From: Sasha Levin Date: Sat, 28 Dec 2024 14:19:49 +0000 (-0500) Subject: Fixes for 6.12 X-Git-Tag: v6.1.123~42 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=02c4e020b801c16d44e328b943ac0be58f26d6fb;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/acpi-iort-add-pmcg-platform-information-for-hisilico.patch b/queue-6.12/acpi-iort-add-pmcg-platform-information-for-hisilico.patch new file mode 100644 index 00000000000..1cccd203199 --- /dev/null +++ b/queue-6.12/acpi-iort-add-pmcg-platform-information-for-hisilico.patch @@ -0,0 +1,58 @@ +From 97d4a026a2da79cc2f7fe5cebb9de597524c7d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 09:33:31 +0800 +Subject: ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A + +From: Qinxin Xia + +[ Upstream commit c2b46ae022704a2d845e59461fa24431ad627022 ] + +HiSilicon HIP09A platforms using the same SMMU PMCG with HIP09 +and thus suffers the same erratum. List them in the PMCG platform +information list without introducing a new SMMU PMCG Model. + +Update the silicon-errata.rst as well. + +Reviewed-by: Yicong Yang +Acked-by: Hanjun Guo +Signed-off-by: Qinxin Xia +Link: https://lore.kernel.org/r/20241205013331.1484017-1-xiaqinxin@huawei.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + Documentation/arch/arm64/silicon-errata.rst | 5 +++-- + drivers/acpi/arm64/iort.c | 2 ++ + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst +index 77db10e944f0..b42fea07c5ce 100644 +--- a/Documentation/arch/arm64/silicon-errata.rst ++++ b/Documentation/arch/arm64/silicon-errata.rst +@@ -255,8 +255,9 @@ stable kernels. + +----------------+-----------------+-----------------+-----------------------------+ + | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | + +----------------+-----------------+-----------------+-----------------------------+ +-| Hisilicon | Hip{08,09,10,10C| #162001900 | N/A | +-| | ,11} SMMU PMCG | | | ++| Hisilicon | Hip{08,09,09A,10| #162001900 | N/A | ++| | ,10C,11} | | | ++| | SMMU PMCG | | | + +----------------+-----------------+-----------------+-----------------------------+ + | Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | + +----------------+-----------------+-----------------+-----------------------------+ +diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c +index 4c745a26226b..bf3be532e089 100644 +--- a/drivers/acpi/arm64/iort.c ++++ b/drivers/acpi/arm64/iort.c +@@ -1703,6 +1703,8 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { + /* HiSilicon Hip09 Platform */ + {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, ++ {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, ++ "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ + {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, +-- +2.39.5 + diff --git a/queue-6.12/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch b/queue-6.12/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch new file mode 100644 index 00000000000..ce4f325a849 --- /dev/null +++ b/queue-6.12/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch @@ -0,0 +1,100 @@ +From 4f03ea169f1bc3eb787c5907f8365c3c6b0b75b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 09:44:41 +0800 +Subject: ALSA: hda/conexant: fix Z60MR100 startup pop issue + +From: bo liu + +[ Upstream commit 947c4012f8f03a8bb946beb6e5294d5e32817d67 ] + +When Z60MR100 startup, speaker will output a pop. To fix this issue, +we mute codec by init verbs in bios when system startup, and set GPIO +to low to unmute codec in codec driver when it loaded . + +[ white space fixes and compile warning fix by tiwai ] + +Signed-off-by: bo liu +Link: https://patch.msgid.link/20241129014441.437205-1-bo.liu@senarytech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_conexant.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 2e9f817b948e..538c37a78a56 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -307,6 +307,7 @@ enum { + CXT_FIXUP_HP_MIC_NO_PRESENCE, + CXT_PINCFG_SWS_JS201D, + CXT_PINCFG_TOP_SPEAKER, ++ CXT_FIXUP_HP_A_U, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -774,6 +775,18 @@ static void cxt_setup_mute_led(struct hda_codec *codec, + } + } + ++static void cxt_setup_gpio_unmute(struct hda_codec *codec, ++ unsigned int gpio_mute_mask) ++{ ++ if (gpio_mute_mask) { ++ // set gpio data to 0. ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0); ++ } ++} ++ + static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -788,6 +801,15 @@ static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, + cxt_setup_mute_led(codec, 0x10, 0x20); + } + ++static void cxt_fixup_hp_a_u(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ // Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise, ++ // so need to unmute once by clearing the gpio data when runs into the system. ++ if (action == HDA_FIXUP_ACT_INIT) ++ cxt_setup_gpio_unmute(codec, 0x2); ++} ++ + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { + { 0x16, 0x042140ff }, /* HP (seq# overridden) */ +@@ -998,6 +1020,10 @@ static const struct hda_fixup cxt_fixups[] = { + { } + }, + }, ++ [CXT_FIXUP_HP_A_U] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_a_u, ++ }, + }; + + static const struct hda_quirk cxt5045_fixups[] = { +@@ -1072,6 +1098,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), ++ SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U), + SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +@@ -1117,6 +1144,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { + { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" }, + { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" }, ++ { .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" }, + {} + }; + +-- +2.39.5 + diff --git a/queue-6.12/alsa-sh-use-standard-helper-for-buffer-accesses.patch b/queue-6.12/alsa-sh-use-standard-helper-for-buffer-accesses.patch new file mode 100644 index 00000000000..dab5e47872a --- /dev/null +++ b/queue-6.12/alsa-sh-use-standard-helper-for-buffer-accesses.patch @@ -0,0 +1,65 @@ +From 47082c3803b7f824272a347726e94c4da32775c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 11:49:38 +0100 +Subject: ALSA: sh: Use standard helper for buffer accesses + +From: Takashi Iwai + +[ Upstream commit 9b5f8ee43e48c25fbe1a10163ec04343d750acd0 ] + +The SH DAC audio driver uses the kmalloc'ed buffer as the main PCM +buffer, and the data is transferred via hrtimer callbacks manually +from there to the hardware. Meanwhile, some of its code are written +as if the buffer is on iomem and use the special helpers for the iomem +(e.g. copy_from_iter_toio() or memset_io()). Those are rather useless +and the standard helpers should be used. + +Similarly, the PCM mmap callback is set to a special one with +snd_pcm_lib_mmap_iomem, but this is also nonsense, because SH +architecture doesn't support this function, hence it leads just to +NULL -- the fallback to the standard helper. + +This patch replaces those special setups with the standard ones. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202411281337.I4M07b7i-lkp@intel.com/ +Link: https://patch.msgid.link/20241128104939.13755-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/sh/sh_dac_audio.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c +index e7b6ce7bd086..5a9f77908a3d 100644 +--- a/sound/sh/sh_dac_audio.c ++++ b/sound/sh/sh_dac_audio.c +@@ -163,7 +163,7 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream, + /* channel is not used (interleaved data) */ + struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); + +- if (copy_from_iter_toio(chip->data_buffer + pos, src, count)) ++ if (copy_from_iter(chip->data_buffer + pos, src, count) != count) + return -EFAULT; + chip->buffer_end = chip->data_buffer + pos + count; + +@@ -182,7 +182,7 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream, + /* channel is not used (interleaved data) */ + struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); + +- memset_io(chip->data_buffer + pos, 0, count); ++ memset(chip->data_buffer + pos, 0, count); + chip->buffer_end = chip->data_buffer + pos + count; + + if (chip->empty) { +@@ -211,7 +211,6 @@ static const struct snd_pcm_ops snd_sh_dac_pcm_ops = { + .pointer = snd_sh_dac_pcm_pointer, + .copy = snd_sh_dac_pcm_copy, + .fill_silence = snd_sh_dac_pcm_silence, +- .mmap = snd_pcm_lib_mmap_iomem, + }; + + static int snd_sh_dac_pcm(struct snd_sh_dac *chip, int device) +-- +2.39.5 + diff --git a/queue-6.12/alsa-ump-don-t-open-legacy-substream-for-an-inactive.patch b/queue-6.12/alsa-ump-don-t-open-legacy-substream-for-an-inactive.patch new file mode 100644 index 00000000000..021d361fba9 --- /dev/null +++ b/queue-6.12/alsa-ump-don-t-open-legacy-substream-for-an-inactive.patch @@ -0,0 +1,36 @@ +From 47c9504c777bcc05a5660e6213a8753099ef6460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 10:45:42 +0100 +Subject: ALSA: ump: Don't open legacy substream for an inactive group + +From: Takashi Iwai + +[ Upstream commit 3978d53df7236f0a517c2abeb43ddf6ac162cdd8 ] + +When a UMP Group is inactive, we shouldn't allow users to access it +via the legacy MIDI access. Add the group active flag check and +return -ENODEV if it's inactive. + +Link: https://patch.msgid.link/20241129094546.32119-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/ump.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/core/ump.c b/sound/core/ump.c +index 8d37f237f83b..0ade67d6b089 100644 +--- a/sound/core/ump.c ++++ b/sound/core/ump.c +@@ -1087,6 +1087,8 @@ static int snd_ump_legacy_open(struct snd_rawmidi_substream *substream) + guard(mutex)(&ump->open_mutex); + if (ump->legacy_substreams[dir][group]) + return -EBUSY; ++ if (!ump->groups[group].active) ++ return -ENODEV; + if (dir == SNDRV_RAWMIDI_STREAM_OUTPUT) { + if (!ump->legacy_out_opens) { + err = snd_rawmidi_kernel_open(&ump->core, 0, +-- +2.39.5 + diff --git a/queue-6.12/alsa-ump-indicate-the-inactive-group-in-legacy-subst.patch b/queue-6.12/alsa-ump-indicate-the-inactive-group-in-legacy-subst.patch new file mode 100644 index 00000000000..56e67ebedcd --- /dev/null +++ b/queue-6.12/alsa-ump-indicate-the-inactive-group-in-legacy-subst.patch @@ -0,0 +1,39 @@ +From 201a7de53632da5c0798deb30a0e513ecc8eceab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 10:45:43 +0100 +Subject: ALSA: ump: Indicate the inactive group in legacy substream names + +From: Takashi Iwai + +[ Upstream commit e29e504e7890b9ee438ca6370d0180d607c473f9 ] + +Since the legacy rawmidi has no proper way to know the inactive group, +indicate it in the rawmidi substream names with "[Inactive]" suffix +when the corresponding UMP group is inactive. + +Link: https://patch.msgid.link/20241129094546.32119-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/ump.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/core/ump.c b/sound/core/ump.c +index 0ade67d6b089..55d5d8af5e44 100644 +--- a/sound/core/ump.c ++++ b/sound/core/ump.c +@@ -1256,8 +1256,9 @@ static void fill_substream_names(struct snd_ump_endpoint *ump, + name = ump->groups[idx].name; + if (!*name) + name = ump->info.name; +- snprintf(s->name, sizeof(s->name), "Group %d (%.16s)", +- idx + 1, name); ++ snprintf(s->name, sizeof(s->name), "Group %d (%.16s)%s", ++ idx + 1, name, ++ ump->groups[idx].active ? "" : " [Inactive]"); + } + } + +-- +2.39.5 + diff --git a/queue-6.12/alsa-ump-update-legacy-substream-names-upon-fb-info-.patch b/queue-6.12/alsa-ump-update-legacy-substream-names-upon-fb-info-.patch new file mode 100644 index 00000000000..dc4e34459f5 --- /dev/null +++ b/queue-6.12/alsa-ump-update-legacy-substream-names-upon-fb-info-.patch @@ -0,0 +1,87 @@ +From a3a3a4613cd6f4821709408877040bd5391ffad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 10:45:44 +0100 +Subject: ALSA: ump: Update legacy substream names upon FB info update + +From: Takashi Iwai + +[ Upstream commit edad3f9519fcacb926d0e3f3217aecaf628a593f ] + +The legacy rawmidi substreams should be updated when UMP FB Info or +UMP FB Name are received, too. + +Link: https://patch.msgid.link/20241129094546.32119-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/ump.