From: Sasha Levin Date: Tue, 16 Jan 2024 10:42:07 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v6.1.74~28 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc26d89ab421662c3a5181f110eb77b26291a89b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch b/queue-5.4/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch new file mode 100644 index 00000000000..48efc966f10 --- /dev/null +++ b/queue-5.4/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch @@ -0,0 +1,59 @@ +From ef8e90fb9c79a80dc7744bc9c556480a71e81bab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 20:09:23 +0300 +Subject: ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook + XPro + +From: Vasiliy Kovalev + +[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ] + +This patch corrected the speaker and headset mic pin config to the more +appropriate values. + +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bfa66b8e3040..36293836a48c 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6398,6 +6398,7 @@ enum { + ALC290_FIXUP_SUBWOOFER_HSJACK, + ALC269_FIXUP_THINKPAD_ACPI, + ALC269_FIXUP_DMIC_THINKPAD_ACPI, ++ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO, + ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, +@@ -6645,6 +6646,14 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_U7x7_headset_mic, + }, ++ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x03a19020 }, /* headset mic */ ++ { 0x1b, 0x90170150 }, /* speaker */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -8481,6 +8490,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), ++ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), + SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC), + SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), +-- +2.43.0 + diff --git a/queue-5.4/arc-fix-spare-error.patch b/queue-5.4/arc-fix-spare-error.patch new file mode 100644 index 00000000000..35752de41a6 --- /dev/null +++ b/queue-5.4/arc-fix-spare-error.patch @@ -0,0 +1,48 @@ +From df114efa4c74a67db8caec507324b8332747645c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:57:07 -0800 +Subject: ARC: fix spare error + +From: Vineet Gupta + +[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/ +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c +index 8877de0dfe6c..2759d49a2f3a 100644 +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -61,7 +61,7 @@ struct rt_sigframe { + unsigned int sigret_magic; + }; + +-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) + #else + v2abi.r58 = v2abi.r59 = 0; + #endif +- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); ++ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi)); + #endif + return err; + } + +-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +-- +2.43.0 + diff --git a/queue-5.4/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch b/queue-5.4/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch new file mode 100644 index 00000000000..c36cac63873 --- /dev/null +++ b/queue-5.4/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch @@ -0,0 +1,49 @@ +From d3a387830b7518a5cbbc29235e3486a981281521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 20:39:03 +0100 +Subject: ARM: sun9i: smp: fix return code check of of_property_match_string + +From: Stefan Wahren + +[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ] + +of_property_match_string returns an int; either an index from 0 or +greater if successful or negative on failure. Even it's very +unlikely that the DT CPU node contains multiple enable-methods +these checks should be fixed. + +This patch was inspired by the work of Nick Desaulniers. + +Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ +Cc: Nick Desaulniers +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/mc_smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c +index b2f5f4f28705..f779e386b6e7 100644 +--- a/arch/arm/mach-sunxi/mc_smp.c ++++ b/arch/arm/mach-sunxi/mc_smp.c +@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void) + for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) { + ret = of_property_match_string(node, "enable-method", + sunxi_mc_smp_data[i].enable_method); +- if (!ret) ++ if (ret >= 0) + break; + } + + of_node_put(node); +- if (ret) ++ if (ret < 0) + return -ENODEV; + + is_a83t = sunxi_mc_smp_data[i].is_a83t; +-- +2.43.0 + diff --git a/queue-5.4/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch b/queue-5.4/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch new file mode 100644 index 00000000000..c0d802eb3ab --- /dev/null +++ b/queue-5.4/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch @@ -0,0 +1,34 @@ +From 5ff52c10df458a868dc2d90c34143dea129d8302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:39 +0000 +Subject: ASoC: cs43130: Fix incorrect frame delay configuration + +From: Maciej Strozek + +[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 285806868c40..02fb9317b697 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -578,7 +578,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk, + break; + case SND_SOC_DAIFMT_LEFT_J: + hi_size = bitwidth_sclk; +- frm_delay = 2; ++ frm_delay = 0; + frm_phase = 1; + break; + case SND_SOC_DAIFMT_DSP_A: +-- +2.43.0 + diff --git a/queue-5.4/asoc-cs43130-fix-the-position-of-const-qualifier.patch b/queue-5.4/asoc-cs43130-fix-the-position-of-const-qualifier.patch new file mode 100644 index 00000000000..ff2b52a6ed3 --- /dev/null +++ b/queue-5.4/asoc-cs43130-fix-the-position-of-const-qualifier.patch @@ -0,0 +1,43 @@ +From 8d58bfc7837637d5bf12f4ae10523df088b03ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:38 +0000 +Subject: ASoC: cs43130: Fix the position of const qualifier + +From: Maciej Strozek + +[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 8f70dee95878..285806868c40 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -1683,7 +1683,7 @@ static ssize_t cs43130_show_dc_r(struct device *dev, + return cs43130_show_dc(dev, buf, HP_RIGHT); + } + +-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = { ++static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = { + 24, + 43, + 93, +@@ -2364,7 +2364,7 @@ static const struct regmap_config cs43130_regmap = { + .use_single_write = true, + }; + +-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { ++static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { + 50, + 120, + }; +-- +2.43.0 + diff --git a/queue-5.4/asoc-da7219-support-low-dc-impedance-headset.patch b/queue-5.4/asoc-da7219-support-low-dc-impedance-headset.patch new file mode 100644 index 00000000000..be7421a1415 --- /dev/null +++ b/queue-5.4/asoc-da7219-support-low-dc-impedance-headset.patch @@ -0,0 +1,36 @@ +From 414abbffbe6fe47d1f9180dc36a3d2d014d65487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 12:29:33 +0800 +Subject: ASoC: da7219: Support low DC impedance headset + +From: David Rau + +[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ] + +Change the default MIC detection impedance threshold to 200ohm +to support low mic DC impedance headset. + +Signed-off-by: David Rau +Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index befe26749bc2..e4e314604c0a 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -655,7 +655,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct snd_soc_component + aad_pdata->mic_det_thr = + da7219_aad_fw_mic_det_thr(component, fw_val32); + else +- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; ++ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS; + + if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0) + aad_pdata->jack_ins_deb = +-- +2.43.0 + diff --git a/queue-5.4/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch b/queue-5.4/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch new file mode 100644 index 00000000000..778a65f22fd --- /dev/null +++ b/queue-5.4/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch @@ -0,0 +1,59 @@ +From 0a7eaa5874109cf7a48aed6669e3d1c7969ea7f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:51:50 +0100 +Subject: ASoC: Intel: Skylake: Fix mem leak in few functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ] + +The resources should be freed when function return error. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 4 +++- + sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 439dd4ba690c..19176ae27274 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -260,8 +260,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream, + snd_pcm_set_sync(substream); + + mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream); +- if (!mconfig) ++ if (!mconfig) { ++ kfree(dma_params); + return -EINVAL; ++ } + + skl_tplg_d0i3_get(skl, mconfig->d0i3_caps); + +diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c +index 667cdddc289f..7286cbd0c46f 100644 +--- a/sound/soc/intel/skylake/skl-sst-ipc.c ++++ b/sound/soc/intel/skylake/skl-sst-ipc.c +@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, + + reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK; + buf = krealloc(reply.data, reply.size, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ kfree(reply.data); + return -ENOMEM; ++ } + *payload = buf; + *bytes = reply.size; + +-- +2.43.0 + diff --git a/queue-5.4/asoc-intel-skylake-mem-leak-in-skl-register-function.patch b/queue-5.4/asoc-intel-skylake-mem-leak-in-skl-register-function.patch new file mode 100644 index 00000000000..c68b844d53e --- /dev/null +++ b/queue-5.4/asoc-intel-skylake-mem-leak-in-skl-register-function.patch @@ -0,0 +1,52 @@ +From b0dc98a0cc83309d76ef6d5a37f776d314834a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 23:41:13 +0100 +Subject: ASoC: Intel: Skylake: mem leak in skl register function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ] + +skl_platform_register() uses krealloc. When krealloc is fail, +then previous memory is not freed. The leak is also when soc +component registration failed. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 19176ae27274..3256f7c4eb74 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1492,6 +1492,7 @@ int skl_platform_register(struct device *dev) + dais = krealloc(skl->dais, sizeof(skl_fe_dai) + + sizeof(skl_platform_dai), GFP_KERNEL); + if (!dais) { ++ kfree(skl->dais); + ret = -ENOMEM; + goto err; + } +@@ -1504,8 +1505,10 @@ int skl_platform_register(struct device *dev) + + ret = devm_snd_soc_register_component(dev, &skl_component, + skl->dais, num_dais); +- if (ret) ++ if (ret) { ++ kfree(skl->dais); + dev_err(dev, "soc component registration failed %d\n", ret); ++ } + err: + return ret; + } +-- +2.43.0 + diff --git a/queue-5.4/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch b/queue-5.4/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch new file mode 100644 index 00000000000..b596d706629 --- /dev/null +++ b/queue-5.4/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch @@ -0,0 +1,75 @@ +From 978c67f815dcadd8264d49604163fa58b003a19b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 12:30:12 +0800 +Subject: ASoC: nau8822: Fix incorrect type in assignment and cast to + restricted __be16 + +From: David Lin + +[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ] + +This issue is reproduced when W=1 build in compiler gcc-12. +The following are sparse warnings: + +sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment +sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short +sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/ +Signed-off-by: David Lin +Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index cd163978792e..1450a84df4e8 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + struct soc_bytes_ext *params = (void *)kcontrol->private_value; + int i, reg; + u16 reg_val, *val; ++ __be16 tmp; + + val = (u16 *)ucontrol->value.bytes.data; + reg = NAU8822_REG_EQ1; +@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- reg_val = cpu_to_be16(reg_val); +- memcpy(val + i, ®_val, sizeof(reg_val)); ++ tmp = cpu_to_be16(reg_val); ++ memcpy(val + i, &tmp, sizeof(tmp)); + } + + return 0; +@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + void *data; + u16 *val, value; + int i, reg, ret; ++ __be16 *tmp; + + data = kmemdup(ucontrol->value.bytes.data, + params->max, GFP_KERNEL | GFP_DMA); +@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- value = be16_to_cpu(*(val + i)); ++ tmp = (__be16 *)(val + i); ++ value = be16_to_cpup(tmp); + ret = snd_soc_component_write(component, reg + i, value); + if (ret) { + dev_err(component->dev, +-- +2.43.0 + diff --git a/queue-5.4/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch b/queue-5.4/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch new file mode 100644 index 00000000000..632f39b3c88 --- /dev/null +++ b/queue-5.4/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch @@ -0,0 +1,79 @@ +From f488a2f47e0dfcb291b9409fda3c1033a2ecba24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 18:01:23 +0800 +Subject: ASoC: rt5650: add mutex to avoid the jack detection failure + +From: Shuming Fan + +[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ] + +This patch adds the jd_mutex to protect the jack detection control flow. +And only the headset type could check the button status. