--- /dev/null
+From 0d8584d288a9b4132e945d76bcc04395d158b2e7 Mon Sep 17 00:00:00 2001
+From: "Gautham R. Shenoy" <gautham.shenoy@amd.com>
+Date: Tue, 13 Aug 2024 15:21:14 +0530
+Subject: cpufreq/amd-pstate: Use topology_logical_package_id() instead of logical_die_id()
+
+From: Gautham R. Shenoy <gautham.shenoy@amd.com>
+
+commit 0d8584d288a9b4132e945d76bcc04395d158b2e7 upstream.
+
+After the commit 63edbaa48a57 ("x86/cpu/topology: Add support for the
+AMD 0x80000026 leaf"), the topolgy_logical_die_id() function returns
+the logical Core Chiplet Die (CCD) ID instead of the logical socket
+ID.
+
+Since this is currently used to set MSR_AMD_CPPC_ENABLE, which needs
+to be set on any one of the threads of the socket, it is prudent to
+use topology_logical_package_id() in place of
+topology_logical_die_id().
+
+Fixes: 63edbaa48a57 ("x86/cpu/topology: Add support for the AMD 0x80000026 leaf")
+cc: stable@vger.kernel.org # 6.10
+Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Tested-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
+Link: https://lore.kernel.org/lkml/20240801124509.3650-1-Dhananjay.Ugwekar@amd.com/
+Signed-off-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/amd-pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/amd-pstate.c
++++ b/drivers/cpufreq/amd-pstate.c
+@@ -329,7 +329,7 @@ static inline int pstate_enable(bool ena
+ return 0;
+
+ for_each_present_cpu(cpu) {
+- unsigned long logical_id = topology_logical_die_id(cpu);
++ unsigned long logical_id = topology_logical_package_id(cpu);
+
+ if (test_bit(logical_id, &logical_proc_id_mask))
+ continue;
--- /dev/null
+From 9f646ff25c09c52cebe726601db27a60f876f15e Mon Sep 17 00:00:00 2001
+From: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+Date: Mon, 26 Aug 2024 17:41:01 +0530
+Subject: dmaengine: dw-edma: Do not enable watermark interrupts for HDMA
+
+From: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+
+commit 9f646ff25c09c52cebe726601db27a60f876f15e upstream.
+
+DW_HDMA_V0_LIE and DW_HDMA_V0_RIE are initialized as BIT(3) and BIT(4)
+respectively in dw_hdma_control enum. But as per HDMA register these
+bits are corresponds to LWIE and RWIE bit i.e local watermark interrupt
+enable and remote watermarek interrupt enable. In linked list mode LWIE
+and RWIE bits only enable the local and remote watermark interrupt.
+
+Since the watermark interrupts are not used but enabled, this leads to
+spurious interrupts getting generated. So remove the code that enables
+them to avoid generating spurious watermark interrupts.
+
+And also rename DW_HDMA_V0_LIE to DW_HDMA_V0_LWIE and DW_HDMA_V0_RIE to
+DW_HDMA_V0_RWIE as there is no LIE and RIE bits in HDMA and those bits
+are corresponds to LWIE and RWIE bits.
+
+Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
+cc: stable@vger.kernel.org
+Signed-off-by: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/1724674261-3144-3-git-send-email-quic_msarkar@quicinc.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw-edma/dw-hdma-v0-core.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c
++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c
+@@ -17,8 +17,8 @@ enum dw_hdma_control {
+ DW_HDMA_V0_CB = BIT(0),
+ DW_HDMA_V0_TCB = BIT(1),
+ DW_HDMA_V0_LLP = BIT(2),
+- DW_HDMA_V0_LIE = BIT(3),
+- DW_HDMA_V0_RIE = BIT(4),
++ DW_HDMA_V0_LWIE = BIT(3),
++ DW_HDMA_V0_RWIE = BIT(4),
+ DW_HDMA_V0_CCS = BIT(8),
+ DW_HDMA_V0_LLE = BIT(9),
+ };
+@@ -195,25 +195,14 @@ static void dw_hdma_v0_write_ll_link(str
+ static void dw_hdma_v0_core_write_chunk(struct dw_edma_chunk *chunk)
+ {
+ struct dw_edma_burst *child;
+- struct dw_edma_chan *chan = chunk->chan;
+ u32 control = 0, i = 0;
+- int j;
+
+ if (chunk->cb)
+ control = DW_HDMA_V0_CB;
+
+- j = chunk->bursts_alloc;
+- list_for_each_entry(child, &chunk->burst->list, list) {
+- j--;
+- if (!j) {
+- control |= DW_HDMA_V0_LIE;
+- if (!(chan->dw->chip->flags & DW_EDMA_CHIP_LOCAL))
+- control |= DW_HDMA_V0_RIE;
+- }
+-
++ list_for_each_entry(child, &chunk->burst->list, list)
+ dw_hdma_v0_write_ll_data(chunk, i++, control, child->sz,
+ child->sar, child->dar);
+- }
+
+ control = DW_HDMA_V0_LLP | DW_HDMA_V0_TCB;
+ if (!chunk->cb)
--- /dev/null
+From 383baf5c8f062091af34c63f28d37642a8f188ae Mon Sep 17 00:00:00 2001
+From: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+Date: Mon, 26 Aug 2024 17:41:00 +0530
+Subject: dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA
+
+From: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+
+commit 383baf5c8f062091af34c63f28d37642a8f188ae upstream.
