parse_imu_report(struct joycon_ctlr *ctlr, + JC_IMU_SAMPLES_PER_DELTA_AVG) { + ctlr->imu_avg_delta_ms = ctlr->imu_delta_samples_sum / + ctlr->imu_delta_samples_count; +- /* don't ever want divide by zero shenanigans */ +- if (ctlr->imu_avg_delta_ms == 0) { +- ctlr->imu_avg_delta_ms = 1; +- hid_warn(ctlr->hdev, +- "calculated avg imu delta of 0\n"); +- } + ctlr->imu_delta_samples_count = 0; + ctlr->imu_delta_samples_sum = 0; + } + ++ /* don't ever want divide by zero shenanigans */ ++ if (ctlr->imu_avg_delta_ms == 0) { ++ ctlr->imu_avg_delta_ms = 1; ++ hid_warn(ctlr->hdev, "calculated avg imu delta of 0\n"); ++ } ++ + /* useful for debugging IMU sample rate */ + hid_dbg(ctlr->hdev, + "imu_report: ms=%u last_ms=%u delta=%u avg_delta=%u\n", +-- +2.43.0 + diff --git a/queue-6.6/hwmon-corsair-psu-fix-probe-when-built-in.patch b/queue-6.6/hwmon-corsair-psu-fix-probe-when-built-in.patch new file mode 100644 index 00000000000..532365326c3 --- /dev/null +++ b/queue-6.6/hwmon-corsair-psu-fix-probe-when-built-in.patch @@ -0,0 +1,57 @@ +From aa7f5875af3005492156e5f36a54f9a9f1a37119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 22:07:23 +0100 +Subject: hwmon: (corsair-psu) Fix probe when built-in + +From: Armin Wolf + +[ Upstream commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e ] + +It seems that when the driver is built-in, the HID bus is +initialized after the driver is loaded, which whould cause +module_hid_driver() to fail. +Fix this by registering the driver after the HID bus using +late_initcall() in accordance with other hwmon HID drivers. + +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20231207210723.222552-1-W_Armin@gmx.de +[groeck: Dropped "compile tested" comment; the patch has been tested + but the tester did not provide a Tested-by: tag] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/corsair-psu.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c +index 904890598c11..2c7c92272fe3 100644 +--- a/drivers/hwmon/corsair-psu.c ++++ b/drivers/hwmon/corsair-psu.c +@@ -899,7 +899,23 @@ static struct hid_driver corsairpsu_driver = { + .reset_resume = corsairpsu_resume, + #endif + }; +-module_hid_driver(corsairpsu_driver); ++ ++static int __init corsair_init(void) ++{ ++ return hid_register_driver(&corsairpsu_driver); ++} ++ ++static void __exit corsair_exit(void) ++{ ++ hid_unregister_driver(&corsairpsu_driver); ++} ++ ++/* ++ * With module_init() the driver would load before the HID bus when ++ * built-in, so use late_initcall() instead. ++ */ ++late_initcall(corsair_init); ++module_exit(corsair_exit); + + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Wilken Gottwalt "); +-- +2.43.0 + diff --git a/queue-6.6/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch b/queue-6.6/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch new file mode 100644 index 00000000000..fdbed239428 --- /dev/null +++ b/queue-6.6/hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch @@ -0,0 +1,38 @@ +From a101ec48c65c5b43fb2b4285946756bf4caacd4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 16:47:30 +0800 +Subject: hwtracing: hisi_ptt: Don't try to attach a task + +From: Yicong Yang + +[ Upstream commit aff787f64ad7cbb54614b51b82c682fe06411ef3 ] + +PTT is an uncore PMU and shouldn't be attached to any task. Block +the usage in pmu::event_init(). + +Signed-off-by: Yicong Yang +Acked-by: Jonathan Cameron +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20231010084731.30450-5-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index dbed4fd4e296..a991ecb7515a 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -1000,6 +1000,9 @@ static int hisi_ptt_pmu_event_init(struct perf_event *event) + return -EOPNOTSUPP; + } + ++ if (event->attach_state & PERF_ATTACH_TASK) ++ return -EOPNOTSUPP; ++ + if (event->attr.type != hisi_ptt->hisi_ptt_pmu.type) + return -ENOENT; + +-- +2.43.0 + diff --git a/queue-6.6/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch b/queue-6.6/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch new file mode 100644 index 00000000000..34c456939b6 --- /dev/null +++ b/queue-6.6/hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch @@ -0,0 +1,50 @@ +From 79c840d4ca036a7e7e8efba75d7bf9bde6ae796f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 16:47:28 +0800 +Subject: hwtracing: hisi_ptt: Handle the interrupt in hardirq context + +From: Yicong Yang + +[ Upstream commit e0dd27ad8af00f147ac3c9de88e0687986afc3ea ] + +Handle the trace interrupt in the hardirq context, make sure the irq +core won't threaded it by declaring IRQF_NO_THREAD and userspace won't +balance it by declaring IRQF_NOBALANCING. Otherwise we may violate the +synchronization requirements of the perf core, referenced to the +change of arm-ccn PMU + commit 0811ef7e2f54 ("bus: arm-ccn: fix PMU interrupt flags"). + +In the interrupt handler we mainly doing 2 things: +- Copy the data from the local DMA buffer to the AUX buffer +- Commit the data in the AUX buffer + +Signed-off-by: Yicong Yang +Acked-by: Jonathan Cameron +[ Fixed commit description to suppress checkpatch warning ] +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20231010084731.30450-3-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 3045d1894b81..dbed4fd4e296 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -342,9 +342,9 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) + return ret; + + hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ); +- ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq, +- NULL, hisi_ptt_isr, 0, +- DRV_NAME, hisi_ptt); ++ ret = devm_request_irq(&pdev->dev, hisi_ptt->trace_irq, hisi_ptt_isr, ++ IRQF_NOBALANCING | IRQF_NO_THREAD, DRV_NAME, ++ hisi_ptt); + if (ret) { + pci_err(pdev, "failed to request irq %d, ret = %d\n", + hisi_ptt->trace_irq, ret); +-- +2.43.0 + diff --git a/queue-6.6/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch b/queue-6.6/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch new file mode 100644 index 00000000000..547e41dcb5b --- /dev/null +++ b/queue-6.6/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch @@ -0,0 +1,84 @@ +From fac989fc5881ccc33bea3c41a564334461265dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:21:59 +0800 +Subject: i2c: rk3x: fix potential spinlock recursion on poll + +From: Jensen Huang + +[ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ] + +Possible deadlock scenario (on reboot): +rk3x_i2c_xfer_common(polling) + -> rk3x_i2c_wait_xfer_poll() + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); + ... + + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); (deadlock here) + +Store the IRQ number and disable/enable it around the polling transfer. +This patch has been tested on NanoPC-T4. + +Signed-off-by: Jensen Huang +Reviewed-by: Heiko Stuebner +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index a044ca0c35a1..4362db7c5789 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data { + * @clk: function clk for rk3399 or function & Bus clks for others + * @pclk: Bus clk for rk3399 + * @clk_rate_nb: i2c clk rate change notify ++ * @irq: irq number + * @t: I2C known timing information + * @lock: spinlock for the i2c bus + * @wait: the waitqueue to wait for i2c transfer +@@ -200,6 +201,7 @@ struct rk3x_i2c { + struct clk *clk; + struct clk *pclk; + struct notifier_block clk_rate_nb; ++ int irq; + + /* Settings */ + struct i2c_timings t; +@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap, + + spin_unlock_irqrestore(&i2c->lock, flags); + +- rk3x_i2c_start(i2c); +- + if (!polling) { ++ rk3x_i2c_start(i2c); ++ + timeout = wait_event_timeout(i2c->wait, !i2c->busy, + msecs_to_jiffies(WAIT_TIMEOUT)); + } else { ++ disable_irq(i2c->irq); ++ rk3x_i2c_start(i2c); ++ + timeout = rk3x_i2c_wait_xfer_poll(i2c); ++ ++ enable_irq(i2c->irq); + } + + spin_lock_irqsave(&i2c->lock, flags); +@@ -1310,6 +1317,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev) + return ret; + } + ++ i2c->irq = irq; ++ + platform_set_drvdata(pdev, i2c); + + if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) { +-- +2.43.0 + diff --git a/queue-6.6/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch b/queue-6.6/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch new file mode 100644 index 00000000000..f5b15455a75 --- /dev/null +++ b/queue-6.6/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch @@ -0,0 +1,99 @@ +From 5012be9023125a0efa1f52b8614eebfcb06823b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 16:53:57 +0000 +Subject: ida: Fix crash in ida_free when the bitmap is empty + +From: Matthew Wilcox (Oracle) + +[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ] + +The IDA usually detects double-frees, but that detection failed to +consider the case when there are no nearby IDs allocated and so we have a +NULL bitmap rather than simply having a clear bit. Add some tests to the +test-suite to be sure we don't inadvertently reintroduce this problem. +Unfortunately they're quite noisy so include a message to disregard +the warnings. + +Reported-by: Zhenghan Wang +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/idr.c | 2 +- + lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/lib/idr.c b/lib/idr.c +index 13f2758c2377..da36054c3ca0 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) + goto delete; + xas_store(&xas, xa_mk_value(v)); + } else { +- if (!test_bit(bit, bitmap->bitmap)) ++ if (!bitmap || !test_bit(bit, bitmap->bitmap)) + goto err; + __clear_bit(bit, bitmap->bitmap); + xas_set_mark(&xas, XA_FREE_MARK); +diff --git a/lib/test_ida.c b/lib/test_ida.c +index b06880625961..55105baa19da 100644 +--- a/lib/test_ida.c ++++ b/lib/test_ida.c +@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) + IDA_BUG_ON(ida, !ida_is_empty(ida)); + } + ++/* ++ * Check various situations where we attempt to free an ID we don't own. ++ */ ++static void ida_check_bad_free(struct ida *ida) ++{ ++ unsigned long i; ++ ++ printk("vvv Ignore \"not allocated\" warnings\n"); ++ /* IDA is empty; all of these will fail */ ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single value entry */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single bitmap */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a tree */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ printk("^^^ \"not allocated\" warnings over\n"); ++ ++ ida_free(ida, 3); ++ ida_free(ida, 1023); ++ ida_free(ida, (1 << 20) - 1); ++ ++ IDA_BUG_ON(ida, !ida_is_empty(ida)); ++} ++ + static DEFINE_IDA(ida); + + static int ida_checks(void) +@@ -162,6 +201,7 @@ static int ida_checks(void) + ida_check_leaf(&ida, 1024 * 64); + ida_check_max(&ida); + ida_check_conv(&ida); ++ ida_check_bad_free(&ida); + + printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); + return (tests_run != tests_passed) ? 0 : -EINVAL; +-- +2.43.0 + diff --git a/queue-6.6/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch b/queue-6.6/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch new file mode 100644 index 00000000000..4ce273c27eb --- /dev/null +++ b/queue-6.6/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch @@ -0,0 +1,126 @@ +From bdb6570276700ca55b8daf270efb018bebd66470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:59:24 -0800 +Subject: Input: atkbd - skip ATKBD_CMD_GETID in translated mode + +From: Hans de Goede + +[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ] + +There have been multiple reports of keyboard issues on recent laptop models +which can be worked around by setting i8042.dumbkbd, with the downside +being this breaks the capslock LED. + +It seems that these issues are caused by recent laptops getting confused by +ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for +this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode. + +The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 +mice/touchpads and those are never used in translated mode. + +Examples of laptop models which benefit from skipping ATKBD_CMD_GETID: + +* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" + models the kbd stops working for the first 2 - 5 minutes after boot + (waiting for EC watchdog reset?) + +* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard + +* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see: + https://github.com/yescallop/atkbd-nogetid + +This has been tested on: + +1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not + in translated mode when no keyboard is plugged in and with a ps/2 kbd + a "AT Translated Set 2 keyboard" /dev/input/event# node shows up + +2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard) + +Reported-by: Shang Ye +Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/ +Closes: https://github.com/yescallop/atkbd-nogetid +Reported-by: gurevitch +Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/ +Reported-by: Egor Ignatov +Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/ +Reported-by: Anton Zhilyaev +Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/ +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- + 1 file changed, 42 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index c92e544c792d..786f00f6b7fd 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -765,6 +765,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) + ps2dev->serio->phys); + } + ++#ifdef CONFIG_X86 ++static bool atkbd_is_portable_device(void) ++{ ++ static const char * const chassis_types[] = { ++ "8", /* Portable */ ++ "9", /* Laptop */ ++ "10", /* Notebook */ ++ "14", /* Sub-Notebook */ ++ "31", /* Convertible */ ++ "32", /* Detachable */ ++ }; ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(chassis_types); i++) ++ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i])) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops ++ * the controller is always in translated mode. In this mode mice/touchpads will ++ * not work. So in this case simply assume a keyboard is connected to avoid ++ * confusing some laptop keyboards. ++ * ++ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is ++ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in ++ * translated mode that is a no-op. ++ */ ++static bool atkbd_skip_getid(struct atkbd *atkbd) ++{ ++ return atkbd->translated && atkbd_is_portable_device(); ++} ++#else ++static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; } ++#endif ++ + /* + * atkbd_probe() probes for an AT keyboard on a serio port. + */ +@@ -794,12 +832,12 @@ static int atkbd_probe(struct atkbd *atkbd) + */ + + param[0] = param[1] = 0xa5; /* initialize with invalid values */ +- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { ++ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { + + /* +- * If the get ID command failed, we check if we can at least set the LEDs on +- * the keyboard. This should work on every keyboard out there. It also turns +- * the LEDs off, which we want anyway. ++ * If the get ID command was skipped or failed, we check if we can at least set ++ * the LEDs on the keyboard. This should work on every keyboard out there. ++ * It also turns the LEDs off, which we want anyway. + */ + param[0] = 0; + if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) +-- +2.43.0 + diff --git a/queue-6.6/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch b/queue-6.6/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch new file mode 100644 index 00000000000..57eca69d430 --- /dev/null +++ b/queue-6.6/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch @@ -0,0 +1,45 @@ +From dbdcf2a911221e2af18e34e88dafaf3568a17c21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 19:56:19 +0000 +Subject: Input: i8042 - add nomux quirk for Acer P459-G2-M + +From: Esther Shimanovich + +[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ] + +After the laptop lid is opened, and the device resumes from S3 deep +sleep, if the user presses a keyboard key while the screen is still black, +the mouse and keyboard become unusable. + +Enabling this quirk prevents this behavior from occurring. + +Signed-off-by: Esther Shimanovich +Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index 9c39553d30fa..b585b1dab870 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -360,6 +360,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK) + }, ++ { ++ /* Acer TravelMate P459-G2-M */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Amoi M636/A737 */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch b/queue-6.6/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch new file mode 100644 index 00000000000..ff260fe82ae --- /dev/null +++ b/queue-6.6/input-psmouse-enable-synaptics-intertouch-for-thinkp.patch @@ -0,0 +1,49 @@ +From 1c10ccc8bfb7d3b214610ee59aba8dfba89d3e56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:50:23 +0000 +Subject: Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Pekkarinen + +[ Upstream commit c1f342f35f820b33390571293498c3e2e9bc77ec ] + +Observed on dmesg of my laptop I see the following +output: + +[ 19.898700] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694] +[ 19.936057] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..] +[ 19.936076] psmouse serio1: synaptics: Your touchpad (PNP: LEN0411 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org. +[ 20.008901] psmouse serio1: synaptics: Touchpad model: 1, fw: 10.32, id: 0x1e2a1, caps: 0xf014a3/0x940300/0x12e800/0x500000, board id: 3471, fw id: 2909640 +[ 20.008925] psmouse serio1: synaptics: serio: Synaptics pass-through port at isa0060/serio1/input0 +[ 20.053344] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio1/input/input7 +[ 20.397608] mousedev: PS/2 mouse device common for all mice + +This patch will add its pnp id to the smbus list to +produce the setup of intertouch for the device. + +Signed-off-by: José Pekkarinen +Link: https://lore.kernel.org/r/20231114063607.71772-1-jose.pekkarinen@foxhound.fi +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 22d16d80efb9..7a303a9d6bf7 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -183,6 +183,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN009b", /* T580 */ + "LEN0402", /* X1 Extreme Gen 2 / P1 Gen 2 */ + "LEN040f", /* P1 Gen 3 */ ++ "LEN0411", /* L14 Gen 1 */ + "LEN200f", /* T450s */ + "LEN2044", /* L470 */ + "LEN2054", /* E480 */ +-- +2.43.0 + diff --git a/queue-6.6/input-xpad-add-razer-wolverine-v2-support.patch b/queue-6.6/input-xpad-add-razer-wolverine-v2-support.patch new file mode 100644 index 00000000000..ee7e1f3afac --- /dev/null +++ b/queue-6.6/input-xpad-add-razer-wolverine-v2-support.patch @@ -0,0 +1,34 @@ +From 66ffe86a35ba7ee035bbec346ca94769905d618a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 17:22:15 +0100 +Subject: Input: xpad - add Razer Wolverine V2 support + +From: Luca Weiss + +[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ] + +Add the VID and PID of Razer Wolverine V2 to xpad_device. + +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index f5c21565bb3c..e2c1848182de 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -286,6 +286,7 @@ static const struct xpad_device { + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, +-- +2.43.0 + diff --git a/queue-6.6/io_uring-use-fget-fput-consistently.patch b/queue-6.6/io_uring-use-fget-fput-consistently.patch new file mode 100644 index 00000000000..29526dd9e78 --- /dev/null +++ b/queue-6.6/io_uring-use-fget-fput-consistently.patch @@ -0,0 +1,166 @@ +From 63de310876a85882fcbc36fa3586c39f23ed1599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 10:29:58 -0700 +Subject: io_uring: use fget/fput consistently + +From: Jens Axboe + +[ Upstream commit 73363c262d6a7d26063da96610f61baf69a70f7c ] + +Normally within a syscall it's fine to use fdget/fdput for grabbing a +file from the file table, and it's fine within io_uring as well. We do +that via io_uring_enter(2), io_uring_register(2), and then also for +cancel which is invoked from the latter. io_uring cannot close its own +file descriptors as that is explicitly rejected, and for the cancel +side of things, the file itself is just used as a lookup cookie. + +However, it is more prudent to ensure that full references are always +grabbed. For anything threaded, either explicitly in the application +itself or through use of the io-wq worker threads, this is what happens +anyway. Generalize it and use fget/fput throughout. + +Also see the below link for more details. + +Link: https://lore.kernel.org/io-uring/CAG48ez1htVSO3TqmrF8QcX2WFuYTRM-VZ_N10i-VZgbtg=NNqw@mail.gmail.com/ +Suggested-by: Jann Horn +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/cancel.c | 11 ++++++----- + io_uring/io_uring.c | 36 ++++++++++++++++++------------------ + 2 files changed, 24 insertions(+), 23 deletions(-) + +diff --git a/io_uring/cancel.c b/io_uring/cancel.c +index 7b23607cf4af..a5d51471feeb 100644 +--- a/io_uring/cancel.c ++++ b/io_uring/cancel.c +@@ -263,7 +263,7 @@ int io_sync_cancel(struct io_ring_ctx *ctx, void __user *arg) + }; + ktime_t timeout = KTIME_MAX; + struct io_uring_sync_cancel_reg sc; +- struct fd f = { }; ++ struct file *file = NULL; + DEFINE_WAIT(wait); + int ret, i; + +@@ -285,10 +285,10 @@ int io_sync_cancel(struct io_ring_ctx *ctx, void __user *arg) + /* we can grab a normal file descriptor upfront */ + if ((cd.flags & IORING_ASYNC_CANCEL_FD) && + !(cd.flags & IORING_ASYNC_CANCEL_FD_FIXED)) { +- f = fdget(sc.fd); +- if (!f.file) ++ file = fget(sc.fd); ++ if (!file) + return -EBADF; +- cd.file = f.file; ++ cd.file = file; + } + + ret = __io_sync_cancel(current->io_uring, &cd, sc.fd); +@@ -338,6 +338,7 @@ int io_sync_cancel(struct io_ring_ctx *ctx, void __user *arg) + if (ret == -ENOENT || ret > 0) + ret = 0; + out: +- fdput(f); ++ if (file) ++ fput(file); + return ret; + } +diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c +index bb8880d1e084..586ac65becfd 100644 +--- a/io_uring/io_uring.c ++++ b/io_uring/io_uring.c +@@ -3607,7 +3607,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + size_t, argsz) + { + struct io_ring_ctx *ctx; +- struct fd f; ++ struct file *file; + long ret; + + if (unlikely(flags & ~(IORING_ENTER_GETEVENTS | IORING_ENTER_SQ_WAKEUP | +@@ -3625,20 +3625,19 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + if (unlikely(!tctx || fd >= IO_RINGFD_REG_MAX)) + return -EINVAL; + fd = array_index_nospec(fd, IO_RINGFD_REG_MAX); +- f.file = tctx->registered_rings[fd]; +- f.flags = 0; +- if (unlikely(!f.file)) ++ file = tctx->registered_rings[fd]; ++ if (unlikely(!file)) + return -EBADF; + } else { +- f = fdget(fd); +- if (unlikely(!f.file)) ++ file = fget(fd); ++ if (unlikely(!file)) + return -EBADF; + ret = -EOPNOTSUPP; +- if (unlikely(!io_is_uring_fops(f.file))) ++ if (unlikely(!io_is_uring_fops(file))) + goto out; + } + +- ctx = f.file->private_data; ++ ctx = file->private_data; + ret = -EBADFD; + if (unlikely(ctx->flags & IORING_SETUP_R_DISABLED)) + goto out; +@@ -3732,7 +3731,8 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit, + } + } + out: +- fdput(f); ++ if (!(flags & IORING_ENTER_REGISTERED_RING)) ++ fput(file); + return ret; + } + +@@ -4573,7 +4573,7 @@ SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode, + { + struct io_ring_ctx *ctx; + long ret = -EBADF; +- struct fd f; ++ struct file *file; + bool use_registered_ring; + + use_registered_ring = !!(opcode & IORING_REGISTER_USE_REGISTERED_RING); +@@ -4592,27 +4592,27 @@ SYSCALL_DEFINE4(io_uring_register, unsigned int, fd, unsigned int, opcode, + if (unlikely(!tctx || fd >= IO_RINGFD_REG_MAX)) + return -EINVAL; + fd = array_index_nospec(fd, IO_RINGFD_REG_MAX); +- f.file = tctx->registered_rings[fd]; +- f.flags = 0; +- if (unlikely(!f.file)) ++ file = tctx->registered_rings[fd]; ++ if (unlikely(!file)) + return -EBADF; + } else { +- f = fdget(fd); +- if (unlikely(!f.file)) ++ file = fget(fd); ++ if (unlikely(!file)) + return -EBADF; + ret = -EOPNOTSUPP; +- if (!io_is_uring_fops(f.file)) ++ if (!io_is_uring_fops(file)) + goto out_fput; + } + +- ctx = f.file->private_data; ++ ctx = file->private_data; + + mutex_lock(&ctx->uring_lock); + ret = __io_uring_register(ctx, opcode, arg, nr_args); + mutex_unlock(&ctx->uring_lock); + trace_io_uring_register(ctx, opcode, ctx->nr_user_files, ctx->nr_user_bufs, ret); + out_fput: +- fdput(f); ++ if (!use_registered_ring) ++ fput(file); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.6/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch b/queue-6.6/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch new file mode 100644 index 00000000000..0c636282519 --- /dev/null +++ b/queue-6.6/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch @@ -0,0 +1,41 @@ +From 00f295ad000e3f1fb9d2654494d3c66b5bcef829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:39 +0800 +Subject: jbd2: correct the printing of write_flags in jbd2_write_superblock() + +From: Zhang Yi + +[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ] + +The write_flags print in the trace of jbd2_write_superblock() is not +real, so move the modification before the trace. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 30dec2bd2ecc..e7aa47a02d4d 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1791,9 +1791,11 @@ static int jbd2_write_superblock(journal_t *journal, blk_opf_t write_flags) + return -EIO; + } + +- trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); ++ ++ trace_jbd2_write_superblock(journal, write_flags); ++ + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +-- +2.43.0 + diff --git a/queue-6.6/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch b/queue-6.6/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch new file mode 100644 index 00000000000..a7a8288d025 --- /dev/null +++ b/queue-6.6/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch @@ -0,0 +1,82 @@ +From d024dcb8774a3c0e4f28fe2276f936ff57776ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:25:44 +0800 +Subject: jbd2: fix soft lockup in journal_finish_inode_data_buffers() + +From: Ye Bin + +[ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ] + +There's issue when do io test: +WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] +CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xb0/0x100 + watchdog_timer_fn+0x254/0x3f8 + __hrtimer_run_queues+0x11c/0x380 + hrtimer_interrupt+0xfc/0x2f8 + arch_timer_handler_phys+0x38/0x58 + handle_percpu_devid_irq+0x90/0x248 + generic_handle_irq+0x3c/0x58 + __handle_domain_irq+0x68/0xc0 + gic_handle_irq+0x90/0x320 + el1_irq+0xcc/0x180 + queued_spin_lock_slowpath+0x1d8/0x320 + jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] + kjournald2+0xec/0x2f0 [jbd2] + kthread+0x134/0x138 + ret_from_fork+0x10/0x18 + +Analyzed informations from vmcore as follows: +(1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; +(2) Now is processing the 855th jbd2_inode; +(3) JBD2 task has TIF_NEED_RESCHED flag; +(4) There's no pags in address_space around the 855th jbd2_inode; +(5) There are some process is doing drop caches; +(6) Mounted with 'nodioread_nolock' option; +(7) 128 CPUs; + +According to informations from vmcore we know 'journal->j_list_lock' spin lock +competition is fierce. So journal_finish_inode_data_buffers() maybe process +slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). +However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, +will not call cond_resched(). So may lead to soft lockup. +journal_finish_inode_data_buffers + filemap_fdatawait_range_keep_errors + __filemap_fdatawait_range + while (index <= end) + nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); + if (!nr_pages) + break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() + for (i = 0; i < nr_pages; i++) + wait_on_page_writeback(page); + cond_resched(); + +To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 9bdb377a348f..5e122586e06e 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -270,6 +270,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, + if (!ret) + ret = err; + } ++ cond_resched(); + spin_lock(&journal->j_list_lock); + jinode->i_flags &= ~JI_COMMIT_RUNNING; + smp_mb(); +-- +2.43.0 + diff --git a/queue-6.6/jbd2-increase-the-journal-io-s-priority.patch b/queue-6.6/jbd2-increase-the-journal-io-s-priority.patch new file mode 100644 index 00000000000..aa8573e7848 --- /dev/null +++ b/queue-6.6/jbd2-increase-the-journal-io-s-priority.patch @@ -0,0 +1,160 @@ +From 1a364cd42d150cfc4f6647d0a0c29f55a652bcab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:40 +0800 +Subject: jbd2: increase the journal IO's priority + +From: Zhang Yi + +[ Upstream commit 6a3afb6ac6dfab158ebdd4b87941178f58c8939f ] + +Current jbd2 only add REQ_SYNC for descriptor block, metadata log +buffer, commit buffer and superblock buffer, the submitted IO could be +throttled by writeback throttle in block layer, that could lead to +priority inversion in some cases. The log IO looks like a kind of high +priority metadata IO, so it should not be throttled by WBT like QOS +policies in block layer, let's add REQ_SYNC | REQ_IDLE to exempt from +writeback throttle, and also add REQ_META together indicates it's a +metadata IO. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-2-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 9 +++++---- + fs/jbd2/journal.c | 20 +++++++++++--------- + include/linux/jbd2.h | 3 +++ + 3 files changed, 19 insertions(+), 13 deletions(-) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index 8d6f934c3d95..9bdb377a348f 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -119,7 +119,7 @@ static int journal_submit_commit_record(journal_t *journal, + struct commit_header *tmp; + struct buffer_head *bh; + struct timespec64 now; +- blk_opf_t write_flags = REQ_OP_WRITE | REQ_SYNC; ++ blk_opf_t write_flags = REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS; + + *cbh = NULL; + +@@ -395,8 +395,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + */ + jbd2_journal_update_sb_log_tail(journal, + journal->j_tail_sequence, +- journal->j_tail, +- REQ_SYNC); ++ journal->j_tail, 0); + mutex_unlock(&journal->j_checkpoint_mutex); + } else { + jbd2_debug(3, "superblock not updated\n"); +@@ -715,6 +714,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) + + for (i = 0; i < bufs; i++) { + struct buffer_head *bh = wbuf[i]; ++ + /* + * Compute checksum. + */ +@@ -727,7 +727,8 @@ void jbd2_journal_commit_transaction(journal_t *journal) + clear_buffer_dirty(bh); + set_buffer_uptodate(bh); + bh->b_end_io = journal_end_buffer_io_sync; +- submit_bh(REQ_OP_WRITE | REQ_SYNC, bh); ++ submit_bh(REQ_OP_WRITE | JBD2_JOURNAL_REQ_FLAGS, ++ bh); + } + cond_resched(); + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index e7aa47a02d4d..19c69229ac6e 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1100,8 +1100,7 @@ int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + * space and if we lose sb update during power failure we'd replay + * old transaction with possibly newly overwritten data. + */ +- ret = jbd2_journal_update_sb_log_tail(journal, tid, block, +- REQ_SYNC | REQ_FUA); ++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, REQ_FUA); + if (ret) + goto out; + +@@ -1768,8 +1767,7 @@ static int journal_reset(journal_t *journal) + */ + jbd2_journal_update_sb_log_tail(journal, + journal->j_tail_sequence, +- journal->j_tail, +- REQ_SYNC | REQ_FUA); ++ journal->j_tail, REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + return jbd2_journal_start_thread(journal); +@@ -1791,6 +1789,11 @@ static int jbd2_write_superblock(journal_t *journal, blk_opf_t write_flags) + return -EIO; + } + ++ /* ++ * Always set high priority flags to exempt from block layer's ++ * QOS policies, e.g. writeback throttle. ++ */ ++ write_flags |= JBD2_JOURNAL_REQ_FLAGS; + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); + +@@ -2045,7 +2048,7 @@ void jbd2_journal_update_sb_errno(journal_t *journal) + jbd2_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); + sb->s_errno = cpu_to_be32(errcode); + +- jbd2_write_superblock(journal, REQ_SYNC | REQ_FUA); ++ jbd2_write_superblock(journal, REQ_FUA); + } + EXPORT_SYMBOL(jbd2_journal_update_sb_errno); + +@@ -2166,8 +2169,7 @@ int jbd2_journal_destroy(journal_t *journal) + ++journal->j_transaction_sequence; + write_unlock(&journal->j_state_lock); + +- jbd2_mark_journal_empty(journal, +- REQ_SYNC | REQ_PREFLUSH | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_PREFLUSH | REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } else + err = -EIO; +@@ -2468,7 +2470,7 @@ int jbd2_journal_flush(journal_t *journal, unsigned int flags) + * the magic code for a fully-recovered superblock. Any future + * commits of data to the journal will restore the current + * s_start value. */ +- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_FUA); + + if (flags) + err = __jbd2_journal_erase(journal, flags); +@@ -2514,7 +2516,7 @@ int jbd2_journal_wipe(journal_t *journal, int write) + if (write) { + /* Lock to make assertions happy... */ + mutex_lock_io(&journal->j_checkpoint_mutex); +- jbd2_mark_journal_empty(journal, REQ_SYNC | REQ_FUA); ++ jbd2_mark_journal_empty(journal, REQ_FUA); + mutex_unlock(&journal->j_checkpoint_mutex); + } + +diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h +index 52772c826c86..0fc6c1f51262 100644 +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1374,6 +1374,9 @@ JBD2_FEATURE_INCOMPAT_FUNCS(csum2, CSUM_V2) + JBD2_FEATURE_INCOMPAT_FUNCS(csum3, CSUM_V3) + JBD2_FEATURE_INCOMPAT_FUNCS(fast_commit, FAST_COMMIT) + ++/* Journal high priority write IO operation flags */ ++#define JBD2_JOURNAL_REQ_FLAGS (REQ_META | REQ_SYNC | REQ_IDLE) ++ + /* + * Journal flag definitions + */ +-- +2.43.0 + diff --git a/queue-6.6/kselftest-alsa-fixed-a-print-formatting-warning.patch b/queue-6.6/kselftest-alsa-fixed-a-print-formatting-warning.patch new file mode 100644 index 00000000000..789d647b74f --- /dev/null +++ b/queue-6.6/kselftest-alsa-fixed-a-print-formatting-warning.patch @@ -0,0 +1,37 @@ +From ec7a2937c67d0c091248085b843077ab9a545fd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Dec 2023 13:30:19 +0530 +Subject: kselftest: alsa: fixed a print formatting warning + +From: Ghanshyam Agrawal + +[ Upstream commit 13d605e32e4cfdedcecdf3d98d21710ffe887708 ] + +A statement used %d print formatter where %s should have +been used. The same has been fixed in this commit. + +Signed-off-by: Ghanshyam Agrawal +Link: 5aaf9efffc57 ("kselftest: alsa: Add simplistic test for ALSA mixer controls kselftest") +Link: https://lore.kernel.org/r/20231217080019.1063476-1-ghanshyam1898@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/alsa/mixer-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c +index 21e482b23f50..23df154fcdd7 100644 +--- a/tools/testing/selftests/alsa/mixer-test.c ++++ b/tools/testing/selftests/alsa/mixer-test.c +@@ -138,7 +138,7 @@ static void find_controls(void) + err = snd_ctl_elem_info(card_data->handle, + ctl_data->info); + if (err < 0) { +- ksft_print_msg("%s getting info for %d\n", ++ ksft_print_msg("%s getting info for %s\n", + snd_strerror(err), + ctl_data->name); + } +-- +2.43.0 + diff --git a/queue-6.6/kunit-reset-suite-counter-right-before-running-tests.patch b/queue-6.6/kunit-reset-suite-counter-right-before-running-tests.patch new file mode 100644 index 00000000000..cee0dafd556 --- /dev/null +++ b/queue-6.6/kunit-reset-suite-counter-right-before-running-tests.patch @@ -0,0 +1,73 @@ +From 5a8ee692f63e9c9f057b19fc0f31b09d34f56560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 22:57:00 +0200 +Subject: kunit: Reset suite counter right before running tests + +From: Michal Wajdeczko + +[ Upstream commit 2e3c94aed51eabbe9c1c0ee515371ea5441c2fa7 ] + +Today we reset the suite counter as part of the suite cleanup, +called from the module exit callback, but it might not work that +well as one can try to collect results without unloading a previous +test (either unintentionally or due to dependencies). + +For easy reproduction try to load the kunit-test.ko and then +collect and parse results from the kunit-example-test.ko load. +Parser will complain about mismatch of expected test number: + +[ ] KTAP version 1 +[ ] 1..1 +[ ] # example: initializing suite +[ ] KTAP version 1 +[ ] # Subtest: example +.. +[ ] # example: pass:5 fail:0 skip:4 total:9 +[ ] # Totals: pass:6 fail:0 skip:6 total:12 +[ ] ok 7 example + +[ ] [ERROR] Test: example: Expected test number 1 but found 7 +[ ] ===================== [PASSED] example ===================== +[ ] ============================================================ +[ ] Testing complete. Ran 12 tests: passed: 6, skipped: 6, errors: 1 + +Since we are now printing suite test plan on every module load, +right before running suite tests, we should make sure that suite +counter will also start from 1. Easiest solution seems to be move +counter reset to the __kunit_test_suites_init() function. + +Signed-off-by: Michal Wajdeczko +Cc: David Gow +Cc: Rae Moar +Reviewed-by: David Gow +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/kunit/test.c b/lib/kunit/test.c +index e451cfe6143e..7452d1a2acd9 100644 +--- a/lib/kunit/test.c ++++ b/lib/kunit/test.c +@@ -740,6 +740,8 @@ int __kunit_test_suites_init(struct kunit_suite * const * const suites, int num_ + return 0; + } + ++ kunit_suite_counter = 1; ++ + static_branch_inc(&kunit_running); + + for (i = 0; i < num_suites; i++) { +@@ -766,8 +768,6 @@ void __kunit_test_suites_exit(struct kunit_suite **suites, int num_suites) + + for (i = 0; i < num_suites; i++) + kunit_exit_suite(suites[i]); +- +- kunit_suite_counter = 1; + } + EXPORT_SYMBOL_GPL(__kunit_test_suites_exit); + +-- +2.43.0 + diff --git a/queue-6.6/kunit-warn-if-tests-are-slow.patch b/queue-6.6/kunit-warn-if-tests-are-slow.patch new file mode 100644 index 00000000000..945f87be872 --- /dev/null +++ b/queue-6.6/kunit-warn-if-tests-are-slow.patch @@ -0,0 +1,94 @@ +From b3ba2d59e4b6bf7139700b0a5892dcc391a24dbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Oct 2023 10:59:31 +0200 +Subject: kunit: Warn if tests are slow + +From: Maxime Ripard + +[ Upstream commit f8f2847f739dc899d0e563eac01299dadefa64ff ] + +Kunit recently gained support to setup attributes, the first one being +the speed of a given test, then allowing to filter out slow tests. + +A slow test is defined in the documentation as taking more than one +second. There's an another speed attribute called "super slow" but whose +definition is less clear. + +Add support to the test runner to check the test execution time, and +report tests that should be marked as slow but aren't. + +Signed-off-by: Maxime Ripard +Reviewed-by: David Gow +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/test.c | 38 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/lib/kunit/test.c b/lib/kunit/test.c +index 421f13981412..e451cfe6143e 100644 +--- a/lib/kunit/test.c ++++ b/lib/kunit/test.c +@@ -372,6 +372,36 @@ void kunit_init_test(struct kunit *test, const char *name, char *log) + } + EXPORT_SYMBOL_GPL(kunit_init_test); + ++/* Only warn when a test takes more than twice the threshold */ ++#define KUNIT_SPEED_WARNING_MULTIPLIER 2 ++ ++/* Slow tests are defined as taking more than 1s */ ++#define KUNIT_SPEED_SLOW_THRESHOLD_S 1 ++ ++#define KUNIT_SPEED_SLOW_WARNING_THRESHOLD_S \ ++ (KUNIT_SPEED_WARNING_MULTIPLIER * KUNIT_SPEED_SLOW_THRESHOLD_S) ++ ++#define s_to_timespec64(s) ns_to_timespec64((s) * NSEC_PER_SEC) ++ ++static void kunit_run_case_check_speed(struct kunit *test, ++ struct kunit_case *test_case, ++ struct timespec64 duration) ++{ ++ struct timespec64 slow_thr = ++ s_to_timespec64(KUNIT_SPEED_SLOW_WARNING_THRESHOLD_S); ++ enum kunit_speed speed = test_case->attr.speed; ++ ++ if (timespec64_compare(&duration, &slow_thr) < 0) ++ return; ++ ++ if (speed == KUNIT_SPEED_VERY_SLOW || speed == KUNIT_SPEED_SLOW) ++ return; ++ ++ kunit_warn(test, ++ "Test should be marked slow (runtime: %lld.%09lds)", ++ duration.tv_sec, duration.tv_nsec); ++} ++ + /* + * Initializes and runs test case. Does not clean up or do post validations. + */ +@@ -379,6 +409,8 @@ static void kunit_run_case_internal(struct kunit *test, + struct kunit_suite *suite, + struct kunit_case *test_case) + { ++ struct timespec64 start, end; ++ + if (suite->init) { + int ret; + +@@ -390,7 +422,13 @@ static void kunit_run_case_internal(struct kunit *test, + } + } + ++ ktime_get_ts64(&start); ++ + test_case->run_case(test); ++ ++ ktime_get_ts64(&end); ++ ++ kunit_run_case_check_speed(test, test_case, timespec64_sub(end, start)); + } + + static void kunit_case_internal_cleanup(struct kunit *test) +-- +2.43.0 + diff --git a/queue-6.6/loongarch-apply-dynamic-relocations-for-lld.patch b/queue-6.6/loongarch-apply-dynamic-relocations-for-lld.patch new file mode 100644 index 00000000000..609af278c72 --- /dev/null +++ b/queue-6.6/loongarch-apply-dynamic-relocations-for-lld.patch @@ -0,0 +1,61 @@ +From 776ee1df593679ce3cb70ee9db7b4e4d85ba4f92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 15:49:15 +0800 +Subject: LoongArch: Apply dynamic relocations for LLD + +From: WANG Rui + +[ Upstream commit eea673e9d5ea994c60b550ffb684413d3759b3f4 ] + +For the following assembly code: + + .text + .global func + func: + nop + + .data + var: + .dword func + +When linked with `-pie`, GNU LD populates the `var` variable with the +pre-relocated value of `func`. However, LLVM LLD does not exhibit the +same behavior. This issue also arises with the `kernel_entry` in arch/ +loongarch/kernel/head.S: + + _head: + .word MZ_MAGIC /* "MZ", MS-DOS header */ + .org 0x8 + .dword kernel_entry /* Kernel entry point */ + +The correct kernel entry from the MS-DOS header is crucial for jumping +to vmlinux from zboot. This necessity is why the compressed relocatable +kernel compiled by Clang encounters difficulties in booting. + +To address this problem, it is proposed to apply dynamic relocations to +place with `--apply-dynamic-relocs`. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1962 +Signed-off-by: WANG Rui +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index 96747bfec1a1..d423fba7c406 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -80,7 +80,7 @@ endif + + ifeq ($(CONFIG_RELOCATABLE),y) + KBUILD_CFLAGS_KERNEL += -fPIE +-LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext ++LDFLAGS_vmlinux += -static -pie --no-dynamic-linker -z notext $(call ld-option, --apply-dynamic-relocs) + endif + + cflags-y += $(call cc-option, -mno-check-zero-division) +-- +2.43.0 + diff --git a/queue-6.6/loongarch-preserve-syscall-nr-across-execve.patch b/queue-6.6/loongarch-preserve-syscall-nr-across-execve.patch new file mode 100644 index 00000000000..17680fcff3c --- /dev/null +++ b/queue-6.6/loongarch-preserve-syscall-nr-across-execve.patch @@ -0,0 +1,50 @@ +From d31e47ab174e48ec43e1b8b5f5abf0f105e95ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 15:49:15 +0800 +Subject: LoongArch: Preserve syscall nr across execve() + +From: Hengqi Chen + +[ Upstream commit d6c5f06e46a836e6a70c7cfd95bb38a67d9252ec ] + +Currently, we store syscall nr in pt_regs::regs[11] and syscall execve() +accidentally overrides it during its execution: + + sys_execve() + -> do_execve() + -> do_execveat_common() + -> bprm_execve() + -> exec_binprm() + -> search_binary_handler() + -> load_elf_binary() + -> ELF_PLAT_INIT() + +ELF_PLAT_INIT() reset regs[11] to 0, so in syscall_exit_to_user_mode() +we later get a wrong syscall nr. This breaks tools like execsnoop since +it relies on execve() tracepoints. + +Skip pt_regs::regs[11] reset in ELF_PLAT_INIT() to fix the issue. + +Signed-off-by: Hengqi Chen +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/elf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/elf.h b/arch/loongarch/include/asm/elf.h +index b9a4ab54285c..9b16a3b8e706 100644 +--- a/arch/loongarch/include/asm/elf.h ++++ b/arch/loongarch/include/asm/elf.h +@@ -293,7 +293,7 @@ extern const char *__elf_platform; + #define ELF_PLAT_INIT(_r, load_addr) do { \ + _r->regs[1] = _r->regs[2] = _r->regs[3] = _r->regs[4] = 0; \ + _r->regs[5] = _r->regs[6] = _r->regs[7] = _r->regs[8] = 0; \ +- _r->regs[9] = _r->regs[10] = _r->regs[11] = _r->regs[12] = 0; \ ++ _r->regs[9] = _r->regs[10] /* syscall n */ = _r->regs[12] = 0; \ + _r->regs[13] = _r->regs[14] = _r->regs[15] = _r->regs[16] = 0; \ + _r->regs[17] = _r->regs[18] = _r->regs[19] = _r->regs[20] = 0; \ + _r->regs[21] = _r->regs[22] = _r->regs[23] = _r->regs[24] = 0; \ +-- +2.43.0 + diff --git a/queue-6.6/loongarch-set-unwind-stack-type-to-unknown-rather-th.patch b/queue-6.6/loongarch-set-unwind-stack-type-to-unknown-rather-th.patch new file mode 100644 index 00000000000..4d1650deafa --- /dev/null +++ b/queue-6.6/loongarch-set-unwind-stack-type-to-unknown-rather-th.patch @@ -0,0 +1,71 @@ +From 57515776f3f0c2c9f4f7c34cc88d072ea44f4fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 15:49:15 +0800 +Subject: LoongArch: Set unwind stack type to unknown rather than set error + flag + +From: Jinyang He + +[ Upstream commit 97ceddbc9404a7d1e2c4049435bff29427d762cc ] + +During unwinding, unwind_done() is used as an end condition. Normally it +unwind to the user stack and then set the stack type to unknown, which +is a normal exit. When something unexpected happens in unwind process +and we cannot unwind anymore, we should set the error flag, and also set +the stack type to unknown to indicate that the unwind process can not +continue. The error flag emphasizes that the unwind process produce an +unexpected error. There is no unexpected things when we unwind the PT_REGS +in the top of IRQ stack and find out that is an user mode PT_REGS. Thus, +we should not set error flag and just set stack type to unknown. + +Reported-by: Hengqi Chen +Acked-by: Hengqi Chen +Signed-off-by: Jinyang He +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/stacktrace.c | 2 +- + arch/loongarch/kernel/unwind.c | 1 - + arch/loongarch/kernel/unwind_prologue.c | 2 +- + 3 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/loongarch/kernel/stacktrace.c b/arch/loongarch/kernel/stacktrace.c +index 92270f14db94..f623feb2129f 100644 +--- a/arch/loongarch/kernel/stacktrace.c ++++ b/arch/loongarch/kernel/stacktrace.c +@@ -32,7 +32,7 @@ void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, + } + + for (unwind_start(&state, task, regs); +- !unwind_done(&state) && !unwind_error(&state); unwind_next_frame(&state)) { ++ !unwind_done(&state); unwind_next_frame(&state)) { + addr = unwind_get_return_address(&state); + if (!addr || !consume_entry(cookie, addr)) + break; +diff --git a/arch/loongarch/kernel/unwind.c b/arch/loongarch/kernel/unwind.c +index ba324ba76fa1..a463d6961344 100644 +--- a/arch/loongarch/kernel/unwind.c ++++ b/arch/loongarch/kernel/unwind.c +@@ -28,6 +28,5 @@ bool default_next_frame(struct unwind_state *state) + + } while (!get_stack_info(state->sp, state->task, info)); + +- state->error = true; + return false; + } +diff --git a/arch/loongarch/kernel/unwind_prologue.c b/arch/loongarch/kernel/unwind_prologue.c +index 55afc27320e1..929ae240280a 100644 +--- a/arch/loongarch/kernel/unwind_prologue.c ++++ b/arch/loongarch/kernel/unwind_prologue.c +@@ -227,7 +227,7 @@ static bool next_frame(struct unwind_state *state) + } while (!get_stack_info(state->sp, state->task, info)); + + out: +- state->error = true; ++ state->stack_info.type = STACK_TYPE_UNKNOWN; + return false; + } + +-- +2.43.0 + diff --git a/queue-6.6/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch b/queue-6.6/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch new file mode 100644 index 00000000000..dc3b6f6c38c --- /dev/null +++ b/queue-6.6/mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch @@ -0,0 +1,57 @@ +From 8590912ec4d2ebadfa6b1484093ae5a3056e7f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:33:54 +0800 +Subject: MIPS: dts: loongson: drop incorrect dwmac fallback compatible + +From: Krzysztof Kozlowski + +[ Upstream commit 4907a3f54b12b8209864572a312cf967befcae80 ] + +Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, +so checking for some other compatible does not make sense. It cannot be +bound to unsupported platform. + +Drop useless, incorrect (space in between) and undocumented compatible. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Yanteng Si +Reviewed-by: Conor Dooley +Acked-by: Jiaxun Yang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +-- + arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +index f878f47e4501..ee3e2153dd13 100644 +--- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi ++++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi +@@ -130,8 +130,7 @@ gmac@3,0 { + compatible = "pci0014,7a03.0", + "pci0014,7a03", + "pciclass0c0320", +- "pciclass0c03", +- "loongson, pci-gmac"; ++ "pciclass0c03"; + + reg = <0x1800 0x0 0x0 0x0 0x0>; + interrupts = <12 IRQ_TYPE_LEVEL_LOW>, +diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +index 7c69e8245c2f..cce9428afc41 100644 +--- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi ++++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi +@@ -193,8 +193,7 @@ gmac@3,0 { + compatible = "pci0014,7a03.0", + "pci0014,7a03", + "pciclass020000", +- "pciclass0200", +- "loongson, pci-gmac"; ++ "pciclass0200"; + + reg = <0x1800 0x0 0x0 0x0 0x0>; + interrupts = <12 IRQ_TYPE_LEVEL_HIGH>, +-- +2.43.0 + diff --git a/queue-6.6/mips-smp-call-rcutree_report_cpu_starting-earlier.patch b/queue-6.6/mips-smp-call-rcutree_report_cpu_starting-earlier.patch new file mode 100644 index 00000000000..a608f8b5345 --- /dev/null +++ b/queue-6.6/mips-smp-call-rcutree_report_cpu_starting-earlier.patch @@ -0,0 +1,77 @@ +From eb9394f897f608aaae953c27d429cb85732aae8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 13:12:07 +0100 +Subject: mips/smp: Call rcutree_report_cpu_starting() earlier + +From: Stefan Wiehler + +[ Upstream commit 55702ec9603ebeffb15e6f7b113623fe1d8872f4 ] + +rcutree_report_cpu_starting() must be called before +clockevents_register_device() to avoid the following lockdep splat triggered by +calling list_add() when CONFIG_PROVE_RCU_LIST=y: + + WARNING: suspicious RCU usage + ... + ----------------------------- + kernel/locking/lockdep.c:3680 RCU-list traversed in non-reader section!! + + other info that might help us debug this: + + RCU used illegally from offline CPU! + rcu_scheduler_active = 1, debug_locks = 1 + no locks held by swapper/1/0. + ... + Call Trace: + [] show_stack+0x64/0x158 + [] dump_stack_lvl+0x90/0xc4 + [] __lock_acquire+0x1404/0x2940 + [] lock_acquire+0x14c/0x448 + [] _raw_spin_lock_irqsave+0x50/0x88 + [] clockevents_register_device+0x60/0x1e8 + [] r4k_clockevent_init+0x220/0x3a0 + [] start_secondary+0x50/0x3b8 + +raw_smp_processor_id() is required in order to avoid calling into lockdep +before RCU has declared the CPU to be watched for readers. + +See also commit 29368e093921 ("x86/smpboot: Move rcu_cpu_starting() earlier"), +commit de5d9dae150c ("s390/smp: move rcu_cpu_starting() earlier") and commit +99f070b62322 ("powerpc/smp: Call rcu_cpu_starting() earlier"). + +Signed-off-by: Stefan Wiehler +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 8fbef537fb88..82e2e051b416 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -351,10 +351,11 @@ early_initcall(mips_smp_ipi_init); + */ + asmlinkage void start_secondary(void) + { +- unsigned int cpu; ++ unsigned int cpu = raw_smp_processor_id(); + + cpu_probe(); + per_cpu_trap_init(false); ++ rcutree_report_cpu_starting(cpu); + mips_clockevent_init(); + mp_ops->init_secondary(); + cpu_report(); +@@ -366,7 +367,6 @@ asmlinkage void start_secondary(void) + */ + + calibrate_delay(); +- cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + + set_cpu_sibling_map(cpu); +-- +2.43.0 + diff --git a/queue-6.6/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch b/queue-6.6/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch new file mode 100644 index 00000000000..e115a98bf82 --- /dev/null +++ b/queue-6.6/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch @@ -0,0 +1,35 @@ +From ce06c3012b3a0e09bc72196f924456019b5d65aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:23:39 +0800 +Subject: mptcp: fix uninit-value in mptcp_incoming_options + +From: Edward Adam Davis + +[ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ] + +Added initialization use_ack to mptcp_parse_option(). + +Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index cd15ec73073e..c53914012d01 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -108,6 +108,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, + mp_opt->suboptions |= OPTION_MPTCP_DSS; + mp_opt->use_map = 1; + mp_opt->mpc_map = 1; ++ mp_opt->use_ack = 0; + mp_opt->data_len = get_unaligned_be16(ptr); + ptr += 2; + } +-- +2.43.0 + diff --git a/queue-6.6/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch b/queue-6.6/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch new file mode 100644 index 00000000000..287cc6c0508 --- /dev/null +++ b/queue-6.6/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch @@ -0,0 +1,64 @@ +From 2e577281684eeda11c18cf2057b1a6691c0656de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 03:38:33 +0000 +Subject: neighbour: Don't let neigh_forced_gc() disable preemption for long + +From: Judy Hsiao + +[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ] + +We are seeing cases where neigh_cleanup_and_release() is called by +neigh_forced_gc() many times in a row with preemption turned off. +When running on a low powered CPU at a low CPU frequency, this has +been measured to keep preemption off for ~10 ms. That's not great on a +system with HZ=1000 which expects tasks to be able to schedule in +with ~1ms latency. + +Suggested-by: Douglas Anderson +Signed-off-by: Judy Hsiao +Reviewed-by: David Ahern +Reviewed-by: Eric Dumazet +Reviewed-by: Douglas Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index df81c1f0a570..552719c3bbc3 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -253,9 +253,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) + { + int max_clean = atomic_read(&tbl->gc_entries) - + READ_ONCE(tbl->gc_thresh2); ++ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC; + unsigned long tref = jiffies - 5 * HZ; + struct neighbour *n, *tmp; + int shrunk = 0; ++ int loop = 0; + + NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs); + +@@ -278,11 +280,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) + shrunk++; + if (shrunk >= max_clean) + break; ++ if (++loop == 16) { ++ if (ktime_get_ns() > tmax) ++ goto unlock; ++ loop = 0; ++ } + } + } + + WRITE_ONCE(tbl->last_flush, jiffies); +- ++unlock: + write_unlock_bh(&tbl->lock); + + return shrunk; +-- +2.43.0 + diff --git a/queue-6.6/net-qrtr-ns-return-0-if-server-port-is-not-present.patch b/queue-6.6/net-qrtr-ns-return-0-if-server-port-is-not-present.patch new file mode 100644 index 00000000000..38c80d550ff --- /dev/null +++ b/queue-6.6/net-qrtr-ns-return-0-if-server-port-is-not-present.patch @@ -0,0 +1,45 @@ +From ef08312fcfd42c788e2d2fb5bcb49264c48abba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 15:36:51 +0530 +Subject: net: qrtr: ns: Return 0 if server port is not present + +From: Sarannya S + +[ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ] + +When a 'DEL_CLIENT' message is received from the remote, the corresponding +server port gets deleted. A DEL_SERVER message is then announced for this +server. As part of handling the subsequent DEL_SERVER message, the name- +server attempts to delete the server port which results in a '-ENOENT' error. +The return value from server_del() is then propagated back to qrtr_ns_worker, +causing excessive error prints. +To address this, return 0 from control_cmd_del_server() without checking the +return value of server_del(), since the above scenario is not an error case +and hence server_del() doesn't have any other error return value. + +Signed-off-by: Sarannya Sasikumar +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index b1db0b519179..abb0c70ffc8b 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -512,7 +512,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from, + if (!node) + return -ENOENT; + +- return server_del(node, port, true); ++ server_del(node, port, true); ++ ++ return 0; + } + + static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, +-- +2.43.0 + diff --git a/queue-6.6/net-tg3-fix-race-condition-in-tg3_reset_task.patch b/queue-6.6/net-tg3-fix-race-condition-in-tg3_reset_task.patch new file mode 100644 index 00000000000..e990f183043 --- /dev/null +++ b/queue-6.6/net-tg3-fix-race-condition-in-tg3_reset_task.patch @@ -0,0 +1,94 @@ +From 49cb387ea9725e86c784ad5960c5526497f2e527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 18:19:11 -0600 +Subject: net/tg3: fix race condition in tg3_reset_task() + +From: Thinh Tran + +[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] + +When an EEH error is encountered by a PCI adapter, the EEH driver +modifies the PCI channel's state as shown below: + + enum { + /* I/O channel is in normal state */ + pci_channel_io_normal = (__force pci_channel_state_t) 1, + + /* I/O to channel is blocked */ + pci_channel_io_frozen = (__force pci_channel_state_t) 2, + + /* PCI card is dead */ + pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, + }; + +If the same EEH error then causes the tg3 driver's transmit timeout +logic to execute, the tg3_tx_timeout() function schedules a reset +task via tg3_reset_task_schedule(), which may cause a race condition +between the tg3 and EEH driver as both attempt to recover the HW via +a reset action. + +EEH driver gets error event +--> eeh_set_channel_state() + and set device to one of + error state above scheduler: tg3_reset_task() get + returned error from tg3_init_hw() + --> dev_close() shuts down the interface +tg3_io_slot_reset() and +tg3_io_resume() fail to +reset/resume the device + +To resolve this issue, we avoid the race condition by checking the PCI +channel state in the tg3_reset_task() function and skip the tg3 driver +initiated reset when the PCI channel is not in the normal state. (The +driver has no access to tg3 device registers at this point and cannot +even complete the reset task successfully without external assistance.) +We'll leave the reset procedure to be managed by the EEH driver which +calls the tg3_io_error_detected(), tg3_io_slot_reset() and +tg3_io_resume() functions as appropriate. + +Adding the same checking in tg3_dump_state() to avoid dumping all +device registers when the PCI channel is not in the normal state. + +Signed-off-by: Thinh Tran +Tested-by: Venkata Sai Duggi +Reviewed-by: David Christensen +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index b7acd994a393..f1c8ff5b63ac 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6439,6 +6439,14 @@ static void tg3_dump_state(struct tg3 *tp) + int i; + u32 *regs; + ++ /* If it is a PCI error, all registers will be 0xffff, ++ * we don't dump them out, just report the error and return ++ */ ++ if (tp->pdev->error_state != pci_channel_io_normal) { ++ netdev_err(tp->dev, "PCI channel ERROR!\n"); ++ return; ++ } ++ + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); + if (!regs) + return; +@@ -11179,7 +11187,8 @@ static void tg3_reset_task(struct work_struct *work) + rtnl_lock(); + tg3_full_lock(tp, 0); + +- if (tp->pcierr_recovery || !netif_running(tp->dev)) { ++ if (tp->pcierr_recovery || !netif_running(tp->dev) || ++ tp->pdev->error_state != pci_channel_io_normal) { + tg3_flag_clear(tp, RESET_TASK_PENDING); + tg3_full_unlock(tp); + rtnl_unlock(); +-- +2.43.0 + diff --git a/queue-6.6/nfc-do-not-send-datagram-if-socket-state-isn-t-llcp_.patch b/queue-6.6/nfc-do-not-send-datagram-if-socket-state-isn-t-llcp_.patch new file mode 100644 index 00000000000..609950a8449 --- /dev/null +++ b/queue-6.6/nfc-do-not-send-datagram-if-socket-state-isn-t-llcp_.patch @@ -0,0 +1,42 @@ +From df735c3ec4ac9ba57b66262c32d9af7056149b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 23:19:44 +0530 +Subject: nfc: Do not send datagram if socket state isn't LLCP_BOUND + +From: Siddh Raman Pant + +[ Upstream commit 6ec0d7527c4287369b52df3bcefd21a0c4fb2b7c ] + +As we know we cannot send the datagram (state can be set to LLCP_CLOSED +by nfc_llcp_socket_release()), there is no need to proceed further. + +Thus, bail out early from llcp_sock_sendmsg(). + +Signed-off-by: Siddh Raman Pant +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Suman Ghosh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_sock.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index 645677f84dba..819157bbb5a2 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, + } + + if (sk->sk_type == SOCK_DGRAM) { ++ if (sk->sk_state != LLCP_BOUND) { ++ release_sock(sk); ++ return -ENOTCONN; ++ } ++ + DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, + msg->msg_name); + +-- +2.43.0 + diff --git a/queue-6.6/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch b/queue-6.6/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch new file mode 100644 index 00000000000..cae40f39422 --- /dev/null +++ b/queue-6.6/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch @@ -0,0 +1,38 @@ +From 95bff34b376448297454fb660998df8b6173c9f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 11:08:52 +1000 +Subject: nouveau/tu102: flush all pdbs on vmm flush + +From: Dave Airlie + +[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ] + +This is a hack around a bug exposed with the GSP code, I'm not sure +what is happening exactly, but it appears some of our flushes don't +result in proper tlb invalidation for out BAR2 and we get a BAR2 +fault from GSP and it all dies. + +Signed-off-by: Dave Airlie +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +index 6cb5eefa45e9..5a08458fe1b7 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +@@ -31,7 +31,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) + + type |= 0x00000001; /* PAGE_ALL */ + if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR])) +- type |= 0x00000004; /* HUB_ONLY */ ++ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */ + + mutex_lock(&vmm->mmu->mutex); + +-- +2.43.0 + diff --git a/queue-6.6/nvme-core-check-for-too-small-lba-shift.patch b/queue-6.6/nvme-core-check-for-too-small-lba-shift.patch new file mode 100644 index 00000000000..8360fe62eb4 --- /dev/null +++ b/queue-6.6/nvme-core-check-for-too-small-lba-shift.patch @@ -0,0 +1,42 @@ +From c4c7fedf26123e11494fe5cfdf698fc8ade45e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 09:36:04 -0800 +Subject: nvme-core: check for too small lba shift + +From: Keith Busch + +[ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ] + +The block layer doesn't support logical block sizes smaller than 512 +bytes. The nvme spec doesn't support that small either, but the driver +isn't checking to make sure the device responded with usable data. +Failing to catch this will result in a kernel bug, either from a +division by zero when stacking, or a zero length bio. + +Reviewed-by: Jens Axboe +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 212991308bbe..ae234f34ac9b 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1893,9 +1893,10 @@ static void nvme_update_disk_info(struct gendisk *disk, + + /* + * The block layer can't support LBA sizes larger than the page size +- * yet, so catch this early and don't allow block I/O. ++ * or smaller than a sector size yet, so catch this early and don't ++ * allow block I/O. + */ +- if (ns->lba_shift > PAGE_SHIFT) { ++ if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { + capacity = 0; + bs = (1 << 9); + } +-- +2.43.0 + diff --git a/queue-6.6/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch b/queue-6.6/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch new file mode 100644 index 00000000000..27307c03350 --- /dev/null +++ b/queue-6.6/nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch @@ -0,0 +1,50 @@ +From 1870992ead3ec33e2bc842b3d29c8cd2f898689d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 15:07:41 +0100 +Subject: nvme-core: fix a memory leak in nvme_ns_info_from_identify() + +From: Maurizio Lombardi + +[ Upstream commit e3139cef8257fcab1725441e2fd5fd0ccb5481b1 ] + +In case of error, free the nvme_id_ns structure that was allocated +by nvme_identify_ns(). + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Reviewed-by: Kanchan Joshi +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b32e3cff37b1..212991308bbe 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1479,7 +1479,8 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, + if (id->ncap == 0) { + /* namespace not allocated or attached */ + info->is_removed = true; +- return -ENODEV; ++ ret = -ENODEV; ++ goto error; + } + + info->anagrpid = id->anagrpid; +@@ -1497,8 +1498,10 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, + !memchr_inv(ids->nguid, 0, sizeof(ids->nguid))) + memcpy(ids->nguid, id->nguid, sizeof(ids->nguid)); + } ++ ++error: + kfree(id); +- return 0; ++ return ret; + } + + static int nvme_ns_info_from_id_cs_indep(struct nvme_ctrl *ctrl, +-- +2.43.0 + diff --git a/queue-6.6/nvme-ensure-reset-state-check-ordering.patch b/queue-6.6/nvme-ensure-reset-state-check-ordering.patch new file mode 100644 index 00000000000..297f82117a6 --- /dev/null +++ b/queue-6.6/nvme-ensure-reset-state-check-ordering.patch @@ -0,0 +1,426 @@ +From 1842c2796919ae8a47d84a5aa1918e1487f32db6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Oct 2023 10:58:12 -0700 +Subject: nvme: ensure reset state check ordering + +From: Keith Busch + +[ Upstream commit e6e7f7ac03e40795346f1b2994a05f507ad8d345 ] + +A different CPU may be setting the ctrl->state value, so ensure proper +barriers to prevent optimizing to a stale state. Normally it isn't a +problem to observe the wrong state as it is merely advisory to take a +quicker path during initialization and error recovery, but seeing an old +state can report unexpected ENETRESET errors when a reset request was in +fact successful. + +Reported-by: Minh Hoang +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Hannes Reinecke +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 42 +++++++++++++++++++++------------------- + drivers/nvme/host/fc.c | 6 +++--- + drivers/nvme/host/pci.c | 14 +++++++------- + drivers/nvme/host/rdma.c | 23 +++++++++++++--------- + drivers/nvme/host/tcp.c | 27 ++++++++++++++++---------- + 5 files changed, 63 insertions(+), 49 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index ae234f34ac9b..c38e234723ec 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -131,7 +131,7 @@ void nvme_queue_scan(struct nvme_ctrl *ctrl) + /* + * Only new queue scan work when admin and IO queues are both alive + */ +- if (ctrl->state == NVME_CTRL_LIVE && ctrl->tagset) ++ if (nvme_ctrl_state(ctrl) == NVME_CTRL_LIVE && ctrl->tagset) + queue_work(nvme_wq, &ctrl->scan_work); + } + +@@ -143,7 +143,7 @@ void nvme_queue_scan(struct nvme_ctrl *ctrl) + */ + int nvme_try_sched_reset(struct nvme_ctrl *ctrl) + { +- if (ctrl->state != NVME_CTRL_RESETTING) ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_RESETTING) + return -EBUSY; + if (!queue_work(nvme_reset_wq, &ctrl->reset_work)) + return -EBUSY; +@@ -156,7 +156,7 @@ static void nvme_failfast_work(struct work_struct *work) + struct nvme_ctrl *ctrl = container_of(to_delayed_work(work), + struct nvme_ctrl, failfast_work); + +- if (ctrl->state != NVME_CTRL_CONNECTING) ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_CONNECTING) + return; + + set_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags); +@@ -200,7 +200,7 @@ int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl) + ret = nvme_reset_ctrl(ctrl); + if (!ret) { + flush_work(&ctrl->reset_work); +- if (ctrl->state != NVME_CTRL_LIVE) ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_LIVE) + ret = -ENETRESET; + } + +@@ -499,7 +499,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + + spin_lock_irqsave(&ctrl->lock, flags); + +- old_state = ctrl->state; ++ old_state = nvme_ctrl_state(ctrl); + switch (new_state) { + case NVME_CTRL_LIVE: + switch (old_state) { +@@ -567,7 +567,7 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + } + + if (changed) { +- ctrl->state = new_state; ++ WRITE_ONCE(ctrl->state, new_state); + wake_up_all(&ctrl->state_wq); + } + +@@ -575,11 +575,11 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, + if (!changed) + return false; + +- if (ctrl->state == NVME_CTRL_LIVE) { ++ if (new_state == NVME_CTRL_LIVE) { + if (old_state == NVME_CTRL_CONNECTING) + nvme_stop_failfast_work(ctrl); + nvme_kick_requeue_lists(ctrl); +- } else if (ctrl->state == NVME_CTRL_CONNECTING && ++ } else if (new_state == NVME_CTRL_CONNECTING && + old_state == NVME_CTRL_RESETTING) { + nvme_start_failfast_work(ctrl); + } +@@ -592,7 +592,7 @@ EXPORT_SYMBOL_GPL(nvme_change_ctrl_state); + */ + static bool nvme_state_terminal(struct nvme_ctrl *ctrl) + { +- switch (ctrl->state) { ++ switch (nvme_ctrl_state(ctrl)) { + case NVME_CTRL_NEW: + case NVME_CTRL_LIVE: + case NVME_CTRL_RESETTING: +@@ -617,7 +617,7 @@ bool nvme_wait_reset(struct nvme_ctrl *ctrl) + wait_event(ctrl->state_wq, + nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING) || + nvme_state_terminal(ctrl)); +- return ctrl->state == NVME_CTRL_RESETTING; ++ return nvme_ctrl_state(ctrl) == NVME_CTRL_RESETTING; + } + EXPORT_SYMBOL_GPL(nvme_wait_reset); + +@@ -704,9 +704,11 @@ EXPORT_SYMBOL_GPL(nvme_init_request); + blk_status_t nvme_fail_nonready_command(struct nvme_ctrl *ctrl, + struct request *rq) + { +- if (ctrl->state != NVME_CTRL_DELETING_NOIO && +- ctrl->state != NVME_CTRL_DELETING && +- ctrl->state != NVME_CTRL_DEAD && ++ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); ++ ++ if (state != NVME_CTRL_DELETING_NOIO && ++ state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DEAD && + !test_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags) && + !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH)) + return BLK_STS_RESOURCE; +@@ -736,7 +738,7 @@ bool __nvme_check_ready(struct nvme_ctrl *ctrl, struct request *rq, + * command, which is require to set the queue live in the + * appropinquate states. + */ +- switch (ctrl->state) { ++ switch (nvme_ctrl_state(ctrl)) { + case NVME_CTRL_CONNECTING: + if (blk_rq_is_passthrough(rq) && nvme_is_fabrics(req->cmd) && + (req->cmd->fabrics.fctype == nvme_fabrics_type_connect || +@@ -2542,7 +2544,7 @@ static void nvme_set_latency_tolerance(struct device *dev, s32 val) + + if (ctrl->ps_max_latency_us != latency) { + ctrl->ps_max_latency_us = latency; +- if (ctrl->state == NVME_CTRL_LIVE) ++ if (nvme_ctrl_state(ctrl) == NVME_CTRL_LIVE) + nvme_configure_apst(ctrl); + } + } +@@ -3228,7 +3230,7 @@ static int nvme_dev_open(struct inode *inode, struct file *file) + struct nvme_ctrl *ctrl = + container_of(inode->i_cdev, struct nvme_ctrl, cdev); + +- switch (ctrl->state) { ++ switch (nvme_ctrl_state(ctrl)) { + case NVME_CTRL_LIVE: + break; + default: +@@ -3914,7 +3916,7 @@ static void nvme_scan_work(struct work_struct *work) + int ret; + + /* No tagset on a live ctrl means IO queues could not created */ +- if (ctrl->state != NVME_CTRL_LIVE || !ctrl->tagset) ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_LIVE || !ctrl->tagset) + return; + + /* +@@ -3984,7 +3986,7 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl) + * removing the namespaces' disks; fail all the queues now to avoid + * potentially having to clean up the failed sync later. + */ +- if (ctrl->state == NVME_CTRL_DEAD) ++ if (nvme_ctrl_state(ctrl) == NVME_CTRL_DEAD) + nvme_mark_namespaces_dead(ctrl); + + /* this is a no-op when called from the controller reset handler */ +@@ -4066,7 +4068,7 @@ static void nvme_async_event_work(struct work_struct *work) + * flushing ctrl async_event_work after changing the controller state + * from LIVE and before freeing the admin queue. + */ +- if (ctrl->state == NVME_CTRL_LIVE) ++ if (nvme_ctrl_state(ctrl) == NVME_CTRL_LIVE) + ctrl->ops->submit_async_event(ctrl); + } + +@@ -4451,7 +4453,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + { + int ret; + +- ctrl->state = NVME_CTRL_NEW; ++ WRITE_ONCE(ctrl->state, NVME_CTRL_NEW); + clear_bit(NVME_CTRL_FAILFAST_EXPIRED, &ctrl->flags); + spin_lock_init(&ctrl->lock); + mutex_init(&ctrl->scan_lock); +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 206f1b4e5eb1..46cce0ec35e9 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -557,7 +557,7 @@ nvme_fc_rport_get(struct nvme_fc_rport *rport) + static void + nvme_fc_resume_controller(struct nvme_fc_ctrl *ctrl) + { +- switch (ctrl->ctrl.state) { ++ switch (nvme_ctrl_state(&ctrl->ctrl)) { + case NVME_CTRL_NEW: + case NVME_CTRL_CONNECTING: + /* +@@ -793,7 +793,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl) + "NVME-FC{%d}: controller connectivity lost. Awaiting " + "Reconnect", ctrl->cnum); + +- switch (ctrl->ctrl.state) { ++ switch (nvme_ctrl_state(&ctrl->ctrl)) { + case NVME_CTRL_NEW: + case NVME_CTRL_LIVE: + /* +@@ -3305,7 +3305,7 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status) + unsigned long recon_delay = ctrl->ctrl.opts->reconnect_delay * HZ; + bool recon = true; + +- if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) ++ if (nvme_ctrl_state(&ctrl->ctrl) != NVME_CTRL_CONNECTING) + return; + + if (portptr->port_state == FC_OBJSTATE_ONLINE) { +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 5c2a3af26d4d..f8e92404a659 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1234,7 +1234,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts) + bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO); + + /* If there is a reset/reinit ongoing, we shouldn't reset again. */ +- switch (dev->ctrl.state) { ++ switch (nvme_ctrl_state(&dev->ctrl)) { + case NVME_CTRL_RESETTING: + case NVME_CTRL_CONNECTING: + return false; +@@ -1322,7 +1322,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) + * cancellation error. All outstanding