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 9fda0e5548dc..c9512e97c12e 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -421,6 +421,7 @@ struct rt5645_priv { + struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)]; + struct rt5645_eq_param_s *eq_param; + struct timer_list btn_check_timer; ++ struct mutex jd_mutex; + + int codec_type; + int sysclk; +@@ -3179,6 +3180,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + rt5645_enable_push_button_irq(component, true); + } + } else { ++ if (rt5645->en_button_func) ++ rt5645_enable_push_button_irq(component, false); + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; +@@ -3259,6 +3262,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + if (!rt5645->component) + return; + ++ mutex_lock(&rt5645->jd_mutex); ++ + switch (rt5645->pdata.jd_mode) { + case 0: /* Not using rt5645 JD */ + if (rt5645->gpiod_hp_det) { +@@ -3283,7 +3288,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) + + if (!val && (rt5645->jack_type == 0)) { /* jack in */ + report = rt5645_jack_detect(rt5645->component, 1); +- } else if (!val && rt5645->jack_type != 0) { ++ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) { + /* for push button and jack out */ + btn_type = 0; + if (snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) { +@@ -3339,6 +3344,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + rt5645_jack_detect(rt5645->component, 0); + } + ++ mutex_unlock(&rt5645->jd_mutex); ++ + snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE); + snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + if (rt5645->en_button_func) +@@ -4041,6 +4048,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + } + timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0); + ++ mutex_init(&rt5645->jd_mutex); + INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); + INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work); + +-- +2.43.0 + diff --git a/queue-5.4/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch b/queue-5.4/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch new file mode 100644 index 00000000000..52c940e5f15 --- /dev/null +++ b/queue-5.4/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch @@ -0,0 +1,35 @@ +From 8f3dfd6bac1b2e22735afe8447766498b134626e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 19:18:16 +0800 +Subject: clk: rockchip: rk3128: Fix HCLK_OTG gate register + +From: Weihao Li + +[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ] + +The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON. + +Signed-off-by: Weihao Li +Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3128.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c +index 4b1122e98e16..ddfe1c402e80 100644 +--- a/drivers/clk/rockchip/clk-rk3128.c ++++ b/drivers/clk/rockchip/clk-rk3128.c +@@ -489,7 +489,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS), + GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS), + GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS), +- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS), ++ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS), + GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS), + GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS), + GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS), +-- +2.43.0 + diff --git a/queue-5.4/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch b/queue-5.4/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch new file mode 100644 index 00000000000..e6009383659 --- /dev/null +++ b/queue-5.4/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch @@ -0,0 +1,79 @@ +From 7a2c45585597a50cac3d10d23ce3fe843b705b1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 09:14:46 -0700 +Subject: drm/crtc: Fix uninit-value bug in drm_mode_setcrtc + +From: Ziqi Zhao + +[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] + +The connector_set contains uninitialized values when allocated with +kmalloc_array. However, in the "out" branch, the logic assumes that any +element in connector_set would be equal to NULL if failed to +initialize, which causes the bug reported by Syzbot. The fix is to use +an extra variable to keep track of how many connectors are initialized +indeed, and use that variable to decrease any refcounts in the "out" +branch. + +Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Signed-off-by: Ziqi Zhao +Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Tested-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 4936e1080e41..38ce608648b0 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -535,8 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret; +- int i; ++ int ret, i, num_connectors; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -674,6 +673,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + ++ num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +@@ -694,6 +694,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + connector->name); + + connector_set[i] = connector; ++ num_connectors++; + } + } + +@@ -702,7 +703,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + set.y = crtc_req->y; + set.mode = mode; + set.connectors = connector_set; +- set.num_connectors = crtc_req->count_connectors; ++ set.num_connectors = num_connectors; + set.fb = fb; + + if (drm_drv_uses_atomic_modeset(dev)) +@@ -715,7 +716,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + drm_framebuffer_put(fb); + + if (connector_set) { +- for (i = 0; i < crtc_req->count_connectors; i++) { ++ for (i = 0; i < num_connectors; i++) { + if (connector_set[i]) + drm_connector_put(connector_set[i]); + } +-- +2.43.0 + diff --git a/queue-5.4/drm-crtc-fix-uninitialized-variable-use.patch b/queue-5.4/drm-crtc-fix-uninitialized-variable-use.patch new file mode 100644 index 00000000000..8ae195b14b6 --- /dev/null +++ b/queue-5.4/drm-crtc-fix-uninitialized-variable-use.patch @@ -0,0 +1,54 @@ +From 35b285e54d4994a7b2e5d9237ffd33f0ddff1636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:12:38 +0200 +Subject: drm/crtc: fix uninitialized variable use + +From: Jani Nikula + +[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ] + +Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in +drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, +but introduced another. + +num_connectors is only initialized if crtc_req->count_connectors > 0, +but it's used regardless. Fix it. + +Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") +Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Cc: Ziqi Zhao +Cc: Maxime Ripard +Cc: Maarten Lankhorst +Cc: Thomas Zimmermann +Signed-off-by: Jani Nikula +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 38ce608648b0..85d85a0ba85f 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -535,7 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret, i, num_connectors; ++ int ret, i, num_connectors = 0; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -673,7 +673,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + +- num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +-- +2.43.0 + diff --git a/queue-5.4/drm-exynos-fix-a-potential-error-pointer-dereference.patch b/queue-5.4/drm-exynos-fix-a-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..086b8c38985 --- /dev/null +++ b/queue-5.4/drm-exynos-fix-a-potential-error-pointer-dereference.patch @@ -0,0 +1,40 @@ +From a7262353251c9fb91a8f77fd74b4f7d87a5d90b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 14:27:48 +0800 +Subject: drm/exynos: fix a potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ] + +Smatch reports the warning below: +drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind() +error: 'crtc' dereferencing possible ERR_PTR() + +The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), +which can not be used directly. Fix this by checking the return value +before using it. + +Signed-off-by: Xiang Yang +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index 0073a2b3b80a..93b2af4936d0 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1850,6 +1850,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data) + return ret; + + crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI); ++ if (IS_ERR(crtc)) ++ return PTR_ERR(crtc); + crtc->pipe_clk = &hdata->phy_clk; + + ret = hdmi_create_connector(encoder); +-- +2.43.0 + diff --git a/queue-5.4/drm-exynos-fix-a-wrong-error-checking.patch b/queue-5.4/drm-exynos-fix-a-wrong-error-checking.patch new file mode 100644 index 00000000000..93cd0de604d --- /dev/null +++ b/queue-5.4/drm-exynos-fix-a-wrong-error-checking.patch @@ -0,0 +1,62 @@ +From 951f176efab51c5912f5993d360914f45fa192c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 18:36:51 +0900 +Subject: drm/exynos: fix a wrong error checking + +From: Inki Dae + +[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ] + +Fix a wrong error checking in exynos_drm_dma.c module. + +In the exynos_drm_register_dma function, both arm_iommu_create_mapping() +and iommu_get_domain_for_dev() functions are expected to return NULL as +an error. + +However, the error checking is performed using the statement +if(IS_ERR(mapping)), which doesn't provide a suitable error value. +So check if 'mapping' is NULL, and if it is, return -ENODEV. + +This issue[1] was reported by Dan. + +Changelog v1: +- fix build warning. + +[1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ + +Reported-by : Dan Carpenter +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c +index a3c9d8b9e1a1..e07d31b9a921 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c +@@ -133,18 +133,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, + return 0; + + if (!priv->mapping) { +- void *mapping; ++ void *mapping = NULL; + + if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) + mapping = arm_iommu_create_mapping(&platform_bus_type, + EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); + else if (IS_ENABLED(CONFIG_IOMMU_DMA)) + mapping = iommu_get_domain_for_dev(priv->dma_dev); +- else +- mapping = ERR_PTR(-ENODEV); + +- if (IS_ERR(mapping)) +- return PTR_ERR(mapping); ++ if (!mapping) ++ return -ENODEV; + priv->mapping = mapping; + } + +-- +2.43.0 + diff --git a/queue-5.4/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch b/queue-5.4/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch new file mode 100644 index 00000000000..7ccb1d1930e --- /dev/null +++ b/queue-5.4/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch @@ -0,0 +1,99 @@ +From e58ddef9c9bbd9550498de22cef54f3c35ff47b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 16:53:57 +0000 +Subject: ida: Fix crash in ida_free when the bitmap is empty + +From: Matthew Wilcox (Oracle) + +[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ] + +The IDA usually detects double-frees, but that detection failed to +consider the case when there are no nearby IDs allocated and so we have a +NULL bitmap rather than simply having a clear bit. Add some tests to the +test-suite to be sure we don't inadvertently reintroduce this problem. +Unfortunately they're quite noisy so include a message to disregard +the warnings. + +Reported-by: Zhenghan Wang +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/idr.c | 2 +- + lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/lib/idr.c b/lib/idr.c +index a91ca1dfe143..a90bd348ba03 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -506,7 +506,7 @@ void ida_free(struct ida *ida, unsigned int id) + goto delete; + xas_store(&xas, xa_mk_value(v)); + } else { +- if (!test_bit(bit, bitmap->bitmap)) ++ if (!bitmap || !test_bit(bit, bitmap->bitmap)) + goto err; + __clear_bit(bit, bitmap->bitmap); + xas_set_mark(&xas, XA_FREE_MARK); +diff --git a/lib/test_ida.c b/lib/test_ida.c +index b06880625961..55105baa19da 100644 +--- a/lib/test_ida.c ++++ b/lib/test_ida.c +@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) + IDA_BUG_ON(ida, !ida_is_empty(ida)); + } + ++/* ++ * Check various situations where we attempt to free an ID we don't own. ++ */ ++static void ida_check_bad_free(struct ida *ida) ++{ ++ unsigned long i; ++ ++ printk("vvv Ignore \"not allocated\" warnings\n"); ++ /* IDA is empty; all of these will fail */ ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single value entry */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single bitmap */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a tree */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ printk("^^^ \"not allocated\" warnings over\n"); ++ ++ ida_free(ida, 3); ++ ida_free(ida, 1023); ++ ida_free(ida, (1 << 20) - 1); ++ ++ IDA_BUG_ON(ida, !ida_is_empty(ida)); ++} ++ + static DEFINE_IDA(ida); + + static int ida_checks(void) +@@ -162,6 +201,7 @@ static int ida_checks(void) + ida_check_leaf(&ida, 1024 * 64); + ida_check_max(&ida); + ida_check_conv(&ida); ++ ida_check_bad_free(&ida); + + printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); + return (tests_run != tests_passed) ? 