+
+The current logic is enabling both STOP_INT_MASK and ABORT_INT_MASK
+bit. This is apparently masking those particular interrupts rather than
+unmasking the same. If the interrupts are masked, they would never get
+triggered.
+
+So fix the issue by unmasking the STOP and ABORT interrupts properly.
+
+Fixes: e74c39573d35 ("dmaengine: dw-edma: Add support for native HDMA")
+cc: stable@vger.kernel.org
+Signed-off-by: Mrinmay Sarkar <quic_msarkar@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/1724674261-3144-2-git-send-email-quic_msarkar@quicinc.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dw-edma/dw-hdma-v0-core.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/dw-edma/dw-hdma-v0-core.c
++++ b/drivers/dma/dw-edma/dw-hdma-v0-core.c
+@@ -247,10 +247,11 @@ static void dw_hdma_v0_core_start(struct
+ if (first) {
+ /* Enable engine */
+ SET_CH_32(dw, chan->dir, chan->id, ch_en, BIT(0));
+- /* Interrupt enable&unmask - done, abort */
+- tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup) |
+- HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK |
+- HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN;
++ /* Interrupt unmask - stop, abort */
++ tmp = GET_CH_32(dw, chan->dir, chan->id, int_setup);
++ tmp &= ~(HDMA_V0_STOP_INT_MASK | HDMA_V0_ABORT_INT_MASK);
++ /* Interrupt enable - stop, abort */
++ tmp |= HDMA_V0_LOCAL_STOP_INT_EN | HDMA_V0_LOCAL_ABORT_INT_EN;
+ if (!(dw->chip->flags & DW_EDMA_CHIP_LOCAL))
+ tmp |= HDMA_V0_REMOTE_STOP_INT_EN | HDMA_V0_REMOTE_ABORT_INT_EN;
+ SET_CH_32(dw, chan->dir, chan->id, int_setup, tmp);
--- /dev/null
+From 996dc53ac289b81957aa70d62ccadc6986d26a87 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@nvidia.com>
+Date: Thu, 22 Aug 2024 11:45:54 -0300
+Subject: iommufd: Do not allow creating areas without READ or WRITE
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+commit 996dc53ac289b81957aa70d62ccadc6986d26a87 upstream.
+
+This results in passing 0 or just IOMMU_CACHE to iommu_map(). Most of
+the page table formats don't like this:
+
+ amdv1 - -EINVAL
+ armv7s - returns 0, doesn't update mapped
+ arm-lpae - returns 0 doesn't update mapped
+ dart - returns 0, doesn't update mapped
+ VT-D - returns -EINVAL
+
+Unfortunately the three formats that return 0 cause serious problems:
+
+ - Returning ret = but not uppdating mapped from domain->map_pages()
+ causes an infinite loop in __iommu_map()
+
+ - Not writing ioptes means that VFIO/iommufd have no way to recover them
+ and we will have memory leaks and worse during unmap
+
+Since almost nothing can support this, and it is a useless thing to do,
+block it early in iommufd.
