From c90a49d36289d8d76e3818162d398a4306dfa96d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Tue, 16 Jan 2024 05:42:06 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...aker-and-headset-mic-pin-config-for-.patch | 59 +++++++ queue-5.10/arc-fix-spare-error.patch | 48 ++++++ ...x-return-code-check-of-of_property_m.patch | 49 ++++++ ...-incorrect-frame-delay-configuration.patch | 34 ++++ ...-fix-the-position-of-const-qualifier.patch | 43 +++++ ...219-support-low-dc-impedance-headset.patch | 36 +++++ ...nditionally-register-dais-for-hdmi-a.patch | 92 +++++++++++ ...da_dsp_generic-drop-hdmi-routes-when.patch | 44 ++++++ ...kylake-fix-mem-leak-in-few-functions.patch | 59 +++++++ ...ke-mem-leak-in-skl-register-function.patch | 52 ++++++ ...-incorrect-type-in-assignment-and-ca.patch | 75 +++++++++ ...mutex-to-avoid-the-jack-detection-fa.patch | 79 ++++++++++ ...oc-wm8974-correct-boost-mixer-inputs.patch | 49 ++++++ ...ip-rk3128-fix-hclk_otg-gate-register.patch | 35 ++++ ...-debugfs-handlers-vs.-removal-with-l.patch | 118 ++++++++++++++ ...debugfs-fix-automount-d_fsdata-usage.patch | 149 ++++++++++++++++++ ...at-debugfs-amdgpu_regs_didt-causes-k.patch | 56 +++++++ ...uninit-value-bug-in-drm_mode_setcrtc.patch | 79 ++++++++++ ...-crtc-fix-uninitialized-variable-use.patch | 54 +++++++ ...-potential-error-pointer-dereference.patch | 40 +++++ ...rm-exynos-fix-a-wrong-error-checking.patch | 62 ++++++++ ...potential-spinlock-recursion-on-poll.patch | 84 ++++++++++ ...in-ida_free-when-the-bitmap-is-empty.patch | 99 ++++++++++++ ...p-atkbd_cmd_getid-in-translated-mode.patch | 126 +++++++++++++++ ...2-add-nomux-quirk-for-acer-p459-g2-m.patch | 45 ++++++ ...-xpad-add-razer-wolverine-v2-support.patch | 34 ++++ ...-printing-of-write_flags-in-jbd2_wri.patch | 41 +++++ ...ckup-in-journal_finish_inode_data_bu.patch | 82 ++++++++++ ...-rcutree_report_cpu_starting-earlier.patch | 77 +++++++++ ...init-value-in-mptcp_incoming_options.patch | 35 ++++ ...let-neigh_forced_gc-disable-preempti.patch | 64 ++++++++ ...turn-0-if-server-port-is-not-present.patch | 45 ++++++ ...fix-race-condition-in-tg3_reset_task.patch | 94 +++++++++++ ...au-tu102-flush-all-pdbs-on-vmm-flush.patch | 38 +++++ ...e-core-check-for-too-small-lba-shift.patch | 42 +++++ ...ce-helper-function-to-get-ctrl-state.patch | 40 +++++ ...inctrl-lochnagar-don-t-build-on-mips.patch | 42 +++++ ...hi6220-fix-wvoid-pointer-to-enum-cas.patch | 38 +++++ ...ot-record-in-nmi-if-the-arch-does-no.patch | 45 ++++++ ...irtual-vs-physical-address-confusion.patch | 59 +++++++ queue-5.10/series | 42 +++++ ...-check-when-printing-trace_marker-ou.patch | 67 ++++++++ ...ge-events-show-up-as-line-too-big-in.patch | 79 ++++++++++ 43 files changed, 2630 insertions(+) create mode 100644 queue-5.10/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch create mode 100644 queue-5.10/arc-fix-spare-error.patch create mode 100644 queue-5.10/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch create mode 100644 queue-5.10/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch create mode 100644 queue-5.10/asoc-cs43130-fix-the-position-of-const-qualifier.patch create mode 100644 queue-5.10/asoc-da7219-support-low-dc-impedance-headset.patch create mode 100644 queue-5.10/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch create mode 100644 queue-5.10/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch create mode 100644 queue-5.10/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch create mode 100644 queue-5.10/asoc-intel-skylake-mem-leak-in-skl-register-function.patch create mode 100644 queue-5.10/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch create mode 100644 queue-5.10/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch create mode 100644 queue-5.10/asoc-wm8974-correct-boost-mixer-inputs.patch create mode 100644 queue-5.10/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch create mode 100644 queue-5.10/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch create mode 100644 queue-5.10/debugfs-fix-automount-d_fsdata-usage.patch create mode 100644 queue-5.10/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch create mode 100644 queue-5.10/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch create mode 100644 queue-5.10/drm-crtc-fix-uninitialized-variable-use.patch create mode 100644 queue-5.10/drm-exynos-fix-a-potential-error-pointer-dereference.patch create mode 100644 queue-5.10/drm-exynos-fix-a-wrong-error-checking.patch create mode 100644 queue-5.10/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch create mode 100644 queue-5.10/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch create mode 100644 queue-5.10/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch create mode 100644 queue-5.10/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch create mode 100644 queue-5.10/input-xpad-add-razer-wolverine-v2-support.patch create mode 100644 queue-5.10/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch create mode 100644 queue-5.10/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch create mode 100644 queue-5.10/mips-smp-call-rcutree_report_cpu_starting-earlier.patch create mode 100644 queue-5.10/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch create mode 100644 queue-5.10/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch create mode 100644 queue-5.10/net-qrtr-ns-return-0-if-server-port-is-not-present.patch create mode 100644 queue-5.10/net-tg3-fix-race-condition-in-tg3_reset_task.patch create mode 100644 queue-5.10/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch create mode 100644 queue-5.10/nvme-core-check-for-too-small-lba-shift.patch create mode 100644 queue-5.10/nvme-introduce-helper-function-to-get-ctrl-state.patch create mode 100644 queue-5.10/pinctrl-lochnagar-don-t-build-on-mips.patch create mode 100644 queue-5.10/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch create mode 100644 queue-5.10/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch create mode 100644 queue-5.10/s390-scm-fix-virtual-vs-physical-address-confusion.patch create mode 100644 queue-5.10/tracing-add-size-check-when-printing-trace_marker-ou.patch create mode 100644 queue-5.10/tracing-have-large-events-show-up-as-line-too-big-in.patch diff --git a/queue-5.10/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch b/queue-5.10/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch new file mode 100644 index 00000000000..56c03d15d43 --- /dev/null +++ b/queue-5.10/alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch @@ -0,0 +1,59 @@ +From ea80bad44b1070c71a1dc97970fd12f566cf095c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 20:09:23 +0300 +Subject: ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook + XPro + +From: Vasiliy Kovalev + +[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ] + +This patch corrected the speaker and headset mic pin config to the more +appropriate values. + +Signed-off-by: Vasiliy Kovalev +Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 99ba89723cd3..c7e76bfad84d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6797,6 +6797,7 @@ enum { + ALC290_FIXUP_SUBWOOFER_HSJACK, + ALC269_FIXUP_THINKPAD_ACPI, + ALC269_FIXUP_DMIC_THINKPAD_ACPI, ++ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO, + ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + ALC255_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, +@@ -7094,6 +7095,14 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_pincfg_U7x7_headset_mic, + }, ++ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x03a19020 }, /* headset mic */ ++ { 0x1b, 0x90170150 }, /* speaker */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -9320,6 +9329,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC), ++ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO), + SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC), + SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), + SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10), +-- +2.43.0 + diff --git a/queue-5.10/arc-fix-spare-error.patch b/queue-5.10/arc-fix-spare-error.patch new file mode 100644 index 00000000000..bea1cceaaf0 --- /dev/null +++ b/queue-5.10/arc-fix-spare-error.patch @@ -0,0 +1,48 @@ +From 3378c9c15c72c44dc68de01728ce601fc9a14eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:57:07 -0800 +Subject: ARC: fix spare error + +From: Vineet Gupta + +[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/ +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/signal.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c +index 4868bdebf586..c43d323bcb59 100644 +--- a/arch/arc/kernel/signal.c ++++ b/arch/arc/kernel/signal.c +@@ -61,7 +61,7 @@ struct rt_sigframe { + unsigned int sigret_magic; + }; + +-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) + #else + v2abi.r58 = v2abi.r59 = 0; + #endif +- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi)); ++ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi)); + #endif + return err; + } + +-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs) ++static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs) + { + int err = 0; + #ifndef CONFIG_ISA_ARCOMPACT +-- +2.43.0 + diff --git a/queue-5.10/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch b/queue-5.10/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch new file mode 100644 index 00000000000..b96392b6c88 --- /dev/null +++ b/queue-5.10/arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch @@ -0,0 +1,49 @@ +From 60212710124176e3fb0762b411fcb934b1167145 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 20:39:03 +0100 +Subject: ARM: sun9i: smp: fix return code check of of_property_match_string + +From: Stefan Wahren + +[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ] + +of_property_match_string returns an int; either an index from 0 or +greater if successful or negative on failure. Even it's very +unlikely that the DT CPU node contains multiple enable-methods +these checks should be fixed. + +This patch was inspired by the work of Nick Desaulniers. + +Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/ +Cc: Nick Desaulniers +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/mc_smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c +index b2f5f4f28705..f779e386b6e7 100644 +--- a/arch/arm/mach-sunxi/mc_smp.c ++++ b/arch/arm/mach-sunxi/mc_smp.c +@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void) + for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) { + ret = of_property_match_string(node, "enable-method", + sunxi_mc_smp_data[i].enable_method); +- if (!ret) ++ if (ret >= 0) + break; + } + + of_node_put(node); +- if (ret) ++ if (ret < 0) + return -ENODEV; + + is_a83t = sunxi_mc_smp_data[i].is_a83t; +-- +2.43.0 + diff --git a/queue-5.10/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch b/queue-5.10/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch new file mode 100644 index 00000000000..1e6a5e5f813 --- /dev/null +++ b/queue-5.10/asoc-cs43130-fix-incorrect-frame-delay-configuration.patch @@ -0,0 +1,34 @@ +From 2f8655994db6769766d05a829d30921bce0ea5fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:39 +0000 +Subject: ASoC: cs43130: Fix