requests are completed on + * shutdown, so we return BLK_EH_DONE. + */ +- switch (dev->ctrl.state) { ++ switch (nvme_ctrl_state(&dev->ctrl)) { + case NVME_CTRL_CONNECTING: + nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING); + fallthrough; +@@ -1594,7 +1594,7 @@ static int nvme_setup_io_queues_trylock(struct nvme_dev *dev) + /* + * Controller is in wrong state, fail early. + */ +- if (dev->ctrl.state != NVME_CTRL_CONNECTING) { ++ if (nvme_ctrl_state(&dev->ctrl) != NVME_CTRL_CONNECTING) { + mutex_unlock(&dev->shutdown_lock); + return -ENODEV; + } +@@ -2574,13 +2574,13 @@ static bool nvme_pci_ctrl_is_dead(struct nvme_dev *dev) + + static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) + { ++ enum nvme_ctrl_state state = nvme_ctrl_state(&dev->ctrl); + struct pci_dev *pdev = to_pci_dev(dev->dev); + bool dead; + + mutex_lock(&dev->shutdown_lock); + dead = nvme_pci_ctrl_is_dead(dev); +- if (dev->ctrl.state == NVME_CTRL_LIVE || +- dev->ctrl.state == NVME_CTRL_RESETTING) { ++ if (state == NVME_CTRL_LIVE || state == NVME_CTRL_RESETTING) { + if (pci_is_enabled(pdev)) + nvme_start_freeze(&dev->ctrl); + /* +@@ -2691,7 +2691,7 @@ static void nvme_reset_work(struct work_struct *work) + bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL); + int result; + +- if (dev->ctrl.state != NVME_CTRL_RESETTING) { ++ if (nvme_ctrl_state(&dev->ctrl) != NVME_CTRL_RESETTING) { + dev_warn(dev->ctrl.device, "ctrl state %d is not RESETTING\n", + dev->ctrl.state); + result = -ENODEV; +@@ -3207,7 +3207,7 @@ static int nvme_suspend(struct device *dev) + nvme_wait_freeze(ctrl); + nvme_sync_queues(ctrl); + +- if (ctrl->state != NVME_CTRL_LIVE) ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_LIVE) + goto unfreeze; + + /* +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index a7fea4cbacd7..c04317a966b3 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -984,10 +984,11 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl) + + static void nvme_rdma_reconnect_or_remove(struct nvme_rdma_ctrl *ctrl) + { ++ enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl); ++ + /* If we are resetting/deleting then do nothing */ +- if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) { +- WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW || +- ctrl->ctrl.state == NVME_CTRL_LIVE); ++ if (state != NVME_CTRL_CONNECTING) { ++ WARN_ON_ONCE(state == NVME_CTRL_NEW || state == NVME_CTRL_LIVE); + return; + } + +@@ -1059,8 +1060,10 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) + * unless we're during creation of a new controller to + * avoid races with teardown flow. + */ +- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING && +- ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO); ++ enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl); ++ ++ WARN_ON_ONCE(state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DELETING_NOIO); + WARN_ON_ONCE(new); + ret = -EINVAL; + goto destroy_io; +@@ -1128,8 +1131,10 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work) + + if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) { + /* state change failure is ok if we started ctrl delete */ +- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING && +- ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO); ++ enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl); ++ ++ WARN_ON_ONCE(state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DELETING_NOIO); + return; + } + +@@ -1161,7 +1166,7 @@ static void nvme_rdma_wr_error(struct ib_cq *cq, struct ib_wc *wc, + struct nvme_rdma_queue *queue = wc->qp->qp_context; + struct nvme_rdma_ctrl *ctrl = queue->ctrl; + +- if (ctrl->ctrl.state == NVME_CTRL_LIVE) ++ if (nvme_ctrl_state(&ctrl->ctrl) == NVME_CTRL_LIVE) + dev_info(ctrl->ctrl.device, + "%s for CQE 0x%p failed with status %s (%d)\n", + op, wc->wr_cqe, +@@ -1944,7 +1949,7 @@ static enum blk_eh_timer_return nvme_rdma_timeout(struct request *rq) + dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n", + rq->tag, nvme_rdma_queue_idx(queue)); + +- if (ctrl->ctrl.state != NVME_CTRL_LIVE) { ++ if (nvme_ctrl_state(&ctrl->ctrl) != NVME_CTRL_LIVE) { + /* + * If we are resetting, connecting or deleting we should + * complete immediately because we may block controller +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 5b332d9f87fc..f1d62d74426f 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1993,10 +1993,11 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, + + static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl) + { ++ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); ++ + /* If we are resetting/deleting then do nothing */ +- if (ctrl->state != NVME_CTRL_CONNECTING) { +- WARN_ON_ONCE(ctrl->state == NVME_CTRL_NEW || +- ctrl->state == NVME_CTRL_LIVE); ++ if (state != NVME_CTRL_CONNECTING) { ++ WARN_ON_ONCE(state == NVME_CTRL_NEW || state == NVME_CTRL_LIVE); + return; + } + +@@ -2056,8 +2057,10 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new) + * unless we're during creation of a new controller to + * avoid races with teardown flow. + */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && +- ctrl->state != NVME_CTRL_DELETING_NOIO); ++ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); ++ ++ WARN_ON_ONCE(state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DELETING_NOIO); + WARN_ON_ONCE(new); + ret = -EINVAL; + goto destroy_io; +@@ -2124,8 +2127,10 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work) + + if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) { + /* state change failure is ok if we started ctrl delete */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && +- ctrl->state != NVME_CTRL_DELETING_NOIO); ++ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); ++ ++ WARN_ON_ONCE(state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DELETING_NOIO); + return; + } + +@@ -2155,8 +2160,10 @@ static void nvme_reset_ctrl_work(struct work_struct *work) + + if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) { + /* state change failure is ok if we started ctrl delete */ +- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING && +- ctrl->state != NVME_CTRL_DELETING_NOIO); ++ enum nvme_ctrl_state state = nvme_ctrl_state(ctrl); ++ ++ WARN_ON_ONCE(state != NVME_CTRL_DELETING && ++ state != NVME_CTRL_DELETING_NOIO); + return; + } + +@@ -2274,7 +2281,7 @@ static enum blk_eh_timer_return nvme_tcp_timeout(struct request *rq) + nvme_tcp_queue_id(req->queue), nvme_cid(rq), pdu->hdr.type, + opc, nvme_opcode_str(qid, opc, fctype)); + +- if (ctrl->state != NVME_CTRL_LIVE) { ++ if (nvme_ctrl_state(ctrl) != NVME_CTRL_LIVE) { + /* + * If we are resetting, connecting or deleting we should + * complete immediately because we may block controller +-- +2.43.0 + diff --git a/queue-6.6/nvme-fix-deadlock-between-reset-and-scan.patch b/queue-6.6/nvme-fix-deadlock-between-reset-and-scan.patch new file mode 100644 index 00000000000..5cca5375341 --- /dev/null +++ b/queue-6.6/nvme-fix-deadlock-between-reset-and-scan.patch @@ -0,0 +1,168 @@ +From bcecb0cc5346e6257e31efebaf8bca7ff1e82f4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 10:13:37 +0800 +Subject: nvme: fix deadlock between reset and scan + +From: Bitao Hu + +[ Upstream commit 839a40d1e730977d4448d141fa653517c2959a88 ] + +If controller reset occurs when allocating namespace, both +nvme_reset_work and nvme_scan_work will hang, as shown below. + +Test Scripts: + + for ((t=1;t<=128;t++)) + do + nsid=`nvme create-ns /dev/nvme1 -s 14537724 -c 14537724 -f 0 -m 0 \ + -d 0 | awk -F: '{print($NF);}'` + nvme attach-ns /dev/nvme1 -n $nsid -c 0 + done + nvme reset /dev/nvme1 + +We will find that both nvme_reset_work and nvme_scan_work hung: + + INFO: task kworker/u249:4:17848 blocked for more than 120 seconds. + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this + message. + task:kworker/u249:4 state:D stack: 0 pid:17848 ppid: 2 + flags:0x00000028 + Workqueue: nvme-reset-wq nvme_reset_work [nvme] + Call trace: + __switch_to+0xb4/0xfc + __schedule+0x22c/0x670 + schedule+0x4c/0xd0 + blk_mq_freeze_queue_wait+0x84/0xc0 + nvme_wait_freeze+0x40/0x64 [nvme_core] + nvme_reset_work+0x1c0/0x5cc [nvme] + process_one_work+0x1d8/0x4b0 + worker_thread+0x230/0x440 + kthread+0x114/0x120 + INFO: task kworker/u249:3:22404 blocked for more than 120 seconds. + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this + message. + task:kworker/u249:3 state:D stack: 0 pid:22404 ppid: 2 + flags:0x00000028 + Workqueue: nvme-wq nvme_scan_work [nvme_core] + Call trace: + __switch_to+0xb4/0xfc + __schedule+0x22c/0x670 + schedule+0x4c/0xd0 + rwsem_down_write_slowpath+0x32c/0x98c + down_write+0x70/0x80 + nvme_alloc_ns+0x1ac/0x38c [nvme_core] + nvme_validate_or_alloc_ns+0xbc/0x150 [nvme_core] + nvme_scan_ns_list+0xe8/0x2e4 [nvme_core] + nvme_scan_work+0x60/0x500 [nvme_core] + process_one_work+0x1d8/0x4b0 + worker_thread+0x260/0x440 + kthread+0x114/0x120 + INFO: task nvme:28428 blocked for more than 120 seconds. + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this + message. + task:nvme state:D stack: 0 pid:28428 ppid: 27119 + flags:0x00000000 + Call trace: + __switch_to+0xb4/0xfc + __schedule+0x22c/0x670 + schedule+0x4c/0xd0 + schedule_timeout+0x160/0x194 + do_wait_for_common+0xac/0x1d0 + __wait_for_common+0x78/0x100 + wait_for_completion+0x24/0x30 + __flush_work.isra.0+0x74/0x90 + flush_work+0x14/0x20 + nvme_reset_ctrl_sync+0x50/0x74 [nvme_core] + nvme_dev_ioctl+0x1b0/0x250 [nvme_core] + __arm64_sys_ioctl+0xa8/0xf0 + el0_svc_common+0x88/0x234 + do_el0_svc+0x7c/0x90 + el0_svc+0x1c/0x30 + el0_sync_handler+0xa8/0xb0 + el0_sync+0x148/0x180 + +The reason for the hang is that nvme_reset_work occurs while nvme_scan_work +is still running. nvme_scan_work may add new ns into ctrl->namespaces +list after nvme_reset_work frozen all ns->q in ctrl->namespaces list. +The newly added ns is not frozen, so nvme_wait_freeze will wait forever. +Unfortunately, ctrl->namespaces_rwsem is held by nvme_reset_work, so +nvme_scan_work will also wait forever. Now we are deadlocked! + +PROCESS1 PROCESS2 +============== ============== +nvme_scan_work + ... nvme_reset_work + nvme_validate_or_alloc_ns nvme_dev_disable + nvme_alloc_ns nvme_start_freeze + down_write ... + nvme_ns_add_to_ctrl_list ... + up_write nvme_wait_freeze + ... down_read + nvme_alloc_ns blk_mq_freeze_queue_wait + down_write + +Fix by marking the ctrl with say NVME_CTRL_FROZEN flag set in +nvme_start_freeze and cleared in nvme_unfreeze. Then the scan can check +it before adding the new namespace (under the namespaces_rwsem). + +Signed-off-by: Bitao Hu +Reviewed-by: Guixin Liu +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 10 ++++++++++ + drivers/nvme/host/nvme.h | 1 + + 2 files changed, 11 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index c38e234723ec..d4564a2517eb 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3652,6 +3652,14 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, struct nvme_ns_info *info) + goto out_unlink_ns; + + down_write(&ctrl->namespaces_rwsem); ++ /* ++ * Ensure that no namespaces are added to the ctrl list after the queues ++ * are frozen, thereby avoiding a deadlock between scan and reset. ++ */ ++ if (test_bit(NVME_CTRL_FROZEN, &ctrl->flags)) { ++ up_write(&ctrl->namespaces_rwsem); ++ goto out_unlink_ns; ++ } + nvme_ns_add_to_ctrl_list(ns); + up_write(&ctrl->namespaces_rwsem); + nvme_get_ctrl(ctrl); +@@ -4562,6 +4570,7 @@ void nvme_unfreeze(struct nvme_ctrl *ctrl) + list_for_each_entry(ns, &ctrl->namespaces, list) + blk_mq_unfreeze_queue(ns->queue); + up_read(&ctrl->namespaces_rwsem); ++ clear_bit(NVME_CTRL_FROZEN, &ctrl->flags); + } + EXPORT_SYMBOL_GPL(nvme_unfreeze); + +@@ -4595,6 +4604,7 @@ void nvme_start_freeze(struct nvme_ctrl *ctrl) + { + struct nvme_ns *ns; + ++ set_bit(NVME_CTRL_FROZEN, &ctrl->flags); + down_read(&ctrl->namespaces_rwsem); + list_for_each_entry(ns, &ctrl->namespaces, list) + blk_freeze_queue_start(ns->queue); +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 13f71461f5f1..ba62d42d2a8b 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -256,6 +256,7 @@ enum nvme_ctrl_flags { + NVME_CTRL_STOPPED = 3, + NVME_CTRL_SKIP_ID_CNS_CS = 4, + NVME_CTRL_DIRTY_CAPABILITY = 5, ++ NVME_CTRL_FROZEN = 6, + }; + + struct nvme_ctrl { +-- +2.43.0 + diff --git a/queue-6.6/nvme-introduce-helper-function-to-get-ctrl-state.patch b/queue-6.6/nvme-introduce-helper-function-to-get-ctrl-state.patch new file mode 100644 index 00000000000..3b7b030da4f --- /dev/null +++ b/queue-6.6/nvme-introduce-helper-function-to-get-ctrl-state.patch @@ -0,0 +1,40 @@ +From a97371d7890712a845b5342c3dd532d610f2dd1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 08:13:09 -0700 +Subject: nvme: introduce helper function to get ctrl state + +From: Keith Busch + +[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ] + +The controller state is typically written by another CPU, so reading it +should ensure no optimizations are taken. This is a repeated pattern in +the driver, so start with adding a convenience function that returns the +controller state with READ_ONCE(). + +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/nvme.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 74f74b459f5f..13f71461f5f1 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -391,6 +391,11 @@ struct nvme_ctrl { + enum nvme_dctype dctype; + }; + ++static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl) ++{ ++ return READ_ONCE(ctrl->state); ++} ++ + enum nvme_iopolicy { + NVME_IOPOLICY_NUMA, + NVME_IOPOLICY_RR, +-- +2.43.0 + diff --git a/queue-6.6/nvme-ioctl-move-capable-admin-check-to-the-end.patch b/queue-6.6/nvme-ioctl-move-capable-admin-check-to-the-end.patch new file mode 100644 index 00000000000..c35662f6084 --- /dev/null +++ b/queue-6.6/nvme-ioctl-move-capable-admin-check-to-the-end.patch @@ -0,0 +1,96 @@ +From 934f6fb74bb8ea9b68f7acae2346f1960e799202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:43:41 -0700 +Subject: nvme-ioctl: move capable() admin check to the end + +From: Keith Busch + +[ Upstream commit 7be866b1cf0bf1dfa74480fe8097daeceda68622 ] + +This can be an expensive call on some kernel configs. Move it to the end +after checking the cheaper ways to determine if the command is allowed. + +Reviewed-by: Jens Axboe +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/ioctl.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c +index 529b9954d2b8..4939ed35638f 100644 +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -18,15 +18,12 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, + { + u32 effects; + +- if (capable(CAP_SYS_ADMIN)) +- return true; +- + /* + * Do not allow unprivileged passthrough on partitions, as that allows an + * escape from the containment of the partition. + */ + if (flags & NVME_IOCTL_PARTITION) +- return false; ++ goto admin; + + /* + * Do not allow unprivileged processes to send vendor specific or fabrics +@@ -34,7 +31,7 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, + */ + if (c->common.opcode >= nvme_cmd_vendor_start || + c->common.opcode == nvme_fabrics_command) +- return false; ++ goto admin; + + /* + * Do not allow unprivileged passthrough of admin commands except +@@ -53,7 +50,7 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, + return true; + } + } +- return false; ++ goto admin; + } + + /* +@@ -63,7 +60,7 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, + */ + effects = nvme_command_effects(ns->ctrl, ns, c->common.opcode); + if (!(effects & NVME_CMD_EFFECTS_CSUPP)) +- return false; ++ goto admin; + + /* + * Don't allow passthrough for command that have intrusive (or unknown) +@@ -72,16 +69,20 @@ static bool nvme_cmd_allowed(struct nvme_ns *ns, struct nvme_command *c, + if (effects & ~(NVME_CMD_EFFECTS_CSUPP | NVME_CMD_EFFECTS_LBCC | + NVME_CMD_EFFECTS_UUID_SEL | + NVME_CMD_EFFECTS_SCOPE_MASK)) +- return false; ++ goto admin; + + /* + * Only allow I/O commands that transfer data to the controller or that + * change the logical block contents if the file descriptor is open for + * writing. + */ +- if (nvme_is_write(c) || (effects & NVME_CMD_EFFECTS_LBCC)) +- return open_for_write; ++ if ((nvme_is_write(c) || (effects & NVME_CMD_EFFECTS_LBCC)) && ++ !open_for_write) ++ goto admin; ++ + return true; ++admin: ++ return capable(CAP_SYS_ADMIN); + } + + /* +-- +2.43.0 + diff --git a/queue-6.6/nvme-prevent-potential-spectre-v1-gadget.patch b/queue-6.6/nvme-prevent-potential-spectre-v1-gadget.patch new file mode 100644 index 00000000000..6c2fd64a691 --- /dev/null +++ b/queue-6.6/nvme-prevent-potential-spectre-v1-gadget.patch @@ -0,0 +1,54 @@ +From b64ff944cd2e040c551ceb7edcdfc28b32401dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 17:59:57 +0530 +Subject: nvme: prevent potential spectre v1 gadget + +From: Nitesh Shetty + +[ Upstream commit 20dc66f2d76b4a410df14e4675e373b718babc34 ] + +This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn: +potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)" +Prevent the contents of kernel memory from being leaked to user space +via speculative execution by using array_index_nospec. + +Signed-off-by: Nitesh Shetty +Reviewed-by: Christoph Hellwig +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/configfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c +index 907143870da5..01b2a3d1a5e6 100644 +--- a/drivers/nvme/target/configfs.c ++++ b/drivers/nvme/target/configfs.c +@@ -17,6 +17,7 @@ + #endif + #include + #include ++#include + + #include "nvmet.h" + +@@ -509,6 +510,7 @@ static ssize_t nvmet_ns_ana_grpid_store(struct config_item *item, + + down_write(&nvmet_ana_sem); + oldgrpid = ns->anagrpid; ++ newgrpid = array_index_nospec(newgrpid, NVMET_MAX_ANAGRPS); + nvmet_ana_group_enabled[newgrpid]++; + ns->anagrpid = newgrpid; + nvmet_ana_group_enabled[oldgrpid]--; +@@ -1700,6 +1702,7 @@ static struct config_group *nvmet_ana_groups_make_group( + grp->grpid = grpid; + + down_write(&nvmet_ana_sem); ++ grpid = array_index_nospec(grpid, NVMET_MAX_ANAGRPS); + nvmet_ana_group_enabled[grpid]++; + up_write(&nvmet_ana_sem); + +-- +2.43.0 + diff --git a/queue-6.6/pds_vdpa-clear-config-callback-when-status-goes-to-0.patch b/queue-6.6/pds_vdpa-clear-config-callback-when-status-goes-to-0.patch new file mode 100644 index 00000000000..1f5948cc41c --- /dev/null +++ b/queue-6.6/pds_vdpa-clear-config-callback-when-status-goes-to-0.patch @@ -0,0 +1,42 @@ +From c98569627dd12e34ac0604421077b782a67acf7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Nov 2023 14:18:01 -0800 +Subject: pds_vdpa: clear config callback when status goes to 0 + +From: Shannon Nelson + +[ Upstream commit dd3b8de16e90c5594eddd29aeeb99e97c6f863be ] + +If the client driver is setting status to 0, something is +getting shutdown and possibly removed. Make sure we clear +the config_cb so that it doesn't end up crashing when +trying to call a bogus callback. + +Signed-off-by: Shannon Nelson +Message-Id: <20231110221802.46841-3-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/pds/vdpa_dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/pds/vdpa_dev.c b/drivers/vdpa/pds/vdpa_dev.c +index 52b2449182ad..9fc89c82d1f0 100644 +--- a/drivers/vdpa/pds/vdpa_dev.c ++++ b/drivers/vdpa/pds/vdpa_dev.c +@@ -461,8 +461,10 @@ static void pds_vdpa_set_status(struct vdpa_device *vdpa_dev, u8 status) + + pds_vdpa_cmd_set_status(pdsv, status); + +- /* Note: still working with FW on the need for this reset cmd */ + if (status == 0) { ++ struct vdpa_callback null_cb = { }; ++ ++ pds_vdpa_set_config_cb(vdpa_dev, &null_cb); + pds_vdpa_cmd_reset(pdsv); + + for (i = 0; i < pdsv->num_vqs; i++) { +-- +2.43.0 + diff --git a/queue-6.6/pds_vdpa-fix-up-format-truncation-complaint.patch b/queue-6.6/pds_vdpa-fix-up-format-truncation-complaint.patch new file mode 100644 index 00000000000..ffa0e132002 --- /dev/null +++ b/queue-6.6/pds_vdpa-fix-up-format-truncation-complaint.patch @@ -0,0 +1,39 @@ +From e666b83d4f592beefdd2c320e5c5064eaa4c80bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Nov 2023 14:18:00 -0800 +Subject: pds_vdpa: fix up format-truncation complaint + +From: Shannon Nelson + +[ Upstream commit 4f317d6529d7fc3ab7769ef89645d43fc7eec61b ] + +Our friendly kernel test robot has recently been pointing out +some format-truncation issues. Here's a fix for one of them. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311040109.RfgJoE7L-lkp@intel.com/ +Signed-off-by: Shannon Nelson +Message-Id: <20231110221802.46841-2-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/pds/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vdpa/pds/debugfs.c b/drivers/vdpa/pds/debugfs.c +index 9b04aad6ec35..c328e694f6e7 100644 +--- a/drivers/vdpa/pds/debugfs.c ++++ b/drivers/vdpa/pds/debugfs.c +@@ -261,7 +261,7 @@ void pds_vdpa_debugfs_add_vdpadev(struct pds_vdpa_aux *vdpa_aux) + debugfs_create_file("config", 0400, vdpa_aux->dentry, vdpa_aux->pdsv, &config_fops); + + for (i = 0; i < vdpa_aux->pdsv->num_vqs; i++) { +- char name[8]; ++ char name[16]; + + snprintf(name, sizeof(name), "vq%02d", i); + debugfs_create_file(name, 0400, vdpa_aux->dentry, +-- +2.43.0 + diff --git a/queue-6.6/pds_vdpa-set-features-order.patch b/queue-6.6/pds_vdpa-set-features-order.patch new file mode 100644 index 00000000000..d6826b1ee81 --- /dev/null +++ b/queue-6.6/pds_vdpa-set-features-order.patch @@ -0,0 +1,40 @@ +From 01e7dc366d2389fda9554aae4462dc3c5898398c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Nov 2023 14:18:02 -0800 +Subject: pds_vdpa: set features order + +From: Shannon Nelson + +[ Upstream commit cefc9ba6aed48a3aa085888e3262ac2aa975714b ] + +Fix up the order that the device and negotiated features +are checked to get a more reliable difference when things +get changed. + +Signed-off-by: Shannon Nelson +Message-Id: <20231110221802.46841-4-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/pds/vdpa_dev.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vdpa/pds/vdpa_dev.c b/drivers/vdpa/pds/vdpa_dev.c +index 9fc89c82d1f0..25c0fe5ec3d5 100644 +--- a/drivers/vdpa/pds/vdpa_dev.c ++++ b/drivers/vdpa/pds/vdpa_dev.c +@@ -318,9 +318,8 @@ static int pds_vdpa_set_driver_features(struct vdpa_device *vdpa_dev, u64 featur + return -EOPNOTSUPP; + } + +- pdsv->negotiated_features = nego_features; +- + driver_features = pds_vdpa_get_driver_features(vdpa_dev); ++ pdsv->negotiated_features = nego_features; + dev_dbg(dev, "%s: %#llx => %#llx\n", + __func__, driver_features, nego_features); + +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-amd-mask-non-wake-source-pins-with-interrupt.patch b/queue-6.6/pinctrl-amd-mask-non-wake-source-pins-with-interrupt.patch new file mode 100644 index 00000000000..be4fe6395dc --- /dev/null +++ b/queue-6.6/pinctrl-amd-mask-non-wake-source-pins-with-interrupt.patch @@ -0,0 +1,68 @@ +From 0ce2163b8cf1690f5c3d6f9f619d8edd203c630f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Dec 2023 21:24:31 -0600 +Subject: pinctrl: amd: Mask non-wake source pins with interrupt enabled at + suspend + +From: Mario Limonciello + +[ Upstream commit 2fff0b5e1a6b9c577b4dd4958902c877159c856b ] + +If a pin isn't marked as a wake source processing any interrupts is +just going to destroy battery life. The APU may wake up from a hardware +sleep state to process the interrupt but not return control to the OS. + +Mask interrupt for all non-wake source pins at suspend. They'll be +re-enabled at resume. + +Reported-and-tested-by: Marcus Aram +Reported-and-tested-by: Mark Herbert +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2812 +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20231203032431.30277-3-mario.limonciello@amd.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-amd.c | 9 +++++++++ + drivers/pinctrl/pinctrl-amd.h | 5 +++++ + 2 files changed, 14 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index 74241b2ff21e..86034c457c04 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -923,6 +923,15 @@ static int amd_gpio_suspend(struct device *dev) + + raw_spin_lock_irqsave(&gpio_dev->lock, flags); + gpio_dev->saved_regs[i] = readl(gpio_dev->base + pin * 4) & ~PIN_IRQ_PENDING; ++ ++ /* mask any interrupts not intended to be a wake source */ ++ if (!(gpio_dev->saved_regs[i] & WAKE_SOURCE)) { ++ writel(gpio_dev->saved_regs[i] & ~BIT(INTERRUPT_MASK_OFF), ++ gpio_dev->base + pin * 4); ++ pm_pr_dbg("Disabling GPIO #%d interrupt for suspend.