+
+Cc: stable@kernel.org
+Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/1-v1-1211e1294c27+4b1-iommu_no_prot_jgg@nvidia.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iommufd/ioas.c | 8 ++++++++
+ tools/testing/selftests/iommu/iommufd.c | 6 +++---
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/iommufd/ioas.c
++++ b/drivers/iommu/iommufd/ioas.c
+@@ -213,6 +213,10 @@ int iommufd_ioas_map(struct iommufd_ucmd
+ if (cmd->iova >= ULONG_MAX || cmd->length >= ULONG_MAX)
+ return -EOVERFLOW;
+
++ if (!(cmd->flags &
++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
++ return -EINVAL;
++
+ ioas = iommufd_get_ioas(ucmd->ictx, cmd->ioas_id);
+ if (IS_ERR(ioas))
+ return PTR_ERR(ioas);
+@@ -253,6 +257,10 @@ int iommufd_ioas_copy(struct iommufd_ucm
+ cmd->dst_iova >= ULONG_MAX)
+ return -EOVERFLOW;
+
++ if (!(cmd->flags &
++ (IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
++ return -EINVAL;
++
+ src_ioas = iommufd_get_ioas(ucmd->ictx, cmd->src_ioas_id);
+ if (IS_ERR(src_ioas))
+ return PTR_ERR(src_ioas);
+--- a/tools/testing/selftests/iommu/iommufd.c
++++ b/tools/testing/selftests/iommu/iommufd.c
+@@ -803,7 +803,7 @@ TEST_F(iommufd_ioas, copy_area)
+ {
+ struct iommu_ioas_copy copy_cmd = {
+ .size = sizeof(copy_cmd),
+- .flags = IOMMU_IOAS_MAP_FIXED_IOVA,
++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
+ .dst_ioas_id = self->ioas_id,
+ .src_ioas_id = self->ioas_id,
+ .length = PAGE_SIZE,
+@@ -1296,7 +1296,7 @@ TEST_F(iommufd_ioas, copy_sweep)
+ {
+ struct iommu_ioas_copy copy_cmd = {
+ .size = sizeof(copy_cmd),
+- .flags = IOMMU_IOAS_MAP_FIXED_IOVA,
++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
+ .src_ioas_id = self->ioas_id,
+ .dst_iova = MOCK_APERTURE_START,
+ .length = MOCK_PAGE_SIZE,
+@@ -1586,7 +1586,7 @@ TEST_F(iommufd_mock_domain, user_copy)
+ };
+ struct iommu_ioas_copy copy_cmd = {
+ .size = sizeof(copy_cmd),
+- .flags = IOMMU_IOAS_MAP_FIXED_IOVA,
++ .flags = IOMMU_IOAS_MAP_FIXED_IOVA | IOMMU_IOAS_MAP_WRITEABLE,
+ .dst_ioas_id = self->ioas_id,
+ .dst_iova = MOCK_APERTURE_START,
+ .length = BUFFER_SIZE,
--- /dev/null
+From ce52c2532299c7ccfd34a52db8d071e890a78c59 Mon Sep 17 00:00:00 2001
+From: Xu Yang <xu.yang_2@nxp.com>
+Date: Thu, 1 Aug 2024 20:46:42 +0800
+Subject: phy: fsl-imx8mq-usb: fix tuning parameter name
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+commit ce52c2532299c7ccfd34a52db8d071e890a78c59 upstream.
+
+According to fsl,imx8mq-usb-phy.yaml, this tuning parameter should be
+fsl,phy-pcs-tx-deemph-3p5db-attenuation-db.
+
+Fixes: 63c85ad0cd81 ("phy: fsl-imx8mp-usb: add support for phy tuning")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20240801124642.1152838-1-xu.yang_2@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/freescale/phy-fsl-imx8mq-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
++++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c
+@@ -176,7 +176,7 @@ static void imx8m_get_phy_tuning_data(st
+ imx_phy->comp_dis_tune =
+ phy_comp_dis_tune_from_property(imx_phy->comp_dis_tune);
+
+- if (device_property_read_u32(dev, "fsl,pcs-tx-deemph-3p5db-attenuation-db",
++ if (device_property_read_u32(dev, "fsl,phy-pcs-tx-deemph-3p5db-attenuation-db",
+ &imx_phy->pcs_tx_deemph_3p5db))
+ imx_phy->pcs_tx_deemph_3p5db = PHY_TUNE_DEFAULT;
+ else
--- /dev/null
+From 76a0e79bc84f466999fa501fce5bf7a07641b8a7 Mon Sep 17 00:00:00 2001
+From: Scott Mayhew <smayhew@redhat.com>
+Date: Wed, 28 Aug 2024 15:51:29 -0400
+Subject: selinux,smack: don't bypass permissions check in inode_setsecctx hook
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+commit 76a0e79bc84f466999fa501fce5bf7a07641b8a7 upstream.