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/sound/core/ump.c b/sound/core/ump.c +index 55d5d8af5e44..24f7d65ce49c 100644 +--- a/sound/core/ump.c ++++ b/sound/core/ump.c +@@ -37,6 +37,7 @@ static int process_legacy_output(struct snd_ump_endpoint *ump, + u32 *buffer, int count); + static void process_legacy_input(struct snd_ump_endpoint *ump, const u32 *src, + int words); ++static void update_legacy_names(struct snd_ump_endpoint *ump); + #else + static inline int process_legacy_output(struct snd_ump_endpoint *ump, + u32 *buffer, int count) +@@ -47,6 +48,9 @@ static inline void process_legacy_input(struct snd_ump_endpoint *ump, + const u32 *src, int words) + { + } ++static inline void update_legacy_names(struct snd_ump_endpoint *ump) ++{ ++} + #endif + + static const struct snd_rawmidi_global_ops snd_ump_rawmidi_ops = { +@@ -861,6 +865,7 @@ static int ump_handle_fb_info_msg(struct snd_ump_endpoint *ump, + fill_fb_info(ump, &fb->info, buf); + if (ump->parsed) { + snd_ump_update_group_attrs(ump); ++ update_legacy_names(ump); + seq_notify_fb_change(ump, fb); + } + } +@@ -893,6 +898,7 @@ static int ump_handle_fb_name_msg(struct snd_ump_endpoint *ump, + /* notify the FB name update to sequencer, too */ + if (ret > 0 && ump->parsed) { + snd_ump_update_group_attrs(ump); ++ update_legacy_names(ump); + seq_notify_fb_change(ump, fb); + } + return ret; +@@ -1262,6 +1268,14 @@ static void fill_substream_names(struct snd_ump_endpoint *ump, + } + } + ++static void update_legacy_names(struct snd_ump_endpoint *ump) ++{ ++ struct snd_rawmidi *rmidi = ump->legacy_rmidi; ++ ++ fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT); ++ fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT); ++} ++ + int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump, + char *id, int device) + { +@@ -1298,10 +1312,7 @@ int snd_ump_attach_legacy_rawmidi(struct snd_ump_endpoint *ump, + rmidi->ops = &snd_ump_legacy_ops; + rmidi->private_data = ump; + ump->legacy_rmidi = rmidi; +- if (input) +- fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_INPUT); +- if (output) +- fill_substream_names(ump, rmidi, SNDRV_RAWMIDI_STREAM_OUTPUT); ++ update_legacy_names(ump); + + ump_dbg(ump, "Created a legacy rawmidi #%d (%s)\n", device, id); + return 0; +-- +2.39.5 + diff --git a/queue-6.12/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch b/queue-6.12/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch new file mode 100644 index 00000000000..edbe994a895 --- /dev/null +++ b/queue-6.12/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch @@ -0,0 +1,73 @@ +From 9a31f71455aff44275f614e9efca2d91ec782d80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 19:16:06 +0800 +Subject: blk-mq: register cpuhp callback after hctx is added to xarray table + +From: Ming Lei + +[ Upstream commit 4bf485a7db5d82ddd0f3ad2b299893199090375e ] + +We need to retrieve 'hctx' from xarray table in the cpuhp callback, so the +callback should be registered after this 'hctx' is added to xarray table. + +Cc: Reinette Chatre +Cc: Fenghua Yu +Cc: Peter Newman +Cc: Babu Moger +Cc: Luck Tony +Signed-off-by: Ming Lei +Tested-by: Tony Luck +Link: https://lore.kernel.org/r/20241206111611.978870-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index d5995021815d..4e76651e786d 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3903,16 +3903,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + { + hctx->queue_num = hctx_idx; + +- if (!(hctx->flags & BLK_MQ_F_STACKING)) +- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, +- &hctx->cpuhp_online); +- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); +- + hctx->tags = set->tags[hctx_idx]; + + if (set->ops->init_hctx && + set->ops->init_hctx(hctx, set->driver_data, hctx_idx)) +- goto unregister_cpu_notifier; ++ goto fail; + + if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx, + hctx->numa_node)) +@@ -3921,6 +3916,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL)) + goto exit_flush_rq; + ++ if (!(hctx->flags & BLK_MQ_F_STACKING)) ++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, ++ &hctx->cpuhp_online); ++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); ++ + return 0; + + exit_flush_rq: +@@ -3929,8 +3929,7 @@ static int blk_mq_init_hctx(struct request_queue *q, + exit_hctx: + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); +- unregister_cpu_notifier: +- blk_mq_remove_cpuhp(hctx); ++ fail: + return -1; + } + +-- +2.39.5 + diff --git a/queue-6.12/bpf-zero-index-arg-error-string-for-dynptr-and-iter.patch b/queue-6.12/bpf-zero-index-arg-error-string-for-dynptr-and-iter.patch new file mode 100644 index 00000000000..56484ec6355 --- /dev/null +++ b/queue-6.12/bpf-zero-index-arg-error-string-for-dynptr-and-iter.patch @@ -0,0 +1,318 @@ +From 494184df4e6252e59aa0d7990757cb8e5eeab3da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 16:22:35 -0800 +Subject: bpf: Zero index arg error string for dynptr and iter + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit bd74e238ae6944b462f57ce8752440a011ba4530 ] + +Andrii spotted that process_dynptr_func's rejection of incorrect +argument register type will print an error string where argument numbers +are not zero-indexed, unlike elsewhere in the verifier. Fix this by +subtracting 1 from regno. The same scenario exists for iterator +messages. Fix selftest error strings that match on the exact argument +number while we're at it to ensure clean bisection. + +Suggested-by: Andrii Nakryiko +Signed-off-by: Kumar Kartikeya Dwivedi +Link: https://lore.kernel.org/r/20241203002235.3776418-1-memxor@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 12 +++++----- + .../testing/selftests/bpf/progs/dynptr_fail.c | 22 +++++++++---------- + .../selftests/bpf/progs/iters_state_safety.c | 14 ++++++------ + .../selftests/bpf/progs/iters_testmod_seq.c | 4 ++-- + .../bpf/progs/test_kfunc_dynptr_param.c | 2 +- + .../selftests/bpf/progs/verifier_bits_iter.c | 4 ++-- + 6 files changed, 29 insertions(+), 29 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 84d958f2c031..767f1cb8c27e 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -7868,7 +7868,7 @@ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn + if (reg->type != PTR_TO_STACK && reg->type != CONST_PTR_TO_DYNPTR) { + verbose(env, + "arg#%d expected pointer to stack or const struct bpf_dynptr\n", +- regno); ++ regno - 1); + return -EINVAL; + } + +@@ -7922,7 +7922,7 @@ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn + if (!is_dynptr_reg_valid_init(env, reg)) { + verbose(env, + "Expected an initialized dynptr as arg #%d\n", +- regno); ++ regno - 1); + return -EINVAL; + } + +@@ -7930,7 +7930,7 @@ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn + if (!is_dynptr_type_expected(env, reg, arg_type & ~MEM_RDONLY)) { + verbose(env, + "Expected a dynptr of type %s as arg #%d\n", +- dynptr_type_str(arg_to_dynptr_type(arg_type)), regno); ++ dynptr_type_str(arg_to_dynptr_type(arg_type)), regno - 1); + return -EINVAL; + } + +@@ -7999,7 +7999,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id + */ + btf_id = btf_check_iter_arg(meta->btf, meta->func_proto, regno - 1); + if (btf_id < 0) { +- verbose(env, "expected valid iter pointer as arg #%d\n", regno); ++ verbose(env, "expected valid iter pointer as arg #%d\n", regno - 1); + return -EINVAL; + } + t = btf_type_by_id(meta->btf, btf_id); +@@ -8009,7 +8009,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id + /* bpf_iter__new() expects pointer to uninit iter state */ + if (!is_iter_reg_valid_uninit(env, reg, nr_slots)) { + verbose(env, "expected uninitialized iter_%s as arg #%d\n", +- iter_type_str(meta->btf, btf_id), regno); ++ iter_type_str(meta->btf, btf_id), regno - 1); + return -EINVAL; + } + +@@ -8033,7 +8033,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id + break; + case -EINVAL: + verbose(env, "expected an initialized iter_%s as arg #%d\n", +- iter_type_str(meta->btf, btf_id), regno); ++ iter_type_str(meta->btf, btf_id), regno - 1); + return err; + case -EPROTO: + verbose(env, "expected an RCU CS when using %s\n", meta->func_name); +diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c +index 8f36c9de7591..dfd817d0348c 100644 +--- a/tools/testing/selftests/bpf/progs/dynptr_fail.c ++++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c +@@ -149,7 +149,7 @@ int ringbuf_release_uninit_dynptr(void *ctx) + + /* A dynptr can't be used after it has been invalidated */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("Expected an initialized dynptr as arg #2") + int use_after_invalid(void *ctx) + { + struct bpf_dynptr ptr; +@@ -428,7 +428,7 @@ int invalid_helper2(void *ctx) + + /* A bpf_dynptr is invalidated if it's been written into */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int invalid_write1(void *ctx) + { + struct bpf_dynptr ptr; +@@ -1407,7 +1407,7 @@ int invalid_slice_rdwr_rdonly(struct __sk_buff *skb) + + /* bpf_dynptr_adjust can only be called on initialized dynptrs */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int dynptr_adjust_invalid(void *ctx) + { + struct bpf_dynptr ptr = {}; +@@ -1420,7 +1420,7 @@ int dynptr_adjust_invalid(void *ctx) + + /* bpf_dynptr_is_null can only be called on initialized dynptrs */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int dynptr_is_null_invalid(void *ctx) + { + struct bpf_dynptr ptr = {}; +@@ -1433,7 +1433,7 @@ int dynptr_is_null_invalid(void *ctx) + + /* bpf_dynptr_is_rdonly can only be called on initialized dynptrs */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int dynptr_is_rdonly_invalid(void *ctx) + { + struct bpf_dynptr ptr = {}; +@@ -1446,7 +1446,7 @@ int dynptr_is_rdonly_invalid(void *ctx) + + /* bpf_dynptr_size can only be called on initialized dynptrs */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int dynptr_size_invalid(void *ctx) + { + struct bpf_dynptr ptr = {}; +@@ -1459,7 +1459,7 @@ int dynptr_size_invalid(void *ctx) + + /* Only initialized dynptrs can be cloned */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #1") ++__failure __msg("Expected an initialized dynptr as arg #0") + int clone_invalid1(void *ctx) + { + struct bpf_dynptr ptr1 = {}; +@@ -1493,7 +1493,7 @@ int clone_invalid2(struct xdp_md *xdp) + + /* Invalidating a dynptr should invalidate its clones */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("Expected an initialized dynptr as arg #2") + int clone_invalidate1(void *ctx) + { + struct bpf_dynptr clone; +@@ -1514,7 +1514,7 @@ int clone_invalidate1(void *ctx) + + /* Invalidating a dynptr should invalidate its parent */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("Expected an initialized dynptr as arg #2") + int clone_invalidate2(void *ctx) + { + struct bpf_dynptr ptr; +@@ -1535,7 +1535,7 @@ int clone_invalidate2(void *ctx) + + /* Invalidating a dynptr should invalidate its siblings */ + SEC("?raw_tp") +-__failure __msg("Expected an initialized dynptr as arg #3") ++__failure __msg("Expected an initialized dynptr as arg #2") + int clone_invalidate3(void *ctx) + { + struct bpf_dynptr ptr; +@@ -1723,7 +1723,7 @@ __noinline long global_call_bpf_dynptr(const struct bpf_dynptr *dynptr) + } + + SEC("?raw_tp") +-__failure __msg("arg#1 expected pointer to stack or const struct bpf_dynptr") ++__failure __msg("arg#0 expected