\n", ++ pin); ++ } ++ + raw_spin_unlock_irqrestore(&gpio_dev->lock, flags); + } + +diff --git a/drivers/pinctrl/pinctrl-amd.h b/drivers/pinctrl/pinctrl-amd.h +index 34c5c3e71fb2..cf59089f2776 100644 +--- a/drivers/pinctrl/pinctrl-amd.h ++++ b/drivers/pinctrl/pinctrl-amd.h +@@ -80,6 +80,11 @@ + #define FUNCTION_MASK GENMASK(1, 0) + #define FUNCTION_INVALID GENMASK(7, 0) + ++#define WAKE_SOURCE (BIT(WAKE_CNTRL_OFF_S0I3) | \ ++ BIT(WAKE_CNTRL_OFF_S3) | \ ++ BIT(WAKE_CNTRL_OFF_S4) | \ ++ BIT(WAKECNTRL_Z_OFF)) ++ + struct amd_function { + const char *name; + const char * const groups[NSELECTS]; +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-cy8c95x0-fix-get_pincfg.patch b/queue-6.6/pinctrl-cy8c95x0-fix-get_pincfg.patch new file mode 100644 index 00000000000..9b048853323 --- /dev/null +++ b/queue-6.6/pinctrl-cy8c95x0-fix-get_pincfg.patch @@ -0,0 +1,36 @@ +From c9d57ce6313e0e5047a794931f4265525975832d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:51:18 +0100 +Subject: pinctrl: cy8c95x0: Fix get_pincfg + +From: Patrick Rudolph + +[ Upstream commit 94c71705cc49092cef60ece13a28680809096fd4 ] + +Invert the register value for PIN_CONFIG_OUTPUT_ENABLE to return +the opposite of PIN_CONFIG_INPUT_ENABLE. + +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20231219125120.4028862-3-patrick.rudolph@9elements.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-cy8c95x0.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c +index 280d7ebd50b7..f2b9db66fdb6 100644 +--- a/drivers/pinctrl/pinctrl-cy8c95x0.c ++++ b/drivers/pinctrl/pinctrl-cy8c95x0.c +@@ -714,6 +714,8 @@ static int cy8c95x0_gpio_get_pincfg(struct cy8c95x0_pinctrl *chip, + ret = regmap_read(chip->regmap, reg, ®_val); + if (reg_val & bit) + arg = 1; ++ if (param == PIN_CONFIG_OUTPUT_ENABLE) ++ arg = !arg; + + *config = pinconf_to_config_packed(param, (u16)arg); + out: +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-cy8c95x0-fix-regression.patch b/queue-6.6/pinctrl-cy8c95x0-fix-regression.patch new file mode 100644 index 00000000000..ae3ed38692e --- /dev/null +++ b/queue-6.6/pinctrl-cy8c95x0-fix-regression.patch @@ -0,0 +1,63 @@ +From 482099147b307e10f491bdf0d75e54ab1115df0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:51:17 +0100 +Subject: pinctrl: cy8c95x0: Fix regression + +From: Patrick Rudolph + +[ Upstream commit 04dfca968cf7349773126340991b68a83378aca2 ] + +Commit 1fa3df901f2c ("pinctrl: cy8c95x0: Remove custom ->set_config()") +removed support for PIN_CONFIG_INPUT_ENABLE and +PIN_CONFIG_OUTPUT. + +Add the following options to restore functionality: +- PIN_CONFIG_INPUT_ENABLE +- PIN_CONFIG_OUTPUT_ENABLE + +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20231219125120.4028862-2-patrick.rudolph@9elements.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-cy8c95x0.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c +index 993b30ebc684..280d7ebd50b7 100644 +--- a/drivers/pinctrl/pinctrl-cy8c95x0.c ++++ b/drivers/pinctrl/pinctrl-cy8c95x0.c +@@ -307,6 +307,9 @@ static const char * const cy8c95x0_groups[] = { + "gp77", + }; + ++static int cy8c95x0_pinmux_direction(struct cy8c95x0_pinctrl *chip, ++ unsigned int pin, bool input); ++ + static inline u8 cypress_get_port(struct cy8c95x0_pinctrl *chip, unsigned int pin) + { + /* Account for GPORT2 which only has 4 bits */ +@@ -726,6 +729,7 @@ static int cy8c95x0_gpio_set_pincfg(struct cy8c95x0_pinctrl *chip, + u8 port = cypress_get_port(chip, off); + u8 bit = cypress_get_pin_mask(chip, off); + unsigned long param = pinconf_to_config_param(config); ++ unsigned long arg = pinconf_to_config_argument(config); + unsigned int reg; + int ret; + +@@ -764,6 +768,12 @@ static int cy8c95x0_gpio_set_pincfg(struct cy8c95x0_pinctrl *chip, + case PIN_CONFIG_MODE_PWM: + reg = CY8C95X0_PWMSEL; + break; ++ case PIN_CONFIG_OUTPUT_ENABLE: ++ ret = cy8c95x0_pinmux_direction(chip, off, !arg); ++ goto out; ++ case PIN_CONFIG_INPUT_ENABLE: ++ ret = cy8c95x0_pinmux_direction(chip, off, arg); ++ goto out; + default: + ret = -ENOTSUPP; + goto out; +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-cy8c95x0-fix-typo.patch b/queue-6.6/pinctrl-cy8c95x0-fix-typo.patch new file mode 100644 index 00000000000..2a09cd8c268 --- /dev/null +++ b/queue-6.6/pinctrl-cy8c95x0-fix-typo.patch @@ -0,0 +1,35 @@ +From 91d8fb9a6220b5a4ecd061b6b0cd1b7fb6ec8852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:51:16 +0100 +Subject: pinctrl: cy8c95x0: Fix typo + +From: Patrick Rudolph + +[ Upstream commit 47b1fa48116238208c1b1198dba10f56fc1b6eb2 ] + +Fix typo to make pinctrl-cy8c95x compile again. + +Signed-off-by: Patrick Rudolph +Link: https://lore.kernel.org/r/20231219125120.4028862-1-patrick.rudolph@9elements.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-cy8c95x0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-cy8c95x0.c b/drivers/pinctrl/pinctrl-cy8c95x0.c +index 58ca6fac7849..993b30ebc684 100644 +--- a/drivers/pinctrl/pinctrl-cy8c95x0.c ++++ b/drivers/pinctrl/pinctrl-cy8c95x0.c +@@ -821,7 +821,7 @@ static int cy8c95x0_setup_gpiochip(struct cy8c95x0_pinctrl *chip) + gc->get_direction = cy8c95x0_gpio_get_direction; + gc->get_multiple = cy8c95x0_gpio_get_multiple; + gc->set_multiple = cy8c95x0_gpio_set_multiple; +- gc->set_config = gpiochip_generic_config, ++ gc->set_config = gpiochip_generic_config; + gc->can_sleep = true; + gc->add_pin_ranges = cy8c95x0_add_pin_ranges; + +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-lochnagar-don-t-build-on-mips.patch b/queue-6.6/pinctrl-lochnagar-don-t-build-on-mips.patch new file mode 100644 index 00000000000..6a8884fb734 --- /dev/null +++ b/queue-6.6/pinctrl-lochnagar-don-t-build-on-mips.patch @@ -0,0 +1,42 @@ +From 08575c2751fac1f497e2f6c3be6c5dce7bba9a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:28:53 +0000 +Subject: pinctrl: lochnagar: Don't build on MIPS + +From: Charles Keepax + +[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ] + +MIPS appears to define a RST symbol at a high level, which clashes +with some register naming in the driver. Since there is currently +no case for running this driver on MIPS devices simply cut off the +build of this driver on MIPS. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/ +Suggested-by: Linus Walleij +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/cirrus/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig +index d6318cb57aff..e7e827a8877a 100644 +--- a/drivers/pinctrl/cirrus/Kconfig ++++ b/drivers/pinctrl/cirrus/Kconfig +@@ -12,7 +12,8 @@ config PINCTRL_CS42L43 + + config PINCTRL_LOCHNAGAR + tristate "Cirrus Logic Lochnagar pinctrl driver" +- depends on MFD_LOCHNAGAR ++ # Avoid clash caused by MIPS defining RST, which is used in the driver ++ depends on MFD_LOCHNAGAR && !MIPS + select GPIOLIB + select PINMUX + select PINCONF +-- +2.43.0 + diff --git a/queue-6.6/pinctrl-s32cc-avoid-possible-string-truncation.patch b/queue-6.6/pinctrl-s32cc-avoid-possible-string-truncation.patch new file mode 100644 index 00000000000..f91e0831e9d --- /dev/null +++ b/queue-6.6/pinctrl-s32cc-avoid-possible-string-truncation.patch @@ -0,0 +1,47 @@ +From 280db9f57a6565a0259612de1cf8712cb1108ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 22:10:44 +0800 +Subject: pinctrl: s32cc: Avoid possible string truncation + +From: Chester Lin + +[ Upstream commit 08e8734d877a9a0fb8af1254a4ce58734fbef296 ] + +With "W=1" and "-Wformat-truncation" build options, the kernel test robot +found a possible string truncation warning in pinctrl-s32cc.c, which uses +an 8-byte char array to hold a memory region name "map%u". Since the +maximum number of digits that a u32 value can present is 10, and the "map" +string occupies 3 bytes with a termination '\0', which means the rest 4 +bytes cannot fully present the integer "X" that exceeds 4 digits. + +Here we check if the number >= 10000, which is the lowest value that +contains more than 4 digits. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/ +Signed-off-by: Chester Lin +Link: https://lore.kernel.org/r/20231107141044.24058-1-clin@suse.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c +index 7daff9f186cd..f0cad2c501f7 100644 +--- a/drivers/pinctrl/nxp/pinctrl-s32cc.c ++++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c +@@ -843,8 +843,8 @@ static int s32_pinctrl_probe_dt(struct platform_device *pdev, + if (!np) + return -ENODEV; + +- if (mem_regions == 0) { +- dev_err(&pdev->dev, "mem_regions is 0\n"); ++ if (mem_regions == 0 || mem_regions >= 10000) { ++ dev_err(&pdev->dev, "mem_regions is invalid: %u\n", mem_regions); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-disable-keyboard-wakeup-on-amd-.patch b/queue-6.6/platform-x86-amd-pmc-disable-keyboard-wakeup-on-amd-.patch new file mode 100644 index 00000000000..e799e794cd5 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-disable-keyboard-wakeup-on-amd-.patch @@ -0,0 +1,100 @@ +From 7be768072030a57aca6c4ea5f73154d64b8f609e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 22:50:06 -0600 +Subject: platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit a55bdad5dfd1efd4ed9ffe518897a21ca8e4e193 ] + +The Laptop 13 (AMD Ryzen 7040Series) BIOS 03.03 has a workaround +included in the EC firmware that will cause the EC to emit a "spurious" +keypress during the resume from s0i3 [1]. + +This series of keypress events can be observed in the kernel log on +resume. + +``` +atkbd serio0: Unknown key pressed (translated set 2, code 0x6b on isa0060/serio0). +atkbd serio0: Use 'setkeycodes 6b ' to make it known. +atkbd serio0: Unknown key released (translated set 2, code 0x6b on isa0060/serio0). +atkbd serio0: Use 'setkeycodes 6b ' to make it known. +``` + +In some user flows this is harmless, but if a user has specifically +suspended the laptop and then closed the lid it will cause the laptop +to wakeup. The laptop wakes up because the ACPI SCI triggers when +the lid is closed and when the kernel sees that IRQ1 is "also" active. +The kernel can't distinguish from a real keyboard keypress and wakes the +system. + +Add the model into the list of quirks to disable keyboard wakeup source. +This is intentionally only matching the production BIOS version in hopes +that a newer EC firmware included in a newer BIOS can avoid this behavior. + +Cc: Kieran Levin +Link: https://github.com/FrameworkComputer/EmbeddedController/blob/lotus-zephyr/zephyr/program/lotus/azalea/src/power_sequence.c#L313 [1] +Link: https://community.frame.work/t/amd-wont-sleep-properly/41755 +Link: https://community.frame.work/t/tracking-framework-amd-ryzen-7040-series-lid-wakeup-behavior-feedback/39128 +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20231212045006.97581-5-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index c32046dfa960..b456370166b6 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -16,12 +16,17 @@ + + struct quirk_entry { + u32 s2idle_bug_mmio; ++ bool spurious_8042; + }; + + static struct quirk_entry quirk_s2idle_bug = { + .s2idle_bug_mmio = 0xfed80380, + }; + ++static struct quirk_entry quirk_spurious_8042 = { ++ .spurious_8042 = true, ++}; ++ + static const struct dmi_system_id fwbug_list[] = { + { + .ident = "L14 Gen2 AMD", +@@ -193,6 +198,16 @@ static const struct dmi_system_id fwbug_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Laptop 15s-eq2xxx"), + } + }, ++ /* https://community.frame.work/t/tracking-framework-amd-ryzen-7040-series-lid-wakeup-behavior-feedback/39128 */ ++ { ++ .ident = "Framework Laptop 13 (Phoenix)", ++ .driver_data = &quirk_spurious_8042, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Framework"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Laptop 13 (AMD Ryzen 7040Series)"), ++ DMI_MATCH(DMI_BIOS_VERSION, "03.03"), ++ } ++ }, + {} + }; + +@@ -245,4 +260,6 @@ void amd_pmc_quirks_init(struct amd_pmc_dev *dev) + if (dev->quirks->s2idle_bug_mmio) + pr_info("Using s2idle quirk to avoid %s platform firmware bug\n", + dmi_id->ident); ++ if (dev->quirks->spurious_8042) ++ dev->disable_8042_wakeup = true; + } +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-move-keyboard-wakeup-disablemen.patch b/queue-6.6/platform-x86-amd-pmc-move-keyboard-wakeup-disablemen.patch new file mode 100644 index 00000000000..1b08125096f --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-move-keyboard-wakeup-disablemen.patch @@ -0,0 +1,71 @@ +From e315f3509634fd8034b1a7cb77f709a86a8a1297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 22:50:05 -0600 +Subject: platform/x86/amd/pmc: Move keyboard wakeup disablement detection to + pmc-quirks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit b614a4bd73efeddc2b20d9e6deb6c2710373802b ] + +Other platforms may need to disable keyboard wakeup besides Cezanne, +so move the detection into amd_pmc_quirks_init() where it may be applied +to multiple platforms. + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20231212045006.97581-4-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc-quirks.c | 3 +++ + drivers/platform/x86/amd/pmc/pmc.c | 2 +- + drivers/platform/x86/amd/pmc/pmc.h | 1 + + 3 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c +index 6bbffb081053..c32046dfa960 100644 +--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c ++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c +@@ -235,6 +235,9 @@ void amd_pmc_quirks_init(struct amd_pmc_dev *dev) + { + const struct dmi_system_id *dmi_id; + ++ if (dev->cpu_id == AMD_CPU_ID_CZN) ++ dev->disable_8042_wakeup = true; ++ + dmi_id = dmi_first_match(fwbug_list); + if (!dmi_id) + return; +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index f28bee6854f4..96caf2221d87 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -878,7 +878,7 @@ static int amd_pmc_suspend_handler(struct device *dev) + { + struct amd_pmc_dev *pdev = dev_get_drvdata(dev); + +- if (pdev->cpu_id == AMD_CPU_ID_CZN && !disable_workarounds) { ++ if (pdev->disable_8042_wakeup && !disable_workarounds) { + int rc = amd_pmc_wa_irq1(pdev); + + if (rc) { +diff --git a/drivers/platform/x86/amd/pmc/pmc.h b/drivers/platform/x86/amd/pmc/pmc.h +index a85c235247d3..b4794f118739 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.h ++++ b/drivers/platform/x86/amd/pmc/pmc.h +@@ -36,6 +36,7 @@ struct amd_pmc_dev { + struct mutex lock; /* generic mutex lock */ + struct dentry *dbgfs_dir; + struct quirk_entry *quirks; ++ bool disable_8042_wakeup; + }; + + void amd_pmc_process_restore_quirks(struct amd_pmc_dev *dev); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-move-platform-defines-to-header.patch b/queue-6.6/platform-x86-amd-pmc-move-platform-defines-to-header.patch new file mode 100644 index 00000000000..848fab51aa3 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-move-platform-defines-to-header.patch @@ -0,0 +1,71 @@ +From 69570f7803928c5d7c674d33b1ff1b5e6387c2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 22:50:03 -0600 +Subject: platform/x86/amd/pmc: Move platform defines to header +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 85980669a863514dd47761efd6c1bc4677a2ae08 ] + +The platform defines will be used by the quirks in the future, +so move them to the common header to allow use by both source +files. + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20231212045006.97581-2-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc.c | 10 ---------- + drivers/platform/x86/amd/pmc/pmc.h | 11 +++++++++++ + 2 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index 212f164bc3db..3fea32880ac8 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -87,16 +87,6 @@ + #define SMU_MSG_LOG_RESET 0x07 + #define SMU_MSG_LOG_DUMP_DATA 0x08 + #define SMU_MSG_GET_SUP_CONSTRAINTS 0x09 +-/* List of supported CPU ids */ +-#define AMD_CPU_ID_RV 0x15D0 +-#define AMD_CPU_ID_RN 0x1630 +-#define AMD_CPU_ID_PCO AMD_CPU_ID_RV +-#define AMD_CPU_ID_CZN AMD_CPU_ID_RN +-#define AMD_CPU_ID_YC 0x14B5 +-#define AMD_CPU_ID_CB 0x14D8 +-#define AMD_CPU_ID_PS 0x14E8 +-#define AMD_CPU_ID_SP 0x14A4 +-#define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT 0x1507 + + #define PMC_MSG_DELAY_MIN_US 50 + #define RESPONSE_REGISTER_LOOP_MAX 20000 +diff --git a/drivers/platform/x86/amd/pmc/pmc.h b/drivers/platform/x86/amd/pmc/pmc.h +index c27bd6a5642f..a85c235247d3 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.h ++++ b/drivers/platform/x86/amd/pmc/pmc.h +@@ -41,4 +41,15 @@ struct amd_pmc_dev { + void amd_pmc_process_restore_quirks(struct amd_pmc_dev *dev); + void amd_pmc_quirks_init(struct amd_pmc_dev *dev); + ++/* List of supported CPU ids */ ++#define AMD_CPU_ID_RV 0x15D0 ++#define AMD_CPU_ID_RN 0x1630 ++#define AMD_CPU_ID_PCO AMD_CPU_ID_RV ++#define AMD_CPU_ID_CZN AMD_CPU_ID_RN ++#define AMD_CPU_ID_YC 0x14B5 ++#define AMD_CPU_ID_CB 0x14D8 ++#define AMD_CPU_ID_PS 0x14E8 ++#define AMD_CPU_ID_SP 0x14A4 ++#define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT 0x1507 ++ + #endif /* PMC_H */ +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-amd-pmc-only-run-irq1-firmware-version-.patch b/queue-6.6/platform-x86-amd-pmc-only-run-irq1-firmware-version-.patch new file mode 100644 index 00000000000..6fad9064399 --- /dev/null +++ b/queue-6.6/platform-x86-amd-pmc-only-run-irq1-firmware-version-.patch @@ -0,0 +1,74 @@ +From 8b8c3a53f3687149bc13c6bc20c52d3bdf929570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 22:50:04 -0600 +Subject: platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +[ Upstream commit 2d53c0ab61e62302d7b62d660fe76de2bff6bf45 ] + +amd_pmc_wa_czn_irq1() only runs on Cezanne platforms currently but +may be extended to other platforms in the future. Rename the function +and only check platform firmware version when it's called for a Cezanne +based platform. + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20231212045006.97581-3-mario.limonciello@amd.com +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmc/pmc.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c +index 3fea32880ac8..f28bee6854f4 100644 +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -704,19 +704,22 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev) + return -EINVAL; + } + +-static int amd_pmc_czn_wa_irq1(struct amd_pmc_dev *pdev) ++static int amd_pmc_wa_irq1(struct amd_pmc_dev *pdev) + { + struct device *d; + int rc; + +- if (!pdev->major) { +- rc = amd_pmc_get_smu_version(pdev); +- if (rc) +- return rc; +- } ++ /* cezanne platform firmware has a fix in 64.66.0 */ ++ if (pdev->cpu_id == AMD_CPU_ID_CZN) { ++ if (!pdev->major) { ++ rc = amd_pmc_get_smu_version(pdev); ++ if (rc) ++ return rc; ++ } + +- if (pdev->major > 64 || (pdev->major == 64 && pdev->minor > 65)) +- return 0; ++ if (pdev->major > 64 || (pdev->major == 64 && pdev->minor > 65)) ++ return 0; ++ } + + d = bus_find_device_by_name(&serio_bus, NULL, "serio0"); + if (!d) +@@ -876,7 +879,7 @@ static int amd_pmc_suspend_handler(struct device *dev) + struct amd_pmc_dev *pdev = dev_get_drvdata(dev); + + if (pdev->cpu_id == AMD_CPU_ID_CZN && !disable_workarounds) { +- int rc = amd_pmc_czn_wa_irq1(pdev); ++ int rc = amd_pmc_wa_irq1(pdev); + + if (rc) { + dev_err(pdev->dev, "failed to adjust keyboard wakeup: %d\n", rc); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch b/queue-6.6/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch new file mode 100644 index 00000000000..e135ffbba94 --- /dev/null +++ b/queue-6.6/platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch @@ -0,0 +1,99 @@ +From fb48022c46f3063c3c9e6e81bc08612e77ebae21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 16:06:01 +0100 +Subject: platform/x86: intel-vbtn: Fix missing tablet-mode-switch events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f ] + +2 issues have been reported on the Dell Inspiron 7352: + +1. Sometimes the tablet-mode-switch stops reporting tablet-mode + change events. + + Add a "VBDL" call to notify_handler() to work around this. + +2. Sometimes the tablet-mode is incorrect after suspend/resume + + Add a detect_tablet_mode() to resume() to fix this. + +Reported-by: Arnold Gozum +Closes: https://lore.kernel.org/platform-driver-x86/87271a74-c831-4eec-b7a4-1371d0e42471@gmail.com/ +Tested-by: Arnold Gozum +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20231204150601.46976-1-hdegoede@redhat.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/vbtn.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c +index 6fa1735ad7a4..210b0a81b7ec 100644 +--- a/drivers/platform/x86/intel/vbtn.c ++++ b/drivers/platform/x86/intel/vbtn.c +@@ -73,10 +73,10 @@ struct intel_vbtn_priv { + bool wakeup_mode; + }; + +-static void detect_tablet_mode(struct platform_device *device) ++static void detect_tablet_mode(struct device *dev) + { +- struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev); +- acpi_handle handle = ACPI_HANDLE(&device->dev); ++ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); ++ acpi_handle handle = ACPI_HANDLE(dev); + unsigned long long vgbs; + acpi_status status; + int m; +@@ -89,6 +89,8 @@ static void detect_tablet_mode(struct platform_device *device) + input_report_switch(priv->switches_dev, SW_TABLET_MODE, m); + m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0; + input_report_switch(priv->switches_dev, SW_DOCK, m); ++ ++ input_sync(priv->switches_dev); + } + + /* +@@ -134,7 +136,7 @@ static int intel_vbtn_input_setup(struct platform_device *device) + priv->switches_dev->id.bustype = BUS_HOST; + + if (priv->has_switches) { +- detect_tablet_mode(device); ++ detect_tablet_mode(&device->dev); + + ret = input_register_device(priv->switches_dev); + if (ret) +@@ -198,6 +200,9 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + autorelease = val && (!ke_rel || ke_rel->type == KE_IGNORE); + + sparse_keymap_report_event(input_dev, event, val, autorelease); ++ ++ /* Some devices need this to report further events */ ++ acpi_evaluate_object(handle, "VBDL", NULL, NULL); + } + + /* +@@ -352,7 +357,13 @@ static void intel_vbtn_pm_complete(struct device *dev) + + static int intel_vbtn_pm_resume(struct device *dev) + { ++ struct intel_vbtn_priv *priv = dev_get_drvdata(dev); ++ + intel_vbtn_pm_complete(dev); ++ ++ if (priv->has_switches) ++ detect_tablet_mode(dev); ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch b/queue-6.6/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch new file mode 100644 index 00000000000..62960f144a4 --- /dev/null +++ b/queue-6.6/platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch @@ -0,0 +1,252 @@ +From 4ef4662083491c37d40fbcf0067b3c2a2cacc79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 22:47:02 +0900 +Subject: platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some + ThinkPad systems +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vishnu Sankar + +[ Upstream commit 66e92e23a72761f5b53f970aeb1badc5fd92fc74 ] + +Some ThinkPad systems ECFW use non-standard addresses for fan control +and reporting. This patch adds support for such ECFW so that it can report +the correct fan values. +Tested on Thinkpads L13 Yoga Gen 2 and X13 Yoga Gen 2. + +Suggested-by: Mark Pearson +Signed-off-by: Vishnu Sankar +Reviewed-by: Hans de Goede +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20231214134702.166464-1-vishnuocv@gmail.