--- /dev/null
+From e3e4bf58bad1576ac732a1429f53e3d4bfb82b4b Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 14 Aug 2024 10:28:24 -0400
+Subject: drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e3e4bf58bad1576ac732a1429f53e3d4bfb82b4b upstream.
+
+The workaround seems to cause stability issues on other
+SDMA 5.2.x IPs.
+
+Fixes: a03ebf116303 ("drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3556
+Acked-by: Ruijing Dong <ruijing.dong@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2dc3851ef7d9c5439ea8e9623fc36878f3b40649)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+@@ -188,14 +188,16 @@ static void sdma_v5_2_ring_set_wptr(stru
+ DRM_DEBUG("calling WDOORBELL64(0x%08x, 0x%016llx)\n",
+ ring->doorbell_index, ring->wptr << 2);
+ WDOORBELL64(ring->doorbell_index, ring->wptr << 2);
+- /* SDMA seems to miss doorbells sometimes when powergating kicks in.
+- * Updating the wptr directly will wake it. This is only safe because
+- * we disallow gfxoff in begin_use() and then allow it again in end_use().
+- */
+- WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR),
+- lower_32_bits(ring->wptr << 2));
+- WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI),
+- upper_32_bits(ring->wptr << 2));
++ if (amdgpu_ip_version(adev, SDMA0_HWIP, 0) == IP_VERSION(5, 2, 1)) {
++ /* SDMA seems to miss doorbells sometimes when powergating kicks in.
++ * Updating the wptr directly will wake it. This is only safe because
++ * we disallow gfxoff in begin_use() and then allow it again in end_use().
++ */
++ WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR),
++ lower_32_bits(ring->wptr << 2));
++ WREG32(sdma_v5_2_get_reg_offset(adev, ring->me, mmSDMA0_GFX_RB_WPTR_HI),
++ upper_32_bits(ring->wptr << 2));
++ }
+ } else {
+ DRM_DEBUG("Not using doorbell -- "
+ "mmSDMA%i_GFX_RB_WPTR == 0x%08x "
--- /dev/null
+From c99769bceab4ecb6a067b9af11f9db281eea3e2a Mon Sep 17 00:00:00 2001
+From: Candice Li <candice.li@amd.com>
+Date: Thu, 15 Aug 2024 11:37:28 +0800
+Subject: drm/amdgpu: Validate TA binary size
+
+From: Candice Li <candice.li@amd.com>
+
+commit c99769bceab4ecb6a067b9af11f9db281eea3e2a upstream.
+
+Add TA binary size validation to avoid OOB write.
+
+Signed-off-by: Candice Li <candice.li@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c
+@@ -166,6 +166,9 @@ static ssize_t ta_if_load_debugfs_write(
+ if (ret)
+ return -EFAULT;
+
++ if (ta_bin_len > PSP_1_MEG)
++ return -EINVAL;
++
+ copy_pos += sizeof(uint32_t);
+
+ ta_bin = kzalloc(ta_bin_len, GFP_KERNEL);
--- /dev/null
+From 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad Mon Sep 17 00:00:00 2001
+From: Jason Gerecke <jason.gerecke@wacom.com>
+Date: Tue, 30 Jul 2024 08:51:55 -0700
+Subject: HID: wacom: Defer calculation of resolution until resolution_code is known
+
+From: Jason Gerecke <jason.gerecke@wacom.com>
+
+commit 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad upstream.
+
+The Wacom driver maps the HID_DG_TWIST usage to ABS_Z (rather than ABS_RZ)
+for historic reasons. When the code to support twist was introduced in
+commit 50066a042da5 ("HID: wacom: generic: Add support for height, tilt,
+and twist usages"), we were careful to write it in such a way that it had
+HID calculate the resolution of the twist axis assuming ABS_RZ instead
+(so that we would get correct angular behavior). This was broken with
+the introduction of commit 08a46b4190d3 ("HID: wacom: Set a default
+resolution for older tablets"), which moved the resolution calculation
+to occur *before* the adjustment from ABS_Z to ABS_RZ occurred.
+
+This commit moves the calculation of resolution after the point that
+we are finished setting things up for its proper use.