pointer to stack or const struct bpf_dynptr") + int test_dynptr_reg_type(void *ctx) + { + struct task_struct *current = NULL; +diff --git a/tools/testing/selftests/bpf/progs/iters_state_safety.c b/tools/testing/selftests/bpf/progs/iters_state_safety.c +index d47e59aba6de..f41257eadbb2 100644 +--- a/tools/testing/selftests/bpf/progs/iters_state_safety.c ++++ b/tools/testing/selftests/bpf/progs/iters_state_safety.c +@@ -73,7 +73,7 @@ int create_and_forget_to_destroy_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int destroy_without_creating_fail(void *ctx) + { + /* init with zeros to stop verifier complaining about uninit stack */ +@@ -91,7 +91,7 @@ int destroy_without_creating_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int compromise_iter_w_direct_write_fail(void *ctx) + { + struct bpf_iter_num iter; +@@ -143,7 +143,7 @@ int compromise_iter_w_direct_write_and_skip_destroy_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int compromise_iter_w_helper_write_fail(void *ctx) + { + struct bpf_iter_num iter; +@@ -230,7 +230,7 @@ int valid_stack_reuse(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected uninitialized iter_num as arg #1") ++__failure __msg("expected uninitialized iter_num as arg #0") + int double_create_fail(void *ctx) + { + struct bpf_iter_num iter; +@@ -258,7 +258,7 @@ int double_create_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int double_destroy_fail(void *ctx) + { + struct bpf_iter_num iter; +@@ -284,7 +284,7 @@ int double_destroy_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int next_without_new_fail(void *ctx) + { + struct bpf_iter_num iter; +@@ -305,7 +305,7 @@ int next_without_new_fail(void *ctx) + } + + SEC("?raw_tp") +-__failure __msg("expected an initialized iter_num as arg #1") ++__failure __msg("expected an initialized iter_num as arg #0") + int next_after_destroy_fail(void *ctx) + { + struct bpf_iter_num iter; +diff --git a/tools/testing/selftests/bpf/progs/iters_testmod_seq.c b/tools/testing/selftests/bpf/progs/iters_testmod_seq.c +index 4a176e6aede8..6543d5b6e0a9 100644 +--- a/tools/testing/selftests/bpf/progs/iters_testmod_seq.c ++++ b/tools/testing/selftests/bpf/progs/iters_testmod_seq.c +@@ -79,7 +79,7 @@ int testmod_seq_truncated(const void *ctx) + + SEC("?raw_tp") + __failure +-__msg("expected an initialized iter_testmod_seq as arg #2") ++__msg("expected an initialized iter_testmod_seq as arg #1") + int testmod_seq_getter_before_bad(const void *ctx) + { + struct bpf_iter_testmod_seq it; +@@ -89,7 +89,7 @@ int testmod_seq_getter_before_bad(const void *ctx) + + SEC("?raw_tp") + __failure +-__msg("expected an initialized iter_testmod_seq as arg #2") ++__msg("expected an initialized iter_testmod_seq as arg #1") + int testmod_seq_getter_after_bad(const void *ctx) + { + struct bpf_iter_testmod_seq it; +diff --git a/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c b/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c +index e68667aec6a6..cd4d752bd089 100644 +--- a/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c ++++ b/tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c +@@ -45,7 +45,7 @@ int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size) + } + + SEC("?lsm.s/bpf") +-__failure __msg("arg#1 expected pointer to stack or const struct bpf_dynptr") ++__failure __msg("arg#0 expected pointer to stack or const struct bpf_dynptr") + int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size) + { + unsigned long val = 0; +diff --git a/tools/testing/selftests/bpf/progs/verifier_bits_iter.c b/tools/testing/selftests/bpf/progs/verifier_bits_iter.c +index a7a6ae6c162f..8bcddadfc4da 100644 +--- a/tools/testing/selftests/bpf/progs/verifier_bits_iter.c ++++ b/tools/testing/selftests/bpf/progs/verifier_bits_iter.c +@@ -32,7 +32,7 @@ int BPF_PROG(no_destroy, struct bpf_iter_meta *meta, struct cgroup *cgrp) + + SEC("iter/cgroup") + __description("uninitialized iter in ->next()") +-__failure __msg("expected an initialized iter_bits as arg #1") ++__failure __msg("expected an initialized iter_bits as arg #0") + int BPF_PROG(next_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp) + { + struct bpf_iter_bits it = {}; +@@ -43,7 +43,7 @@ int BPF_PROG(next_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp) + + SEC("iter/cgroup") + __description("uninitialized iter in ->destroy()") +-__failure __msg("expected an initialized iter_bits as arg #1") ++__failure __msg("expected an initialized iter_bits as arg #0") + int BPF_PROG(destroy_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp) + { + struct bpf_iter_bits it = {}; +-- +2.39.5 + diff --git a/queue-6.12/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch b/queue-6.12/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch new file mode 100644 index 00000000000..35e1bf9d6ba --- /dev/null +++ b/queue-6.12/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch @@ -0,0 +1,99 @@ +From 8348c70033aa2ef45075c5404035bc11249da1a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 15:20:07 +0200 +Subject: drm/dp_mst: Ensure mst_primary pointer is valid in + drm_dp_mst_handle_up_req() + +From: Imre Deak + +[ Upstream commit e54b00086f7473dbda1a7d6fc47720ced157c6a8 ] + +While receiving an MST up request message from one thread in +drm_dp_mst_handle_up_req(), the MST topology could be removed from +another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing +mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. +This could lead to a NULL deref/use-after-free of mst_primary in +drm_dp_mst_handle_up_req(). + +Avoid the above by holding a reference for mst_primary in +drm_dp_mst_handle_up_req() while it's used. + +v2: Fix kfreeing the request if getting an mst_primary reference fails. + +Cc: Lyude Paul +Reviewed-by: Lyude Paul (v1) +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20241204132007.3132494-1-imre.deak@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 24 ++++++++++++++----- + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index bcf3a33123be..f0c6d50d8c33 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4108,9 +4108,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work) + static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + { + struct drm_dp_pending_up_req *up_req; ++ struct drm_dp_mst_branch *mst_primary; + + if (!drm_dp_get_one_sb_msg(mgr, true, NULL)) +- goto out; ++ goto out_clear_reply; + + if (!mgr->up_req_recv.have_eomt) + return 0; +@@ -4128,10 +4129,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n", + up_req->msg.req_type); + kfree(up_req); +- goto out; ++ goto out_clear_reply; ++ } ++ ++ mutex_lock(&mgr->lock); ++ mst_primary = mgr->mst_primary; ++ if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) { ++ mutex_unlock(&mgr->lock); ++ kfree(up_req); ++ goto out_clear_reply; + } ++ mutex_unlock(&mgr->lock); + +- drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type, ++ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, + false); + + if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { +@@ -4148,13 +4158,13 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + conn_stat->peer_device_type); + + mutex_lock(&mgr->probe_lock); +- handle_csn = mgr->mst_primary->link_address_sent; ++ handle_csn = mst_primary->link_address_sent; + mutex_unlock(&mgr->probe_lock); + + if (!handle_csn) { + drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); + kfree(up_req); +- goto out; ++ goto out_put_primary; + } + } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { + const struct drm_dp_resource_status_notify *res_stat = +@@ -4171,7 +4181,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + mutex_unlock(&mgr->up_req_lock); + queue_work(system_long_wq, &mgr->up_req_work); + +-out: ++out_put_primary: ++ drm_dp_mst_topology_put_mstb(mst_primary); ++out_clear_reply: + memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch b/queue-6.12/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch new file mode 100644 index 00000000000..722ad17d040 --- /dev/null +++ b/queue-6.12/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch @@ -0,0 +1,103 @@ +From 12f055c1df84b4468b81004b942784bd0c2cb6e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 16:42:08 +0800 +Subject: LoongArch: BPF: Adjust the parameter of emit_jirl() + +From: Tiezhu Yang + +[ Upstream commit c1474bb0b7cff4e8481095bd0618b8f6c2f0aeb4 ] + +The branch instructions beq, bne, blt, bge, bltu, bgeu and jirl belong +to the format reg2i16, but the sequence of oprand is different for the +instruction jirl. So adjust the parameter order of emit_jirl() to make +it more readable correspond with the Instruction Set Architecture manual. + +Here are the instruction formats: + + beq rj, rd, offs16 + bne rj, rd, offs16 + blt rj, rd, offs16 + bge rj, rd, offs16 + bltu rj, rd, offs16 + bgeu rj, rd, offs16 + jirl rd, rj, offs16 + +Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#branch-instructions +Suggested-by: Huacai Chen +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/inst.h | 12 +++++++++++- + arch/loongarch/kernel/inst.c | 2 +- + arch/loongarch/net/bpf_jit.c | 6 +++--- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h +index 944482063f14..3089785ca97e 100644 +--- a/arch/loongarch/include/asm/inst.h ++++ b/arch/loongarch/include/asm/inst.h +@@ -683,7 +683,17 @@ DEF_EMIT_REG2I16_FORMAT(blt, blt_op) + DEF_EMIT_REG2I16_FORMAT(bge, bge_op) + DEF_EMIT_REG2I16_FORMAT(bltu, bltu_op) + DEF_EMIT_REG2I16_FORMAT(bgeu, bgeu_op) +-DEF_EMIT_REG2I16_FORMAT(jirl, jirl_op) ++ ++static inline void emit_jirl(union loongarch_instruction *insn, ++ enum loongarch_gpr rd, ++ enum loongarch_gpr rj, ++ int offset) ++{ ++ insn->reg2i16_format.opcode = jirl_op; ++ insn->reg2i16_format.immediate = offset; ++ insn->reg2i16_format.rd = rd; ++ insn->reg2i16_format.rj = rj; ++} + + #define DEF_EMIT_REG2BSTRD_FORMAT(NAME, OP) \ + static inline void emit_##NAME(union loongarch_instruction *insn, \ +diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c +index 3050329556d1..14d7d700bcb9 100644 +--- a/arch/loongarch/kernel/inst.c ++++ b/arch/loongarch/kernel/inst.c +@@ -332,7 +332,7 @@ u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm) + return INSN_BREAK; + } + +- emit_jirl(&insn, rj, rd, imm >> 2); ++ emit_jirl(&insn, rd, rj, imm >> 2); + + return insn.word; + } +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index dd350cba1252..ea357a3edc09 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -181,13 +181,13 @@ static void __build_epilogue(struct jit_ctx *ctx, bool is_tail_call) + /* Set return value */ + emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0); + /* Return to the caller */ +- emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_RA, 0); + } else { + /* + * Call the next bpf prog and skip the first instruction + * of TCC initialization. + */ +- emit_insn(ctx, jirl, LOONGARCH_GPR_T3, LOONGARCH_GPR_ZERO, 1); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_T3, 1); + } + } + +@@ -904,7 +904,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext + return ret; + + move_addr(ctx, t1, func_addr); +- emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); + move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + break; + +-- +2.39.5 + diff --git a/queue-6.12/loongarch-fix-reserving-screen-info-memory-for-above.patch b/queue-6.12/loongarch-fix-reserving-screen-info-memory-for-above.patch new file mode 100644 index 00000000000..f42b38c3d97 --- /dev/null +++ b/queue-6.12/loongarch-fix-reserving-screen-info-memory-for-above.patch @@ -0,0 +1,39 @@ +From 7e2a735d283fe40eee22482ca3343a52853d4028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 16:42:07 +0800 +Subject: LoongArch: Fix reserving screen info memory for above-4G firmware + +From: Huacai Chen + +[ Upstream commit 55dc2f8f263448f1e6c7ef135d08e640d5a4826e ] + +Since screen_info.lfb_base is a __u32 type, an above-4G address need an +ext_lfb_base to present its higher 32bits. In init_screen_info() we can +use __screen_info_lfb_base() to handle this case for reserving screen +info memory. + +Signed-off-by: Xuefeng Zhao +Signed-off-by: Jianmin Lv +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/kernel/efi.c b/arch/loongarch/kernel/efi.c +index 2bf86aeda874..de21e72759ee 100644 +--- a/arch/loongarch/kernel/efi.c ++++ b/arch/loongarch/kernel/efi.c +@@ -95,7 +95,7 @@ static void __init init_screen_info(void) + memset(si, 0, sizeof(*si)); + early_memunmap(si, sizeof(*si)); + +- memblock_reserve(screen_info.lfb_base, screen_info.lfb_size); ++ memblock_reserve(__screen_info_lfb_base(&screen_info), screen_info.lfb_size); + } + + void __init efi_init(void) +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch b/queue-6.12/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch new file mode 100644 index 00000000000..64929d871b5 --- /dev/null +++ b/queue-6.12/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch @@ -0,0 +1,70 @@ +From 7d456cb2aa66ddedd8bcf06c6e45f97411b6f09e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Nov 2024 23:47:00 +0100 +Subject: platform/x86: asus-nb-wmi: Ignore unknown event 0xCF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit e9fba20c29e27dc99e55e1c550573a114561bf8c ] + +On the Asus X541UAK an unknown event 0xCF is emited when the charger +is plugged in. This is caused by the following AML code: + + If (ACPS ()) + { + ACPF = One + Local0 = 0x58 + If (ATKP) + { + ^^^^ATKD.IANE (0xCF) + } + } + Else + { + ACPF = Zero + Local0 = 0x57 + } + + Notify (AC0, 0x80) // Status Change + If (ATKP) + { + ^^^^ATKD.IANE (Local0) + } + + Sleep (0x64) + PNOT () + Sleep (0x0A) + NBAT (0x80) + +Ignore the 0xCF event to silence the unknown event warning. + +Reported-by: Pau Espin Pedrol +Closes: https://lore.kernel.org/platform-driver-x86/54d4860b-ec9c-4992-acf6-db3f90388293@espeweb.net +Signed-off-by: Armin Wolf +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241123224700.18530-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index ef04d396f61c..a5933980ade3 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -623,6 +623,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_IGNORE, 0xCF, }, /* AC mode */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ + { KE_END, 0}, +-- +2.39.5 + diff --git a/queue-6.12/power-supply-bq24190-fix-bq24296-vbus-regulator-supp.patch b/queue-6.12/power-supply-bq24190-fix-bq24296-vbus-regulator-supp.patch new file mode 100644 index 00000000000..203ffeffe6f --- /dev/null +++ b/queue-6.12/power-supply-bq24190-fix-bq24296-vbus-regulator-supp.patch @@ -0,0 +1,66 @@ +From 04595c7901859ddc28a0853a3c89a4dd1181ea11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Nov 2024 21:36:47 +0100 +Subject: power: supply: bq24190: Fix BQ24296 Vbus regulator support + +From: Hans de Goede + +[ Upstream commit b3ded6072c5600704cfa3ce3a8dc8718d34bda66 ] + +There are 2 issues with bq24296_set_otg_vbus(): + +1. When writing the OTG_CONFIG bit it uses POC_CHG_CONFIG_SHIFT which + should be POC_OTG_CONFIG_SHIFT. + +2. When turning the regulator off it never turns charging back on. Note + this must be done through bq24190_charger_set_charge_type(), to ensure + that the charge_type property value of none/trickle/fast is honored. + +Resolve both issues to fix BQ24296 Vbus regulator support not working. + +Fixes: b150a703b56f ("power: supply: bq24190_charger: Add support for BQ24296") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20241116203648.169100-2-hdegoede@redhat.com +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq24190_charger.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 2b393eb5c282..c47f32f152e6 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -567,6 +567,7 @@ static int bq24190_set_otg_vbus(struct bq24190_dev_info *bdi, bool enable) + + static int bq24296_set_otg_vbus(struct bq24190_dev_info *bdi, bool enable) + { ++ union power_supply_propval val = { .intval = bdi->charge_type }; + int ret; + + ret = pm_runtime_resume_and_get(bdi->dev); +@@ -587,13 +588,18 @@ static int bq24296_set_otg_vbus(struct bq24190_dev_info *bdi, bool enable) + + ret = bq24190_write_mask(bdi, BQ24190_REG_POC, + BQ24296_REG_POC_OTG_CONFIG_MASK, +- BQ24296_REG_POC_CHG_CONFIG_SHIFT, ++ BQ24296_REG_POC_OTG_CONFIG_SHIFT, + BQ24296_REG_POC_OTG_CONFIG_OTG); +- } else ++ } else { + ret = bq24190_write_mask(bdi, BQ24190_REG_POC, + BQ24296_REG_POC_OTG_CONFIG_MASK, +- BQ24296_REG_POC_CHG_CONFIG_SHIFT, ++ BQ24296_REG_POC_OTG_CONFIG_SHIFT, + BQ24296_REG_POC_OTG_CONFIG_DISABLE); ++ if (ret < 0) ++ goto out; ++ ++ ret = bq24190_charger_set_charge_type(bdi, &val); ++ } + + out: + pm_runtime_mark_last_busy(bdi->dev); +-- +2.39.5 + diff --git a/queue-6.12/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch b/queue-6.12/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch new file mode 100644 index 00000000000..cf48bc80732 --- /dev/null +++ b/queue-6.12/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch @@ -0,0 +1,155 @@ +From 89c14a1a96a40920ec900831a2c88d3af918fb9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 21:17:58 -0800 +Subject: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct + +From: Haren Myneni + +[ Upstream commit 05aa156e156ef3168e7ab8a68721945196495c17 ] + +The mapping VMA address is saved in VAS window struct when the +paste address is mapped. This VMA address is used during migration +to unmap the paste address if the window is active. The paste +address mapping will be removed when the window is closed or with +the munmap(). But the VMA address in the VAS window is not updated +with munmap() which is causing invalid access during migration. + +The KASAN report shows: +[16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8 +[16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928 + +[16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2 +[16386.255128] Tainted: [B]=BAD_PAGE +[16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries +[16386.255181] Call Trace: +[16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) +[16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764 +[16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8 +[16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0 +[16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8 +[16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc +[16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4 +... + +[16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: +[16386.256149] kasan_save_stack+0x34/0x68 +[16386.256163] kasan_save_track+0x34/0x80 +[16386.256175] kasan_save_alloc_info+0x58/0x74 +[16386.256196] __kasan_slab_alloc+0xb8/0xdc +[16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0 +[16386.256225] vm_area_alloc+0x44/0x150 +[16386.256245] mmap_region+0x214/0x10c4 +[16386.256265] do_mmap+0x5fc/0x750 +[16386.256277] vm_mmap_pgoff+0x14c/0x24c +[16386.256292] ksys_mmap_pgoff+0x20c/0x348 +[16386.256303] sys_mmap+0xd0/0x160 +... + +[16386.256350] Freed by task 0 on cpu 31 at 16386.204848s: +[16386.256363] kasan_save_stack+0x34/0x68 +[16386.256374] kasan_save_track+0x34/0x80 +[16386.256384] kasan_save_free_info+0x64/0x10c +[16386.256396] __kasan_slab_free+0x120/0x204 +[16386.256415] kmem_cache_free+0x128/0x450 +[16386.256428] vm_area_free_rcu_cb+0xa8/0xd8 +[16386.256441] rcu_do_batch+0x2c8/0xcf0 +[16386.256458] rcu_core+0x378/0x3c4 +[16386.256473] handle_softirqs+0x20c/0x60c +[16386.256495] do_softirq_own_stack+0x6c/0x88 +[16386.256509] do_softirq_own_stack+0x58/0x88 +[16386.256521] __irq_exit_rcu+0x1a4/0x20c +[16386.256533] irq_exit+0x20/0x38 +[16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c +... + +[16386.256717] Last potentially related work creation: +[16386.256729] kasan_save_stack+0x34/0x68 +[16386.256741] __kasan_record_aux_stack+0xcc/0x12c +[16386.256753] __call_rcu_common.constprop.0+0x94/0xd04 +[16386.256766] vm_area_free+0x28/0x3c +[16386.256778] remove_vma+0xf4/0x114 +[16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870 +[16386.256811] __vm_munmap+0xe0/0x1f8 +[16386.256821] sys_munmap+0x54/0x6c +[16386.256830] system_call_exception+0x1a0/0x4a0 +[16386.256841] system_call_vectored_common+0x15c/0x2ec + +[16386.256868] The buggy address belongs to the object at c00000014a819670 + which belongs to the cache vm_area_struct of size 168 +[16386.256887] The buggy address is located 0 bytes inside of + freed 168-byte region [c00000014a819670, c00000014a819718) + +[16386.256915] The buggy address belongs to the physical page: +[16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81 +[16386.256950] memcg:c0000000ba430001 +[16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff) +[16386.256975] page_type: 0xfdffffff(slab) +[16386.256990] raw: 043ffff800000000 c00000000501c080 0000000000000000 5deadbee00000001 +[16386.257003] raw: 0000000000000000 00000000011a011a 00000001fdffffff c0000000ba430001 +[16386.257018] page dumped because: kasan: bad access detected + +This patch adds close() callback in vas_vm_ops vm_operations_struct +which will be executed during munmap() before freeing VMA. The VMA +address in the VAS window is set to NULL after holding the window +mmap_mutex. + +Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler") +Signed-off-by: Haren Myneni +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241214051758.997759-1-haren@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/book3s/vas-api.c | 36 +++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c +index f381b177ea06..0b6365d85d11 100644 +--- a/arch/powerpc/platforms/book3s/vas-api.c ++++ b/arch/powerpc/platforms/book3s/vas-api.c +@@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf) + return VM_FAULT_SIGBUS; + } + ++/* ++ * During mmap() paste address, mapping VMA is saved in VAS window ++ * struct which is used to unmap during migration if the window is ++ * still open. But the user space can remove this mapping with ++ * munmap() before closing the window and the VMA address will ++ * be invalid. Set VAS window VMA to NULL in this function which ++ * is called before VMA free. ++ */ ++static void vas_mmap_close(struct vm_area_struct *vma) ++{ ++ struct file *fp = vma->vm_file; ++ struct coproc_instance *cp_inst = fp->private_data; ++ struct vas_window *txwin; ++ ++ /* Should not happen */ ++ if (!cp_inst || !cp_inst->txwin) { ++ pr_err("No attached VAS window for the paste address mmap\n"); ++ return; ++ } ++ ++ txwin = cp_inst->txwin; ++ /* ++ * task_ref.vma is set in coproc_mmap() during mmap paste ++ * address. So it has to be the same VMA that is getting freed. ++ */ ++ if (WARN_ON(txwin->task_ref.vma != vma)) { ++ pr_err("Invalid paste address mmaping\n"); ++ return; ++ } ++ ++ mutex_lock(&txwin->task_ref.mmap_mutex); ++ txwin->task_ref.vma = NULL; ++ mutex_unlock(&txwin->task_ref.mmap_mutex); ++} ++ + static const struct vm_operations_struct vas_vm_ops = { ++ .close = vas_mmap_close, + .fault = vas_mmap_fault, + }; + +-- +2.39.5 + diff --git a/queue-6.12/regmap-use-correct-format-specifier-for-logging-rang.patch b/queue-6.12/regmap-use-correct-format-specifier-for-logging-rang.patch new file mode 100644 index 00000000000..1bd8b687961 --- /dev/null +++ b/queue-6.12/regmap-use-correct-format-specifier-for-logging-rang.patch @@ -0,0 +1,43 @@ +From 0883a14096f65a6f0e949e470cdb478d73c21050 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:35:06 +0000 +Subject: regmap: Use correct format specifier for logging range errors + +From: Mark Brown + +[ Upstream commit 3f1aa0c533d9dd8a835caf9a6824449c463ee7e2 ] + +The register addresses are unsigned ints so we should use %u not %d to +log them. + +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20241127-regmap-test-high-addr-v1-1-74a48a9e0dc5@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index e3e2afc2c83c..5962ea1230a1 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1063,13 +1063,13 @@ struct regmap *__regmap_init(struct device *dev, + + /* Sanity check */ + if (range_cfg->range_max < range_cfg->range_min) { +- dev_err(map->dev, "Invalid range %d: %d < %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u < %u\n", i, + range_cfg->range_max, range_cfg->range_min); + goto err_range; + } + + if (range_cfg->range_max > map->max_register) { +- dev_err(map->dev, "Invalid range %d: %d > %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u > %u\n", i, + range_cfg->range_max, map->max_register); + goto err_range; + } +-- +2.39.5 + diff --git a/queue-6.12/revert-watchdog-s3c2410_wdt-use-exynos_get_pmu_regma.patch b/queue-6.12/revert-watchdog-s3c2410_wdt-use-exynos_get_pmu_regma.patch new file mode 100644 index 00000000000..26b93e37d36 --- /dev/null +++ b/queue-6.12/revert-watchdog-s3c2410_wdt-use-exynos_get_pmu_regma.patch @@ -0,0 +1,73 @@ +From 5cd8f7caa08c5352cae1a94438ae513f3bdfaca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2024 19:11:31 +0000 +Subject: Revert "watchdog: s3c2410_wdt: use exynos_get_pmu_regmap_by_phandle() + for PMU regs" + +From: Peter Griffin + +[ Upstream commit ccfb765944bb66813398958983cb8141e2624a6b ] + +This reverts commit 746f0770f916e6c48e422d6a34e67eae16707f0e. + +Now that we can register a SoC specific regmap with syscon using +of_syscon_register_regmap() api we can switch back to using +syscon_regmap_lookup_by_phandle() in the client drivers. + +Signed-off-by: Peter Griffin +Reviewed-by: Sam Protsenko +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241029191131.2329414-1-peter.griffin@linaro.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 1 + + drivers/watchdog/s3c2410_wdt.c | 8 ++++---- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index 94c96bcfefe3..0b59c669c26d 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -549,6 +549,7 @@ config S3C2410_WATCHDOG + tristate "S3C6410/S5Pv210/Exynos Watchdog" + depends on ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST + select WATCHDOG_CORE ++ select MFD_SYSCON if ARCH_EXYNOS + help + Watchdog timer block in the Samsung S3C64xx, S5Pv210 and Exynos + SoCs. This will reboot the system when the timer expires with +diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c +index 686cf544d0ae..349d30462c8c 100644 +--- a/drivers/watchdog/s3c2410_wdt.c ++++ b/drivers/watchdog/s3c2410_wdt.c +@@ -24,9 +24,9 @@ + #include + #include + #include ++#include + #include + #include +-#include + + #define S3C2410_WTCON 0x00 + #define S3C2410_WTDAT 0x04 +@@ -699,11 +699,11 @@ static int s3c2410wdt_probe(struct platform_device *pdev) + return ret; + + if (wdt->drv_data->quirks & QUIRKS_HAVE_PMUREG) { +- wdt->pmureg = exynos_get_pmu_regmap_by_phandle(dev->of_node, +- "samsung,syscon-phandle"); ++ wdt->pmureg = syscon_regmap_lookup_by_phandle(dev->of_node, ++ "samsung,syscon-phandle"); + if (IS_ERR(wdt->pmureg)) + return dev_err_probe(dev, PTR_ERR(wdt->pmureg), +- "PMU regmap lookup failed.\n"); ++ "syscon regmap lookup failed.\n"); + } + + wdt_irq = platform_get_irq(pdev, 0); +-- +2.39.5 + diff --git a/queue-6.12/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch b/queue-6.12/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch new file mode 100644 index 00000000000..3412cf49aaf --- /dev/null +++ b/queue-6.12/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch @@ -0,0 +1,48 @@ +From 7dcfc56f24a8ce4c53a8fd12ea03b67b6e357f82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2024 19:48:33 +0200 +Subject: scsi: megaraid_sas: Fix for a potential deadlock + +From: Tomas Henzl + +[ Upstream commit 50740f4dc78b41dec7c8e39772619d5ba841ddd7 ] + +This fixes a 'possible circular locking dependency detected' warning + CPU0 CPU1 + ---- ---- + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + +Fix this by temporarily releasing the reset_mutex. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20240923174833.45345-1-thenzl@redhat.com +Acked-by: Chandrakanth Patil +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 8e75e2e279a4..50f1dcb6d584 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -8907,8 +8907,11 @@ megasas_aen_polling(struct work_struct *work) + (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), + (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL), + 0); +- if (sdev1) ++ if (sdev1) { ++ mutex_unlock(&instance->reset_mutex); + megasas_remove_scsi_device(sdev1); ++ mutex_lock(&instance->reset_mutex); ++ } + + event_type = SCAN_VD_CHANNEL; + break; +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpi3mr-fix-corrupt-config-pages-phy-state-is-sw.patch b/queue-6.12/scsi-mpi3mr-fix-corrupt-config-pages-phy-state-is-sw.patch new file mode 100644 index 00000000000..8f9667c4ed6 --- /dev/null +++ b/queue-6.12/scsi-mpi3mr-fix-corrupt-config-pages-phy-state-is-sw.patch @@ -0,0 +1,184 @@ +From 797f24791d75059078b0f7eaae02b8047660586d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 01:14:02 +0530 +Subject: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs + +From: Ranjan Kumar + +[ Upstream commit 711201a8b8334a397440ac0b859df0054e174bc9 ] + +The driver, through the SAS transport, exposes a sysfs interface to +enable/disable PHYs in a controller/expander setup. When multiple PHYs +are disabled and enabled in rapid succession, the persistent and current +config pages related to SAS IO unit/SAS Expander pages could get +corrupted. + +Use separate memory for each config request. + +Signed-off-by: Prayas Patel +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110194405.10108-3-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr.h | 9 ---- + drivers/scsi/mpi3mr/mpi3mr_fw.c | 81 ++++++--------------------------- + 2 files changed, 13 insertions(+), 77 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h +index 81bb408ce56d..1e715fd65a7d 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr.h ++++ b/drivers/scsi/mpi3mr/mpi3mr.h +@@ -134,8 +134,6 @@ extern atomic64_t event_counter; + + #define MPI3MR_WATCHDOG_INTERVAL 1000 /* in milli seconds */ + +-#define MPI3MR_DEFAULT_CFG_PAGE_SZ 1024 /* in bytes */ +- + #define MPI3MR_RESET_TOPOLOGY_SETTLE_TIME 10 + + #define MPI3MR_SCMD_TIMEOUT (60 * HZ) +@@ -1133,9 +1131,6 @@ struct scmd_priv { + * @io_throttle_low: I/O size to stop throttle in 512b blocks + * @num_io_throttle_group: Maximum number of throttle groups + * @throttle_groups: Pointer to throttle group info structures +- * @cfg_page: Default memory for configuration pages +- * @cfg_page_dma: Configuration page DMA address +- * @cfg_page_sz: Default configuration page memory size + * @sas_transport_enabled: SAS transport enabled or not + * @scsi_device_channel: Channel ID for SCSI devices + * @transport_cmds: Command tracker for SAS transport commands +@@ -1332,10 +1327,6 @@ struct mpi3mr_ioc { + u16 num_io_throttle_group; + struct mpi3mr_throttle_group_info *throttle_groups; + +- void *cfg_page; +- dma_addr_t cfg_page_dma; +- u16 cfg_page_sz; +- + u8 sas_transport_enabled; + u8 scsi_device_channel; + struct mpi3mr_drv_cmd transport_cmds; +diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c +index f1ab76351bd8..2e6245bd4282 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -4186,17 +4186,6 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc) + mpi3mr_read_tsu_interval(mrioc); + mpi3mr_print_ioc_info(mrioc); + +- if (!mrioc->cfg_page) { +- dprint_init(mrioc, "allocating config page buffers\n"); +- mrioc->cfg_page_sz = MPI3MR_DEFAULT_CFG_PAGE_SZ; +- mrioc->cfg_page = dma_alloc_coherent(&mrioc->pdev->dev, +- mrioc->cfg_page_sz, &mrioc->cfg_page_dma, GFP_KERNEL); +- if (!mrioc->cfg_page) { +- retval = -1; +- goto out_failed_noretry; +- } +- } +- + dprint_init(mrioc, "allocating host diag buffers\n"); + mpi3mr_alloc_diag_bufs(mrioc); + +@@ -4768,11 +4757,7 @@ void mpi3mr_free_mem(struct mpi3mr_ioc *mrioc) + mrioc->admin_req_base, mrioc->admin_req_dma); + mrioc->admin_req_base = NULL; + } +- if (mrioc->cfg_page) { +- dma_free_coherent(&mrioc->pdev->dev, mrioc->cfg_page_sz, +- mrioc->cfg_page, mrioc->cfg_page_dma); +- mrioc->cfg_page = NULL; +- } ++ + if (mrioc->pel_seqnum_virt) { + dma_free_coherent(&mrioc->pdev->dev, mrioc->pel_seqnum_sz, + mrioc->pel_seqnum_virt, mrioc->pel_seqnum_dma); +@@ -5392,55 +5377,6 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc, + return retval; + } + +- +-/** +- * mpi3mr_free_config_dma_memory - free memory for config page +- * @mrioc: Adapter instance reference +- * @mem_desc: memory descriptor structure +- * +- * Check whether the size of the buffer specified by the memory +- * descriptor is greater than the default page size if so then +- * free the memory pointed by the descriptor. +- * +- * Return: Nothing. +- */ +-static void mpi3mr_free_config_dma_memory(struct mpi3mr_ioc *mrioc, +- struct dma_memory_desc *mem_desc) +-{ +- if ((mem_desc->size > mrioc->cfg_page_sz) && mem_desc->addr) { +- dma_free_coherent(&mrioc->pdev->dev, mem_desc->size, +- mem_desc->addr, mem_desc->dma_addr); +- mem_desc->addr = NULL; +- } +-} +- +-/** +- * mpi3mr_alloc_config_dma_memory - Alloc memory for config page +- * @mrioc: Adapter instance reference +- * @mem_desc: Memory descriptor to hold dma memory info +- * +- * This function allocates new dmaable memory or provides the +- * default config page dmaable memory based on the memory size +- * described by the descriptor. +- * +- * Return: 0 on success, non-zero on failure. +- */ +-static int mpi3mr_alloc_config_dma_memory(struct mpi3mr_ioc *mrioc, +- struct dma_memory_desc *mem_desc) +-{ +- if (mem_desc->size > mrioc->cfg_page_sz) { +- mem_desc->addr = dma_alloc_coherent(&mrioc->pdev->dev, +- mem_desc->size, &mem_desc->dma_addr, GFP_KERNEL); +- if (!mem_desc->addr) +- return -ENOMEM; +- } else { +- mem_desc->addr = mrioc->cfg_page; +- mem_desc->dma_addr = mrioc->cfg_page_dma; +- memset(mem_desc->addr, 0, mrioc->cfg_page_sz); +- } +- return 0; +-} +- + /** + * mpi3mr_post_cfg_req - Issue config requests and wait + * @mrioc: Adapter instance reference +@@ -5596,8 +5532,12 @@ static int mpi3mr_process_cfg_req(struct mpi3mr_ioc *mrioc, + cfg_req->page_length = cfg_hdr->page_length; + cfg_req->page_version = cfg_hdr->page_version; + } +- if (mpi3mr_alloc_config_dma_memory(mrioc, &mem_desc)) +- goto out; ++ ++ mem_desc.addr = dma_alloc_coherent(&mrioc->pdev->dev, ++ mem_desc.size, &mem_desc.dma_addr, GFP_KERNEL); ++ ++ if (!mem_desc.addr) ++ return retval; + + mpi3mr_add_sg_single(&cfg_req->sgl, sgl_flags, mem_desc.size, + mem_desc.dma_addr); +@@ -5626,7 +5566,12 @@ static int mpi3mr_process_cfg_req(struct mpi3mr_ioc *mrioc, + } + + out: +- mpi3mr_free_config_dma_memory(mrioc, &mem_desc); ++ if (mem_desc.addr) { ++ dma_free_coherent(&mrioc->pdev->dev, mem_desc.size, ++ mem_desc.addr, mem_desc.dma_addr); ++ mem_desc.addr = NULL; ++ } ++ + return retval; + } + +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpi3mr-handling-of-fault-code-for-insufficient-.patch b/queue-6.12/scsi-mpi3mr-handling-of-fault-code-for-insufficient-.patch new file mode 100644 index 00000000000..527ff73bcd0 --- /dev/null +++ b/queue-6.12/scsi-mpi3mr-handling-of-fault-code-for-insufficient-.patch @@ -0,0 +1,91 @@ +From