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/thinkpad_acpi.c | 98 ++++++++++++++++++++++++---- + 1 file changed, 85 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index a46fc417cb20..d73cbae4aa21 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -7948,8 +7948,19 @@ static struct ibm_struct volume_driver_data = { + * TPACPI_FAN_WR_TPEC is also available and should be used to + * command the fan. The X31/X40/X41 seems to have 8 fan levels, + * but the ACPI tables just mention level 7. ++ * ++ * TPACPI_FAN_RD_TPEC_NS: ++ * This mode is used for a few ThinkPads (L13 Yoga Gen2, X13 Yoga Gen2 etc.) ++ * that are using non-standard EC locations for reporting fan speeds. ++ * Currently these platforms only provide fan rpm reporting. ++ * + */ + ++#define FAN_RPM_CAL_CONST 491520 /* FAN RPM calculation offset for some non-standard ECFW */ ++ ++#define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */ ++#define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */ ++ + enum { /* Fan control constants */ + fan_status_offset = 0x2f, /* EC register 0x2f */ + fan_rpm_offset = 0x84, /* EC register 0x84: LSB, 0x85 MSB (RPM) +@@ -7957,6 +7968,11 @@ enum { /* Fan control constants */ + fan_select_offset = 0x31, /* EC register 0x31 (Firmware 7M) + bit 0 selects which fan is active */ + ++ fan_status_offset_ns = 0x93, /* Special status/control offset for non-standard EC Fan1 */ ++ fan2_status_offset_ns = 0x96, /* Special status/control offset for non-standard EC Fan2 */ ++ fan_rpm_status_ns = 0x95, /* Special offset for Fan1 RPM status for non-standard EC */ ++ fan2_rpm_status_ns = 0x98, /* Special offset for Fan2 RPM status for non-standard EC */ ++ + TP_EC_FAN_FULLSPEED = 0x40, /* EC fan mode: full speed */ + TP_EC_FAN_AUTO = 0x80, /* EC fan mode: auto fan control */ + +@@ -7967,6 +7983,7 @@ enum fan_status_access_mode { + TPACPI_FAN_NONE = 0, /* No fan status or control */ + TPACPI_FAN_RD_ACPI_GFAN, /* Use ACPI GFAN */ + TPACPI_FAN_RD_TPEC, /* Use ACPI EC regs 0x2f, 0x84-0x85 */ ++ TPACPI_FAN_RD_TPEC_NS, /* Use non-standard ACPI EC regs (eg: L13 Yoga gen2 etc.) */ + }; + + enum fan_control_access_mode { +@@ -7994,6 +8011,8 @@ static u8 fan_control_desired_level; + static u8 fan_control_resume_level; + static int fan_watchdog_maxinterval; + ++static bool fan_with_ns_addr; ++ + static struct mutex fan_mutex; + + static void fan_watchdog_fire(struct work_struct *ignored); +@@ -8123,6 +8142,15 @@ static int fan_get_status(u8 *status) + } + + break; ++ case TPACPI_FAN_RD_TPEC_NS: ++ /* Default mode is AUTO which means controlled by EC */ ++ if (!acpi_ec_read(fan_status_offset_ns, &s)) ++ return -EIO; ++ ++ if (status) ++ *status = s; ++ ++ break; + + default: + return -ENXIO; +@@ -8139,7 +8167,8 @@ static int fan_get_status_safe(u8 *status) + if (mutex_lock_killable(&fan_mutex)) + return -ERESTARTSYS; + rc = fan_get_status(&s); +- if (!rc) ++ /* NS EC doesn't have register with level settings */ ++ if (!rc && !fan_with_ns_addr) + fan_update_desired_level(s); + mutex_unlock(&fan_mutex); + +@@ -8166,7 +8195,13 @@ static int fan_get_speed(unsigned int *speed) + + if (likely(speed)) + *speed = (hi << 8) | lo; ++ break; ++ case TPACPI_FAN_RD_TPEC_NS: ++ if (!acpi_ec_read(fan_rpm_status_ns, &lo)) ++ return -EIO; + ++ if (speed) ++ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; + break; + + default: +@@ -8178,7 +8213,7 @@ static int fan_get_speed(unsigned int *speed) + + static int fan2_get_speed(unsigned int *speed) + { +- u8 hi, lo; ++ u8 hi, lo, status; + bool rc; + + switch (fan_status_access_mode) { +@@ -8194,7 +8229,21 @@ static int fan2_get_speed(unsigned int *speed) + + if (likely(speed)) + *speed = (hi << 8) | lo; ++ break; + ++ case TPACPI_FAN_RD_TPEC_NS: ++ rc = !acpi_ec_read(fan2_status_offset_ns, &status); ++ if (rc) ++ return -EIO; ++ if (!(status & FAN_NS_CTRL_STATUS)) { ++ pr_info("secondary fan control not supported\n"); ++ return -EIO; ++ } ++ rc = !acpi_ec_read(fan2_rpm_status_ns, &lo); ++ if (rc) ++ return -EIO; ++ if (speed) ++ *speed = lo ? FAN_RPM_CAL_CONST / lo : 0; + break; + + default: +@@ -8697,6 +8746,7 @@ static const struct attribute_group fan_driver_attr_group = { + #define TPACPI_FAN_2FAN 0x0002 /* EC 0x31 bit 0 selects fan2 */ + #define TPACPI_FAN_2CTL 0x0004 /* selects fan2 control */ + #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */ ++#define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */ + + static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1), +@@ -8715,6 +8765,8 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = { + TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */ + TPACPI_Q_LNV3('N', '3', '0', TPACPI_FAN_2CTL), /* P15 (1st gen) / P15v (1st gen) */ + TPACPI_Q_LNV3('N', '3', '7', TPACPI_FAN_2CTL), /* T15g (2nd gen) */ ++ TPACPI_Q_LNV3('R', '1', 'F', TPACPI_FAN_NS), /* L13 Yoga Gen 2 */ ++ TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/ + TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */ + }; + +@@ -8749,18 +8801,27 @@ static int __init fan_init(struct ibm_init_struct *iibm) + return -ENODEV; + } + ++ if (quirks & TPACPI_FAN_NS) { ++ pr_info("ECFW with non-standard fan reg control found\n"); ++ fan_with_ns_addr = 1; ++ /* Fan ctrl support from host is undefined for now */ ++ tp_features.fan_ctrl_status_undef = 1; ++ } ++ + if (gfan_handle) { + /* 570, 600e/x, 770e, 770x */ + fan_status_access_mode = TPACPI_FAN_RD_ACPI_GFAN; + } else { + /* all other ThinkPads: note that even old-style + * ThinkPad ECs supports the fan control register */ +- if (likely(acpi_ec_read(fan_status_offset, +- &fan_control_initial_status))) { ++ if (fan_with_ns_addr || ++ likely(acpi_ec_read(fan_status_offset, &fan_control_initial_status))) { + int res; + unsigned int speed; + +- fan_status_access_mode = TPACPI_FAN_RD_TPEC; ++ fan_status_access_mode = fan_with_ns_addr ? ++ TPACPI_FAN_RD_TPEC_NS : TPACPI_FAN_RD_TPEC; ++ + if (quirks & TPACPI_FAN_Q1) + fan_quirk1_setup(); + /* Try and probe the 2nd fan */ +@@ -8769,7 +8830,8 @@ static int __init fan_init(struct ibm_init_struct *iibm) + if (res >= 0 && speed != FAN_NOT_PRESENT) { + /* It responded - so let's assume it's there */ + tp_features.second_fan = 1; +- tp_features.second_fan_ctl = 1; ++ /* fan control not currently available for ns ECFW */ ++ tp_features.second_fan_ctl = !fan_with_ns_addr; + pr_info("secondary fan control detected & enabled\n"); + } else { + /* Fan not auto-detected */ +@@ -8944,6 +9006,7 @@ static int fan_read(struct seq_file *m) + str_enabled_disabled(status), status); + break; + ++ case TPACPI_FAN_RD_TPEC_NS: + case TPACPI_FAN_RD_TPEC: + /* all except 570, 600e/x, 770e, 770x */ + rc = fan_get_status_safe(&status); +@@ -8958,13 +9021,22 @@ static int fan_read(struct seq_file *m) + + seq_printf(m, "speed:\t\t%d\n", speed); + +- if (status & TP_EC_FAN_FULLSPEED) +- /* Disengaged mode takes precedence */ +- seq_printf(m, "level:\t\tdisengaged\n"); +- else if (status & TP_EC_FAN_AUTO) +- seq_printf(m, "level:\t\tauto\n"); +- else +- seq_printf(m, "level:\t\t%d\n", status); ++ if (fan_status_access_mode == TPACPI_FAN_RD_TPEC_NS) { ++ /* ++ * No full speed bit in NS EC ++ * EC Auto mode is set by default. ++ * No other levels settings available ++ */ ++ seq_printf(m, "level:\t\t%s\n", status & FAN_NS_CTRL ? "unknown" : "auto"); ++ } else { ++ if (status & TP_EC_FAN_FULLSPEED) ++ /* Disengaged mode takes precedence */ ++ seq_printf(m, "level:\t\tdisengaged\n"); ++ else if (status & TP_EC_FAN_AUTO) ++ seq_printf(m, "level:\t\tauto\n"); ++ else ++ seq_printf(m, "level:\t\t%d\n", status); ++ } + break; + + case TPACPI_FAN_NONE: +-- +2.43.0 + diff --git a/queue-6.6/posix-timers-get-rid-of-compat_-sys_ni-uses.patch b/queue-6.6/posix-timers-get-rid-of-compat_-sys_ni-uses.patch new file mode 100644 index 00000000000..ba6e8800aa0 --- /dev/null +++ b/queue-6.6/posix-timers-get-rid-of-compat_-sys_ni-uses.patch @@ -0,0 +1,337 @@ +From f826a80de35b4ac585cc129835e120bc67f2dca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 15:26:59 -0800 +Subject: posix-timers: Get rid of [COMPAT_]SYS_NI() uses + +From: Linus Torvalds + +[ Upstream commit a4aebe936554dac6a91e5d091179c934f8325708 ] + +Only the posix timer system calls use this (when the posix timer support +is disabled, which does not actually happen in any normal case), because +they had debug code to print out a warning about missing system calls. + +Get rid of that special case, and just use the standard COND_SYSCALL +interface that creates weak system call stubs that return -ENOSYS for +when the system call does not exist. + +This fixes a kCFI issue with the SYS_NI() hackery: + + CFI failure at int80_emulation+0x67/0xb0 (target: sys_ni_posix_timers+0x0/0x70; expected type: 0xb02b34d9) + WARNING: CPU: 0 PID: 48 at int80_emulation+0x67/0xb0 + +Reported-by: kernel test robot +Reviewed-by: Sami Tolvanen +Tested-by: Sami Tolvanen +Cc: Thomas Gleixner +Cc: Dave Hansen +Cc: Borislav Petkov +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/syscall_wrapper.h | 4 --- + arch/riscv/include/asm/syscall_wrapper.h | 5 --- + arch/s390/include/asm/syscall_wrapper.h | 13 +------ + arch/x86/include/asm/syscall_wrapper.h | 34 +++--------------- + kernel/sys_ni.c | 14 ++++++++ + kernel/time/posix-stubs.c | 45 ------------------------ + 6 files changed, 19 insertions(+), 96 deletions(-) + +diff --git a/arch/arm64/include/asm/syscall_wrapper.h b/arch/arm64/include/asm/syscall_wrapper.h +index 17f687510c48..7a0e7b59be9b 100644 +--- a/arch/arm64/include/asm/syscall_wrapper.h ++++ b/arch/arm64/include/asm/syscall_wrapper.h +@@ -44,9 +44,6 @@ + return sys_ni_syscall(); \ + } + +-#define COMPAT_SYS_NI(name) \ +- SYSCALL_ALIAS(__arm64_compat_sys_##name, sys_ni_posix_timers); +- + #endif /* CONFIG_COMPAT */ + + #define __SYSCALL_DEFINEx(x, name, ...) \ +@@ -82,6 +79,5 @@ + } + + asmlinkage long __arm64_sys_ni_syscall(const struct pt_regs *__unused); +-#define SYS_NI(name) SYSCALL_ALIAS(__arm64_sys_##name, sys_ni_posix_timers); + + #endif /* __ASM_SYSCALL_WRAPPER_H */ +diff --git a/arch/riscv/include/asm/syscall_wrapper.h b/arch/riscv/include/asm/syscall_wrapper.h +index 1d7942c8a6cb..eeec04b7dae6 100644 +--- a/arch/riscv/include/asm/syscall_wrapper.h ++++ b/arch/riscv/include/asm/syscall_wrapper.h +@@ -46,9 +46,6 @@ asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *); + return sys_ni_syscall(); \ + } + +-#define COMPAT_SYS_NI(name) \ +- SYSCALL_ALIAS(__riscv_compat_sys_##name, sys_ni_posix_timers); +- + #endif /* CONFIG_COMPAT */ + + #define __SYSCALL_DEFINEx(x, name, ...) \ +@@ -82,6 +79,4 @@ asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *); + return sys_ni_syscall(); \ + } + +-#define SYS_NI(name) SYSCALL_ALIAS(__riscv_sys_##name, sys_ni_posix_timers); +- + #endif /* __ASM_SYSCALL_WRAPPER_H */ +diff --git a/arch/s390/include/asm/syscall_wrapper.h b/arch/s390/include/asm/syscall_wrapper.h +index 9286430fe729..35c1d1b860d8 100644 +--- a/arch/s390/include/asm/syscall_wrapper.h ++++ b/arch/s390/include/asm/syscall_wrapper.h +@@ -63,10 +63,6 @@ + cond_syscall(__s390x_sys_##name); \ + cond_syscall(__s390_sys_##name) + +-#define SYS_NI(name) \ +- SYSCALL_ALIAS(__s390x_sys_##name, sys_ni_posix_timers); \ +- SYSCALL_ALIAS(__s390_sys_##name, sys_ni_posix_timers) +- + #define COMPAT_SYSCALL_DEFINEx(x, name, ...) \ + long __s390_compat_sys##name(struct pt_regs *regs); \ + ALLOW_ERROR_INJECTION(__s390_compat_sys##name, ERRNO); \ +@@ -85,15 +81,11 @@ + + /* + * As some compat syscalls may not be implemented, we need to expand +- * COND_SYSCALL_COMPAT in kernel/sys_ni.c and COMPAT_SYS_NI in +- * kernel/time/posix-stubs.c to cover this case as well. ++ * COND_SYSCALL_COMPAT in kernel/sys_ni.c to cover this case as well. + */ + #define COND_SYSCALL_COMPAT(name) \ + cond_syscall(__s390_compat_sys_##name) + +-#define COMPAT_SYS_NI(name) \ +- SYSCALL_ALIAS(__s390_compat_sys_##name, sys_ni_posix_timers) +- + #define __S390_SYS_STUBx(x, name, ...) \ + long __s390_sys##name(struct pt_regs *regs); \ + ALLOW_ERROR_INJECTION(__s390_sys##name, ERRNO); \ +@@ -124,9 +116,6 @@ + #define COND_SYSCALL(name) \ + cond_syscall(__s390x_sys_##name) + +-#define SYS_NI(name) \ +- SYSCALL_ALIAS(__s390x_sys_##name, sys_ni_posix_timers) +- + #define __S390_SYS_STUBx(x, fullname, name, ...) + + #endif /* CONFIG_COMPAT */ +diff --git a/arch/x86/include/asm/syscall_wrapper.h b/arch/x86/include/asm/syscall_wrapper.h +index fd2669b1cb2d..21f9407be5d3 100644 +--- a/arch/x86/include/asm/syscall_wrapper.h ++++ b/arch/x86/include/asm/syscall_wrapper.h +@@ -86,9 +86,6 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + return sys_ni_syscall(); \ + } + +-#define __SYS_NI(abi, name) \ +- SYSCALL_ALIAS(__##abi##_##name, sys_ni_posix_timers); +- + #ifdef CONFIG_X86_64 + #define __X64_SYS_STUB0(name) \ + __SYS_STUB0(x64, sys_##name) +@@ -100,13 +97,10 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + #define __X64_COND_SYSCALL(name) \ + __COND_SYSCALL(x64, sys_##name) + +-#define __X64_SYS_NI(name) \ +- __SYS_NI(x64, sys_##name) + #else /* CONFIG_X86_64 */ + #define __X64_SYS_STUB0(name) + #define __X64_SYS_STUBx(x, name, ...) + #define __X64_COND_SYSCALL(name) +-#define __X64_SYS_NI(name) + #endif /* CONFIG_X86_64 */ + + #if defined(CONFIG_X86_32) || defined(CONFIG_IA32_EMULATION) +@@ -120,13 +114,10 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + #define __IA32_COND_SYSCALL(name) \ + __COND_SYSCALL(ia32, sys_##name) + +-#define __IA32_SYS_NI(name) \ +- __SYS_NI(ia32, sys_##name) + #else /* CONFIG_X86_32 || CONFIG_IA32_EMULATION */ + #define __IA32_SYS_STUB0(name) + #define __IA32_SYS_STUBx(x, name, ...) + #define __IA32_COND_SYSCALL(name) +-#define __IA32_SYS_NI(name) + #endif /* CONFIG_X86_32 || CONFIG_IA32_EMULATION */ + + #ifdef CONFIG_IA32_EMULATION +@@ -135,8 +126,7 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + * additional wrappers (aptly named __ia32_sys_xyzzy) which decode the + * ia32 regs in the proper order for shared or "common" syscalls. As some + * syscalls may not be implemented, we need to expand COND_SYSCALL in +- * kernel/sys_ni.c and SYS_NI in kernel/time/posix-stubs.c to cover this +- * case as well. ++ * kernel/sys_ni.c to cover this case as well. + */ + #define __IA32_COMPAT_SYS_STUB0(name) \ + __SYS_STUB0(ia32, compat_sys_##name) +@@ -148,14 +138,10 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + #define __IA32_COMPAT_COND_SYSCALL(name) \ + __COND_SYSCALL(ia32, compat_sys_##name) + +-#define __IA32_COMPAT_SYS_NI(name) \ +- __SYS_NI(ia32, compat_sys_##name) +- + #else /* CONFIG_IA32_EMULATION */ + #define __IA32_COMPAT_SYS_STUB0(name) + #define __IA32_COMPAT_SYS_STUBx(x, name, ...) + #define __IA32_COMPAT_COND_SYSCALL(name) +-#define __IA32_COMPAT_SYS_NI(name) + #endif /* CONFIG_IA32_EMULATION */ + + +@@ -175,13 +161,10 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + #define __X32_COMPAT_COND_SYSCALL(name) \ + __COND_SYSCALL(x64, compat_sys_##name) + +-#define __X32_COMPAT_SYS_NI(name) \ +- __SYS_NI(x64, compat_sys_##name) + #else /* CONFIG_X86_X32_ABI */ + #define __X32_COMPAT_SYS_STUB0(name) + #define __X32_COMPAT_SYS_STUBx(x, name, ...) + #define __X32_COMPAT_COND_SYSCALL(name) +-#define __X32_COMPAT_SYS_NI(name) + #endif /* CONFIG_X86_X32_ABI */ + + +@@ -212,17 +195,12 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + + /* + * As some compat syscalls may not be implemented, we need to expand +- * COND_SYSCALL_COMPAT in kernel/sys_ni.c and COMPAT_SYS_NI in +- * kernel/time/posix-stubs.c to cover this case as well. ++ * COND_SYSCALL_COMPAT in kernel/sys_ni.c to cover this case as well. + */ + #define COND_SYSCALL_COMPAT(name) \ + __IA32_COMPAT_COND_SYSCALL(name) \ + __X32_COMPAT_COND_SYSCALL(name) + +-#define COMPAT_SYS_NI(name) \ +- __IA32_COMPAT_SYS_NI(name) \ +- __X32_COMPAT_SYS_NI(name) +- + #endif /* CONFIG_COMPAT */ + + #define __SYSCALL_DEFINEx(x, name, ...) \ +@@ -243,8 +221,8 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + * As the generic SYSCALL_DEFINE0() macro does not decode any parameters for + * obvious reasons, and passing struct pt_regs *regs to it in %rdi does not + * hurt, we only need to re-define it here to keep the naming congruent to +- * SYSCALL_DEFINEx() -- which is essential for the COND_SYSCALL() and SYS_NI() +- * macros to work correctly. ++ * SYSCALL_DEFINEx() -- which is essential for the COND_SYSCALL() macro ++ * to work correctly. + */ + #define SYSCALL_DEFINE0(sname) \ + SYSCALL_METADATA(_##sname, 0); \ +@@ -257,10 +235,6 @@ extern long __ia32_sys_ni_syscall(const struct pt_regs *regs); + __X64_COND_SYSCALL(name) \ + __IA32_COND_SYSCALL(name) + +-#define SYS_NI(name) \ +- __X64_SYS_NI(name) \ +- __IA32_SYS_NI(name) +- + + /* + * For VSYSCALLS, we need to declare these three syscalls with the new +diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c +index e137c1385c56..11c55593a2e9 100644 +--- a/kernel/sys_ni.c ++++ b/kernel/sys_ni.c +@@ -200,6 +200,20 @@ COND_SYSCALL(recvmmsg_time32); + COND_SYSCALL_COMPAT(recvmmsg_time32); + COND_SYSCALL_COMPAT(recvmmsg_time64); + ++/* Posix timer syscalls may be configured out */ ++COND_SYSCALL(timer_create); ++COND_SYSCALL(timer_gettime); ++COND_SYSCALL(timer_getoverrun); ++COND_SYSCALL(timer_settime); ++COND_SYSCALL(timer_delete); ++COND_SYSCALL(clock_adjtime); ++COND_SYSCALL(getitimer); ++COND_SYSCALL(setitimer); ++COND_SYSCALL(alarm); ++COND_SYSCALL_COMPAT(timer_create); ++COND_SYSCALL_COMPAT(getitimer); ++COND_SYSCALL_COMPAT(setitimer); ++ + /* + * Architecture specific syscalls: see further below + */ +diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c +index 828aeecbd1e8..9b6fcb8d85e7 100644 +--- a/kernel/time/posix-stubs.c ++++ b/kernel/time/posix-stubs.c +@@ -17,40 +17,6 @@ + #include + #include + +-#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER +-/* Architectures may override SYS_NI and COMPAT_SYS_NI */ +-#include +-#endif +- +-asmlinkage long sys_ni_posix_timers(void) +-{ +- pr_err_once("process %d (%s) attempted a POSIX timer syscall " +- "while CONFIG_POSIX_TIMERS is not set\n", +- current->pid, current->comm); +- return -ENOSYS; +-} +- +-#ifndef SYS_NI +-#define SYS_NI(name) SYSCALL_ALIAS(sys_##name, sys_ni_posix_timers) +-#endif +- +-#ifndef COMPAT_SYS_NI +-#define COMPAT_SYS_NI(name) SYSCALL_ALIAS(compat_sys_##name, sys_ni_posix_timers) +-#endif +- +-SYS_NI(timer_create); +-SYS_NI(timer_gettime); +-SYS_NI(timer_getoverrun); +-SYS_NI(timer_settime); +-SYS_NI(timer_delete); +-SYS_NI(clock_adjtime); +-SYS_NI(getitimer); +-SYS_NI(setitimer); +-SYS_NI(clock_adjtime32); +-#ifdef __ARCH_WANT_SYS_ALARM +-SYS_NI(alarm); +-#endif +- + /* + * We preserve minimal support for CLOCK_REALTIME and CLOCK_MONOTONIC + * as it is easy to remain compatible with little code. CLOCK_BOOTTIME +@@ -158,18 +124,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, + which_clock); + } + +-#ifdef CONFIG_COMPAT +-COMPAT_SYS_NI(timer_create); +-#endif +- +-#if defined(CONFIG_COMPAT) || defined(CONFIG_ALPHA) +-COMPAT_SYS_NI(getitimer); +-COMPAT_SYS_NI(setitimer); +-#endif +- + #ifdef CONFIG_COMPAT_32BIT_TIME +-SYS_NI(timer_settime32); +-SYS_NI(timer_gettime32); + + SYSCALL_DEFINE2(clock_settime32, const clockid_t, which_clock, + struct old_timespec32 __user *, tp) +-- +2.43.0 + diff --git a/queue-6.6/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch b/queue-6.6/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch new file mode 100644 index 00000000000..51bec9fee83 --- /dev/null +++ b/queue-6.6/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch @@ -0,0 +1,38 @@ +From d1524722148558ec85290c32f3b8fabe2592af5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 11:13:00 +0200 +Subject: reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning + +From: Krzysztof Kozlowski + +[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ] + +'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 +causes: + + hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/hisilicon/hi6220_reset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c +index 8d1fce18ded7..5c3267acd2b1 100644 +--- a/drivers/reset/hisilicon/hi6220_reset.c ++++ b/drivers/reset/hisilicon/hi6220_reset.c +@@ -163,7 +163,7 @@ static int hi6220_reset_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + +- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev); ++ type = (uintptr_t)of_device_get_match_data(dev); + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { +-- +2.43.0 + diff --git a/queue-6.6/revert-drm-prime-unexport-helpers-for-fd-handle-conv.patch b/queue-6.6/revert-drm-prime-unexport-helpers-for-fd-handle-conv.patch new file mode 100644 index 00000000000..566307f53c3 --- /dev/null +++ b/queue-6.6/revert-drm-prime-unexport-helpers-for-fd-handle-conv.patch @@ -0,0 +1,151 @@ +From c5b9cd9b82e4bedb513a97b6cd6520d4e1a00adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 16:44:17 -0500 +Subject: Revert "drm/prime: Unexport helpers for fd/handle conversion" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit 0514f63cfff38a0dcb7ba9c5f245827edc0c5107 ] + +This reverts commit 71a7974ac7019afeec105a54447ae1dc7216cbb3. + +These helper functions are needed for KFD to export and import DMABufs +the right way without duplicating the tracking of DMABufs associated with +GEM objects while ensuring that move notifier callbacks are working as +intended. + +CC: Christian König +CC: Thomas Zimmermann +Acked-by: Thomas Zimmermann +Acked-by: Daniel Vetter +Signed-off-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_prime.c | 33 ++++++++++++++++++--------------- + include/drm/drm_prime.h | 7 +++++++ + 2 files changed, 25 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c +index 63b709a67471..834a5e28abbe 100644 +--- a/drivers/gpu/drm/drm_prime.c ++++ b/drivers/gpu/drm/drm_prime.c +@@ -278,7 +278,7 @@ void drm_gem_dmabuf_release(struct dma_buf *dma_buf) + } + EXPORT_SYMBOL(drm_gem_dmabuf_release); + +-/* ++/** + * drm_gem_prime_fd_to_handle - PRIME import function for GEM drivers + * @dev: drm_device to import into + * @file_priv: drm file-private structure +@@ -292,9 +292,9 @@ EXPORT_SYMBOL(drm_gem_dmabuf_release); + * + * Returns 0 on success or a negative error code on failure. + */ +-static int drm_gem_prime_fd_to_handle(struct drm_device *dev, +- struct drm_file *file_priv, int prime_fd, +- uint32_t *handle) ++int drm_gem_prime_fd_to_handle(struct drm_device *dev, ++ struct drm_file *file_priv, int prime_fd, ++ uint32_t *handle) + { + struct dma_buf *dma_buf; + struct drm_gem_object *obj; +@@ -360,6 +360,7 @@ static int drm_gem_prime_fd_to_handle(struct drm_device *dev, + dma_buf_put(dma_buf); + return ret; + } ++EXPORT_SYMBOL(drm_gem_prime_fd_to_handle); + + int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data, + struct drm_file *file_priv) +@@ -408,7 +409,7 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev, + return dmabuf; + } + +-/* ++/** + * drm_gem_prime_handle_to_fd - PRIME export function for GEM drivers + * @dev: dev to export the buffer from + * @file_priv: drm file-private structure +@@ -421,10 +422,10 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev, + * The actual exporting from GEM object to a dma-buf is done through the + * &drm_gem_object_funcs.export callback. + */ +-static int drm_gem_prime_handle_to_fd(struct drm_device *dev, +- struct drm_file *file_priv, uint32_t handle, +- uint32_t flags, +- int *prime_fd) ++int drm_gem_prime_handle_to_fd(struct drm_device *dev, ++ struct drm_file *file_priv, uint32_t handle, ++ uint32_t flags, ++ int *prime_fd) + { + struct drm_gem_object *obj; + int ret = 0; +@@ -506,6 +507,7 @@ static int drm_gem_prime_handle_to_fd(struct drm_device *dev, + + return ret; + } ++EXPORT_SYMBOL(drm_gem_prime_handle_to_fd); + + int drm_prime_handle_to_fd_ioctl(struct drm_device *dev, void *data, + struct drm_file *file_priv) +@@ -864,9 +866,9 @@ EXPORT_SYMBOL(drm_prime_get_contiguous_size); + * @obj: GEM object to export + * @flags: flags like DRM_CLOEXEC and DRM_RDWR + * +- * This is the implementation of the &drm_gem_object_funcs.export functions +- * for GEM drivers using the PRIME helpers. It is used as the default for +- * drivers that do not set their own. ++ * This is the implementation of the &drm_gem_object_funcs.export functions for GEM drivers ++ * using the PRIME helpers. It is used as the default in ++ * drm_gem_prime_handle_to_fd(). + */ + struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj, + int flags) +@@ -962,9 +964,10 @@ EXPORT_SYMBOL(drm_gem_prime_import_dev); + * @dev: drm_device to import into + * @dma_buf: dma-buf object to import + * +- * This is the implementation of the gem_prime_import functions for GEM +- * drivers using the PRIME helpers. It is the default for drivers that do +- * not set their own &drm_driver.gem_prime_import. ++ * This is the implementation of the gem_prime_import functions for GEM drivers ++ * using the PRIME helpers. Drivers can use this as their ++ * &drm_driver.gem_prime_import implementation. It is used as the default ++ * implementation in drm_gem_prime_fd_to_handle(). + * + * Drivers must arrange to call drm_prime_gem_destroy() from their + * &drm_gem_object_funcs.free hook when using this function. +diff --git a/include/drm/drm_prime.h b/include/drm/drm_prime.h +index a7abf9f3e697..2a1d01e5b56b 100644 +--- a/include/drm/drm_prime.h ++++ b/include/drm/drm_prime.h +@@ -60,12 +60,19 @@ enum dma_data_direction; + + struct drm_device; + struct drm_gem_object; ++struct drm_file; + + /* core prime functions */ + struct dma_buf *drm_gem_dmabuf_export(struct drm_device *dev, + struct dma_buf_export_info *exp_info); + void drm_gem_dmabuf_release(struct dma_buf *dma_buf); + ++int drm_gem_prime_fd_to_handle(struct drm_device *dev, ++ struct drm_file *file_priv, int prime_fd, uint32_t *handle); ++int drm_gem_prime_handle_to_fd(struct drm_device *dev, ++ struct drm_file *file_priv, uint32_t handle, uint32_t flags, ++ int *prime_fd); ++ + /* helper functions for exporting */ + int drm_gem_map_attach(struct dma_buf *dma_buf, + struct dma_buf_attachment *attach); +-- +2.43.0 + diff --git a/queue-6.6/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch b/queue-6.6/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch new file mode 100644 index 00000000000..65fc380229e --- /dev/null +++ b/queue-6.6/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch @@ -0,0 +1,45 @@ +From 4c90bd3469bc3549cc5018f7102c95a720a6cad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 17:54:03 -0500 +Subject: ring-buffer: Do not record in NMI if the arch does not support + cmpxchg in NMI + +From: Steven Rostedt (Google) + +[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ] + +As the ring buffer recording requires cmpxchg() to work, if the +architecture does not support cmpxchg in NMI, then do not do any recording +within an NMI. + +Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 901a140e30fa..f232cf56fa05 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3649,6 +3649,12 @@ rb_reserve_next_event(struct trace_buffer *buffer, + int nr_loops = 0; + int add_ts_default; + ++ /* ring buffer does cmpxchg, make sure it is safe in NMI context */ ++ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) && ++ (unlikely(in_nmi()))) { ++ return NULL; ++ } ++ + rb_start_commit(cpu_buffer); + /* The commit page can not change after this */ + +-- +2.43.0 + diff --git a/queue-6.6/s390-scm-fix-virtual-vs-physical-address-confusion.patch b/queue-6.6/s390-scm-fix-virtual-vs-physical-address-confusion.patch new file mode 100644 index 00000000000..6275d91e13d --- /dev/null +++ b/queue-6.6/s390-scm-fix-virtual-vs-physical-address-confusion.patch @@ -0,0 +1,59 @@ +From 2fbb62dcd5e521a0130ef3116104de573e30b06a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 22:52:53 +0100 +Subject: s390/scm: fix virtual vs physical address confusion + +From: Vineeth Vijayan + +[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ] + +Fix virtual vs physical address confusion (which currently are the same). + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Acked-by: Alexander Gordeev +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/block/scm_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c +index 3a9cc8a4a230..ade95e91b3c8 100644 +--- a/drivers/s390/block/scm_blk.c ++++ b/drivers/s390/block/scm_blk.