0 : -EINVAL; +-- +2.43.0 + diff --git a/queue-5.4/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch b/queue-5.4/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch new file mode 100644 index 00000000000..ed90ab6a1dd --- /dev/null +++ b/queue-5.4/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch @@ -0,0 +1,126 @@ +From f010f410659a7eca243a4a775c387afc80c2a07c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:59:24 -0800 +Subject: Input: atkbd - skip ATKBD_CMD_GETID in translated mode + +From: Hans de Goede + +[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ] + +There have been multiple reports of keyboard issues on recent laptop models +which can be worked around by setting i8042.dumbkbd, with the downside +being this breaks the capslock LED. + +It seems that these issues are caused by recent laptops getting confused by +ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for +this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode. + +The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 +mice/touchpads and those are never used in translated mode. + +Examples of laptop models which benefit from skipping ATKBD_CMD_GETID: + +* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" + models the kbd stops working for the first 2 - 5 minutes after boot + (waiting for EC watchdog reset?) + +* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard + +* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see: + https://github.com/yescallop/atkbd-nogetid + +This has been tested on: + +1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not + in translated mode when no keyboard is plugged in and with a ps/2 kbd + a "AT Translated Set 2 keyboard" /dev/input/event# node shows up + +2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard) + +Reported-by: Shang Ye +Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/ +Closes: https://github.com/yescallop/atkbd-nogetid +Reported-by: gurevitch +Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/ +Reported-by: Egor Ignatov +Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/ +Reported-by: Anton Zhilyaev +Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/ +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- + 1 file changed, 42 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index 7e3eae54c192..380221dbfc19 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -715,6 +715,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) + ps2dev->serio->phys); + } + ++#ifdef CONFIG_X86 ++static bool atkbd_is_portable_device(void) ++{ ++ static const char * const chassis_types[] = { ++ "8", /* Portable */ ++ "9", /* Laptop */ ++ "10", /* Notebook */ ++ "14", /* Sub-Notebook */ ++ "31", /* Convertible */ ++ "32", /* Detachable */ ++ }; ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(chassis_types); i++) ++ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i])) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops ++ * the controller is always in translated mode. In this mode mice/touchpads will ++ * not work. So in this case simply assume a keyboard is connected to avoid ++ * confusing some laptop keyboards. ++ * ++ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is ++ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in ++ * translated mode that is a no-op. ++ */ ++static bool atkbd_skip_getid(struct atkbd *atkbd) ++{ ++ return atkbd->translated && atkbd_is_portable_device(); ++} ++#else ++static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; } ++#endif ++ + /* + * atkbd_probe() probes for an AT keyboard on a serio port. + */ +@@ -744,12 +782,12 @@ static int atkbd_probe(struct atkbd *atkbd) + */ + + param[0] = param[1] = 0xa5; /* initialize with invalid values */ +- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { ++ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { + + /* +- * If the get ID command failed, we check if we can at least set the LEDs on +- * the keyboard. This should work on every keyboard out there. It also turns +- * the LEDs off, which we want anyway. ++ * If the get ID command was skipped or failed, we check if we can at least set ++ * the LEDs on the keyboard. This should work on every keyboard out there. ++ * It also turns the LEDs off, which we want anyway. + */ + param[0] = 0; + if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) +-- +2.43.0 + diff --git a/queue-5.4/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch b/queue-5.4/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch new file mode 100644 index 00000000000..4f0c47c507f --- /dev/null +++ b/queue-5.4/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch @@ -0,0 +1,45 @@ +From cca640589373d164a2b7c4d43742d5cc0fb30285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 19:56:19 +0000 +Subject: Input: i8042 - add nomux quirk for Acer P459-G2-M + +From: Esther Shimanovich + +[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ] + +After the laptop lid is opened, and the device resumes from S3 deep +sleep, if the user presses a keyboard key while the screen is still black, +the mouse and keyboard become unusable. + +Enabling this quirk prevents this behavior from occurring. + +Signed-off-by: Esther Shimanovich +Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 5df6eef18228..1ab7f27bc906 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -351,6 +351,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK) + }, ++ { ++ /* Acer TravelMate P459-G2-M */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Amoi M636/A737 */ + .matches = { +-- +2.43.0 + diff --git a/queue-5.4/input-xpad-add-razer-wolverine-v2-support.patch b/queue-5.4/input-xpad-add-razer-wolverine-v2-support.patch new file mode 100644 index 00000000000..fdb42d52f28 --- /dev/null +++ b/queue-5.4/input-xpad-add-razer-wolverine-v2-support.patch @@ -0,0 +1,34 @@ +From 9fa2a4f1723df9d5faca27d1bd919293518b03a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 17:22:15 +0100 +Subject: Input: xpad - add Razer Wolverine V2 support + +From: Luca Weiss + +[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ] + +Add the VID and PID of Razer Wolverine V2 to xpad_device. + +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index beedad0fe09a..239471cf7e4c 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -266,6 +266,7 @@ static const struct xpad_device { + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, +-- +2.43.0 + diff --git a/queue-5.4/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch b/queue-5.4/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch new file mode 100644 index 00000000000..7a200601b7d --- /dev/null +++ b/queue-5.4/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch @@ -0,0 +1,41 @@ +From fd32f6c8962cf37c3627da2509cbed2c4fce803c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:39 +0800 +Subject: jbd2: correct the printing of write_flags in jbd2_write_superblock() + +From: Zhang Yi + +[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ] + +The write_flags print in the trace of jbd2_write_superblock() is not +real, so move the modification before the trace. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index eeebe64b7c54..81bd7b29a10b 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1355,9 +1355,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + return -EIO; + } + +- trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); ++ ++ trace_jbd2_write_superblock(journal, write_flags); ++ + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +-- +2.43.0 + diff --git a/queue-5.4/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch b/queue-5.4/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch new file mode 100644 index 00000000000..cbc00261ce1 --- /dev/null +++ b/queue-5.4/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch @@ -0,0 +1,64 @@ +From 77e4a65d88710e70b7a3c5d01f530bdb91be6da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 03:38:33 +0000 +Subject: neighbour: Don't let neigh_forced_gc() disable preemption for long + +From: Judy Hsiao + +[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ] + +We are seeing cases where neigh_cleanup_and_release() is called by +neigh_forced_gc() many times in a row with preemption turned off. +When running on a low powered CPU at a low CPU frequency, this has +been measured to keep preemption off for ~10 ms. That's not great on a +system with HZ=1000 which expects tasks to be able to schedule in +with ~1ms latency. + +Suggested-by: Douglas Anderson +Signed-off-by: Judy Hsiao +Reviewed-by: David Ahern +Reviewed-by: Eric Dumazet +Reviewed-by: Douglas Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 9d631b7adb7b..e571007d083c 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -226,9 +226,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) + { + int max_clean = atomic_read(&tbl->gc_entries) - + READ_ONCE(tbl->gc_thresh2); ++ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC; + unsigned long tref = jiffies - 5 * HZ; + struct neighbour *n, *tmp; + int shrunk = 0; ++ int loop = 0; + + NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs); + +@@ -251,11 +253,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) + shrunk++; + if (shrunk >= max_clean) + break; ++ if (++loop == 16) { ++ if (ktime_get_ns() > tmax) ++ goto unlock; ++ loop = 0; ++ } + } + } + + WRITE_ONCE(tbl->last_flush, jiffies); +- ++unlock: + write_unlock_bh(&tbl->lock); + + return shrunk; +-- +2.43.0 + diff --git a/queue-5.4/net-tg3-fix-race-condition-in-tg3_reset_task.patch b/queue-5.4/net-tg3-fix-race-condition-in-tg3_reset_task.patch new file mode 100644 index 00000000000..c55e84445df --- /dev/null +++ b/queue-5.4/net-tg3-fix-race-condition-in-tg3_reset_task.patch @@ -0,0 +1,94 @@ +From 482332937cd61ee31d94d016f3c6a79921376e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 18:19:11 -0600 +Subject: net/tg3: fix race condition in tg3_reset_task() + +From: Thinh Tran + +[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] + +When an EEH error is encountered by a PCI adapter, the EEH driver +modifies the PCI channel's state as shown below: + + enum { + /* I/O channel is in normal state */ + pci_channel_io_normal = (__force pci_channel_state_t) 1, + + /* I/O to channel is blocked */ + pci_channel_io_frozen = (__force pci_channel_state_t) 2, + + /* PCI card is dead */ + pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, + }; + +If the same EEH error then causes the tg3 driver's transmit timeout +logic to execute, the tg3_tx_timeout() function schedules a reset +task via tg3_reset_task_schedule(), which may cause a race condition +between the tg3 and EEH driver as both attempt to recover the HW via +a reset action. + +EEH driver gets error event +--> eeh_set_channel_state() + and set device to one of + error state above scheduler: tg3_reset_task() get + returned error from tg3_init_hw() + --> dev_close() shuts down the interface +tg3_io_slot_reset() and +tg3_io_resume() fail to +reset/resume the device + +To resolve this issue, we avoid the race condition by checking the PCI +channel state in the tg3_reset_task() function and skip the tg3 driver +initiated reset when the PCI channel is not in the normal state. (The +driver has no access to tg3 device registers at this point and cannot +even complete the reset task successfully without external assistance.) +We'll leave the reset procedure to be managed by the EEH driver which +calls the tg3_io_error_detected(), tg3_io_slot_reset() and +tg3_io_resume() functions as appropriate. + +Adding the same checking in tg3_dump_state() to avoid dumping all +device registers when the PCI channel is not in the normal state. + +Signed-off-by: Thinh Tran +Tested-by: Venkata Sai Duggi +Reviewed-by: David Christensen +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 4cfb0d0ee80c..4847441cf161 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6460,6 +6460,14 @@ static void tg3_dump_state(struct tg3 *tp) + int i; + u32 *regs; + ++ /* If it is a PCI error, all registers will be 0xffff, ++ * we don't dump them out, just report the error and return ++ */ ++ if (tp->pdev->error_state != pci_channel_io_normal) { ++ netdev_err(tp->dev, "PCI channel ERROR!\n"); ++ return; ++ } ++ + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); + if (!regs) + return; +@@ -11205,7 +11213,8 @@ static void tg3_reset_task(struct work_struct *work) + rtnl_lock(); + tg3_full_lock(tp, 0); + +- if (tp->pcierr_recovery || !netif_running(tp->dev)) { ++ if (tp->pcierr_recovery || !netif_running(tp->dev) || ++ tp->pdev->error_state != pci_channel_io_normal) { + tg3_flag_clear(tp, RESET_TASK_PENDING); + tg3_full_unlock(tp); + rtnl_unlock(); +-- +2.43.0 + diff --git a/queue-5.4/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch b/queue-5.4/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch new file mode 100644 index 00000000000..c7f8aeec938 --- /dev/null +++ b/queue-5.4/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch @@ -0,0 +1,38 @@ +From 520ad0f2075065930b40ccf470cdb37018745b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 11:08:52 +1000 +Subject: nouveau/tu102: flush all pdbs on vmm flush + +From: Dave Airlie + +[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ] + +This is a hack around a bug exposed with the GSP code, I'm not sure +what is