incorrect frame delay configuration + +From: Maciej Strozek + +[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 285806868c40..02fb9317b697 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -578,7 +578,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk, + break; + case SND_SOC_DAIFMT_LEFT_J: + hi_size = bitwidth_sclk; +- frm_delay = 2; ++ frm_delay = 0; + frm_phase = 1; + break; + case SND_SOC_DAIFMT_DSP_A: +-- +2.43.0 + diff --git a/queue-5.10/asoc-cs43130-fix-the-position-of-const-qualifier.patch b/queue-5.10/asoc-cs43130-fix-the-position-of-const-qualifier.patch new file mode 100644 index 00000000000..38efdad1aa8 --- /dev/null +++ b/queue-5.10/asoc-cs43130-fix-the-position-of-const-qualifier.patch @@ -0,0 +1,43 @@ +From 0b841474a34b70a52409b66e9cbad5f584664394 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 14:13:38 +0000 +Subject: ASoC: cs43130: Fix the position of const qualifier + +From: Maciej Strozek + +[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ] + +Signed-off-by: Maciej Strozek +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 8f70dee95878..285806868c40 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -1683,7 +1683,7 @@ static ssize_t cs43130_show_dc_r(struct device *dev, + return cs43130_show_dc(dev, buf, HP_RIGHT); + } + +-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = { ++static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = { + 24, + 43, + 93, +@@ -2364,7 +2364,7 @@ static const struct regmap_config cs43130_regmap = { + .use_single_write = true, + }; + +-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { ++static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = { + 50, + 120, + }; +-- +2.43.0 + diff --git a/queue-5.10/asoc-da7219-support-low-dc-impedance-headset.patch b/queue-5.10/asoc-da7219-support-low-dc-impedance-headset.patch new file mode 100644 index 00000000000..eabd05395a7 --- /dev/null +++ b/queue-5.10/asoc-da7219-support-low-dc-impedance-headset.patch @@ -0,0 +1,36 @@ +From 76f9db62f99fde97d1da7b761256dc656a4b2777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 12:29:33 +0800 +Subject: ASoC: da7219: Support low DC impedance headset + +From: David Rau + +[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ] + +Change the default MIC detection impedance threshold to 200ohm +to support low mic DC impedance headset. + +Signed-off-by: David Rau +Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index b316d613a709..b6030709b6b6 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -654,7 +654,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev) + aad_pdata->mic_det_thr = + da7219_aad_fw_mic_det_thr(dev, fw_val32); + else +- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; ++ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS; + + if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0) + aad_pdata->jack_ins_deb = +-- +2.43.0 + diff --git a/queue-5.10/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch b/queue-5.10/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch new file mode 100644 index 00000000000..556c01a55d3 --- /dev/null +++ b/queue-5.10/asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch @@ -0,0 +1,92 @@ +From 3c2be8ef979ccdd0c5a3742bbcd3842bde01b40d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 14:39:14 +0200 +Subject: ASoC: hdac_hda: Conditionally register dais for HDMI and Analog + +From: Peter Ujfalusi + +[ Upstream commit a0575b4add21a243cc3257e75ad913cd5377d5f2 ] + +The current driver is registering the same dais for each hdev found in the +system which results duplicated widgets to be registered and the kernel +log contains similar prints: +snd_hda_codec_realtek ehdaudio0D0: ASoC: sink widget AIF1TX overwritten +snd_hda_codec_realtek ehdaudio0D0: ASoC: source widget AIF1RX overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi3 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi2 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Codec Output Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Codec Input Pin1 overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Digital Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Alt Analog Codec Playback overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Analog Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Digital Codec Capture overwritten +skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Alt Analog Codec Capture overwritten + +To avoid such issue, split the dai array into HDMI and non HDMI array and +register them conditionally: +for HDMI hdev only register the dais needed for HDMI +for non HDMI hdev do not register the HDMI dais. + +Depends-on: 3d1dc8b1030d ("ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available") +Link: https://github.com/thesofproject/linux/issues/4509 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20231128123914.3986-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hda.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c +index de5955db0a5f..d2e3697b76e7 100644 +--- a/sound/soc/codecs/hdac_hda.c ++++ b/sound/soc/codecs/hdac_hda.c +@@ -124,6 +124,9 @@ static struct snd_soc_dai_driver hdac_hda_dais[] = { + .sig_bits = 24, + }, + }, ++}; ++ ++static struct snd_soc_dai_driver hdac_hda_hdmi_dais[] = { + { + .id = HDAC_HDMI_0_DAI_ID, + .name = "intel-hdmi-hifi1", +@@ -575,6 +578,13 @@ static const struct snd_soc_component_driver hdac_hda_codec = { + .num_dapm_routes = ARRAY_SIZE(hdac_hda_dapm_routes), + }; + ++static const struct snd_soc_component_driver hdac_hda_hdmi_codec = { ++ .probe = hdac_hda_codec_probe, ++ .remove = hdac_hda_codec_remove, ++ .idle_bias_on = false, ++ .endianness = 1, ++}; ++ + static int hdac_hda_dev_probe(struct hdac_device *hdev) + { + struct hdac_ext_link *hlink; +@@ -594,9 +604,15 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) + return -ENOMEM; + + /* ASoC specific initialization */ +- ret = devm_snd_soc_register_component(&hdev->dev, +- &hdac_hda_codec, hdac_hda_dais, +- ARRAY_SIZE(hdac_hda_dais)); ++ if (hda_pvt->need_display_power) ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_hdmi_codec, hdac_hda_hdmi_dais, ++ ARRAY_SIZE(hdac_hda_hdmi_dais)); ++ else ++ ret = devm_snd_soc_register_component(&hdev->dev, ++ &hdac_hda_codec, hdac_hda_dais, ++ ARRAY_SIZE(hdac_hda_dais)); ++ + if (ret < 0) { + dev_err(&hdev->dev, "failed to register HDA codec %d\n", ret); + return ret; +-- +2.43.0 + diff --git a/queue-5.10/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch b/queue-5.10/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch new file mode 100644 index 00000000000..ba6705409f3 --- /dev/null +++ b/queue-5.10/asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch @@ -0,0 +1,44 @@ +From 339baaf38ee13baead36d1858ce7b6df08c11b86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 14:40:15 +0200 +Subject: ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not + available + +From: Peter Ujfalusi + +[ Upstream commit 3d1dc8b1030df8ca0fdfd4905c88ee10db943bf8 ] + +When the HDMI is not present due to disabled display support +we will use dummy codec and the HDMI routes will refer to non existent +DAPM widgets. + +Trim the route list from the HDMI routes to be able to probe the card even +if the HDMI dais are not registered. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Bard Liao +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20231124124015.15878-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index bc50eda297ab..9d0f08db709a 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -157,6 +157,8 @@ static int skl_hda_fill_card_info(struct snd_soc_acpi_mach_params *mach_params) + card->dapm_widgets = skl_hda_widgets; + card->num_dapm_widgets = ARRAY_SIZE(skl_hda_widgets); + if (!ctx->idisp_codec) { ++ card->dapm_routes = &skl_hda_map[IDISP_ROUTE_COUNT]; ++ num_route -= IDISP_ROUTE_COUNT; + for (i = 0; i < IDISP_DAI_COUNT; i++) { + skl_hda_be_dai_links[i].codecs = dummy_codec; + skl_hda_be_dai_links[i].num_codecs = +-- +2.43.0 + diff --git a/queue-5.10/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch b/queue-5.10/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch new file mode 100644 index 00000000000..2ebaa2c7a93 --- /dev/null +++ b/queue-5.10/asoc-intel-skylake-fix-mem-leak-in-few-functions.patch @@ -0,0 +1,59 @@ +From 6746c4934d6461fa4c3a5b305ff710f7df2949a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 13:51:50 +0100 +Subject: ASoC: Intel: Skylake: Fix mem leak in few functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ] + +The resources should be freed when function return error. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 4 +++- + sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index b531d9dfc2d6..c7e76111f68b 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -251,8 +251,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream, + snd_pcm_set_sync(substream); + + mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream); +- if (!mconfig) ++ if (!mconfig) { ++ kfree(dma_params); + return -EINVAL; ++ } + + skl_tplg_d0i3_get(skl, mconfig->d0i3_caps); + +diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c +index 7a425271b08b..fd9624ad5f72 100644 +--- a/sound/soc/intel/skylake/skl-sst-ipc.c ++++ b/sound/soc/intel/skylake/skl-sst-ipc.c +@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, + + reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK; + buf = krealloc(reply.data, reply.size, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ kfree(reply.data); + return -ENOMEM; ++ } + *payload = buf; + *bytes = reply.size; + +-- +2.43.0 + diff --git a/queue-5.10/asoc-intel-skylake-mem-leak-in-skl-register-function.patch b/queue-5.10/asoc-intel-skylake-mem-leak-in-skl-register-function.patch new file mode 100644 index 00000000000..b94b531b458 --- /dev/null +++ b/queue-5.10/asoc-intel-skylake-mem-leak-in-skl-register-function.patch @@ -0,0 +1,52 @@ +From a662d35a072a1d2fa6be9009fe5bc08a799ac53e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 23:41:13 +0100 +Subject: ASoC: Intel: Skylake: mem leak in skl register function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kamil Duljas + +[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ] + +skl_platform_register() uses krealloc. When krealloc is fail, +then previous memory is not freed. The leak is also when soc +component registration failed. + +Signed-off-by: Kamil Duljas +Reviewed-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/skylake/skl-pcm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index c7e76111f68b..935c871abdaa 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1477,6 +1477,7 @@ int skl_platform_register(struct device *dev) + dais = krealloc(skl->dais, sizeof(skl_fe_dai) + + sizeof(skl_platform_dai), GFP_KERNEL); + if (!dais) { ++ kfree(skl->dais); + ret = -ENOMEM; + goto err; + } +@@ -1489,8 +1490,10 @@ int skl_platform_register(struct device *dev) + + ret = devm_snd_soc_register_component(dev, &skl_component, + skl->dais, num_dais); +- if (ret) ++ if (ret) { ++ kfree(skl->dais); + dev_err(dev, "soc component registration failed %d\n", ret); ++ } + err: + return ret; + } +-- +2.43.0 + diff --git