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include "scm_blk.h" + +@@ -130,7 +131,7 @@ static void scm_request_done(struct scm_request *scmrq) + + for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) { + msb = &scmrq->aob->msb[i]; +- aidaw = msb->data_addr; ++ aidaw = (u64)phys_to_virt(msb->data_addr); + + if ((msb->flags & MSB_FLAG_IDA) && aidaw && + IS_ALIGNED(aidaw, PAGE_SIZE)) +@@ -195,12 +196,12 @@ static int scm_request_prepare(struct scm_request *scmrq) + msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9); + msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE; + msb->flags |= MSB_FLAG_IDA; +- msb->data_addr = (u64) aidaw; ++ msb->data_addr = (u64)virt_to_phys(aidaw); + + rq_for_each_segment(bv, req, iter) { + WARN_ON(bv.bv_offset); + msb->blk_count += bv.bv_len >> 12; +- aidaw->data_addr = (u64) page_address(bv.bv_page); ++ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page)); + aidaw++; + } + +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 4c6ad7e1923..effaadb0be5 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,131 @@ f2fs-explicitly-null-terminate-the-xattr-list.patch +pinctrl-s32cc-avoid-possible-string-truncation.patch +kunit-warn-if-tests-are-slow.patch +kunit-reset-suite-counter-right-before-running-tests.patch +pinctrl-lochnagar-don-t-build-on-mips.patch +alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch +mptcp-fix-uninit-value-in-mptcp_incoming_options.patch +wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch +wifi-avoid-offset-calculation-on-null-pointer.patch +wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch +debugfs-fix-automount-d_fsdata-usage.patch +debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch +alsa-hda-intel-nhlt-ignore-vbps-when-looking-for-dmi.patch +nvme-core-fix-a-memory-leak-in-nvme_ns_info_from_ide.patch +io_uring-use-fget-fput-consistently.patch +block-warn-once-for-each-partition-in-bio_check_ro.patch +drm-amdgpu-do-not-issue-gpu-reset-from-nbio-v7_9-bif.patch +drm-amdkfd-use-common-function-for-ip-version-check.patch +drm-amd-display-update-dcn315-lpddr-pstate-latency.patch +drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch +drm-amdkfd-free-gang_ctx_bo-and-wptr_bo-in-pqm_unini.patch +drm-amdgpu-use-another-offset-for-gc-9.4.3-remap.patch +smb-client-common-fix-fortify-warnings.patch +revert-drm-prime-unexport-helpers-for-fd-handle-conv.patch +blk-mq-don-t-count-completed-flush-data-request-as-i.patch +nvme-core-check-for-too-small-lba-shift.patch +hwtracing-hisi_ptt-handle-the-interrupt-in-hardirq-c.patch +hwtracing-hisi_ptt-don-t-try-to-attach-a-task.patch +asoc-amd-yc-add-hp-255-g10-into-quirk-table.patch +asoc-wm8974-correct-boost-mixer-inputs.patch +arm64-dts-rockchip-fix-rk356x-pcie-msg-interrupt-nam.patch +asoc-intel-skylake-fix-mem-leak-in-few-functions.patch +asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch +asoc-sof-topology-fix-mem-leak-in-sof_dai_load.patch +asoc-intel-skylake-mem-leak-in-skl-register-function.patch +asoc-cs43130-fix-the-position-of-const-qualifier.patch +asoc-cs43130-fix-incorrect-frame-delay-configuration.patch +asoc-fsl_xcvr-enable-2-tx-bit-clock-for-spdif-only-c.patch +asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch +asoc-sof-mediatek-mt8186-add-google-steelix-topology.patch +asoc-fsl_xcvr-refine-the-requested-phy-clock-frequen.patch +asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch +asoc-sof-ipc4-topology-add-core_mask-in-struct-snd_s.patch +asoc-sof-sof-audio-modify-logic-for-enabling-disabli.patch +nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch +asoc-amd-yc-add-dmi-entry-to-support-system76-pangol.patch +asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch +asoc-sof-ipc4-topology-correct-data-structures-for-t.patch +asoc-sof-ipc4-topology-correct-data-structures-for-t.patch-24694 +pds_vdpa-fix-up-format-truncation-complaint.patch +pds_vdpa-clear-config-callback-when-status-goes-to-0.patch +pds_vdpa-set-features-order.patch +net-tg3-fix-race-condition-in-tg3_reset_task.patch +asoc-da7219-support-low-dc-impedance-headset.patch +nvme-introduce-helper-function-to-get-ctrl-state.patch +nvme-ensure-reset-state-check-ordering.patch +nvme-ioctl-move-capable-admin-check-to-the-end.patch +nvme-prevent-potential-spectre-v1-gadget.patch +nvme-fix-deadlock-between-reset-and-scan.patch +arm64-dts-rockchip-fix-pci-node-addresses-on-rk3399-.patch +mips-smp-call-rcutree_report_cpu_starting-earlier.patch +drm-amd-display-use-channel_width-2-for-vram-table-3.patch +drm-amd-display-add-monitor-patch-for-specific-edp.patch +drm-amdgpu-add-null-checks-for-function-pointers.patch +drm-exynos-fix-a-potential-error-pointer-dereference.patch +drm-exynos-fix-a-wrong-error-checking.patch +alsa-pcmtest-stop-timer-before-buffer-is-released.patch +hwmon-corsair-psu-fix-probe-when-built-in.patch +loongarch-apply-dynamic-relocations-for-lld.patch +loongarch-set-unwind-stack-type-to-unknown-rather-th.patch +loongarch-preserve-syscall-nr-across-execve.patch +clk-rockchip-rk3568-add-pll-rate-for-292.5mhz.patch +clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch +soundwire-intel_ace2x-fix-ac-timing-setting-for-ace2.patch +jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch +jbd2-increase-the-journal-io-s-priority.patch +drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch +neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch +platform-x86-intel-vbtn-fix-missing-tablet-mode-swit.patch +efi-loongarch-use-load-address-to-calculate-kernel-e.patch +jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch +tracing-have-large-events-show-up-as-line-too-big-in.patch +tracing-add-size-check-when-printing-trace_marker-ou.patch +stmmac-dwmac-loongson-drop-useless-check-for-compati.patch +mips-dts-loongson-drop-incorrect-dwmac-fallback-comp.patch +tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch +ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch +input-psmouse-enable-synaptics-intertouch-for-thinkp.patch +reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch +input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch +input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch +pinctrl-amd-mask-non-wake-source-pins-with-interrupt.patch +asoc-cs35l45-use-modern-pm_ops.patch +asoc-cs35l45-prevent-irq-handling-when-suspending-re.patch +asoc-cs35l45-prevents-spinning-during-runtime-suspen.patch +s390-scm-fix-virtual-vs-physical-address-confusion.patch +arc-fix-spare-error.patch +arc-fix-smatch-warning.patch +wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch +input-xpad-add-razer-wolverine-v2-support.patch +driver-core-add-a-guard-definition-for-the-device_lo.patch +kselftest-alsa-fixed-a-print-formatting-warning.patch +hid-nintendo-fix-initializer-element-is-not-constant.patch +platform-x86-thinkpad_acpi-fix-for-incorrect-fan-rep.patch +platform-x86-amd-pmc-move-platform-defines-to-header.patch +platform-x86-amd-pmc-only-run-irq1-firmware-version-.patch +platform-x86-amd-pmc-move-keyboard-wakeup-disablemen.patch +platform-x86-amd-pmc-disable-keyboard-wakeup-on-amd-.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-medion-lif.patch +asoc-intel-bytcr_rt5640-add-new-swapped-speakers-qui.patch +alsa-hda-realtek-add-quirks-for-asus-zenbook-2022-mo.patch +dm-audit-fix-kconfig-so-dm_audit-depends-on-blk_dev_.patch +hid-nintendo-prevent-divide-by-zero-on-code.patch +smb-client-fix-potential-oob-in-smb2_dump_detail.patch +i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch +drm-amdkfd-svm-range-always-mapped-flag-not-working-.patch +drm-amd-display-add-case-for-dcn35-to-support-usb4-d.patch +drm-amd-display-get-dprefclk-ss-info-from-integratio.patch +pinctrl-cy8c95x0-fix-typo.patch +pinctrl-cy8c95x0-fix-regression.patch +pinctrl-cy8c95x0-fix-get_pincfg.patch +posix-timers-get-rid-of-compat_-sys_ni-uses.patch +ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch +virtio_blk-fix-snprintf-truncation-compiler-warning.patch +nfc-do-not-send-datagram-if-socket-state-isn-t-llcp_.patch +net-qrtr-ns-return-0-if-server-port-is-not-present.patch +connector-fix-proc_event_num_listeners-count-not-cle.patch +arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch +x86-csum-remove-unnecessary-odd-handling.patch +x86-csum-clean-up-csum_partial-further.patch +drm-crtc-fix-uninitialized-variable-use.patch diff --git a/queue-6.6/smb-client-common-fix-fortify-warnings.patch b/queue-6.6/smb-client-common-fix-fortify-warnings.patch new file mode 100644 index 00000000000..23d29e36d52 --- /dev/null +++ b/queue-6.6/smb-client-common-fix-fortify-warnings.patch @@ -0,0 +1,217 @@ +From 4e0680e5d2b34513b35f5dcabff7830ce7a336b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 13:53:47 +0300 +Subject: smb: client, common: fix fortify warnings + +From: Dmitry Antipov + +[ Upstream commit 0015eb6e12384ff1c589928e84deac2ad1ceb236 ] + +When compiling with gcc version 14.0.0 20231126 (experimental) +and CONFIG_FORTIFY_SOURCE=y, I've noticed the following: + +In file included from ./include/linux/string.h:295, + from ./include/linux/bitmap.h:12, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/paravirt.h:17, + from ./arch/x86/include/asm/cpuid.h:62, + from ./arch/x86/include/asm/processor.h:19, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:60, + from ./arch/x86/include/asm/preempt.h:9, + from ./include/linux/preempt.h:79, + from ./include/linux/spinlock.h:56, + from ./include/linux/wait.h:9, + from ./include/linux/wait_bit.h:8, + from ./include/linux/fs.h:6, + from fs/smb/client/smb2pdu.c:18: +In function 'fortify_memcpy_chk', + inlined from '__SMB2_close' at fs/smb/client/smb2pdu.c:3480:4: +./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' +declared with attribute warning: detected read beyond size of field (2nd parameter); +maybe use struct_group()? [-Wattribute-warning] + 588 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +and: + +In file included from ./include/linux/string.h:295, + from ./include/linux/bitmap.h:12, + from ./include/linux/cpumask.h:12, + from ./arch/x86/include/asm/paravirt.h:17, + from ./arch/x86/include/asm/cpuid.h:62, + from ./arch/x86/include/asm/processor.h:19, + from ./arch/x86/include/asm/cpufeature.h:5, + from ./arch/x86/include/asm/thread_info.h:53, + from ./include/linux/thread_info.h:60, + from ./arch/x86/include/asm/preempt.h:9, + from ./include/linux/preempt.h:79, + from ./include/linux/spinlock.h:56, + from ./include/linux/wait.h:9, + from ./include/linux/wait_bit.h:8, + from ./include/linux/fs.h:6, + from fs/smb/client/cifssmb.c:17: +In function 'fortify_memcpy_chk', + inlined from 'CIFS_open' at fs/smb/client/cifssmb.c:1248:3: +./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' +declared with attribute warning: detected read beyond size of field (2nd parameter); +maybe use struct_group()? [-Wattribute-warning] + 588 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +In both cases, the fortification logic inteprets calls to 'memcpy()' as an +attempts to copy an amount of data which exceeds the size of the specified +field (i.e. more than 8 bytes from __le64 value) and thus issues an overread +warning. Both of these warnings may be silenced by using the convenient +'struct_group()' quirk. + +Signed-off-by: Dmitry Antipov +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifspdu.h | 24 ++++++++++++++---------- + fs/smb/client/cifssmb.c | 6 ++++-- + fs/smb/client/smb2pdu.c | 8 +++----- + fs/smb/client/smb2pdu.h | 16 +++++++++------- + fs/smb/common/smb2pdu.h | 17 ++++++++++------- + 5 files changed, 40 insertions(+), 31 deletions(-) + +diff --git a/fs/smb/client/cifspdu.h b/fs/smb/client/cifspdu.h +index 83ccc51a54d0..c0513fbb8a59 100644 +--- a/fs/smb/client/cifspdu.h ++++ b/fs/smb/client/cifspdu.h +@@ -882,11 +882,13 @@ typedef struct smb_com_open_rsp { + __u8 OplockLevel; + __u16 Fid; + __le32 CreateAction; +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le32 FileAttributes; ++ struct_group(common_attributes, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le32 FileAttributes; ++ ); + __le64 AllocationSize; + __le64 EndOfFile; + __le16 FileType; +@@ -2264,11 +2266,13 @@ typedef struct { + /* QueryFileInfo/QueryPathinfo (also for SetPath/SetFile) data buffer formats */ + /******************************************************************************/ + typedef struct { /* data block encoding of response to level 263 QPathInfo */ +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le32 Attributes; ++ struct_group(common_attributes, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le32 Attributes; ++ ); + __u32 Pad1; + __le64 AllocationSize; + __le64 EndOfFile; /* size ie offset to first free byte in file */ +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index bad91ba6c3a9..9ee348e6d106 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -1244,8 +1244,10 @@ CIFS_open(const unsigned int xid, struct cifs_open_parms *oparms, int *oplock, + *oplock |= CIFS_CREATE_ACTION; + + if (buf) { +- /* copy from CreationTime to Attributes */ +- memcpy((char *)buf, (char *)&rsp->CreationTime, 36); ++ /* copy commonly used attributes */ ++ memcpy(&buf->common_attributes, ++ &rsp->common_attributes, ++ sizeof(buf->common_attributes)); + /* the file_info buf is endian converted by caller */ + buf->AllocationSize = rsp->AllocationSize; + buf->EndOfFile = rsp->EndOfFile; +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 76a0b9dbcf75..5276992e3647 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -3401,12 +3401,10 @@ __SMB2_close(const unsigned int xid, struct cifs_tcon *tcon, + } else { + trace_smb3_close_done(xid, persistent_fid, tcon->tid, + ses->Suid); +- /* +- * Note that have to subtract 4 since struct network_open_info +- * has a final 4 byte pad that close response does not have +- */ + if (pbuf) +- memcpy(pbuf, (char *)&rsp->CreationTime, sizeof(*pbuf) - 4); ++ memcpy(&pbuf->network_open_info, ++ &rsp->network_open_info, ++ sizeof(pbuf->network_open_info)); + } + + atomic_dec(&tcon->num_remote_opens); +diff --git a/fs/smb/client/smb2pdu.h b/fs/smb/client/smb2pdu.h +index 220994d0a0f7..db08194484e0 100644 +--- a/fs/smb/client/smb2pdu.h ++++ b/fs/smb/client/smb2pdu.h +@@ -319,13 +319,15 @@ struct smb2_file_reparse_point_info { + } __packed; + + struct smb2_file_network_open_info { +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le64 AllocationSize; +- __le64 EndOfFile; +- __le32 Attributes; ++ struct_group(network_open_info, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ __le64 AllocationSize; ++ __le64 EndOfFile; ++ __le32 Attributes; ++ ); + __le32 Reserved; + } __packed; /* level 34 Query also similar returned in close rsp and open rsp */ + +diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h +index d58550c1c937..63f969a8e44d 100644 +--- a/fs/smb/common/smb2pdu.h ++++ b/fs/smb/common/smb2pdu.h +@@ -700,13 +700,16 @@ struct smb2_close_rsp { + __le16 StructureSize; /* 60 */ + __le16 Flags; + __le32 Reserved; +- __le64 CreationTime; +- __le64 LastAccessTime; +- __le64 LastWriteTime; +- __le64 ChangeTime; +- __le64 AllocationSize; /* Beginning of FILE_STANDARD_INFO equivalent */ +- __le64 EndOfFile; +- __le32 Attributes; ++ struct_group(network_open_info, ++ __le64 CreationTime; ++ __le64 LastAccessTime; ++ __le64 LastWriteTime; ++ __le64 ChangeTime; ++ /* Beginning of FILE_STANDARD_INFO equivalent */ ++ __le64 AllocationSize; ++ __le64 EndOfFile; ++ __le32 Attributes; ++ ); + } __packed; + + +-- +2.43.0 + diff --git a/queue-6.6/smb-client-fix-potential-oob-in-smb2_dump_detail.patch b/queue-6.6/smb-client-fix-potential-oob-in-smb2_dump_detail.patch new file mode 100644 index 00000000000..18ead3f14d9 --- /dev/null +++ b/queue-6.6/smb-client-fix-potential-oob-in-smb2_dump_detail.patch @@ -0,0 +1,93 @@ +From e7499fb197edfd473a2687b408facf78cb536235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 13:10:31 -0300 +Subject: smb: client: fix potential OOB in smb2_dump_detail() + +From: Paulo Alcantara + +[ Upstream commit 567320c46a60a3c39b69aa1df802d753817a3f86 ] + +Validate SMB message with ->check_message() before calling +->calc_smb_size(). + +This fixes CVE-2023-6610. + +Reported-by: j51569436@gmail.com +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219 +Cc; stable@vger.kernel.org +Signed-off-by: Paulo Alcantara +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2misc.c | 30 +++++++++++++++--------------- + fs/smb/client/smb2ops.c | 6 ++++-- + 2 files changed, 19 insertions(+), 17 deletions(-) + +diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c +index e20b4354e703..82b84a4941dd 100644 +--- a/fs/smb/client/smb2misc.c ++++ b/fs/smb/client/smb2misc.c +@@ -173,6 +173,21 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) + } + + mid = le64_to_cpu(shdr->MessageId); ++ if (check_smb2_hdr(shdr, mid)) ++ return 1; ++ ++ if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { ++ cifs_dbg(VFS, "Invalid structure size %u\n", ++ le16_to_cpu(shdr->StructureSize)); ++ return 1; ++ } ++ ++ command = le16_to_cpu(shdr->Command); ++ if (command >= NUMBER_OF_SMB2_COMMANDS) { ++ cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); ++ return 1; ++ } ++ + if (len < pdu_size) { + if ((len >= hdr_size) + && (shdr->Status != 0)) { +@@ -193,21 +208,6 @@ smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server) + return 1; + } + +- if (check_smb2_hdr(shdr, mid)) +- return 1; +- +- if (shdr->StructureSize != SMB2_HEADER_STRUCTURE_SIZE) { +- cifs_dbg(VFS, "Invalid structure size %u\n", +- le16_to_cpu(shdr->StructureSize)); +- return 1; +- } +- +- command = le16_to_cpu(shdr->Command); +- if (command >= NUMBER_OF_SMB2_COMMANDS) { +- cifs_dbg(VFS, "Invalid SMB2 command %d\n", command); +- return 1; +- } +- + if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) { + if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 || + pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) { +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 94e4af4128f1..0604696f59c1 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -403,8 +403,10 @@ smb2_dump_detail(void *buf, struct TCP_Server_Info *server) + cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n", + shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId, + shdr->Id.SyncId.ProcessId); +- cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, +- server->ops->calc_smb_size(buf)); ++ if (!server->ops->check_message(buf, server->total_read, server)) { ++ cifs_server_dbg(VFS, "smb buf %p len %u\n", buf, ++ server->ops->calc_smb_size(buf)); ++ } + #endif + } + +-- +2.43.0 + diff --git a/queue-6.6/soundwire-intel_ace2x-fix-ac-timing-setting-for-ace2.patch b/queue-6.6/soundwire-intel_ace2x-fix-ac-timing-setting-for-ace2.patch new file mode 100644 index 00000000000..1ef6756528a --- /dev/null +++ b/queue-6.6/soundwire-intel_ace2x-fix-ac-timing-setting-for-ace2.patch @@ -0,0 +1,52 @@ +From b35ca5facae65e4708b0b11ecf04eeb406f57d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 20:47:35 +0800 +Subject: soundwire: intel_ace2x: fix AC timing setting for ACE2.x + +From: Chao Song + +[ Upstream commit 393cae5f32d640b9798903702018a48c7a45e59f ] + +Start from ACE1.x, DOAISE is added to AC timing control +register bit 5, it combines with DOAIS to get effective +timing, and has the default value 1. + +The current code fills DOAIS, DACTQE and DODS bits to a +variable initialized to zero, and updates the variable +to AC timing control register. With this operation, We +change DOAISE to 0, and force a much more aggressive +timing. The timing is even unable to form a working +waveform on SDA pin. + +This patch uses read-modify-write operation for the AC +timing control register access, thus makes sure those +bits not supposed and intended to change are not touched. + +Signed-off-by: Chao Song +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20231127124735.2080562-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel_ace2x.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/intel_ace2x.c b/drivers/soundwire/intel_ace2x.c +index a9d25ae0b73f..e320c9128913 100644 +--- a/drivers/soundwire/intel_ace2x.c ++++ b/drivers/soundwire/intel_ace2x.c +@@ -23,8 +23,9 @@ + static void intel_shim_vs_init(struct sdw_intel *sdw) + { + void __iomem *shim_vs = sdw->link_res->shim_vs; +- u16 act = 0; ++ u16 act; + ++ act = intel_readw(shim_vs, SDW_SHIM2_INTEL_VS_ACTMCTL); + u16p_replace_bits(&act, 0x1, SDW_SHIM2_INTEL_VS_ACTMCTL_DOAIS); + act |= SDW_SHIM2_INTEL_VS_ACTMCTL_DACTQE; + act |= SDW_SHIM2_INTEL_VS_ACTMCTL_DODS; +-- +2.43.0 + diff --git a/queue-6.6/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch b/queue-6.6/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch new file mode 100644 index 00000000000..308f3fdd408 --- /dev/null +++ b/queue-6.6/stmmac-dwmac-loongson-drop-useless-check-for-compati.patch @@ -0,0 +1,44 @@ +From 27441db126c2c239093d7f42d8b577058d5e2509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:33:53 +0800 +Subject: stmmac: dwmac-loongson: drop useless check for compatible fallback + +From: Krzysztof Kozlowski + +[ Upstream commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd ] + +Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS, +so checking for some other compatible does not make sense. It cannot be +bound to unsupported platform. + +Drop useless, incorrect (space in between) and undocumented compatible. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Yanteng Si +Reviewed-by: Conor Dooley +Acked-by: Jiaxun Yang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +index e7701326adc6..9e40c28d453a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +@@ -59,11 +59,6 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id + return -ENODEV; + } + +- if (!of_device_is_compatible(np, "loongson, pci-gmac")) { +- pr_info("dwmac_loongson_pci: Incompatible OF node\n"); +- return -ENODEV; +- } +- + plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL); + if (!plat) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/tracing-add-size-check-when-printing-trace_marker-ou.patch b/queue-6.6/tracing-add-size-check-when-printing-trace_marker-ou.patch new file mode 100644 index 00000000000..6965b2b31de --- /dev/null +++ b/queue-6.6/tracing-add-size-check-when-printing-trace_marker-ou.patch @@ -0,0 +1,67 @@ +From 8fc5e7aa6ab82fa286ed4dbfe35e7007120d4ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 08:44:44 -0500 +Subject: tracing: Add size check when printing trace_marker output + +From: Steven Rostedt (Google) + +[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ] + +If for some reason the trace_marker write does not have a nul byte for the +string, it will overflow the print: + + trace_seq_printf(s, ": %s", field->buf); + +The field->buf could be missing the nul byte. To prevent overflow, add the +max size that the buf can be by using the event size and the field +location. + + int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_seq_printf(s, ": %*.s", max, field->buf); + +Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_output.