+
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Fixes: 08a46b4190d3 ("HID: wacom: Set a default resolution for older tablets")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_wac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1924,12 +1924,14 @@ static void wacom_map_usage(struct input
+ int fmax = field->logical_maximum;
+ unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
+ int resolution_code = code;
+- int resolution = hidinput_calc_abs_res(field, resolution_code);
++ int resolution;
+
+ if (equivalent_usage == HID_DG_TWIST) {
+ resolution_code = ABS_RZ;
+ }
+
++ resolution = hidinput_calc_abs_res(field, resolution_code);
++
+ if (equivalent_usage == HID_GD_X) {
+ fmin += features->offset_left;
+ fmax -= features->offset_right;
--- /dev/null
+From ce61b605a00502c59311d0a4b1f58d62b48272d0 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Tue, 20 Aug 2024 22:07:38 +0900
+Subject: ksmbd: the buffer of smb2 query dir response has at least 1 byte
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit ce61b605a00502c59311d0a4b1f58d62b48272d0 upstream.
+
+When STATUS_NO_MORE_FILES status is set to smb2 query dir response,
+->StructureSize is set to 9, which mean buffer has 1 byte.
+This issue occurs because ->Buffer[1] in smb2_query_directory_rsp to
+flex-array.
+
+Fixes: eb3e28c1e89b ("smb3: Replace smb2pdu 1-element arrays with flex-arrays")
+Cc: stable@vger.kernel.org # v6.1+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/smb2pdu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -4406,7 +4406,8 @@ int smb2_query_dir(struct ksmbd_work *wo
+ rsp->OutputBufferLength = cpu_to_le32(0);
+ rsp->Buffer[0] = 0;
+ rc = ksmbd_iov_pin_rsp(work, (void *)rsp,
+- sizeof(struct smb2_query_directory_rsp));
++ offsetof(struct smb2_query_directory_rsp, Buffer)
++ + 1);
+ if (rc)
+ goto err_out;
+ } else {
--- /dev/null
+From 1cb6ab446424649f03c82334634360c2e3043684 Mon Sep 17 00:00:00 2001
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Date: Tue, 23 Jul 2024 17:15:44 +0800
+Subject: MIPS: Loongson64: Set timer mode in cpu-probe
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+commit 1cb6ab446424649f03c82334634360c2e3043684 upstream.
+
+Loongson64 C and G processors have EXTIMER feature which
+is conflicting with CP0 counter.
+
+Although the processor resets in EXTIMER disabled & INTIMER
+enabled mode, which is compatible with MIPS CP0 compare, firmware
+may attempt to enable EXTIMER and interfere CP0 compare.
+
+Set timer mode back to MIPS compatible mode to fix booting on
+systems with such firmware before we have an actual driver for
+EXTIMER.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kernel/cpu-probe.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1725,12 +1725,16 @@ static inline void cpu_probe_loongson(st
+ c->ases |= (MIPS_ASE_LOONGSON_MMI | MIPS_ASE_LOONGSON_CAM |
+ MIPS_ASE_LOONGSON_EXT | MIPS_ASE_LOONGSON_EXT2);
+ c->ases &= ~MIPS_ASE_VZ; /* VZ of Loongson-3A2000/3000 is incomplete */
++ change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
++ LOONGSON_CONF6_INTIMER);
+ break;
+ case PRID_IMP_LOONGSON_64G:
+ __cpu_name[cpu] = "ICT Loongson-3";
+ set_elf_platform(cpu, "loongson3a");
+ set_isa(c, MIPS_CPU_ISA_M64R2);
+ decode_cpucfg(c);
++ change_c0_config6(LOONGSON_CONF6_EXTIMER | LOONGSON_CONF6_INTIMER,
++ LOONGSON_CONF6_INTIMER);
+ break;
+ default:
+ panic("Unknown Loongson Processor ID!");
--- /dev/null
+From 6efea5135417ae8194485d1d05ea79a21cf1a11c Mon Sep 17 00:00:00 2001
+From: Martin Whitaker <foss@martin-whitaker.me.uk>
+Date: Sat, 17 Aug 2024 10:41:41 +0100
+Subject: net: dsa: microchip: fix PTP config failure when using multiple ports
+
+From: Martin Whitaker <foss@martin-whitaker.me.uk>
+
+commit 6efea5135417ae8194485d1d05ea79a21cf1a11c upstream.