a/queue-5.10/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch b/queue-5.10/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch new file mode 100644 index 00000000000..5ab7dec0d8a --- /dev/null +++ b/queue-5.10/asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch @@ -0,0 +1,75 @@ +From f74507e977131a80487a9bcffbfaadb303009a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 12:30:12 +0800 +Subject: ASoC: nau8822: Fix incorrect type in assignment and cast to + restricted __be16 + +From: David Lin + +[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ] + +This issue is reproduced when W=1 build in compiler gcc-12. +The following are sparse warnings: + +sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment +sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short +sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 +sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/ +Signed-off-by: David Lin +Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index d831959d8ff7..4ce15cd9ed02 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + struct soc_bytes_ext *params = (void *)kcontrol->private_value; + int i, reg; + u16 reg_val, *val; ++ __be16 tmp; + + val = (u16 *)ucontrol->value.bytes.data; + reg = NAU8822_REG_EQ1; +@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- reg_val = cpu_to_be16(reg_val); +- memcpy(val + i, ®_val, sizeof(reg_val)); ++ tmp = cpu_to_be16(reg_val); ++ memcpy(val + i, &tmp, sizeof(tmp)); + } + + return 0; +@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + void *data; + u16 *val, value; + int i, reg, ret; ++ __be16 *tmp; + + data = kmemdup(ucontrol->value.bytes.data, + params->max, GFP_KERNEL | GFP_DMA); +@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol, + /* conversion of 16-bit integers between native CPU format + * and big endian format + */ +- value = be16_to_cpu(*(val + i)); ++ tmp = (__be16 *)(val + i); ++ value = be16_to_cpup(tmp); + ret = snd_soc_component_write(component, reg + i, value); + if (ret) { + dev_err(component->dev, +-- +2.43.0 + diff --git a/queue-5.10/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch b/queue-5.10/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch new file mode 100644 index 00000000000..c0ebbf45e7f --- /dev/null +++ b/queue-5.10/asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch @@ -0,0 +1,79 @@ +From 2cd3b26442a53b9e89b2ad6fb3033ef386a3dcd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 18:01:23 +0800 +Subject: ASoC: rt5650: add mutex to avoid the jack detection failure + +From: Shuming Fan + +[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ] + +This patch adds the jd_mutex to protect the jack detection control flow. +And only the headset type could check the button status. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 99d91bfb8812..7dc80183921e 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -421,6 +421,7 @@ struct rt5645_priv { + struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)]; + struct rt5645_eq_param_s *eq_param; + struct timer_list btn_check_timer; ++ struct mutex jd_mutex; + + int codec_type; + int sysclk; +@@ -3179,6 +3180,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse + rt5645_enable_push_button_irq(component, true); + } + } else { ++ if (rt5645->en_button_func) ++ rt5645_enable_push_button_irq(component, false); + snd_soc_dapm_disable_pin(dapm, "Mic Det Power"); + snd_soc_dapm_sync(dapm); + rt5645->jack_type = SND_JACK_HEADPHONE; +@@ -3259,6 +3262,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + if (!rt5645->component) + return; + ++ mutex_lock(&rt5645->jd_mutex); ++ + switch (rt5645->pdata.jd_mode) { + case 0: /* Not using rt5645 JD */ + if (rt5645->gpiod_hp_det) { +@@ -3283,7 +3288,7 @@ static void rt5645_jack_detect_work(struct work_struct *work) + + if (!val && (rt5645->jack_type == 0)) { /* jack in */ + report = rt5645_jack_detect(rt5645->component, 1); +- } else if (!val && rt5645->jack_type != 0) { ++ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) { + /* for push button and jack out */ + btn_type = 0; + if (snd_soc_component_read(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) { +@@ -3339,6 +3344,8 @@ static void rt5645_jack_detect_work(struct work_struct *work) + rt5645_jack_detect(rt5645->component, 0); + } + ++ mutex_unlock(&rt5645->jd_mutex); ++ + snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE); + snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE); + if (rt5645->en_button_func) +@@ -4062,6 +4069,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, + } + timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0); + ++ mutex_init(&rt5645->jd_mutex); + INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work); + INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work); + +-- +2.43.0 + diff --git a/queue-5.10/asoc-wm8974-correct-boost-mixer-inputs.patch b/queue-5.10/asoc-wm8974-correct-boost-mixer-inputs.patch new file mode 100644 index 00000000000..08304d8a2ae --- /dev/null +++ b/queue-5.10/asoc-wm8974-correct-boost-mixer-inputs.patch @@ -0,0 +1,49 @@ +From f67919c0b9464a94dceadfc1fd71f8ffaf6b7933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 15:59:16 +0000 +Subject: ASoC: wm8974: Correct boost mixer inputs + +From: Charles Keepax + +[ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ] + +Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls +the input PGA path, as can been seen from Figure 8 Input Boost Stage in +the datasheet. Update the naming of things in the driver to match this +and update the routing to also reflect this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8974.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c +index c86231dfcf4f..600e93d61a90 100644 +--- a/sound/soc/codecs/wm8974.c ++++ b/sound/soc/codecs/wm8974.c +@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0), + + /* Boost mixer */ + static const struct snd_kcontrol_new wm8974_boost_mixer[] = { +-SOC_DAPM_SINGLE("Aux Switch", WM8974_INPPGA, 6, 1, 1), ++SOC_DAPM_SINGLE("PGA Switch", WM8974_INPPGA, 6, 1, 1), + }; + + /* Input PGA */ +@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = { + + /* Boost Mixer */ + {"ADC", NULL, "Boost Mixer"}, +- {"Boost Mixer", "Aux Switch", "Aux Input"}, +- {"Boost Mixer", NULL, "Input PGA"}, ++ {"Boost Mixer", NULL, "Aux Input"}, ++ {"Boost Mixer", "PGA Switch", "Input PGA"}, + {"Boost Mixer", NULL, "MICP"}, + + /* Input PGA */ +-- +2.43.0 + diff --git a/queue-5.10/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch b/queue-5.10/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch new file mode 100644 index 00000000000..adf3959704a --- /dev/null +++ b/queue-5.10/clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch @@ -0,0 +1,35 @@ +From d14cf8b79ab2dc9593713b27289f244d86ebd191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 19:18:16 +0800 +Subject: clk: rockchip: rk3128: Fix HCLK_OTG gate register + +From: Weihao Li + +[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ] + +The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON. + +Signed-off-by: Weihao Li +Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3128.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c +index 4b1122e98e16..ddfe1c402e80 100644 +--- a/drivers/clk/rockchip/clk-rk3128.c ++++ b/drivers/clk/rockchip/clk-rk3128.c +@@ -489,7 +489,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS), + GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS), + GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS), +- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS), ++ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS), + GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS), + GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS), + GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS), +-- +2.43.0 + diff --git a/queue-5.10/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch b/queue-5.10/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch new file mode 100644 index 00000000000..eb5738ddcef --- /dev/null +++ b/queue-5.10/debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch @@ -0,0 +1,118 @@ +From 4b1b4da283db21916e3ef99a286ae80f842ac56f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:25 +0100 +Subject: debugfs: annotate debugfs handlers vs. removal with lockdep + +From: Johannes Berg + +[ Upstream commit f4acfcd4deb158b96595250cc332901b282d15b0 ] + +When you take a lock in a debugfs handler but also try +to remove the debugfs file under that lock, things can +deadlock since the removal has to wait for all users +to finish. + +Add lockdep annotations in debugfs_file_get()/_put() +to catch such issues. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 10 ++++++++++ + fs/debugfs/inode.c | 12 ++++++++++++ + fs/debugfs/internal.h | 6 ++++++ + 3 files changed, 28 insertions(+) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index 9c0aadedfbff..6bc55a517446 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -108,6 +108,12 @@ int debugfs_file_get(struct dentry *dentry) + kfree(fsd); + fsd = READ_ONCE(dentry->d_fsdata); + } ++#ifdef CONFIG_LOCKDEP ++ fsd->lock_name = kasprintf(GFP_KERNEL, "debugfs:%pd", dentry); ++ lockdep_register_key(&fsd->key); ++ lockdep_init_map(&fsd->lockdep_map, fsd->lock_name ?: "debugfs", ++ &fsd->key, 0); ++#endif + } + + /* +@@ -124,6 +130,8 @@ int debugfs_file_get(struct dentry *dentry) + if (!refcount_inc_not_zero(&fsd->active_users)) + return -EIO; + ++ lock_map_acquire_read(&fsd->lockdep_map); ++ + return 0; + } + EXPORT_SYMBOL_GPL(debugfs_file_get); +@@ -141,6 +149,8 @@ void debugfs_file_put(struct dentry *dentry) + { + struct debugfs_fsdata *fsd = READ_ONCE(dentry->d_fsdata); + ++ lock_map_release(&fsd->lockdep_map); ++ + if (refcount_dec_and_test(&fsd->active_users)) + complete(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index d04930c199cb..001d5e2513aa 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -215,6 +215,14 @@ static void debugfs_release_dentry(struct dentry *dentry) + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; + ++ /* check it wasn't a dir (no fsdata) or automount (no real_fops) */ ++ if (fsd && fsd->real_fops) { ++#ifdef CONFIG_LOCKDEP ++ lockdep_unregister_key(&fsd->key); ++ kfree(fsd->lock_name); ++#endif ++ } ++ + kfree(fsd); + } + +@@ -708,6 +716,10 @@ static void __debugfs_file_removed(struct dentry *dentry) + fsd = READ_ONCE(dentry->d_fsdata); + if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) + return; ++ ++ lock_map_acquire(&fsd->lockdep_map); ++ lock_map_release(&fsd->lockdep_map); ++ + if (!refcount_dec_and_test(&fsd->active_users)) + wait_for_completion(&fsd->active_users_drained); + } +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index f7c489b5a368..c7d61cfc97d2 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -7,6 +7,7 @@ + + #ifndef _DEBUGFS_INTERNAL_H_ + #define _DEBUGFS_INTERNAL_H_ ++#include + + struct file_operations; + +@@ -23,6 +24,11 @@ struct debugfs_fsdata { + struct { + refcount_t active_users; + struct completion active_users_drained; ++#ifdef CONFIG_LOCKDEP ++ struct lockdep_map lockdep_map; ++ struct lock_class_key key; ++ char *lock_name; ++#endif + }; + }; + }; +-- +2.43.0 + diff --git