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c +index db575094c498..3b7d3e9eb6ea 100644 +--- a/kernel/trace/trace_output.c ++++ b/kernel/trace/trace_output.c +@@ -1587,11 +1587,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, + { + struct print_entry *field; + struct trace_seq *s = &iter->seq; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + + seq_print_ip_sym(s, field->ip, flags); +- trace_seq_printf(s, ": %s", field->buf); ++ trace_seq_printf(s, ": %.*s", max, field->buf); + + return trace_handle_return(s); + } +@@ -1600,10 +1601,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, + struct trace_event *event) + { + struct print_entry *field; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + +- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf); ++ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf); + + return trace_handle_return(&iter->seq); + } +-- +2.43.0 + diff --git a/queue-6.6/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch b/queue-6.6/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch new file mode 100644 index 00000000000..b7b5c024208 --- /dev/null +++ b/queue-6.6/tracing-fix-uaf-issue-when-open-the-hist-or-hist_deb.patch @@ -0,0 +1,180 @@ +From 7e262aa7f1e77c9b9f420c19bbfa031d2bbb9d3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 09:21:53 +0800 +Subject: tracing: Fix uaf issue when open the hist or hist_debug file + +From: Zheng Yejian + +[ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ] + +KASAN report following issue. The root cause is when opening 'hist' +file of an instance and accessing 'trace_event_file' in hist_show(), +but 'trace_event_file' has been freed due to the instance being removed. +'hist_debug' file has the same problem. To fix it, call +tracing_{open,release}_file_tr() in file_operations callback to have +the ref count and avoid 'trace_event_file' being freed. + + BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278 + Read of size 8 at addr ffff242541e336b8 by task head/190 + + CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x98/0xf8 + show_stack+0x1c/0x30 + dump_stack_lvl+0x44/0x58 + print_report+0xf0/0x5a0 + kasan_report+0x80/0xc0 + __asan_report_load8_noabort+0x1c/0x28 + hist_show+0x11e0/0x1278 + seq_read_iter+0x344/0xd78 + seq_read+0x128/0x1c0 + vfs_read+0x198/0x6c8 + ksys_read+0xf4/0x1e0 + __arm64_sys_read+0x70/0xa8 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + + Allocated by task 188: + kasan_save_stack+0x28/0x50 + kasan_set_track+0x28/0x38 + kasan_save_alloc_info+0x20/0x30 + __kasan_slab_alloc+0x6c/0x80 + kmem_cache_alloc+0x15c/0x4a8 + trace_create_new_event+0x84/0x348 + __trace_add_new_event+0x18/0x88 + event_trace_add_tracer+0xc4/0x1a0 + trace_array_create_dir+0x6c/0x100 + trace_array_create+0x2e8/0x568 + instance_mkdir+0x48/0x80 + tracefs_syscall_mkdir+0x90/0xe8 + vfs_mkdir+0x3c4/0x610 + do_mkdirat+0x144/0x200 + __arm64_sys_mkdirat+0x8c/0xc0 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + + Freed by task 191: + kasan_save_stack+0x28/0x50 + kasan_set_track+0x28/0x38 + kasan_save_free_info+0x34/0x58 + __kasan_slab_free+0xe4/0x158 + kmem_cache_free+0x19c/0x508 + event_file_put+0xa0/0x120 + remove_event_file_dir+0x180/0x320 + event_trace_del_tracer+0xb0/0x180 + __remove_instance+0x224/0x508 + instance_rmdir+0x44/0x78 + tracefs_syscall_rmdir+0xbc/0x140 + vfs_rmdir+0x1cc/0x4c8 + do_rmdir+0x220/0x2b8 + __arm64_sys_unlinkat+0xc0/0x100 + invoke_syscall+0x70/0x260 + el0_svc_common.constprop.0+0xb0/0x280 + do_el0_svc+0x44/0x60 + el0_svc+0x34/0x68 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x168/0x170 + +Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyejian1@huawei.com + +Suggested-by: Steven Rostedt +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 ++++++ + kernel/trace/trace.h | 1 + + kernel/trace/trace_events_hist.c | 12 ++++++++---- + 3 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 438c5b64db25..fc00356a5a0a 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4990,6 +4990,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp) + return 0; + } + ++int tracing_single_release_file_tr(struct inode *inode, struct file *filp) ++{ ++ tracing_release_file_tr(inode, filp); ++ return single_release(inode, filp); ++} ++ + static int tracing_mark_open(struct inode *inode, struct file *filp) + { + stream_open(inode, filp); +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index d608f6128704..51c0a970339e 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -612,6 +612,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp); + int tracing_open_generic_tr(struct inode *inode, struct file *filp); + int tracing_open_file_tr(struct inode *inode, struct file *filp); + int tracing_release_file_tr(struct inode *inode, struct file *filp); ++int tracing_single_release_file_tr(struct inode *inode, struct file *filp); + bool tracing_is_disabled(void); + bool tracer_tracing_is_on(struct trace_array *tr); + void tracer_tracing_on(struct trace_array *tr); +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index d06938ae0717..68aaf0bd7a78 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -5630,10 +5630,12 @@ static int event_hist_open(struct inode *inode, struct file *file) + { + int ret; + +- ret = security_locked_down(LOCKDOWN_TRACEFS); ++ ret = tracing_open_file_tr(inode, file); + if (ret) + return ret; + ++ /* Clear private_data to avoid warning in single_open() */ ++ file->private_data = NULL; + return single_open(file, hist_show, file); + } + +@@ -5641,7 +5643,7 @@ const struct file_operations event_hist_fops = { + .open = event_hist_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = single_release, ++ .release = tracing_single_release_file_tr, + }; + + #ifdef CONFIG_HIST_TRIGGERS_DEBUG +@@ -5907,10 +5909,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) + { + int ret; + +- ret = security_locked_down(LOCKDOWN_TRACEFS); ++ ret = tracing_open_file_tr(inode, file); + if (ret) + return ret; + ++ /* Clear private_data to avoid warning in single_open() */ ++ file->private_data = NULL; + return single_open(file, hist_debug_show, file); + } + +@@ -5918,7 +5922,7 @@ const struct file_operations event_hist_debug_fops = { + .open = event_hist_debug_open, + .read = seq_read, + .llseek = seq_lseek, +- .release = single_release, ++ .release = tracing_single_release_file_tr, + }; + #endif + +-- +2.43.0 + diff --git a/queue-6.6/tracing-have-large-events-show-up-as-line-too-big-in.patch b/queue-6.6/tracing-have-large-events-show-up-as-line-too-big-in.patch new file mode 100644 index 00000000000..0891e17e8d3 --- /dev/null +++ b/queue-6.6/tracing-have-large-events-show-up-as-line-too-big-in.patch @@ -0,0 +1,79 @@ +From 87ee502c1c8479d303f346e34a222f133fe9ea4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 17:10:58 -0500 +Subject: tracing: Have large events show up as '[LINE TOO BIG]' instead of + nothing + +From: Steven Rostedt (Google) + +[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ] + +If a large event was added to the ring buffer that is larger than what the +trace_seq can handle, it just drops the output: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234 + +Instead, catch this case and add some context: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG] + <...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234 + +This now emulates the same output as trace_pipe. + +Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index a55f7d091355..438c5b64db25 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4744,7 +4744,11 @@ static int s_show(struct seq_file *m, void *v) + iter->leftover = ret; + + } else { +- print_trace_line(iter); ++ ret = print_trace_line(iter); ++ if (ret == TRACE_TYPE_PARTIAL_LINE) { ++ iter->seq.full = 0; ++ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n"); ++ } + ret = trace_print_seq(m, &iter->seq); + /* + * If we overflow the seq_file buffer, then it will +-- +2.43.0 + diff --git a/queue-6.6/virtio_blk-fix-snprintf-truncation-compiler-warning.patch b/queue-6.6/virtio_blk-fix-snprintf-truncation-compiler-warning.patch new file mode 100644 index 00000000000..c752bda831e --- /dev/null +++ b/queue-6.6/virtio_blk-fix-snprintf-truncation-compiler-warning.patch @@ -0,0 +1,83 @@ +From 59edd3111eadddeb6716482e89b51b36746078e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 09:07:43 -0500 +Subject: virtio_blk: fix snprintf truncation compiler warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Hajnoczi + +[ Upstream commit b8e0792449928943c15d1af9f63816911d139267 ] + +Commit 4e0400525691 ("virtio-blk: support polling I/O") triggers the +following gcc 13 W=1 warnings: + +drivers/block/virtio_blk.c: In function ‘init_vq’: +drivers/block/virtio_blk.c:1077:68: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 7 [-Wformat-truncation=] + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~ +drivers/block/virtio_blk.c:1077:58: note: directive argument in the range [-2147483648, 65534] + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~~~~~~~~~~~~ +drivers/block/virtio_blk.c:1077:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16 + 1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This is a false positive because the lower bound -2147483648 is +incorrect. The true range of i is [0, num_vqs - 1] where 0 < num_vqs < +65536. + +The code mixes int, unsigned short, and unsigned int types in addition +to using "%d" for an unsigned value. Use unsigned short and "%u" +consistently to solve the compiler warning. + +Cc: Suwan Kim +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312041509.DIyvEt9h-lkp@intel.com/ +Signed-off-by: Stefan Hajnoczi +Message-Id: <20231204140743.1487843-1-stefanha@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 4a4b9bad551e..225c86c74d4e 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1021,12 +1021,12 @@ static void virtblk_config_changed(struct virtio_device *vdev) + static int init_vq(struct virtio_blk *vblk) + { + int err; +- int i; ++ unsigned short i; + vq_callback_t **callbacks; + const char **names; + struct virtqueue **vqs; + unsigned short num_vqs; +- unsigned int num_poll_vqs; ++ unsigned short num_poll_vqs; + struct virtio_device *vdev = vblk->vdev; + struct irq_affinity desc = { 0, }; + +@@ -1070,13 +1070,13 @@ static int init_vq(struct virtio_blk *vblk) + + for (i = 0; i < num_vqs - num_poll_vqs; i++) { + callbacks[i] = virtblk_done; +- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%d", i); ++ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%u", i); + names[i] = vblk->vqs[i].name; + } + + for (; i < num_vqs; i++) { + callbacks[i] = NULL; +- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i); ++ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%u", i); + names[i] = vblk->vqs[i].name; + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-avoid-offset-calculation-on-null-pointer.patch b/queue-6.6/wifi-avoid-offset-calculation-on-null-pointer.patch new file mode 100644 index 00000000000..e58cb0c373d --- /dev/null +++ b/queue-6.6/wifi-avoid-offset-calculation-on-null-pointer.patch @@ -0,0 +1,45 @@ +From 15b2424ce39279195fc38b41da6b898cd0ceadf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 11:02:37 +0800 +Subject: wifi: avoid offset calculation on NULL pointer + +From: Michael-CY Lee + +[ Upstream commit ef5828805842204dd0259ecfc132b5916c8a77ae ] + +ieee80211_he_6ghz_oper() can be passed a NULL pointer +and checks for that, but already did the calculation +to inside of it before. Move it after the check. + +Signed-off-by: Michael-CY Lee +Link: https://lore.kernel.org/r/20231122030237.31276-1-michael-cy.lee@mediatek.com +[rewrite commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/linux/ieee80211.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h +index 2b0a73cb7cbb..2fa186258e35 100644 +--- a/include/linux/ieee80211.h ++++ b/include/linux/ieee80211.h +@@ -2790,12 +2790,14 @@ ieee80211_he_oper_size(const u8 *he_oper_ie) + static inline const struct ieee80211_he_6ghz_oper * + ieee80211_he_6ghz_oper(const struct ieee80211_he_operation *he_oper) + { +- const u8 *ret = (const void *)&he_oper->optional; ++ const u8 *ret; + u32 he_oper_params; + + if (!he_oper) + return NULL; + ++ ret = (const void *)&he_oper->optional; ++ + he_oper_params = le32_to_cpu(he_oper->he_oper_params); + + if (!(he_oper_params & IEEE80211_HE_OPERATION_6GHZ_OP_INFO)) +-- +2.43.0 + diff --git a/queue-6.6/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch b/queue-6.6/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch new file mode 100644 index 00000000000..c611195e2c8 --- /dev/null +++ b/queue-6.6/wifi-cfg80211-lock-wiphy-mutex-for-rfkill-poll.patch @@ -0,0 +1,36 @@ +From 1e29fc7d17027bb18cc6d57190944054eff9c079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 13:41:25 +0100 +Subject: wifi: cfg80211: lock wiphy mutex for rfkill poll + +From: Johannes Berg + +[ Upstream commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 ] + +We want to guarantee the mutex is held for pretty much +all operations, so ensure that here as well. + +Reported-by: syzbot+7e59a5bfc7a897247e18@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 563cfbe3237c..f6ada0a72977 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -221,7 +221,9 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data) + { + struct cfg80211_registered_device *rdev = data; + ++ wiphy_lock(&rdev->wiphy); + rdev_rfkill_poll(rdev); ++ wiphy_unlock(&rdev->wiphy); + } + + void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev, +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch b/queue-6.6/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..14ff27729f3 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-pcie-avoid-a-null-pointer-dereference.patch @@ -0,0 +1,39 @@ +From 3411e6d398c0a8ad51705ef6062a40e7e3319da5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 04:50:17 +0200 +Subject: wifi: iwlwifi: pcie: avoid a NULL pointer dereference + +From: Avraham Stern + +[ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ] + +It possible that while the rx rb is being handled, the transport has +been stopped and re-started. In this case the tx queue pointer is not +yet initialized, which will lead to a NULL pointer dereference. +Fix it. + +Signed-off-by: Avraham Stern +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index a9415d333490..63091c45a576 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1385,7 +1385,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans, + * if it is true then one of the handlers took the page. + */ + +- if (reclaim) { ++ if (reclaim && txq) { + u16 sequence = le16_to_cpu(pkt->hdr.sequence); + int index = SEQ_TO_INDEX(sequence); + int cmd_index = iwl_txq_get_cmd_index(txq, index); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch b/queue-6.6/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch new file mode 100644 index 00000000000..22e90b9fdd9 --- /dev/null +++ b/queue-6.6/wifi-mac80211-handle-320-mhz-in-ieee80211_ht_cap_ie_.patch @@ -0,0 +1,37 @@ +From 93eecfb7eeeaad1b42f7b72f2e3183b52068e1f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 10:22:01 -0800 +Subject: wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap + +From: Ben Greear + +[ Upstream commit 00f7d153f3358a7c7e35aef66fcd9ceb95d90430 ] + +The new 320 MHz channel width wasn't handled, so connecting +a station to a 320 MHz AP would limit the station to 20 MHz +(on HT) after a warning, handle 320 MHz to fix that. + +Signed-off-by: Ben Greear +Link: https://lore.kernel.org/r/20231109182201.495381-1-greearb@candelatech.com +[write a proper commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/ht.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c +index 33729870ad8a..b3371872895c 100644 +--- a/net/mac80211/ht.c ++++ b/net/mac80211/ht.c +@@ -271,6 +271,7 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata, + case NL80211_CHAN_WIDTH_80: + case NL80211_CHAN_WIDTH_80P80: + case NL80211_CHAN_WIDTH_160: ++ case NL80211_CHAN_WIDTH_320: + bw = ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ? + IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20; + break; +-- +2.43.0 + diff --git a/queue-6.6/x86-csum-clean-up-csum_partial-further.patch b/queue-6.6/x86-csum-clean-up-csum_partial-further.patch new file mode 100644 index 00000000000..e687bea5794 --- /dev/null +++ b/queue-6.6/x86-csum-clean-up-csum_partial-further.patch @@ -0,0 +1,139 @@ +From 5f01bbe87e4ed050de9c7b55139383437b852dc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 13:55:32 -0700 +Subject: x86/csum: clean up `csum_partial' further + +From: Linus Torvalds + +[ Upstream commit a476aae3f1dc78a162a0d2e7945feea7d2b29401 ] + +Commit 688eb8191b47 ("x86/csum: Improve performance of `csum_partial`") +ended up improving the code generation for the IP csum calculations, and +in particular special-casing the 40-byte case that is a hot case for +IPv6 headers. + +It then had _another_ special case for the 64-byte unrolled loop, which +did two chains of 32-byte blocks, which allows modern CPU's to improve +performance by doing the chains in parallel thanks to renaming the carry +flag. + +This just unifies the special cases and combines them into just one +single helper the 40-byte csum case, and replaces the 64-byte case by a +80-byte case that just does that single helper twice. It avoids having +all these different versions of inline assembly, and actually improved +performance further in my tests. + +There was never anything magical about the 64-byte unrolled case, even +though it happens to be a common size (and typically is the cacheline +size). + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/lib/csum-partial_64.c | 81 ++++++++++++++++------------------ + 1 file changed, 37 insertions(+), 44 deletions(-) + +diff --git a/arch/x86/lib/csum-partial_64.c b/arch/x86/lib/csum-partial_64.c +index 557e42ede68e..c9dae65ac01b 100644 +--- a/arch/x86/lib/csum-partial_64.c ++++ b/arch/x86/lib/csum-partial_64.c +@@ -16,6 +16,20 @@ static inline __wsum csum_finalize_sum(u64 temp64) + return (__force __wsum)((temp64 + ror64(temp64, 32)) >> 32); + } + ++static inline unsigned long update_csum_40b(unsigned long sum, const unsigned long m[5]) ++{ ++ asm("addq %1,%0\n\t" ++ "adcq %2,%0\n\t" ++ "adcq %3,%0\n\t" ++ "adcq %4,%0\n\t" ++ "adcq %5,%0\n\t" ++ "adcq $0,%0" ++ :"+r" (sum) ++ :"m" (m[0]), "m" (m[1]), "m" (m[2]), ++ "m" (m[3]), "m" (m[4])); ++ return sum; ++} ++ + /* + * Do a checksum on an arbitrary memory area. + * Returns a 32bit checksum. +@@ -31,52 +45,31 @@ __wsum csum_partial(const void *buff, int len, __wsum sum) + { + u64 temp64 = (__force u64)sum; + +- /* +- * len == 40 is the hot case due to IPv6 headers, but annotating it likely() +- * has noticeable negative affect on codegen for all other cases with +- * minimal performance benefit here. +- */ +- if (len == 40) { +- asm("addq 0*8(%[src]),%[res]\n\t" +- "adcq 1*8(%[src]),%[res]\n\t" +- "adcq 2*8(%[src]),%[res]\n\t" +- "adcq 3*8(%[src]),%[res]\n\t" +- "adcq 4*8(%[src]),%[res]\n\t" +- "adcq $0,%[res]" +- : [res] "+r"(temp64) +- : [src] "r"(buff), "m"(*(const char(*)[40])buff)); +- return csum_finalize_sum(temp64); ++ /* Do two 40-byte chunks in parallel to get better ILP */ ++ if (likely(len >= 80)) { ++ u64 temp64_2 = 0; ++ do { ++ temp64 = update_csum_40b(temp64, buff); ++ temp64_2 = update_csum_40b(temp64_2, buff + 40); ++ buff += 80; ++ len -= 80; ++ } while (len >= 80); ++ ++ asm("addq %1,%0\n\t" ++ "adcq $0,%0" ++ :"+r" (temp64): "r" (temp64_2)); + } +- if (unlikely(len >= 64)) { +- /* +- * Extra accumulators for better ILP in the loop. +- */ +- u64 tmp_accum, tmp_carries; + +- asm("xorl %k[tmp_accum],%k[tmp_accum]\n\t" +- "xorl %k[tmp_carries],%k[tmp_carries]\n\t" +- "subl $64, %[len]\n\t" +- "1:\n\t" +- "addq 0*8(%[src]),%[res]\n\t" +- "adcq 1*8(%[src]),%[res]\n\t" +- "adcq 2*8(%[src]),%[res]\n\t" +- "adcq 3*8(%[src]),%[res]\n\t" +- "adcl $0,%k[tmp_carries]\n\t" +- "addq 4*8(%[src]),%[tmp_accum]\n\t" +- "adcq 5*8(%[src]),%[tmp_accum]\n\t" +- "adcq 6*8(%[src]),%[tmp_accum]\n\t" +- "adcq 7*8(%[src]),%[tmp_accum]\n\t" +- "adcl $0,%k[tmp_carries]\n\t" +- "addq $64, %[src]\n\t" +- "subl $64, %[len]\n\t" +- "jge 1b\n\t" +- "addq %[tmp_accum],%[res]\n\t" +- "adcq %[tmp_carries],%[res]\n\t" +- "adcq $0,%[res]" +- : [tmp_accum] "=&r"(tmp_accum), +- [tmp_carries] "=&r"(tmp_carries), [res] "+r"(temp64), +- [len] "+r"(len), [src] "+r"(buff) +- : "m"(*(const char *)buff)); ++ /* ++ * len == 40 is the hot case due to IPv6 headers, so return ++ * early for that exact case without checking the tail bytes. ++ */ ++ if (len >= 40) { ++ temp64 = update_csum_40b(temp64, buff); ++ len -= 40; ++ if (!len) ++ return csum_finalize_sum(temp64); ++ buff += 40; + } + + if (len & 32) { +-- +2.43.0 + diff --git a/queue-6.6/x86-csum-remove-unnecessary-odd-handling.patch b/queue-6.6/x86-csum-remove-unnecessary-odd-handling.patch new file mode 100644 index 00000000000..f65c6edbf1c --- /dev/null +++ b/queue-6.6/x86-csum-remove-unnecessary-odd-handling.patch @@ -0,0 +1,103 @@ +From a1099be4e9addad09147133bbd2c4d4079bb3085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Sep 2023 09:35:49 -0500 +Subject: x86/csum: Remove unnecessary odd handling + +From: Noah Goldstein + +[ Upstream commit 5d4acb62853abac1da2deebcb1c1c5b79219bf3b ] + +The special case for odd aligned buffers is unnecessary and mostly +just adds overhead. Aligned buffers is the expectations, and even for +unaligned buffer, the only case that was helped is if the buffer was +1-byte from word aligned which is ~1/7 of the cases. Overall it seems +highly unlikely to be worth to extra branch. + +It was left in the previous perf improvement patch because I was +erroneously comparing the exact output of `csum_partial(...)`, but +really we only need `csum_fold(csum_partial(...))` to match so its +safe to remove. + +All csum kunit tests pass. + +Signed-off-by: Noah Goldstein +Reviewed-by: Eric Dumazet +Reviewed-by: David Laight +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/lib/csum-partial_64.c | 36 ++++------------------------------ + 1 file changed, 4 insertions(+), 32 deletions(-) + +diff --git a/arch/x86/lib/csum-partial_64.c b/arch/x86/lib/csum-partial_64.c +index cea25ca8b8cf..557e42ede68e 100644 +--- a/arch/x86/lib/csum-partial_64.c ++++ b/arch/x86/lib/csum-partial_64.c +@@ -11,26 +11,9 @@ + #include + #include + +-static inline unsigned short from32to16(unsigned a) ++static inline __wsum csum_finalize_sum(u64 temp64) + { +- unsigned short b = a >> 16; +- asm("addw %w2,%w0\n\t" +- "adcw $0,%w0\n" +- : "=r" (b) +- : "0" (b), "r" (a)); +- return b; +-} +- +-static inline __wsum csum_tail(u64 temp64, int odd) +-{ +- unsigned int result; +- +- result = add32_with_carry(temp64 >> 32, temp64 & 0xffffffff); +- if (unlikely(odd)) { +- result = from32to16(result); +- result = ((result >> 8) & 0xff) | ((result & 0xff) << 8); +- } +- return (__force __wsum)result; ++ return (__force __wsum)((temp64 + ror64(temp64, 32)) >> 32); + } + + /* +@@ -47,17 +30,6 @@ static inline __wsum csum_tail(u64 temp64, int odd) + __wsum csum_partial(const void *buff, int len, __wsum sum) + { + u64 temp64 = (__force u64)sum; +- unsigned odd; +- +- odd = 1 & (unsigned long) buff; +- if (unlikely(odd)) { +- if (unlikely(len == 0)) +- return sum; +- temp64 = ror32((__force u32)sum, 8); +- temp64 += (*(unsigned char *)buff << 8); +- len--; +- buff++; +- } + + /* + * len == 40 is the hot case due to IPv6 headers, but annotating it likely() +@@ -73,7 +45,7 @@ __wsum csum_partial(const void *buff, int len, __wsum sum) + "adcq $0,%[res]" + : [res] "+r"(temp64) + : [src] "r"(buff), "m"(*(const char(*)[40])buff)); +- return csum_tail(temp64, odd); ++ return csum_finalize_sum(temp64); + } + if (unlikely(len >= 64)) { + /* +@@ -143,7 +115,7 @@ __wsum csum_partial(const void *buff, int len, __wsum sum) + : [res] "+r"(temp64) + : [trail] "r"(trail)); + } +- return csum_tail(temp64, odd); ++ return csum_finalize_sum(temp64); + } + EXPORT_SYMBOL(csum_partial); + +-- +2.43.0 +