happening exactly, but it appears some of our flushes don't +result in proper tlb invalidation for out BAR2 and we get a BAR2 +fault from GSP and it all dies. + +Signed-off-by: Dave Airlie +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +index be91cffc3b52..315000b2f8e3 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +@@ -32,7 +32,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) + + type = 0x00000001; /* PAGE_ALL */ + if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR])) +- type |= 0x00000004; /* HUB_ONLY */ ++ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */ + + mutex_lock(&subdev->mutex); + +-- +2.43.0 + diff --git a/queue-5.4/nvme-introduce-helper-function-to-get-ctrl-state.patch b/queue-5.4/nvme-introduce-helper-function-to-get-ctrl-state.patch new file mode 100644 index 00000000000..5173e9a3530 --- /dev/null +++ b/queue-5.4/nvme-introduce-helper-function-to-get-ctrl-state.patch @@ -0,0 +1,40 @@ +From 9b4c90ec964d2afafa337d7ee3c935727f5cba71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 08:13:09 -0700 +Subject: nvme: introduce helper function to get ctrl state + +From: Keith Busch + +[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ] + +The controller state is typically written by another CPU, so reading it +should ensure no optimizations are taken. This is a repeated pattern in +the driver, so start with adding a convenience function that returns the +controller state with READ_ONCE(). + +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/nvme.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 17c0d6ae3eee..c492d7d32398 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -292,6 +292,11 @@ struct nvme_ctrl { + struct nvme_fault_inject fault_inject; + }; + ++static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl) ++{ ++ return READ_ONCE(ctrl->state); ++} ++ + enum nvme_iopolicy { + NVME_IOPOLICY_NUMA, + NVME_IOPOLICY_RR, +-- +2.43.0 + diff --git a/queue-5.4/pinctrl-lochnagar-don-t-build-on-mips.patch b/queue-5.4/pinctrl-lochnagar-don-t-build-on-mips.patch new file mode 100644 index 00000000000..3af7059c565 --- /dev/null +++ b/queue-5.4/pinctrl-lochnagar-don-t-build-on-mips.patch @@ -0,0 +1,42 @@ +From c0e16b3aca0c178dbd91300b2cfd4aafbd151cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:28:53 +0000 +Subject: pinctrl: lochnagar: Don't build on MIPS + +From: Charles Keepax + +[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ] + +MIPS appears to define a RST symbol at a high level, which clashes +with some register naming in the driver. Since there is currently +no case for running this driver on MIPS devices simply cut off the +build of this driver on MIPS. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/ +Suggested-by: Linus Walleij +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/cirrus/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig +index 530426a74f75..b3cea8d56c4f 100644 +--- a/drivers/pinctrl/cirrus/Kconfig ++++ b/drivers/pinctrl/cirrus/Kconfig +@@ -1,7 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0-only + config PINCTRL_LOCHNAGAR + tristate "Cirrus Logic Lochnagar pinctrl driver" +- depends on MFD_LOCHNAGAR ++ # Avoid clash caused by MIPS defining RST, which is used in the driver ++ depends on MFD_LOCHNAGAR && !MIPS + select GPIOLIB + select PINMUX + select PINCONF +-- +2.43.0 + diff --git a/queue-5.4/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch b/queue-5.4/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch new file mode 100644 index 00000000000..22b63cc8641 --- /dev/null +++ b/queue-5.4/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch @@ -0,0 +1,38 @@ +From d798022bafc622a26e69a1c72c40f61e18d4fc6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 11:13:00 +0200 +Subject: reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning + +From: Krzysztof Kozlowski + +[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ] + +'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 +causes: + + hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/hisilicon/hi6220_reset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c +index 24e6d420b26b..84e761f454b6 100644 +--- a/drivers/reset/hisilicon/hi6220_reset.c ++++ b/drivers/reset/hisilicon/hi6220_reset.c +@@ -104,7 +104,7 @@ static int hi6220_reset_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + +- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev); ++ type = (uintptr_t)of_device_get_match_data(dev); + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { +-- +2.43.0 + diff --git a/queue-5.4/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch b/queue-5.4/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch new file mode 100644 index 00000000000..c2216c9b88a --- /dev/null +++ b/queue-5.4/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch @@ -0,0 +1,45 @@ +From bf76a80555cff2b51a4ed37bbed5806514c52561 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 17:54:03 -0500 +Subject: ring-buffer: Do not record in NMI if the arch does not support + cmpxchg in NMI + +From: Steven Rostedt (Google) + +[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ] + +As the ring buffer recording requires cmpxchg() to work, if the +architecture does not support cmpxchg in NMI, then do not do any recording +within an NMI. + +Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 4a03eac43aaf..0c0ca21d807d 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -2976,6 +2976,12 @@ rb_reserve_next_event(struct ring_buffer *buffer, + int nr_loops = 0; + u64 diff; + ++ /* ring buffer does cmpxchg, make sure it is safe in NMI context */ ++ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) && ++ (unlikely(in_nmi()))) { ++ return NULL; ++ } ++ + rb_start_commit(cpu_buffer); + + #ifdef CONFIG_RING_BUFFER_ALLOW_SWAP +-- +2.43.0 + diff --git a/queue-5.4/s390-scm-fix-virtual-vs-physical-address-confusion.patch b/queue-5.4/s390-scm-fix-virtual-vs-physical-address-confusion.patch new file mode 100644 index 00000000000..76085a29f92 --- /dev/null +++ b/queue-5.4/s390-scm-fix-virtual-vs-physical-address-confusion.patch @@ -0,0 +1,59 @@ +From 44228c78da115251636d852ea782989d9f3892ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 22:52:53 +0100 +Subject: s390/scm: fix virtual vs physical address confusion + +From: Vineeth Vijayan + +[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ] + +Fix virtual vs physical address confusion (which currently are the same). + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Acked-by: Alexander Gordeev +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/block/scm_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c +index e01889394c84..d3133023a557 100644 +--- a/drivers/s390/block/scm_blk.c ++++ b/drivers/s390/block/scm_blk.