+
+When performing the port_hwtstamp_set operation, ptp_schedule_worker()
+will be called if hardware timestamoing is enabled on any of the ports.
+When using multiple ports for PTP, port_hwtstamp_set is executed for
+each port. When called for the first time ptp_schedule_worker() returns
+0. On subsequent calls it returns 1, indicating the worker is already
+scheduled. Currently the ksz driver treats 1 as an error and fails to
+complete the port_hwtstamp_set operation, thus leaving the timestamping
+configuration for those ports unchanged.
+
+This patch fixes this by ignoring the ptp_schedule_worker() return
+value.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/7aae307a-35ca-4209-a850-7b2749d40f90@martin-whitaker.me.uk
+Fixes: bb01ad30570b0 ("net: dsa: microchip: ptp: manipulating absolute time using ptp hw clock")
+Signed-off-by: Martin Whitaker <foss@martin-whitaker.me.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Arun Ramadoss <arun.ramadoss@microchip.com>
+Link: https://patch.msgid.link/20240817094141.3332-1-foss@martin-whitaker.me.uk
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz_ptp.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/microchip/ksz_ptp.c
++++ b/drivers/net/dsa/microchip/ksz_ptp.c
+@@ -266,7 +266,6 @@ static int ksz_ptp_enable_mode(struct ks
+ struct ksz_port *prt;
+ struct dsa_port *dp;
+ bool tag_en = false;
+- int ret;
+
+ dsa_switch_for_each_user_port(dp, dev->ds) {
+ prt = &dev->ports[dp->index];
+@@ -277,9 +276,7 @@ static int ksz_ptp_enable_mode(struct ks
+ }
+
+ if (tag_en) {
+- ret = ptp_schedule_worker(ptp_data->clock, 0);
+- if (ret)
+- return ret;
++ ptp_schedule_worker(ptp_data->clock, 0);
+ } else {
+ ptp_cancel_worker_sync(ptp_data->clock);
+ }
--- /dev/null
+From f03e94f23b04c2b71c0044c1534921b3975ef10c Mon Sep 17 00:00:00 2001
+From: Chaotian Jing <chaotian.jing@mediatek.com>
+Date: Tue, 13 Aug 2024 13:34:10 +0800
+Subject: scsi: core: Fix the return value of scsi_logical_block_count()
+
+From: Chaotian Jing <chaotian.jing@mediatek.com>
+
+commit f03e94f23b04c2b71c0044c1534921b3975ef10c upstream.
+
+scsi_logical_block_count() should return the block count of a given SCSI
+command. The original implementation ended up shifting twice, leading to an
+incorrect count being returned. Fix the conversion between bytes and
+logical blocks.
+
+Cc: stable@vger.kernel.org
+Fixes: 6a20e21ae1e2 ("scsi: core: Add helper to return number of logical blocks in a request")
+Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
+Link: https://lore.kernel.org/r/20240813053534.7720-1-chaotian.jing@mediatek.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/scsi/scsi_cmnd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/scsi/scsi_cmnd.h
++++ b/include/scsi/scsi_cmnd.h
+@@ -234,7 +234,7 @@ static inline sector_t scsi_get_lba(stru
+
+ static inline unsigned int scsi_logical_block_count(struct scsi_cmnd *scmd)
+ {
+- unsigned int shift = ilog2(scmd->device->sector_size) - SECTOR_SHIFT;
++ unsigned int shift = ilog2(scmd->device->sector_size);
+
+ return blk_rq_bytes(scsi_cmd_to_rq(scmd)) >> shift;
+ }
mmc-mmc_test-fix-null-dereference-on-allocation-fail.patch
smb-client-ignore-unhandled-reparse-tags.patch
bluetooth-mgmt-add-error-handling-to-pair_device.patch
+scsi-core-fix-the-return-value-of-scsi_logical_block_count.patch
+ksmbd-the-buffer-of-smb2-query-dir-response-has-at-least-1-byte.patch
+drm-amdgpu-validate-ta-binary-size.patch
+drm-amdgpu-sdma5.2-limit-wptr-workaround-to-sdma-5.2.1.patch
+net-dsa-microchip-fix-ptp-config-failure-when-using-multiple-ports.patch
+mips-loongson64-set-timer-mode-in-cpu-probe.patch
+hid-wacom-defer-calculation-of-resolution-until-resolution_code-is-known.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