+
+Marek Gresko reports that the root user on an NFS client is able to
+change the security labels on files on an NFS filesystem that is
+exported with root squashing enabled.
+
+The end of the kerneldoc comment for __vfs_setxattr_noperm() states:
+
+ * This function requires the caller to lock the inode's i_mutex before it
+ * is executed. It also assumes that the caller will make the appropriate
+ * permission checks.
+
+nfsd_setattr() does do permissions checking via fh_verify() and
+nfsd_permission(), but those don't do all the same permissions checks
+that are done by security_inode_setxattr() and its related LSM hooks do.
+
+Since nfsd_setattr() is the only consumer of security_inode_setsecctx(),
+simplest solution appears to be to replace the call to
+__vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This
+fixes the above issue and has the added benefit of causing nfsd to
+recall conflicting delegations on a file when a client tries to change
+its security label.
+
+Cc: stable@kernel.org
+Reported-by: Marek Gresko <marek.gresko@protonmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218809
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 4 ++--
+ security/smack/smack_lsm.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -6660,8 +6660,8 @@ static int selinux_inode_notifysecctx(st
+ */
+ static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
+ {
+- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
+- ctx, ctxlen, 0);
++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
++ ctx, ctxlen, 0, NULL);
+ }
+
+ static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -4874,8 +4874,8 @@ static int smack_inode_notifysecctx(stru
+
+ static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
+ {
+- return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK,
+- ctx, ctxlen, 0);
++ return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK,
++ ctx, ctxlen, 0, NULL);
+ }
+
+ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
nfsd-hold-reference-to-delegation-when-updating-it-f.patch
nfsd-fix-potential-uaf-in-nfsd4_cb_getattr_release.patch
fs-nfsd-fix-update-of-inode-attrs-in-cb_getattr.patch
+selinux-smack-don-t-bypass-permissions-check-in-inode_setsecctx-hook.patch
+cpufreq-amd-pstate-use-topology_logical_package_id-instead-of-logical_die_id.patch
+iommufd-do-not-allow-creating-areas-without-read-or-write.patch
+phy-fsl-imx8mq-usb-fix-tuning-parameter-name.patch
+soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch
+dmaengine-dw-edma-fix-unmasking-stop-and-abort-interrupts-for-hdma.patch
+dmaengine-dw-edma-do-not-enable-watermark-interrupts-for-hdma.patch
--- /dev/null
+From ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Mon, 29 Jul 2024 16:01:57 +0200
+Subject: soundwire: stream: fix programming slave ports for non-continous port maps
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 upstream.
+
+Two bitmasks in 'struct sdw_slave_prop' - 'source_ports' and
+'sink_ports' - define which ports to program in
+sdw_program_slave_port_params(). The masks are used to get the
+appropriate data port properties ('struct sdw_get_slave_dpn_prop') from
+an array.
+
+Bitmasks can be non-continuous or can start from index different than 0,
+thus when looking for matching port property for given port, we must
+iterate over mask bits, not from 0 up to number of ports.
+
+This fixes allocation and programming slave ports, when a source or sink
+masks start from further index.
+
+Fixes: f8101c74aa54 ("soundwire: Add Master and Slave port programming")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20240729140157.326450-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soundwire/stream.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -1286,18 +1286,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_p
+ unsigned int port_num)
+ {
+ struct sdw_dpn_prop *dpn_prop;
+- u8 num_ports;
++ unsigned long mask;
+ int i;
+
+ if (direction == SDW_DATA_DIR_TX) {
+- num_ports = hweight32(slave->prop.source_ports);
++ mask = slave->prop.source_ports;
+ dpn_prop = slave->prop.src_dpn_prop;
+ } else {
+- num_ports = hweight32(slave->prop.sink_ports);
++ mask = slave->prop.sink_ports;
+ dpn_prop = slave->prop.sink_dpn_prop;
+ }
+
+- for (i = 0; i < num_ports; i++) {
++ for_each_set_bit(i, &mask, 32) {
+ if (dpn_prop[i].num == port_num)
+ return &dpn_prop[i];
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