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include "scm_blk.h" + +@@ -131,7 +132,7 @@ static void scm_request_done(struct scm_request *scmrq) + + for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) { + msb = &scmrq->aob->msb[i]; +- aidaw = msb->data_addr; ++ aidaw = (u64)phys_to_virt(msb->data_addr); + + if ((msb->flags & MSB_FLAG_IDA) && aidaw && + IS_ALIGNED(aidaw, PAGE_SIZE)) +@@ -196,12 +197,12 @@ static int scm_request_prepare(struct scm_request *scmrq) + msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9); + msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE; + msb->flags |= MSB_FLAG_IDA; +- msb->data_addr = (u64) aidaw; ++ msb->data_addr = (u64)virt_to_phys(aidaw); + + rq_for_each_segment(bv, req, iter) { + WARN_ON(bv.bv_offset); + msb->blk_count += bv.bv_len >> 12; +- aidaw->data_addr = (u64) page_address(bv.bv_page); ++ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page)); + aidaw++; + } + +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 4c6ad7e1923..5cfb217e993 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,31 @@ f2fs-explicitly-null-terminate-the-xattr-list.patch +pinctrl-lochnagar-don-t-build-on-mips.patch +alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch +asoc-intel-skylake-fix-mem-leak-in-few-functions.patch +asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch +asoc-intel-skylake-mem-leak-in-skl-register-function.patch +asoc-cs43130-fix-the-position-of-const-qualifier.patch +asoc-cs43130-fix-incorrect-frame-delay-configuration.patch +asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch +nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch +net-tg3-fix-race-condition-in-tg3_reset_task.patch +asoc-da7219-support-low-dc-impedance-headset.patch +nvme-introduce-helper-function-to-get-ctrl-state.patch +drm-exynos-fix-a-potential-error-pointer-dereference.patch +drm-exynos-fix-a-wrong-error-checking.patch +clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch +jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch +drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch +neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch +tracing-have-large-events-show-up-as-line-too-big-in.patch +tracing-add-size-check-when-printing-trace_marker-ou.patch +ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch +reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch +input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch +input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch +s390-scm-fix-virtual-vs-physical-address-confusion.patch +arc-fix-spare-error.patch +input-xpad-add-razer-wolverine-v2-support.patch +ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch +arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch +drm-crtc-fix-uninitialized-variable-use.patch diff --git a/queue-5.4/tracing-add-size-check-when-printing-trace_marker-ou.patch b/queue-5.4/tracing-add-size-check-when-printing-trace_marker-ou.patch new file mode 100644 index 00000000000..dbdc3f2c40a --- /dev/null +++ b/queue-5.4/tracing-add-size-check-when-printing-trace_marker-ou.patch @@ -0,0 +1,67 @@ +From 3236c58263eb8574ae91c69ae30aaac03b4109d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 08:44:44 -0500 +Subject: tracing: Add size check when printing trace_marker output + +From: Steven Rostedt (Google) + +[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ] + +If for some reason the trace_marker write does not have a nul byte for the +string, it will overflow the print: + + trace_seq_printf(s, ": %s", field->buf); + +The field->buf could be missing the nul byte. To prevent overflow, add the +max size that the buf can be by using the event size and the field +location. + + int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_seq_printf(s, ": %*.s", max, field->buf); + +Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_output.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c +index b194dd1c8420..9ffe54ff3edb 100644 +--- a/kernel/trace/trace_output.c ++++ b/kernel/trace/trace_output.c +@@ -1291,11 +1291,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, + { + struct print_entry *field; + struct trace_seq *s = &iter->seq; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + + seq_print_ip_sym(s, field->ip, flags); +- trace_seq_printf(s, ": %s", field->buf); ++ trace_seq_printf(s, ": %.*s", max, field->buf); + + return trace_handle_return(s); + } +@@ -1304,10 +1305,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, + struct trace_event *event) + { + struct print_entry *field; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + +- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf); ++ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf); + + return trace_handle_return(&iter->seq); + } +-- +2.43.0 + diff --git a/queue-5.4/tracing-have-large-events-show-up-as-line-too-big-in.patch b/queue-5.4/tracing-have-large-events-show-up-as-line-too-big-in.patch new file mode 100644 index 00000000000..6394a816eaa --- /dev/null +++ b/queue-5.4/tracing-have-large-events-show-up-as-line-too-big-in.patch @@ -0,0 +1,79 @@ +From 8adb86b8aefe79bc5e805c65ae5eaddfa7c2966a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 17:10:58 -0500 +Subject: tracing: Have large events show up as '[LINE TOO BIG]' instead of + nothing + +From: Steven Rostedt (Google) + +[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ] + +If a large event was added to the ring buffer that is larger than what the +trace_seq can handle, it just drops the output: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234 + +Instead, catch this case and add some context: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG] + <...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234 + +This now emulates the same output as trace_pipe. + +Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index d7ca8f97b315..35c150085556 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4078,7 +4078,11 @@ static int s_show(struct seq_file *m, void *v) + iter->leftover = ret; + + } else { +- print_trace_line(iter); ++ ret = print_trace_line(iter); ++ if (ret == TRACE_TYPE_PARTIAL_LINE) { ++ iter->seq.full = 0; ++ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n"); ++ } + ret = trace_print_seq(m, &iter->seq); + /* + * If we overflow the seq_file buffer, then it will +-- +2.43.0 +