ec94e8571f4feee2c14c192bca273c8f35c5007b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 01:14:04 +0530 +Subject: scsi: mpi3mr: Handling of fault code for insufficient power + +From: Ranjan Kumar + +[ Upstream commit fb6eb98f3965e2ee92cbcb466051d2f2acf552d1 ] + +Before retrying initialization, check and abort if the fault code +indicates insufficient power. Also mark the controller as unrecoverable +instead of issuing reset in the watch dog timer if the fault code +indicates insufficient power. + +Signed-off-by: Prayas Patel +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110194405.10108-5-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_fw.c | 40 +++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c +index 2e6245bd4282..5ed31fe57474 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c +@@ -1035,6 +1035,36 @@ static const char *mpi3mr_reset_type_name(u16 reset_type) + return name; + } + ++/** ++ * mpi3mr_is_fault_recoverable - Read fault code and decide ++ * whether the controller can be recoverable ++ * @mrioc: Adapter instance reference ++ * Return: true if fault is recoverable, false otherwise. ++ */ ++static inline bool mpi3mr_is_fault_recoverable(struct mpi3mr_ioc *mrioc) ++{ ++ u32 fault; ++ ++ fault = (readl(&mrioc->sysif_regs->fault) & ++ MPI3_SYSIF_FAULT_CODE_MASK); ++ ++ switch (fault) { ++ case MPI3_SYSIF_FAULT_CODE_COMPLETE_RESET_NEEDED: ++ case MPI3_SYSIF_FAULT_CODE_POWER_CYCLE_REQUIRED: ++ ioc_warn(mrioc, ++ "controller requires system power cycle, marking controller as unrecoverable\n"); ++ return false; ++ case MPI3_SYSIF_FAULT_CODE_INSUFFICIENT_PCI_SLOT_POWER: ++ ioc_warn(mrioc, ++ "controller faulted due to insufficient power,\n" ++ " try by connecting it to a different slot\n"); ++ return false; ++ default: ++ break; ++ } ++ return true; ++} ++ + /** + * mpi3mr_print_fault_info - Display fault information + * @mrioc: Adapter instance reference +@@ -1373,6 +1403,11 @@ static int mpi3mr_bring_ioc_ready(struct mpi3mr_ioc *mrioc) + ioc_info(mrioc, "ioc_status(0x%08x), ioc_config(0x%08x), ioc_info(0x%016llx) at the bringup\n", + ioc_status, ioc_config, base_info); + ++ if (!mpi3mr_is_fault_recoverable(mrioc)) { ++ mrioc->unrecoverable = 1; ++ goto out_device_not_present; ++ } ++ + /*The timeout value is in 2sec unit, changing it to seconds*/ + mrioc->ready_timeout = + ((base_info & MPI3_SYSIF_IOC_INFO_LOW_TIMEOUT_MASK) >> +@@ -2734,6 +2769,11 @@ static void mpi3mr_watchdog_work(struct work_struct *work) + mpi3mr_print_fault_info(mrioc); + mrioc->diagsave_timeout = 0; + ++ if (!mpi3mr_is_fault_recoverable(mrioc)) { ++ mrioc->unrecoverable = 1; ++ goto schedule_work; ++ } ++ + switch (trigger_data.fault) { + case MPI3_SYSIF_FAULT_CODE_COMPLETE_RESET_NEEDED: + case MPI3_SYSIF_FAULT_CODE_POWER_CYCLE_REQUIRED: +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpi3mr-start-controller-indexing-from-0.patch b/queue-6.12/scsi-mpi3mr-start-controller-indexing-from-0.patch new file mode 100644 index 00000000000..8b999c93040 --- /dev/null +++ b/queue-6.12/scsi-mpi3mr-start-controller-indexing-from-0.patch @@ -0,0 +1,37 @@ +From d8febd18e9c62bf2de5556c0e07498967a966908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 01:14:03 +0530 +Subject: scsi: mpi3mr: Start controller indexing from 0 + +From: Ranjan Kumar + +[ Upstream commit 0d32014f1e3e7a7adf1583c45387f26b9bb3a49d ] + +Instead of displaying the controller index starting from '1' make the +driver display the controller index starting from '0'. + +Signed-off-by: Sumit Saxena +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110194405.10108-4-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c +index 5f2f67acf8bf..1bef88130d0c 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_os.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c +@@ -5215,7 +5215,7 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) + } + + mrioc = shost_priv(shost); +- retval = ida_alloc_range(&mrioc_ida, 1, U8_MAX, GFP_KERNEL); ++ retval = ida_alloc_range(&mrioc_ida, 0, U8_MAX, GFP_KERNEL); + if (retval < 0) + goto id_alloc_failed; + mrioc->id = (u8)retval; +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpi3mr-synchronize-access-to-ioctl-data-buffer.patch b/queue-6.12/scsi-mpi3mr-synchronize-access-to-ioctl-data-buffer.patch new file mode 100644 index 00000000000..1ed1edd9067 --- /dev/null +++ b/queue-6.12/scsi-mpi3mr-synchronize-access-to-ioctl-data-buffer.patch @@ -0,0 +1,175 @@ +From cc99a4a81db0070d10117d37f6c6f9209c16669a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 01:14:01 +0530 +Subject: scsi: mpi3mr: Synchronize access to ioctl data buffer + +From: Ranjan Kumar + +[ Upstream commit 367ac16e5ff2dcd6b7f00a8f94e6ba98875cb397 ] + +The driver serializes ioctls through a mutex lock but access to the +ioctl data buffer is not guarded by the mutex. This results in multiple +user threads being able to write to the driver's ioctl buffer +simultaneously. + +Protect the ioctl buffer with the ioctl mutex. + +Signed-off-by: Sumit Saxena +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110194405.10108-2-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_app.c | 36 ++++++++++++++++++++++---------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c +index 01f035f9330e..10b8e4dc64f8 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_app.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_app.c +@@ -2329,6 +2329,15 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + if (!mrioc) + return -ENODEV; + ++ if (mutex_lock_interruptible(&mrioc->bsg_cmds.mutex)) ++ return -ERESTARTSYS; ++ ++ if (mrioc->bsg_cmds.state & MPI3MR_CMD_PENDING) { ++ dprint_bsg_err(mrioc, "%s: command is in use\n", __func__); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); ++ return -EAGAIN; ++ } ++ + if (!mrioc->ioctl_sges_allocated) { + dprint_bsg_err(mrioc, "%s: DMA memory was not allocated\n", + __func__); +@@ -2339,13 +2348,16 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + karg->timeout = MPI3MR_APP_DEFAULT_TIMEOUT; + + mpi_req = kzalloc(MPI3MR_ADMIN_REQ_FRAME_SZ, GFP_KERNEL); +- if (!mpi_req) ++ if (!mpi_req) { ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + return -ENOMEM; ++ } + mpi_header = (struct mpi3_request_header *)mpi_req; + + bufcnt = karg->buf_entry_list.num_of_entries; + drv_bufs = kzalloc((sizeof(*drv_bufs) * bufcnt), GFP_KERNEL); + if (!drv_bufs) { ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -ENOMEM; + goto out; + } +@@ -2353,6 +2365,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + dout_buf = kzalloc(job->request_payload.payload_len, + GFP_KERNEL); + if (!dout_buf) { ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -ENOMEM; + goto out; + } +@@ -2360,6 +2373,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + din_buf = kzalloc(job->reply_payload.payload_len, + GFP_KERNEL); + if (!din_buf) { ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -ENOMEM; + goto out; + } +@@ -2435,6 +2449,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + (mpi_msg_size > MPI3MR_ADMIN_REQ_FRAME_SZ)) { + dprint_bsg_err(mrioc, "%s: invalid MPI message size\n", + __func__); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2447,6 +2462,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + if (invalid_be) { + dprint_bsg_err(mrioc, "%s: invalid buffer entries passed\n", + __func__); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2454,12 +2470,14 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + if (sgl_dout_iter > (dout_buf + job->request_payload.payload_len)) { + dprint_bsg_err(mrioc, "%s: data_out buffer length mismatch\n", + __func__); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } + if (sgl_din_iter > (din_buf + job->reply_payload.payload_len)) { + dprint_bsg_err(mrioc, "%s: data_in buffer length mismatch\n", + __func__); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2472,6 +2490,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + dprint_bsg_err(mrioc, "%s:%d: invalid data transfer size passed for function 0x%x din_size = %d, dout_size = %d\n", + __func__, __LINE__, mpi_header->function, din_size, + dout_size); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2480,6 +2499,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + dprint_bsg_err(mrioc, + "%s:%d: invalid data transfer size passed for function 0x%x din_size=%d\n", + __func__, __LINE__, mpi_header->function, din_size); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2487,6 +2507,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + dprint_bsg_err(mrioc, + "%s:%d: invalid data transfer size passed for function 0x%x dout_size = %d\n", + __func__, __LINE__, mpi_header->function, dout_size); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2497,6 +2518,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + dprint_bsg_err(mrioc, "%s:%d: invalid message size passed:%d:%d:%d:%d\n", + __func__, __LINE__, din_cnt, dout_cnt, din_size, + dout_size); ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + rval = -EINVAL; + goto out; + } +@@ -2544,6 +2566,7 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + continue; + if (mpi3mr_map_data_buffer_dma(mrioc, drv_buf_iter, desc_count)) { + rval = -ENOMEM; ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + dprint_bsg_err(mrioc, "%s:%d: mapping data buffers failed\n", + __func__, __LINE__); + goto out; +@@ -2556,20 +2579,11 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job) + sense_buff_k = kzalloc(erbsz, GFP_KERNEL); + if (!sense_buff_k) { + rval = -ENOMEM; ++ mutex_unlock(&mrioc->bsg_cmds.mutex); + goto out; + } + } + +- if (mutex_lock_interruptible(&mrioc->bsg_cmds.mutex)) { +- rval = -ERESTARTSYS; +- goto out; +- } +- if (mrioc->bsg_cmds.state & MPI3MR_CMD_PENDING) { +- rval = -EAGAIN; +- dprint_bsg_err(mrioc, "%s: command is in use\n", __func__); +- mutex_unlock(&mrioc->bsg_cmds.mutex); +- goto out; +- } + if (mrioc->unrecoverable) { + dprint_bsg_err(mrioc, "%s: unrecoverable controller\n", + __func__); +-- +2.39.5 + diff --git a/queue-6.12/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch b/queue-6.12/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch new file mode 100644 index 00000000000..80e422afa1a --- /dev/null +++ b/queue-6.12/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch @@ -0,0 +1,53 @@ +From b02bb1fe89fff454e62e6c7ad3168406e8860073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2024 23:03:40 +0530 +Subject: scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during + driver load time + +From: Ranjan Kumar + +[ Upstream commit 3f5eb062e8aa335643181c480e6c590c6cedfd22 ] + +Issue a Diag-Reset when the "Doorbell-In-Use" bit is set during the +driver load/initialization. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110173341.11595-2-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index ed5046593fda..16ac2267c71e 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7041,11 +7041,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + int i; + u8 failed; + __le32 *mfp; ++ int ret_val; + + /* make sure doorbell is not in use */ + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); +- return -EFAULT; ++ goto doorbell_diag_reset; + } + + /* clear pending doorbell interrupts from previous state changes */ +@@ -7135,6 +7136,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + le32_to_cpu(mfp[i])); + } + return 0; ++ ++doorbell_diag_reset: ++ ret_val = _base_diag_reset(ioc); ++ return ret_val; + } + + /** +-- +2.39.5 + diff --git a/queue-6.12/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch b/queue-6.12/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch new file mode 100644 index 00000000000..1d1994ee709 --- /dev/null +++ b/queue-6.12/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch @@ -0,0 +1,49 @@ +From 9be7a65dcc5e3de6a7c78ad0956fc251d9848afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 23:51:49 +0100 +Subject: scsi: qla1280: Fix hw revision numbering for ISP1020/1040 + +From: Magnus Lindholm + +[ Upstream commit c064de86d2a3909222d5996c5047f64c7a8f791b ] + +Fix the hardware revision numbering for Qlogic ISP1020/1040 boards. HWMASK +suggests that the revision number only needs four bits, this is consistent +with how NetBSD does things in their ISP driver. Verified on a IPS1040B +which is seen as rev 5 not as BIT_4. + +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20241113225636.2276-1-linmag7@gmail.