a/queue-5.10/debugfs-fix-automount-d_fsdata-usage.patch b/queue-5.10/debugfs-fix-automount-d_fsdata-usage.patch new file mode 100644 index 00000000000..30a00ede898 --- /dev/null +++ b/queue-5.10/debugfs-fix-automount-d_fsdata-usage.patch @@ -0,0 +1,149 @@ +From 22c2b8b1c36da1a730e86341b78ebd17a0d82f8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 17:25:24 +0100 +Subject: debugfs: fix automount d_fsdata usage + +From: Johannes Berg + +[ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ] + +debugfs_create_automount() stores a function pointer in d_fsdata, +but since commit 7c8d469877b1 ("debugfs: add support for more +elaborate ->d_fsdata") debugfs_release_dentry() will free it, now +conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not +set for the function pointer in automount. As a result, removing +an automount dentry would attempt to free the function pointer. +Luckily, the only user of this (tracing) never removes it. + +Nevertheless, it's safer if we just handle the fsdata in one way, +namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus, +change the automount to allocate it, and use the real_fops in the +data to indicate whether or not automount is filled, rather than +adding a type tag. At least for now this isn't actually needed, +but the next changes will require it. + +Also check in debugfs_file_get() that it gets only called +on regular files, just to make things clearer. + +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 8 ++++++++ + fs/debugfs/inode.c | 27 ++++++++++++++++++++------- + fs/debugfs/internal.h | 10 ++++++++-- + 3 files changed, 36 insertions(+), 9 deletions(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index 42bab9270e7d..9c0aadedfbff 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry) + struct debugfs_fsdata *fsd; + void *d_fsd; + ++ /* ++ * This could only happen if some debugfs user erroneously calls ++ * debugfs_file_get() on a dentry that isn't even a file, let ++ * them know about it. ++ */ ++ if (WARN_ON(!d_is_reg(dentry))) ++ return -EINVAL; ++ + d_fsd = READ_ONCE(dentry->d_fsdata); + if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) { + fsd = d_fsd; +diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c +index f47f0a7d2c3b..d04930c199cb 100644 +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -210,17 +210,19 @@ static const struct super_operations debugfs_super_operations = { + + static void debugfs_release_dentry(struct dentry *dentry) + { +- void *fsd = dentry->d_fsdata; ++ struct debugfs_fsdata *fsd = dentry->d_fsdata; + +- if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) +- kfree(dentry->d_fsdata); ++ if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT) ++ return; ++ ++ kfree(fsd); + } + + static struct vfsmount *debugfs_automount(struct path *path) + { +- debugfs_automount_t f; +- f = (debugfs_automount_t)path->dentry->d_fsdata; +- return f(path->dentry, d_inode(path->dentry)->i_private); ++ struct debugfs_fsdata *fsd = path->dentry->d_fsdata; ++ ++ return fsd->automount(path->dentry, d_inode(path->dentry)->i_private); + } + + static const struct dentry_operations debugfs_dops = { +@@ -598,13 +600,23 @@ struct dentry *debugfs_create_automount(const char *name, + void *data) + { + struct dentry *dentry = start_creating(name, parent); ++ struct debugfs_fsdata *fsd; + struct inode *inode; + + if (IS_ERR(dentry)) + return dentry; + ++ fsd = kzalloc(sizeof(*fsd), GFP_KERNEL); ++ if (!fsd) { ++ failed_creating(dentry); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ fsd->automount = f; ++ + if (!(debugfs_allow & DEBUGFS_ALLOW_API)) { + failed_creating(dentry); ++ kfree(fsd); + return ERR_PTR(-EPERM); + } + +@@ -612,13 +624,14 @@ struct dentry *debugfs_create_automount(const char *name, + if (unlikely(!inode)) { + pr_err("out of free dentries, can not create automount '%s'\n", + name); ++ kfree(fsd); + return failed_creating(dentry); + } + + make_empty_dir_inode(inode); + inode->i_flags |= S_AUTOMOUNT; + inode->i_private = data; +- dentry->d_fsdata = (void *)f; ++ dentry->d_fsdata = fsd; + /* directory inodes start off with i_nlink == 2 (for "." entry) */ + inc_nlink(inode); + d_instantiate(dentry, inode); +diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h +index 92af8ae31313..f7c489b5a368 100644 +--- a/fs/debugfs/internal.h ++++ b/fs/debugfs/internal.h +@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations; + + struct debugfs_fsdata { + const struct file_operations *real_fops; +- refcount_t active_users; +- struct completion active_users_drained; ++ union { ++ /* automount_fn is used when real_fops is NULL */ ++ debugfs_automount_t automount; ++ struct { ++ refcount_t active_users; ++ struct completion active_users_drained; ++ }; ++ }; + }; + + /* +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch b/queue-5.10/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch new file mode 100644 index 00000000000..aef655cc58a --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch @@ -0,0 +1,56 @@ +From 4522a8d7bb2211fa7330bdf8cfdb8d88cedd0b0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:22:34 +0800 +Subject: drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null + pointer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lu Yao + +[ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ] + +For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init +'didt_rreg' and 'didt_wreg' to 'NULL'. But in func +'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT' +lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use +these two definitions won't be added for 'AMDGPU_FAMILY_SI'. + +So, add null pointer judgment before calling. + +Reviewed-by: Christian König +Signed-off-by: Lu Yao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 48df32dd352e..3e573077368b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -459,6 +459,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf, + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_rreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +@@ -518,6 +521,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user + if (size & 0x3 || *pos & 0x3) + return -EINVAL; + ++ if (!adev->didt_wreg) ++ return -EOPNOTSUPP; ++ + r = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (r < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); +-- +2.43.0 + diff --git a/queue-5.10/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch b/queue-5.10/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch new file mode 100644 index 00000000000..91a9246d521 --- /dev/null +++ b/queue-5.10/drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch @@ -0,0 +1,79 @@ +From ceb5d489c4aac5f5e3b241f4af45440e32214e63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 09:14:46 -0700 +Subject: drm/crtc: Fix uninit-value bug in drm_mode_setcrtc + +From: Ziqi Zhao + +[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ] + +The connector_set contains uninitialized values when allocated with +kmalloc_array. However, in the "out" branch, the logic assumes that any +element in connector_set would be equal to NULL if failed to +initialize, which causes the bug reported by Syzbot. The fix is to use +an extra variable to keep track of how many connectors are initialized +indeed, and use that variable to decrease any refcounts in the "out" +branch. + +Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Signed-off-by: Ziqi Zhao +Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Tested-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index aecdd7ea26dc..b3c0a9ea8c6f 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -562,8 +562,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret; +- int i; ++ int ret, i, num_connectors; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -701,6 +700,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + ++ num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +@@ -721,6 +721,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + connector->name); + + connector_set[i] = connector; ++ num_connectors++; + } + } + +@@ -729,7 +730,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + set.y = crtc_req->y; + set.mode = mode; + set.connectors = connector_set; +- set.num_connectors = crtc_req->count_connectors; ++ set.num_connectors = num_connectors; + set.fb = fb; + + if (drm_drv_uses_atomic_modeset(dev)) +@@ -742,7 +743,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + drm_framebuffer_put(fb); + + if (connector_set) { +- for (i = 0; i < crtc_req->count_connectors; i++) { ++ for (i = 0; i < num_connectors; i++) { + if (connector_set[i]) + drm_connector_put(connector_set[i]); + } +-- +2.43.0 + diff --git a/queue-5.10/drm-crtc-fix-uninitialized-variable-use.patch b/queue-5.10/drm-crtc-fix-uninitialized-variable-use.patch new file mode 100644 index 00000000000..b8c5c292968 --- /dev/null +++ b/queue-5.10/drm-crtc-fix-uninitialized-variable-use.patch @@ -0,0 +1,54 @@ +From a0c48b9da4c0fa4eb30ebb1ad7ea86b96f507326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 15:12:38 +0200 +Subject: drm/crtc: fix uninitialized variable use + +From: Jani Nikula + +[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ] + +Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in +drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, +but introduced another. + +num_connectors is only initialized if crtc_req->count_connectors > 0, +but it's used regardless. Fix it. + +Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") +Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com +Cc: Ziqi Zhao +Cc: Maxime Ripard +Cc: Maarten Lankhorst +Cc: Thomas Zimmermann +Signed-off-by: Jani Nikula +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_crtc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index b3c0a9ea8c6f..4ed3fc28d4da 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -562,7 +562,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + struct drm_mode_set set; + uint32_t __user *set_connectors_ptr; + struct drm_modeset_acquire_ctx ctx; +- int ret, i, num_connectors; ++ int ret, i, num_connectors = 0; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EOPNOTSUPP; +@@ -700,7 +700,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, + goto out; + } + +- num_connectors = 0; + for (i = 0; i < crtc_req->count_connectors; i++) { + connector_set[i] = NULL; + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; +-- +2.43.0 + diff --git a/queue-5.10/drm-exynos-fix-a-potential-error-pointer-dereference.patch b/queue-5.10/drm-exynos-fix-a-potential-error-pointer-dereference.patch new file mode 100644 index 00000000000..75fa24ec29e --- /dev/null +++ b/queue-5.10/drm-exynos-fix-a-potential-error-pointer-dereference.patch @@ -0,0 +1,40 @@ +From e8c13c9d9d509c27ca4897f5a2945101aca34278 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Aug 2023 14:27:48 +0800 +Subject: drm/exynos: fix a potential error pointer dereference + +From: Xiang Yang + +[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ] + +Smatch reports the warning below: +drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind() +error: 'crtc' dereferencing possible ERR_PTR() + +The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), +which can not be used directly. Fix this by checking the return value +before using it. + +Signed-off-by: Xiang Yang +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index dc01c188c0e0..981bffacda24 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -1849,6 +1849,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data) + return ret; + + crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI); ++ if (IS_ERR(crtc)) ++ return PTR_ERR(crtc); + crtc->pipe_clk = &hdata->phy_clk; + + ret = hdmi_create_connector(encoder); +-- +2.43.0 + diff --git a/queue-5.10/drm-exynos-fix-a-wrong-error-checking.patch b/queue-5.10/drm-exynos-fix-a-wrong-error-checking.patch new file mode 100644 index 00000000000..e31a81725b6 --- /dev/null +++ b/queue-5.10/drm-exynos-fix-a-wrong-error-checking.patch @@ -0,0 +1,62 @@ +From eeba994d7da38f6e8b05401e49a3c80fca55b077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 18:36:51 +0900 +Subject: drm/exynos: fix a wrong error checking + +From: Inki Dae + +[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ] + +Fix a wrong error checking in exynos_drm_dma.c module. + +In the exynos_drm_register_dma function, both arm_iommu_create_mapping() +and iommu_get_domain_for_dev() functions are expected to return NULL as +an error. + +However, the error checking is performed using the statement +if(IS_ERR(mapping)), which doesn't provide a suitable error value. +So check if 'mapping' is NULL, and if it is, return -ENODEV. + +This issue[1] was reported by Dan. + +Changelog v1: +- fix build warning. + +[1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/ + +Reported-by : Dan Carpenter +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c +index bf33c3084cb4..6b4d6da3b1f4 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c +@@ -108,18 +108,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, + return 0; + + if (!priv->mapping) { +- void *mapping; ++ void *mapping = NULL; + + if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU)) + mapping = arm_iommu_create_mapping(&platform_bus_type, + EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); + else if (IS_ENABLED(CONFIG_IOMMU_DMA)) + mapping = iommu_get_domain_for_dev(priv->dma_dev); +- else +- mapping = ERR_PTR(-ENODEV); + +- if (IS_ERR(mapping)) +- return PTR_ERR(mapping); ++ if (!mapping) ++ return -ENODEV; + priv->mapping = mapping; + } + +-- +2.43.0 + diff --git a/queue-5.10/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch b/queue-5.10/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch new file mode 100644 index 00000000000..ebf1ddb8f30 --- /dev/null +++ b/queue-5.10/i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch @@ -0,0 +1,84 @@ +From 2dd1f145ebf4c40417a71507d7ea564203c316ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:21:59 +0800 +Subject: i2c: rk3x: fix potential spinlock recursion on poll + +From: Jensen Huang + +[ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ] + +Possible deadlock scenario (on reboot): +rk3x_i2c_xfer_common(polling) + -> rk3x_i2c_wait_xfer_poll() + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); + ... + + -> rk3x_i2c_irq(0, i2c); + --> spin_lock(&i2c->lock); (deadlock here) + +Store the IRQ number and disable/enable it around the polling transfer. +This patch has been tested on NanoPC-T4. + +Signed-off-by: Jensen Huang +Reviewed-by: Heiko Stuebner +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index 13c14eb175e9..6abcf975a2db 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data { + * @clk: function clk for rk3399 or function & Bus clks for others + * @pclk: Bus clk for rk3399 + * @clk_rate_nb: i2c clk rate change notify ++ * @irq: irq number + * @t: I2C known timing information + * @lock: spinlock for the i2c bus + * @wait: the waitqueue to wait for i2c transfer +@@ -200,6 +201,7 @@ struct rk3x_i2c { + struct clk *clk; + struct clk *pclk; + struct notifier_block clk_rate_nb; ++ int irq; + + /* Settings */ + struct i2c_timings t; +@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap, + + spin_unlock_irqrestore(&i2c->lock, flags); + +- rk3x_i2c_start(i2c); +- + if (!polling) { ++ rk3x_i2c_start(i2c); ++ + timeout = wait_event_timeout(i2c->wait, !i2c->busy, + msecs_to_jiffies(WAIT_TIMEOUT)); + } else { ++ disable_irq(i2c->irq); ++ rk3x_i2c_start(i2c); ++ + timeout = rk3x_i2c_wait_xfer_poll(i2c); ++ ++ enable_irq(i2c->irq); + } + + spin_lock_irqsave(&i2c->lock, flags); +@@ -1301,6 +1308,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev) + return ret; + } + ++ i2c->irq = irq; ++ + platform_set_drvdata(pdev, i2c); + + if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) { +-- +2.43.0 + diff --git a/queue-5.10/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch b/queue-5.10/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch new file mode 100644 index 00000000000..31ddce68f26 --- /dev/null +++ b/queue-5.10/ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch @@ -0,0 +1,99 @@ +From 2bd3a29ecf868bcdf7214515fa21bca39e06ec3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 16:53:57 +0000 +Subject: ida: Fix crash in ida_free when the bitmap is empty + +From: Matthew Wilcox (Oracle) + +[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ] + +The IDA usually detects double-frees, but that detection failed to +consider the case when there are no nearby IDs allocated and so we have a +NULL bitmap rather than simply having a clear bit. Add some tests to the +test-suite to be sure we don't inadvertently reintroduce this problem. +Unfortunately they're quite noisy so include a message to disregard +the warnings. + +Reported-by: Zhenghan Wang +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/idr.c | 2 +- + lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 1 deletion(-) + +diff --git a/lib/idr.c b/lib/idr.c +index 13f2758c2377..da36054c3ca0 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id) + goto delete; + xas_store(&xas, xa_mk_value(v)); + } else { +- if (!test_bit(bit, bitmap->bitmap)) ++ if (!bitmap || !test_bit(bit, bitmap->bitmap)) + goto err; + __clear_bit(bit, bitmap->bitmap); + xas_set_mark(&xas, XA_FREE_MARK); +diff --git a/lib/test_ida.c b/lib/test_ida.c +index b06880625961..55105baa19da 100644 +--- a/lib/test_ida.c ++++ b/lib/test_ida.c +@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida) + IDA_BUG_ON(ida, !ida_is_empty(ida)); + } + ++/* ++ * Check various situations where we attempt to free an ID we don't own. ++ */ ++static void ida_check_bad_free(struct ida *ida) ++{ ++ unsigned long i; ++ ++ printk("vvv Ignore \"not allocated\" warnings\n"); ++ /* IDA is empty; all of these will fail */ ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single value entry */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a single bitmap */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ ++ /* IDA contains a tree */ ++ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1); ++ ida_free(ida, 0); ++ for (i = 0; i < 31; i++) ++ ida_free(ida, 1 << i); ++ printk("^^^ \"not allocated\" warnings over\n"); ++ ++ ida_free(ida, 3); ++ ida_free(ida, 1023); ++ ida_free(ida, (1 << 20) - 1); ++ ++ IDA_BUG_ON(ida, !ida_is_empty(ida)); ++} ++ + static DEFINE_IDA(ida); + + static int ida_checks(void) +@@ -162,6 +201,7 @@ static int ida_checks(void) + ida_check_leaf(&ida, 1024 * 64); + ida_check_max(&ida); + ida_check_conv(&ida); ++ ida_check_bad_free(&ida); + + printk("IDA: %u of %u tests passed\n", tests_passed, tests_run); + return (tests_run != tests_passed) ? 0 : -EINVAL; +-- +2.43.0 + diff --git a/queue-5.10/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch b/queue-5.10/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch new file mode 100644 index 00000000000..f02659c70ba --- /dev/null +++ b/queue-5.10/input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch @@ -0,0 +1,126 @@ +From 27011aca4869ab17f10d7030524e72920dbba51e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 19:59:24 -0800 +Subject: Input: atkbd - skip ATKBD_CMD_GETID in translated mode + +From: Hans de Goede + +[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ] + +There have been multiple reports of keyboard issues on recent laptop models +which can be worked around by setting i8042.dumbkbd, with the downside +being this breaks the capslock LED. + +It seems that these issues are caused by recent laptops getting confused by +ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for +this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode. + +The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 +mice/touchpads and those are never used in translated mode. + +Examples of laptop models which benefit from skipping ATKBD_CMD_GETID: + +* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" + models the kbd stops working for the first 2 - 5 minutes after boot + (waiting for EC watchdog reset?) + +* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard + +* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see: + https://github.com/yescallop/atkbd-nogetid + +This has been tested on: + +1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not + in translated mode when no keyboard is plugged in and with a ps/2 kbd + a "AT Translated Set 2 keyboard" /dev/input/event# node shows up + +2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard) + +Reported-by: Shang Ye +Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/ +Closes: https://github.com/yescallop/atkbd-nogetid +Reported-by: gurevitch +Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/ +Reported-by: Egor Ignatov +Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/ +Reported-by: Anton Zhilyaev +Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/ +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156 +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- + 1 file changed, 42 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c +index edc613efc158..90dd3caa4612 100644 +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -756,6 +756,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) + ps2dev->serio->phys); + } + ++#ifdef CONFIG_X86 ++static bool atkbd_is_portable_device(void) ++{ ++ static const char * const chassis_types[] = { ++ "8", /* Portable */ ++ "9", /* Laptop */ ++ "10", /* Notebook */ ++ "14", /* Sub-Notebook */ ++ "31", /* Convertible */ ++ "32", /* Detachable */ ++ }; ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(chassis_types); i++) ++ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i])) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops ++ * the controller is always in translated mode. In this mode mice/touchpads will ++ * not work. So in this case simply assume a keyboard is connected to avoid ++ * confusing some laptop keyboards. ++ * ++ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is ++ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in ++ * translated mode that is a no-op. ++ */ ++static bool atkbd_skip_getid(struct atkbd *atkbd) ++{ ++ return atkbd->translated && atkbd_is_portable_device(); ++} ++#else ++static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; } ++#endif ++ + /* + * atkbd_probe() probes for an AT keyboard on a serio port. + */ +@@ -785,12 +823,12 @@ static int atkbd_probe(struct atkbd *atkbd) + */ + + param[0] = param[1] = 0xa5; /* initialize with invalid values */ +- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { ++ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) { + + /* +- * If the get ID command failed, we check if we can at least set the LEDs on +- * the keyboard. This should work on every keyboard out there. It also turns +- * the LEDs off, which we want anyway. ++ * If the get ID command was skipped or failed, we check if we can at least set ++ * the LEDs on the keyboard. This should work on every keyboard out there. ++ * It also turns the LEDs off, which we want anyway. + */ + param[0] = 0; + if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS)) +-- +2.43.0 + diff --git a/queue-5.10/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch b/queue-5.10/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch new file mode 100644 index 00000000000..7c2d804440c --- /dev/null +++ b/queue-5.10/input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch @@ -0,0 +1,45 @@ +From f2bce617fbf6a45b1f32330c2c21216999164414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 19:56:19 +0000 +Subject: Input: i8042 - add nomux quirk for Acer P459-G2-M + +From: Esther Shimanovich + +[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ] + +After the laptop lid is opened, and the device resumes from S3 deep +sleep, if the user presses a keyboard key while the screen is still black, +the mouse and keyboard become unusable. + +Enabling this quirk prevents this behavior from occurring. + +Signed-off-by: Esther Shimanovich +Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index 09528c0a8a34..124ab98ea43a 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -351,6 +351,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK) + }, ++ { ++ /* Acer TravelMate P459-G2-M */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Amoi M636/A737 */ + .matches = { +-- +2.43.0 + diff --git a/queue-5.10/input-xpad-add-razer-wolverine-v2-support.patch b/queue-5.10/input-xpad-add-razer-wolverine-v2-support.patch new file mode 100644 index 00000000000..b56460e9d2d --- /dev/null +++ b/queue-5.10/input-xpad-add-razer-wolverine-v2-support.patch @@ -0,0 +1,34 @@ +From 222fa362d9379098cadaa1bb3a0a454260075bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Nov 2023 17:22:15 +0100 +Subject: Input: xpad - add Razer Wolverine V2 support + +From: Luca Weiss + +[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ] + +Add the VID and PID of Razer Wolverine V2 to xpad_device. + +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index beedad0fe09a..239471cf7e4c 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -266,6 +266,7 @@ static const struct xpad_device { + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, ++ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, + { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, +-- +2.43.0 + diff --git a/queue-5.10/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch b/queue-5.10/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch new file mode 100644 index 00000000000..18475c4f165 --- /dev/null +++ b/queue-5.10/jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch @@ -0,0 +1,41 @@ +From 7ff881fc5c04b99d0f47d818b5ea479e63af629b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 19:47:39 +0800 +Subject: jbd2: correct the printing of write_flags in jbd2_write_superblock() + +From: Zhang Yi + +[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ] + +The write_flags print in the trace of jbd2_write_superblock() is not +real, so move the modification before the trace. + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/journal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index fee325d62bfd..effd837b8c1f 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1568,9 +1568,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) + return -EIO; + } + +- trace_jbd2_write_superblock(journal, write_flags); + if (!(journal->j_flags & JBD2_BARRIER)) + write_flags &= ~(REQ_FUA | REQ_PREFLUSH); ++ ++ trace_jbd2_write_superblock(journal, write_flags); ++ + if (buffer_write_io_error(bh)) { + /* + * Oh, dear. A previous attempt to write the journal +-- +2.43.0 + diff --git a/queue-5.10/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch b/queue-5.10/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch new file mode 100644 index 00000000000..f426eed4696 --- /dev/null +++ b/queue-5.10/jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch @@ -0,0 +1,82 @@ +From 1b9ccd568848ee62f246107b2f5b269e3d8173a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:25:44 +0800 +Subject: jbd2: fix soft lockup in journal_finish_inode_data_buffers() + +From: Ye Bin + +[ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ] + +There's issue when do io test: +WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170] +CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xb0/0x100 + watchdog_timer_fn+0x254/0x3f8 + __hrtimer_run_queues+0x11c/0x380 + hrtimer_interrupt+0xfc/0x2f8 + arch_timer_handler_phys+0x38/0x58 + handle_percpu_devid_irq+0x90/0x248 + generic_handle_irq+0x3c/0x58 + __handle_domain_irq+0x68/0xc0 + gic_handle_irq+0x90/0x320 + el1_irq+0xcc/0x180 + queued_spin_lock_slowpath+0x1d8/0x320 + jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2] + kjournald2+0xec/0x2f0 [jbd2] + kthread+0x134/0x138 + ret_from_fork+0x10/0x18 + +Analyzed informations from vmcore as follows: +(1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list'; +(2) Now is processing the 855th jbd2_inode; +(3) JBD2 task has TIF_NEED_RESCHED flag; +(4) There's no pags in address_space around the 855th jbd2_inode; +(5) There are some process is doing drop caches; +(6) Mounted with 'nodioread_nolock' option; +(7) 128 CPUs; + +According to informations from vmcore we know 'journal->j_list_lock' spin lock +competition is fierce. So journal_finish_inode_data_buffers() maybe process +slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors(). +However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK, +will not call cond_resched(). So may lead to soft lockup. +journal_finish_inode_data_buffers + filemap_fdatawait_range_keep_errors + __filemap_fdatawait_range + while (index <= end) + nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK); + if (!nr_pages) + break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched() + for (i = 0; i < nr_pages; i++) + wait_on_page_writeback(page); + cond_resched(); + +To solve above issue, add scheduling point in the journal_finish_inode_data_buffers(); + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index fa24b407a9dc..db137671a41f 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal, + if (!ret) + ret = err; + } ++ cond_resched(); + spin_lock(&journal->j_list_lock); + jinode->i_flags &= ~JI_COMMIT_RUNNING; + smp_mb(); +-- +2.43.0 + diff --git a/queue-5.10/mips-smp-call-rcutree_report_cpu_starting-earlier.patch b/queue-5.10/mips-smp-call-rcutree_report_cpu_starting-earlier.patch new file mode 100644 index 00000000000..0c5e98a8374 --- /dev/null +++ b/queue-5.10/mips-smp-call-rcutree_report_cpu_starting-earlier.patch @@ -0,0 +1,77 @@ +From 4e41e856b5594fb699ac6b7315bc489b0f74cb05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 13:12:07 +0100 +Subject: mips/smp: Call rcutree_report_cpu_starting() earlier + +From: Stefan Wiehler + +[ Upstream commit 55702ec9603ebeffb15e6f7b113623fe1d8872f4 ] + +rcutree_report_cpu_starting() must be called before +clockevents_register_device() to avoid the following lockdep splat triggered by +calling list_add() when CONFIG_PROVE_RCU_LIST=y: + + WARNING: suspicious RCU usage + ... + ----------------------------- + kernel/locking/lockdep.c:3680 RCU-list traversed in non-reader section!! + + other info that might help us debug this: + + RCU used illegally from offline CPU! + rcu_scheduler_active = 1, debug_locks = 1 + no locks held by swapper/1/0. + ... + Call Trace: + [] show_stack+0x64/0x158 + [] dump_stack_lvl+0x90/0xc4 + [] __lock_acquire+0x1404/0x2940 + [] lock_acquire+0x14c/0x448 + [] _raw_spin_lock_irqsave+0x50/0x88 + [] clockevents_register_device+0x60/0x1e8 + [] r4k_clockevent_init+0x220/0x3a0 + [] start_secondary+0x50/0x3b8 + +raw_smp_processor_id() is required in order to avoid calling into lockdep +before RCU has declared the CPU to be watched for readers. + +See also commit 29368e093921 ("x86/smpboot: Move rcu_cpu_starting() earlier"), +commit de5d9dae150c ("s390/smp: move rcu_cpu_starting() earlier") and commit +99f070b62322 ("powerpc/smp: Call rcu_cpu_starting() earlier"). + +Signed-off-by: Stefan Wiehler +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 14db66dbcdad..73045313387c 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -333,10 +333,11 @@ early_initcall(mips_smp_ipi_init); + */ + asmlinkage void start_secondary(void) + { +- unsigned int cpu; ++ unsigned int cpu = raw_smp_processor_id(); + + cpu_probe(); + per_cpu_trap_init(false); ++ rcutree_report_cpu_starting(cpu); + mips_clockevent_init(); + mp_ops->init_secondary(); + cpu_report(); +@@ -348,7 +349,6 @@ asmlinkage void start_secondary(void) + */ + + calibrate_delay(); +- cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + + set_cpu_sibling_map(cpu); +-- +2.43.0 + diff --git a/queue-5.10/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch b/queue-5.10/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch new file mode 100644 index 00000000000..381032bed0b --- /dev/null +++ b/queue-5.10/mptcp-fix-uninit-value-in-mptcp_incoming_options.patch @@ -0,0 +1,35 @@ +From a413aecedb00145cfe779c16b5d24da31911d68e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:23:39 +0800 +Subject: mptcp: fix uninit-value in mptcp_incoming_options + +From: Edward Adam Davis + +[ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ] + +Added initialization use_ack to mptcp_parse_option(). + +Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 64afe71e2129..c389d7e47135 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -92,6 +92,7 @@ static void mptcp_parse_option(const struct sk_buff *skb, + mp_opt->dss = 1; + mp_opt->use_map = 1; + mp_opt->mpc_map = 1; ++ mp_opt->use_ack = 0; + mp_opt->data_len = get_unaligned_be16(ptr); + ptr += 2; + } +-- +2.43.0 + diff --git a/queue-5.10/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch b/queue-5.10/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch new file mode 100644 index 00000000000..cc7abc018ff --- /dev/null +++ b/queue-5.10/neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch @@ -0,0 +1,64 @@ +From 7c810478901461c78e0473eacc333199bc8c1f1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 03:38:33 +0000 +Subject: neighbour: Don't let neigh_forced_gc() disable preemption for long + +From: Judy Hsiao + +[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ] + +We are seeing cases where neigh_cleanup_and_release() is called by +neigh_forced_gc() many times in a row with preemption turned off. +When running on a low powered CPU at a low CPU frequency, this has +been measured to keep preemption off for ~10 ms. That's not great on a +system with HZ=1000 which expects tasks