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla1280.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h +index d309e2ca14de..dea2290b37d4 100644 +--- a/drivers/scsi/qla1280.h ++++ b/drivers/scsi/qla1280.h +@@ -116,12 +116,12 @@ struct device_reg { + uint16_t id_h; /* ID high */ + uint16_t cfg_0; /* Configuration 0 */ + #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */ +-#define ISP_CFG0_1020 BIT_0 /* ISP1020 */ +-#define ISP_CFG0_1020A BIT_1 /* ISP1020A */ +-#define ISP_CFG0_1040 BIT_2 /* ISP1040 */ +-#define ISP_CFG0_1040A BIT_3 /* ISP1040A */ +-#define ISP_CFG0_1040B BIT_4 /* ISP1040B */ +-#define ISP_CFG0_1040C BIT_5 /* ISP1040C */ ++#define ISP_CFG0_1020 1 /* ISP1020 */ ++#define ISP_CFG0_1020A 2 /* ISP1020A */ ++#define ISP_CFG0_1040 3 /* ISP1040 */ ++#define ISP_CFG0_1040A 4 /* ISP1040A */ ++#define ISP_CFG0_1040B 5 /* ISP1040B */ ++#define ISP_CFG0_1040C 6 /* ISP1040C */ + uint16_t cfg_1; /* Configuration 1 */ + #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */ + #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */ +-- +2.39.5 + diff --git a/queue-6.12/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch b/queue-6.12/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch new file mode 100644 index 00000000000..064eed41a1d --- /dev/null +++ b/queue-6.12/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch @@ -0,0 +1,72 @@ +From f7ba92511d2dd52bd8cff34793490ff955cdd2b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:13:24 -0500 +Subject: scsi: storvsc: Do not flag MAINTENANCE_IN return of + SRB_STATUS_DATA_OVERRUN as an error + +From: Cathy Avery + +[ Upstream commit b1aee7f034615b6824d2c70ddb37ef9fc23493b7 ] + +This partially reverts commit 812fe6420a6e ("scsi: storvsc: Handle +additional SRB status values"). + +HyperV does not support MAINTENANCE_IN resulting in FC passthrough +returning the SRB_STATUS_DATA_OVERRUN value. Now that +SRB_STATUS_DATA_OVERRUN is treated as an error, multipath ALUA paths go +into a faulty state as multipath ALUA submits RTPG commands via +MAINTENANCE_IN. + +[ 3.215560] hv_storvsc 1d69d403-9692-4460-89f9-a8cbcc0f94f3: +tag#230 cmd 0xa3 status: scsi 0x0 srb 0x12 hv 0xc0000001 +[ 3.215572] scsi 1:0:0:32: alua: rtpg failed, result 458752 + +Make MAINTENANCE_IN return success to avoid the error path as is +currently done with INQUIRY and MODE_SENSE. + +Suggested-by: Michael Kelley +Signed-off-by: Cathy Avery +Link: https://lore.kernel.org/r/20241127181324.3318443-1-cavery@redhat.com +Reviewed-by: Michael Kelley +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 7ceb982040a5..d0b55c1fa908 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -149,6 +149,8 @@ struct hv_fc_wwn_packet { + */ + static int vmstor_proto_version; + ++static bool hv_dev_is_fc(struct hv_device *hv_dev); ++ + #define STORVSC_LOGGING_NONE 0 + #define STORVSC_LOGGING_ERROR 1 + #define STORVSC_LOGGING_WARN 2 +@@ -1138,6 +1140,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + * not correctly handle: + * INQUIRY command with page code parameter set to 0x80 + * MODE_SENSE command with cmd[2] == 0x1c ++ * MAINTENANCE_IN is not supported by HyperV FC passthrough + * + * Setup srb and scsi status so this won't be fatal. + * We do this so we can distinguish truly fatal failues +@@ -1145,7 +1148,9 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + */ + + if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || +- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) { ++ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || ++ (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && ++ hv_dev_is_fc(device))) { + vstor_packet->vm_srb.scsi_status = 0; + vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; + } +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index d7a37363b16..eb3d61aa22b 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -39,3 +39,39 @@ asoc-amd-ps-fix-for-enabling-dmic-on-acp63-platform-via-_dsd-entry.patch asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-21qa-and-21qb.patch asoc-dt-bindings-realtek-rt5645-fix-cpvdd-voltage-comment.patch asoc-intel-sof_sdw-fix-dmi-match-for-lenovo-21q6-and-21q7.patch +powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch +power-supply-bq24190-fix-bq24296-vbus-regulator-supp.patch +stddef-make-__struct_group-uapi-c-friendly.patch +tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch +watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch +watchdog-rzg2l_wdt-power-on-the-watchdog-domain-in-t.patch +revert-watchdog-s3c2410_wdt-use-exynos_get_pmu_regma.patch +watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch +watchdog-s3c2410_wdt-add-support-for-exynosautov920-.patch +scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch +scsi-megaraid_sas-fix-for-a-potential-deadlock.patch +udf-skip-parent-dir-link-count-update-if-corrupted.patch +udf-verify-inode-link-counts-before-performing-renam.patch +alsa-ump-don-t-open-legacy-substream-for-an-inactive.patch +alsa-ump-indicate-the-inactive-group-in-legacy-subst.patch +alsa-ump-update-legacy-substream-names-upon-fb-info-.patch +alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch +alsa-sh-use-standard-helper-for-buffer-accesses.patch +smb-server-fix-building-with-gcc-15.patch +regmap-use-correct-format-specifier-for-logging-rang.patch +loongarch-fix-reserving-screen-info-memory-for-above.patch +loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch +platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch +bpf-zero-index-arg-error-string-for-dynptr-and-iter.patch +spi-intel-add-panther-lake-spi-controller-support.patch +scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch +scsi-mpi3mr-synchronize-access-to-ioctl-data-buffer.patch +scsi-mpi3mr-fix-corrupt-config-pages-phy-state-is-sw.patch +scsi-mpi3mr-start-controller-indexing-from-0.patch +scsi-mpi3mr-handling-of-fault-code-for-insufficient-.patch +scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch +acpi-iort-add-pmcg-platform-information-for-hisilico.patch +spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch +drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch +virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch +blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch diff --git a/queue-6.12/smb-server-fix-building-with-gcc-15.patch b/queue-6.12/smb-server-fix-building-with-gcc-15.patch new file mode 100644 index 00000000000..519aac68ded --- /dev/null +++ b/queue-6.12/smb-server-fix-building-with-gcc-15.patch @@ -0,0 +1,47 @@ +From 16dfa6a19c9c325b65e9334b9b72dd18addbae7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 11:41:35 +0530 +Subject: smb: server: Fix building with GCC 15 + +From: Brahmajit Das + +[ Upstream commit e18655cf35a5958fbf4ae9ca3ebf28871a3a1801 ] + +GCC 15 introduces -Werror=unterminated-string-initialization by default, +this results in the following build error + +fs/smb/server/smb_common.c:21:35: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-ini +tialization] + 21 | static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +To this we are replacing char basechars[43] with a character pointer +and then using strlen to get the length. + +Signed-off-by: Brahmajit Das +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 75b4eb856d32..af8e24163bf2 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -18,8 +18,8 @@ + #include "mgmt/share_config.h" + + /*for shortname implementation */ +-static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; +-#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1) ++static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; ++#define MANGLE_BASE (strlen(basechars) - 1) + #define MAGIC_CHAR '~' + #define PERIOD '.' + #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE])) +-- +2.39.5 + diff --git a/queue-6.12/spi-intel-add-panther-lake-spi-controller-support.patch b/queue-6.12/spi-intel-add-panther-lake-spi-controller-support.patch new file mode 100644 index 00000000000..924cd2502cc --- /dev/null +++ b/queue-6.12/spi-intel-add-panther-lake-spi-controller-support.patch @@ -0,0 +1,40 @@ +From 6a1845679f4cc195724db378e0a58a9b12605078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 10:02:08 +0200 +Subject: spi: intel: Add Panther Lake SPI controller support + +From: Aapo Vienamo + +[ Upstream commit ceb259e43bf572ba7d766e1679ba73861d16203a ] + +The Panther Lake SPI controllers are compatible with the Cannon Lake +controllers. Add support for following SPI controller device IDs: + - H-series: 0xe323 + - P-series: 0xe423 + - U-series: 0xe423 + +Signed-off-by: Aapo Vienamo +Signed-off-by: Mika Westerberg +Link: https://patch.msgid.link/20241204080208.1036537-1-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index 4337ca51d7aa..5c0dec90eec1 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -86,6 +86,8 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info }, + { }, + }; + MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); +-- +2.39.5 + diff --git a/queue-6.12/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch b/queue-6.12/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch new file mode 100644 index 00000000000..9a252974b1f --- /dev/null +++ b/queue-6.12/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch @@ -0,0 +1,46 @@ +From af6c63c3b41aae949e2c40770c01f1a2ef59f7e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 12:34:26 +0530 +Subject: spi: omap2-mcspi: Fix the IS_ERR() bug for + devm_clk_get_optional_enabled() + +From: Purushothama Siddaiah + +[ Upstream commit 4c6ac5446d060f0bf435ccc8bc3aa7b7b5f718ad ] + +The devm_clk_get_optional_enabled() function returns error +pointers(PTR_ERR()). So use IS_ERR() to check it. + +Verified on K3-J7200 EVM board, without clock node mentioned +in the device tree. + +Signed-off-by: Purushothama Siddaiah +Reviewed-by: Corey Minyard +Link: https://patch.msgid.link/20241205070426.1861048-1-psiddaiah@mvista.