to be able to schedule in +with ~1ms latency. + +Suggested-by: Douglas Anderson +Signed-off-by: Judy Hsiao +Reviewed-by: David Ahern +Reviewed-by: Eric Dumazet +Reviewed-by: Douglas Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 4c43183a8d93..432e3a64dc4a 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -226,9 +226,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) + { + int max_clean = atomic_read(&tbl->gc_entries) - + READ_ONCE(tbl->gc_thresh2); ++ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC; + unsigned long tref = jiffies - 5 * HZ; + struct neighbour *n, *tmp; + int shrunk = 0; ++ int loop = 0; + + NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs); + +@@ -251,11 +253,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) + shrunk++; + if (shrunk >= max_clean) + break; ++ if (++loop == 16) { ++ if (ktime_get_ns() > tmax) ++ goto unlock; ++ loop = 0; ++ } + } + } + + WRITE_ONCE(tbl->last_flush, jiffies); +- ++unlock: + write_unlock_bh(&tbl->lock); + + return shrunk; +-- +2.43.0 + diff --git a/queue-5.10/net-qrtr-ns-return-0-if-server-port-is-not-present.patch b/queue-5.10/net-qrtr-ns-return-0-if-server-port-is-not-present.patch new file mode 100644 index 00000000000..09ceb63755f --- /dev/null +++ b/queue-5.10/net-qrtr-ns-return-0-if-server-port-is-not-present.patch @@ -0,0 +1,45 @@ +From e190ecf84df42d81cd63061f18851f29884af92a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Dec 2023 15:36:51 +0530 +Subject: net: qrtr: ns: Return 0 if server port is not present + +From: Sarannya S + +[ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ] + +When a 'DEL_CLIENT' message is received from the remote, the corresponding +server port gets deleted. A DEL_SERVER message is then announced for this +server. As part of handling the subsequent DEL_SERVER message, the name- +server attempts to delete the server port which results in a '-ENOENT' error. +The return value from server_del() is then propagated back to qrtr_ns_worker, +causing excessive error prints. +To address this, return 0 from control_cmd_del_server() without checking the +return value of server_del(), since the above scenario is not an error case +and hence server_del() doesn't have any other error return value. + +Signed-off-by: Sarannya Sasikumar +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index 713e9940d88b..c92dd960bfef 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -577,7 +577,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from, + if (!node) + return -ENOENT; + +- return server_del(node, port, true); ++ server_del(node, port, true); ++ ++ return 0; + } + + static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from, +-- +2.43.0 + diff --git a/queue-5.10/net-tg3-fix-race-condition-in-tg3_reset_task.patch b/queue-5.10/net-tg3-fix-race-condition-in-tg3_reset_task.patch new file mode 100644 index 00000000000..66d44364c5a --- /dev/null +++ b/queue-5.10/net-tg3-fix-race-condition-in-tg3_reset_task.patch @@ -0,0 +1,94 @@ +From 902d7b7baf23cb69f8d9e54827e1327a6d421a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 18:19:11 -0600 +Subject: net/tg3: fix race condition in tg3_reset_task() + +From: Thinh Tran + +[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ] + +When an EEH error is encountered by a PCI adapter, the EEH driver +modifies the PCI channel's state as shown below: + + enum { + /* I/O channel is in normal state */ + pci_channel_io_normal = (__force pci_channel_state_t) 1, + + /* I/O to channel is blocked */ + pci_channel_io_frozen = (__force pci_channel_state_t) 2, + + /* PCI card is dead */ + pci_channel_io_perm_failure = (__force pci_channel_state_t) 3, + }; + +If the same EEH error then causes the tg3 driver's transmit timeout +logic to execute, the tg3_tx_timeout() function schedules a reset +task via tg3_reset_task_schedule(), which may cause a race condition +between the tg3 and EEH driver as both attempt to recover the HW via +a reset action. + +EEH driver gets error event +--> eeh_set_channel_state() + and set device to one of + error state above scheduler: tg3_reset_task() get + returned error from tg3_init_hw() + --> dev_close() shuts down the interface +tg3_io_slot_reset() and +tg3_io_resume() fail to +reset/resume the device + +To resolve this issue, we avoid the race condition by checking the PCI +channel state in the tg3_reset_task() function and skip the tg3 driver +initiated reset when the PCI channel is not in the normal state. (The +driver has no access to tg3 device registers at this point and cannot +even complete the reset task successfully without external assistance.) +We'll leave the reset procedure to be managed by the EEH driver which +calls the tg3_io_error_detected(), tg3_io_slot_reset() and +tg3_io_resume() functions as appropriate. + +Adding the same checking in tg3_dump_state() to avoid dumping all +device registers when the PCI channel is not in the normal state. + +Signed-off-by: Thinh Tran +Tested-by: Venkata Sai Duggi +Reviewed-by: David Christensen +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index b010f28b0abf..fe2c9b110e60 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -6454,6 +6454,14 @@ static void tg3_dump_state(struct tg3 *tp) + int i; + u32 *regs; + ++ /* If it is a PCI error, all registers will be 0xffff, ++ * we don't dump them out, just report the error and return ++ */ ++ if (tp->pdev->error_state != pci_channel_io_normal) { ++ netdev_err(tp->dev, "PCI channel ERROR!\n"); ++ return; ++ } ++ + regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC); + if (!regs) + return; +@@ -11195,7 +11203,8 @@ static void tg3_reset_task(struct work_struct *work) + rtnl_lock(); + tg3_full_lock(tp, 0); + +- if (tp->pcierr_recovery || !netif_running(tp->dev)) { ++ if (tp->pcierr_recovery || !netif_running(tp->dev) || ++ tp->pdev->error_state != pci_channel_io_normal) { + tg3_flag_clear(tp, RESET_TASK_PENDING); + tg3_full_unlock(tp); + rtnl_unlock(); +-- +2.43.0 + diff --git a/queue-5.10/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch b/queue-5.10/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch new file mode 100644 index 00000000000..bd19695bf6f --- /dev/null +++ b/queue-5.10/nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch @@ -0,0 +1,38 @@ +From ac4f2f4d424954f58e26ce56e96a88fb4a8356df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 11:08:52 +1000 +Subject: nouveau/tu102: flush all pdbs on vmm flush + +From: Dave Airlie + +[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ] + +This is a hack around a bug exposed with the GSP code, I'm not sure +what is happening exactly, but it appears some of our flushes don't +result in proper tlb invalidation for out BAR2 and we get a BAR2 +fault from GSP and it all dies. + +Signed-off-by: Dave Airlie +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +index b1294d0076c0..72449bf613bf 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +@@ -32,7 +32,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) + + type |= 0x00000001; /* PAGE_ALL */ + if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR])) +- type |= 0x00000004; /* HUB_ONLY */ ++ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */ + + mutex_lock(&subdev->mutex); + +-- +2.43.0 + diff --git a/queue-5.10/nvme-core-check-for-too-small-lba-shift.patch b/queue-5.10/nvme-core-check-for-too-small-lba-shift.patch new file mode 100644 index 00000000000..f903d01a09c --- /dev/null +++ b/queue-5.10/nvme-core-check-for-too-small-lba-shift.patch @@ -0,0 +1,42 @@ +From 5f9b0a0e799278756282559a60b55f8088bc752e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 09:36:04 -0800 +Subject: nvme-core: check for too small lba shift + +From: Keith Busch + +[ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ] + +The block layer doesn't support logical block sizes smaller than 512 +bytes. The nvme spec doesn't support that small either, but the driver +isn't checking to make sure the device responded with usable data. +Failing to catch this will result in a kernel bug, either from a +division by zero when stacking, or a zero length bio. + +Reviewed-by: Jens Axboe +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 07c41a149328..30a642c8f537 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2071,9 +2071,10 @@ static void nvme_update_disk_info(struct gendisk *disk, + + /* + * The block layer can't support LBA sizes larger than the page size +- * yet, so catch this early and don't allow block I/O. ++ * or smaller than a sector size yet, so catch this early and don't ++ * allow block I/O. + */ +- if (ns->lba_shift > PAGE_SHIFT) { ++ if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) { + capacity = 0; + bs = (1 << 9); + } +-- +2.43.0 + diff --git a/queue-5.10/nvme-introduce-helper-function-to-get-ctrl-state.patch b/queue-5.10/nvme-introduce-helper-function-to-get-ctrl-state.patch new file mode 100644 index 00000000000..70bfba31aaa --- /dev/null +++ b/queue-5.10/nvme-introduce-helper-function-to-get-ctrl-state.patch @@ -0,0 +1,40 @@ +From 04d188b41ed7a6cf98448ea6903336082808b85e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 08:13:09 -0700 +Subject: nvme: introduce helper function to get ctrl state + +From: Keith Busch + +[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ] + +The controller state is typically written by another CPU, so reading it +should ensure no optimizations are taken. This is a repeated pattern in +the driver, so start with adding a convenience function that returns the +controller state with READ_ONCE(). + +Reviewed-by: Sagi Grimberg +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/nvme.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index c3e4d9b6f9c0..1e56fe8e8157 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -354,6 +354,11 @@ struct nvme_ctrl { + struct nvme_fault_inject fault_inject; + }; + ++static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl) ++{ ++ return READ_ONCE(ctrl->state); ++} ++ + enum nvme_iopolicy { + NVME_IOPOLICY_NUMA, + NVME_IOPOLICY_RR, +-- +2.43.0 + diff --git a/queue-5.10/pinctrl-lochnagar-don-t-build-on-mips.patch b/queue-5.10/pinctrl-lochnagar-don-t-build-on-mips.patch new file mode 100644 index 00000000000..c868c679055 --- /dev/null +++ b/queue-5.10/pinctrl-lochnagar-don-t-build-on-mips.patch @@ -0,0 +1,42 @@ +From f5d05b4b9d2744816f51bcb81bdbfd8f01370aa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 16:28:53 +0000 +Subject: pinctrl: lochnagar: Don't build on MIPS + +From: Charles Keepax + +[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ] + +MIPS appears to define a RST symbol at a high level, which clashes +with some register naming in the driver. Since there is currently +no case for running this driver on MIPS devices simply cut off the +build of this driver on MIPS. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/ +Suggested-by: Linus Walleij +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/cirrus/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig +index 530426a74f75..b3cea8d56c4f 100644 +--- a/drivers/pinctrl/cirrus/Kconfig ++++ b/drivers/pinctrl/cirrus/Kconfig +@@ -1,7 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0-only + config PINCTRL_LOCHNAGAR + tristate "Cirrus Logic Lochnagar pinctrl driver" +- depends on MFD_LOCHNAGAR ++ # Avoid clash caused by MIPS defining RST, which is used in the driver ++ depends on MFD_LOCHNAGAR && !MIPS + select GPIOLIB + select PINMUX + select PINCONF +-- +2.43.0 + diff --git a/queue-5.10/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch b/queue-5.10/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch new file mode 100644 index 00000000000..bec0825aa89 --- /dev/null +++ b/queue-5.10/reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch @@ -0,0 +1,38 @@ +From ceadcbe47f7b0446716fc74474a5815a63e13ded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 11:13:00 +0200 +Subject: reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning + +From: Krzysztof Kozlowski + +[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ] + +'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 +causes: + + hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/hisilicon/hi6220_reset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c +index 19926506d033..2a7688fa9b9b 100644 +--- a/drivers/reset/hisilicon/hi6220_reset.c ++++ b/drivers/reset/hisilicon/hi6220_reset.c +@@ -164,7 +164,7 @@ static int hi6220_reset_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + +- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev); ++ type = (uintptr_t)of_device_get_match_data(dev); + + regmap = syscon_node_to_regmap(np); + if (IS_ERR(regmap)) { +-- +2.43.0 + diff --git a/queue-5.10/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch b/queue-5.10/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch new file mode 100644 index 00000000000..96275c6128d --- /dev/null +++ b/queue-5.10/ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch @@ -0,0 +1,45 @@ +From 039157d4339d54722850295778f42ff52b9a9bcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 17:54:03 -0500 +Subject: ring-buffer: Do not record in NMI if the arch does not support + cmpxchg in NMI + +From: Steven Rostedt (Google) + +[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ] + +As the ring buffer recording requires cmpxchg() to work, if the +architecture does not support cmpxchg in NMI, then do not do any recording +within an NMI. + +Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 5abe88091803..041b91c2ba10 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3444,6 +3444,12 @@ rb_reserve_next_event(struct trace_buffer *buffer, + int nr_loops = 0; + int add_ts_default; + ++ /* ring buffer does cmpxchg, make sure it is safe in NMI context */ ++ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) && ++ (unlikely(in_nmi()))) { ++ return NULL; ++ } ++ + rb_start_commit(cpu_buffer); + /* The commit page can not change after this */ + +-- +2.43.0 + diff --git a/queue-5.10/s390-scm-fix-virtual-vs-physical-address-confusion.patch b/queue-5.10/s390-scm-fix-virtual-vs-physical-address-confusion.patch new file mode 100644 index 00000000000..49f3109a1cf --- /dev/null +++ b/queue-5.10/s390-scm-fix-virtual-vs-physical-address-confusion.patch @@ -0,0 +1,59 @@ +From 871a13007391e0df0e577c7d4ee6f7e2728a6119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 22:52:53 +0100 +Subject: s390/scm: fix virtual vs physical address confusion + +From: Vineeth Vijayan + +[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ] + +Fix virtual vs physical address confusion (which currently are the same). + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Acked-by: Alexander Gordeev +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/block/scm_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c +index a4f6f2e62b1d..b5b36217b15e 100644 +--- a/drivers/s390/block/scm_blk.c ++++ b/drivers/s390/block/scm_blk.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include "scm_blk.h" + +@@ -131,7 +132,7 @@ static void scm_request_done(struct scm_request *scmrq) + + for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) { + msb = &scmrq->aob->msb[i]; +- aidaw = msb->data_addr; ++ aidaw = (u64)phys_to_virt(msb->data_addr); + + if ((msb->flags & MSB_FLAG_IDA) && aidaw && + IS_ALIGNED(aidaw, PAGE_SIZE)) +@@ -196,12 +197,12 @@ static int scm_request_prepare(struct scm_request *scmrq) + msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9); + msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE; + msb->flags |= MSB_FLAG_IDA; +- msb->data_addr = (u64) aidaw; ++ msb->data_addr = (u64)virt_to_phys(aidaw); + + rq_for_each_segment(bv, req, iter) { + WARN_ON(bv.bv_offset); + msb->blk_count += bv.bv_len >> 12; +- aidaw->data_addr = (u64) page_address(bv.bv_page); ++ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page)); + aidaw++; + } + +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 4c6ad7e1923..58bb2aedcaf 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,43 @@ f2fs-explicitly-null-terminate-the-xattr-list.patch +pinctrl-lochnagar-don-t-build-on-mips.patch +alsa-hda-fix-speaker-and-headset-mic-pin-config-for-.patch +mptcp-fix-uninit-value-in-mptcp_incoming_options.patch +debugfs-fix-automount-d_fsdata-usage.patch +debugfs-annotate-debugfs-handlers-vs.-removal-with-l.patch +drm-amdgpu-fix-cat-debugfs-amdgpu_regs_didt-causes-k.patch +nvme-core-check-for-too-small-lba-shift.patch +asoc-wm8974-correct-boost-mixer-inputs.patch +asoc-intel-skylake-fix-mem-leak-in-few-functions.patch +asoc-nau8822-fix-incorrect-type-in-assignment-and-ca.patch +asoc-intel-skylake-mem-leak-in-skl-register-function.patch +asoc-cs43130-fix-the-position-of-const-qualifier.patch +asoc-cs43130-fix-incorrect-frame-delay-configuration.patch +asoc-rt5650-add-mutex-to-avoid-the-jack-detection-fa.patch +asoc-intel-skl_hda_dsp_generic-drop-hdmi-routes-when.patch +nouveau-tu102-flush-all-pdbs-on-vmm-flush.patch +asoc-hdac_hda-conditionally-register-dais-for-hdmi-a.patch +net-tg3-fix-race-condition-in-tg3_reset_task.patch +asoc-da7219-support-low-dc-impedance-headset.patch +nvme-introduce-helper-function-to-get-ctrl-state.patch +mips-smp-call-rcutree_report_cpu_starting-earlier.patch +drm-exynos-fix-a-potential-error-pointer-dereference.patch +drm-exynos-fix-a-wrong-error-checking.patch +clk-rockchip-rk3128-fix-hclk_otg-gate-register.patch +jbd2-correct-the-printing-of-write_flags-in-jbd2_wri.patch +drm-crtc-fix-uninit-value-bug-in-drm_mode_setcrtc.patch +neighbour-don-t-let-neigh_forced_gc-disable-preempti.patch +jbd2-fix-soft-lockup-in-journal_finish_inode_data_bu.patch +tracing-have-large-events-show-up-as-line-too-big-in.patch +tracing-add-size-check-when-printing-trace_marker-ou.patch +ring-buffer-do-not-record-in-nmi-if-the-arch-does-no.patch +reset-hisilicon-hi6220-fix-wvoid-pointer-to-enum-cas.patch +input-atkbd-skip-atkbd_cmd_getid-in-translated-mode.patch +input-i8042-add-nomux-quirk-for-acer-p459-g2-m.patch +s390-scm-fix-virtual-vs-physical-address-confusion.patch +arc-fix-spare-error.patch +input-xpad-add-razer-wolverine-v2-support.patch +i2c-rk3x-fix-potential-spinlock-recursion-on-poll.patch +ida-fix-crash-in-ida_free-when-the-bitmap-is-empty.patch +net-qrtr-ns-return-0-if-server-port-is-not-present.patch +arm-sun9i-smp-fix-return-code-check-of-of_property_m.patch +drm-crtc-fix-uninitialized-variable-use.patch diff --git a/queue-5.10/tracing-add-size-check-when-printing-trace_marker-ou.patch b/queue-5.10/tracing-add-size-check-when-printing-trace_marker-ou.patch new file mode 100644 index 00000000000..8a91f8360f2 --- /dev/null +++ b/queue-5.10/tracing-add-size-check-when-printing-trace_marker-ou.patch @@ -0,0 +1,67 @@ +From 7205aa28964855fe843fd49d48c09164b999c26e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 08:44:44 -0500 +Subject: tracing: Add size check when printing trace_marker output + +From: Steven Rostedt (Google) + +[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ] + +If for some reason the trace_marker write does not have a nul byte for the +string, it will overflow the print: + + trace_seq_printf(s, ": %s", field->buf); + +The field->buf could be missing the nul byte. To prevent overflow, add the +max size that the buf can be by using the event size and the field +location. + + int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_seq_printf(s, ": %*.s", max, field->buf); + +Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_output.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c +index 94b0991717b6..753b84c50848 100644 +--- a/kernel/trace/trace_output.c ++++ b/kernel/trace/trace_output.c +@@ -1313,11 +1313,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, + { + struct print_entry *field; + struct trace_seq *s = &iter->seq; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + + seq_print_ip_sym(s, field->ip, flags); +- trace_seq_printf(s, ": %s", field->buf); ++ trace_seq_printf(s, ": %.*s", max, field->buf); + + return trace_handle_return(s); + } +@@ -1326,10 +1327,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, + struct trace_event *event) + { + struct print_entry *field; ++ int max = iter->ent_size - offsetof(struct print_entry, buf); + + trace_assign_type(field, iter->ent); + +- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf); ++ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf); + + return trace_handle_return(&iter->seq); + } +-- +2.43.0 + diff --git a/queue-5.10/tracing-have-large-events-show-up-as-line-too-big-in.patch b/queue-5.10/tracing-have-large-events-show-up-as-line-too-big-in.patch new file mode 100644 index 00000000000..f9bc13dbc95 --- /dev/null +++ b/queue-5.10/tracing-have-large-events-show-up-as-line-too-big-in.patch @@ -0,0 +1,79 @@ +From 71ec7712ce52f00456ae6fc6a300befce6cee270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 17:10:58 -0500 +Subject: tracing: Have large events show up as '[LINE TOO BIG]' instead of + nothing + +From: Steven Rostedt (Google) + +[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ] + +If a large event was added to the ring buffer that is larger than what the +trace_seq can handle, it just drops the output: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234 + +Instead, catch this case and add some context: + + ~# cat /sys/kernel/tracing/trace + # tracer: nop + # + # entries-in-buffer/entries-written: 2/2 #P:8 + # + # _-----=> irqs-off/BH-disabled + # / _----=> need-resched + # | / _---=> hardirq/softirq + # || / _--=> preempt-depth + # ||| / _-=> migrate-disable + # |||| / delay + # TASK-PID CPU# ||||| TIMESTAMP FUNCTION + # | | | ||||| | | + <...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG] + <...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234 + +This now emulates the same output as trace_pipe. + +Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home + +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 0cbf833bebcc..548f694fc857 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4339,7 +4339,11 @@ static int s_show(struct seq_file *m, void *v) + iter->leftover = ret; + + } else { +- print_trace_line(iter); ++ ret = print_trace_line(iter); ++ if (ret == TRACE_TYPE_PARTIAL_LINE) { ++ iter->seq.full = 0; ++ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n"); ++ } + ret = trace_print_seq(m, &iter->seq); + /* + * If we overflow the seq_file buffer, then it will +-- +2.43.0 + -- 2.47.3