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 2c043817c66a..4a2f84c4d22e 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1561,10 +1561,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + } + + mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL); +- if (mcspi->ref_clk) +- mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); +- else ++ if (IS_ERR(mcspi->ref_clk)) + mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; ++ else ++ mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); + ctlr->max_speed_hz = mcspi->ref_clk_hz; + ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15; + +-- +2.39.5 + diff --git a/queue-6.12/stddef-make-__struct_group-uapi-c-friendly.patch b/queue-6.12/stddef-make-__struct_group-uapi-c-friendly.patch new file mode 100644 index 00000000000..c93ff369e40 --- /dev/null +++ b/queue-6.12/stddef-make-__struct_group-uapi-c-friendly.patch @@ -0,0 +1,116 @@ +From f9af3c812b5e7f1a56833a3e8dc0ba799b179a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 14:57:34 +0100 +Subject: stddef: make __struct_group() UAPI C++-friendly + +From: Alexander Lobakin + +[ Upstream commit 724c6ce38bbaeb4b3f109b0e066d6c0ecd15446c ] + +For the most part of the C++ history, it couldn't have type +declarations inside anonymous unions for different reasons. At the +same time, __struct_group() relies on the latters, so when the @TAG +argument is not empty, C++ code doesn't want to build (even under +`extern "C"`): + +../linux/include/uapi/linux/pkt_cls.h:25:24: error: +'struct tc_u32_sel::::tc_u32_sel_hdr,' invalid; +an anonymous union may only have public non-static data members +[-fpermissive] + +The safest way to fix this without trying to switch standards (which +is impossible in UAPI anyway) etc., is to disable tag declaration +for that language. This won't break anything since for now it's not +buildable at all. +Use a separate definition for __struct_group() when __cplusplus is +defined to mitigate the error, including the version from tools/. + +Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro") +Reported-by: Christopher Ferris +Closes: https://lore.kernel.org/linux-hardening/Z1HZpe3WE5As8UAz@google.com +Suggested-by: Kees Cook # __struct_group_tag() +Signed-off-by: Alexander Lobakin +Reviewed-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/20241219135734.2130002-1-aleksander.lobakin@intel.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/uapi/linux/stddef.h | 13 ++++++++++--- + tools/include/uapi/linux/stddef.h | 15 +++++++++++---- + 2 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h +index 58154117d9b0..a6fce46aeb37 100644 +--- a/include/uapi/linux/stddef.h ++++ b/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline inline + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,13 +27,13 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ + } ATTRS + + #ifdef __cplusplus +diff --git a/tools/include/uapi/linux/stddef.h b/tools/include/uapi/linux/stddef.h +index bb6ea517efb5..c53cde425406 100644 +--- a/tools/include/uapi/linux/stddef.h ++++ b/tools/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline __inline__ + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,14 +27,14 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ +- } ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ ++ } ATTRS + + /** + * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union +-- +2.39.5 + diff --git a/queue-6.12/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch b/queue-6.12/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch new file mode 100644 index 00000000000..270e0f6bcde --- /dev/null +++ b/queue-6.12/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch @@ -0,0 +1,41 @@ +From 01209172aaed8cafaca5caca153f1139a04bdbf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 09:10:55 +0900 +Subject: tracing/kprobe: Make trace_kprobe's module callback called after + jump_label update + +From: Masami Hiramatsu (Google) + +[ Upstream commit d685d55dfc86b1a4bdcec77c3c1f8a83f181264e ] + +Make sure the trace_kprobe's module notifer callback function is called +after jump_label's callback is called. Since the trace_kprobe's callback +eventually checks jump_label address during registering new kprobe on +the loading module, jump_label must be updated before this registration +happens. + +Link: https://lore.kernel.org/all/173387585556.995044.3157941002975446119.stgit@devnote2/ + +Fixes: 614243181050 ("tracing/kprobes: Support module init function probing") +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 263fac44d3ca..935a886af40c 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -725,7 +725,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb, + + static struct notifier_block trace_kprobe_module_nb = { + .notifier_call = trace_kprobe_module_callback, +- .priority = 1 /* Invoked after kprobe module callback */ ++ .priority = 2 /* Invoked after kprobe and jump_label module callback */ + }; + static int trace_kprobe_register_module_notifier(void) + { +-- +2.39.5 + diff --git a/queue-6.12/udf-skip-parent-dir-link-count-update-if-corrupted.patch b/queue-6.12/udf-skip-parent-dir-link-count-update-if-corrupted.patch new file mode 100644 index 00000000000..7d7e8598632 --- /dev/null +++ b/queue-6.12/udf-skip-parent-dir-link-count-update-if-corrupted.patch @@ -0,0 +1,39 @@ +From 4c02fffd5cb1889f51d4101051d7bf7c40bd6ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 12:46:00 +0100 +Subject: udf: Skip parent dir link count update if corrupted + +From: Jan Kara + +[ Upstream commit c5566903af56dd1abb092f18dcb0c770d6cd8dcb ] + +If the parent directory link count is too low (likely directory inode +corruption), just skip updating its link count as if it goes to 0 too +early it can cause unexpected issues. + +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/namei.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 78a603129dd5..2be775d30ac1 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -517,7 +517,11 @@ static int udf_rmdir(struct inode *dir, struct dentry *dentry) + inode->i_nlink); + clear_nlink(inode); + inode->i_size = 0; +- inode_dec_link_count(dir); ++ if (dir->i_nlink >= 3) ++ inode_dec_link_count(dir); ++ else ++ udf_warn(inode->i_sb, "parent dir link count too low (%u)\n", ++ dir->i_nlink); + udf_add_fid_counter(dir->i_sb, true, -1); + inode_set_mtime_to_ts(dir, + inode_set_ctime_to_ts(dir, inode_set_ctime_current(inode))); +-- +2.39.5 + diff --git a/queue-6.12/udf-verify-inode-link-counts-before-performing-renam.patch b/queue-6.12/udf-verify-inode-link-counts-before-performing-renam.patch new file mode 100644 index 00000000000..49e1b4c392b --- /dev/null +++ b/queue-6.12/udf-verify-inode-link-counts-before-performing-renam.patch @@ -0,0 +1,47 @@ +From ed2cf146ebf022106b5222452e71e9470e2371e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 12:55:12 +0100 +Subject: udf: Verify inode link counts before performing rename + +From: Jan Kara + +[ Upstream commit 6756af923e06aa33ad8894aaecbf9060953ba00f ] + +During rename, we are updating link counts of various inodes either when +rename deletes target or when moving directory across directories. +Verify involved link counts are sane so that we don't trip warnings in +VFS. + +Reported-by: syzbot+3ff7365dc04a6bcafa66@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/namei.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 2be775d30ac1..2cb49b6b0716 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -791,8 +791,18 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, + retval = -ENOTEMPTY; + if (!empty_dir(new_inode)) + goto out_oiter; ++ retval = -EFSCORRUPTED; ++ if (new_inode->i_nlink != 2) ++ goto out_oiter; + } ++ retval = -EFSCORRUPTED; ++ if (old_dir->i_nlink < 3) ++ goto out_oiter; + is_dir = true; ++ } else if (new_inode) { ++ retval = -EFSCORRUPTED; ++ if (new_inode->i_nlink < 1) ++ goto out_oiter; + } + if (is_dir && old_dir != new_dir) { + retval = udf_fiiter_find_entry(old_inode, &dotdot_name, +-- +2.39.5 + diff --git a/queue-6.12/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch b/queue-6.12/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch new file mode 100644 index 00000000000..3feb2195fa6 --- /dev/null +++ b/queue-6.12/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch @@ -0,0 +1,72 @@ +From 3886913c169f633bdcf347bca49bdf8f89c089ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 20:58:21 +0800 +Subject: virtio-blk: don't keep queue frozen during system suspend + +From: Ming Lei + +[ Upstream commit 7678abee0867e6b7fb89aa40f6e9f575f755fb37 ] + +Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before +deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's +PM callbacks. And the motivation is to drain inflight IOs before suspending. + +block layer's queue freeze looks very handy, but it is also easy to cause +deadlock, such as, any attempt to call into bio_queue_enter() may run into +deadlock if the queue is frozen in current context. There are all kinds +of ->suspend() called in suspend context, so keeping queue frozen in the +whole suspend context isn't one good idea. And Marek reported lockdep +warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). + +[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ + +Given the motivation is to drain in-flight IOs, it can be done by calling +freeze & unfreeze, meantime restore to previous behavior by keeping queue +quiesced during suspend. + +Cc: Yi Sun +Cc: Michael S. Tsirkin +Cc: Jason Wang +Cc: Stefan Hajnoczi +Cc: virtualization@lists.linux.dev +Reported-by: Marek Szyprowski +Signed-off-by: Ming Lei +Acked-by: Stefan Hajnoczi +Link: https://lore.kernel.org/r/20241112125821.1475793-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 43c96b73a711..0e50b65e1dbf 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1587,9 +1587,12 @@ static void virtblk_remove(struct virtio_device *vdev) + static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; ++ struct request_queue *q = vblk->disk->queue; + + /* Ensure no requests in virtqueues before deleting vqs. */ +- blk_mq_freeze_queue(vblk->disk->queue); ++ blk_mq_freeze_queue(q); ++ blk_mq_quiesce_queue_nowait(q); ++ blk_mq_unfreeze_queue(q); + + /* Ensure we don't receive any more interrupts */ + virtio_reset_device(vdev); +@@ -1613,8 +1616,8 @@ static int virtblk_restore(struct virtio_device *vdev) + return ret; + + virtio_device_ready(vdev); ++ blk_mq_unquiesce_queue(vblk->disk->queue); + +- blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +-- +2.39.5 + diff --git a/queue-6.12/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch b/queue-6.12/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch new file mode 100644 index 00000000000..929510859b2 --- /dev/null +++ b/queue-6.12/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch @@ -0,0 +1,121 @@ +From 09688db92b5807e12a64e86da6d72e6059483110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 00:34:40 -0600 +Subject: watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 + +From: James Hilliard + +[ Upstream commit 43439076383a7611300334d1357c0f8883f40816 ] + +For the watchdog timer to work properly on the QCML04 board we need to +set PWRGD enable in the Environment Controller Configuration Registers +Special Configuration Register 1 when it is not already set, this may +be the case when the watchdog is not enabled from within the BIOS. + +Signed-off-by: James Hilliard +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241025063441.3494837-1-james.hilliard1@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 39 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 3e8c15138edd..1a5a0a2c3f2e 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -20,6 +20,8 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include ++#include + #include + #include + #include +@@ -40,6 +42,7 @@ + #define VAL 0x2f + + /* Logical device Numbers LDN */ ++#define EC 0x04 + #define GPIO 0x07 + + /* Configuration Registers and Functions */ +@@ -73,6 +76,12 @@ + #define IT8784_ID 0x8784 + #define IT8786_ID 0x8786 + ++/* Environment Controller Configuration Registers LDN=0x04 */ ++#define SCR1 0xfa ++ ++/* Environment Controller Bits SCR1 */ ++#define WDT_PWRGD 0x20 ++ + /* GPIO Configuration Registers LDN=0x07 */ + #define WDTCTRL 0x71 + #define WDTCFG 0x72 +@@ -240,6 +249,21 @@ static int wdt_set_timeout(struct watchdog_device *wdd, unsigned int t) + return ret; + } + ++enum { ++ IT87_WDT_OUTPUT_THROUGH_PWRGD = BIT(0), ++}; ++ ++static const struct dmi_system_id it87_quirks[] = { ++ { ++ /* Qotom Q30900P (IT8786) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"), ++ }, ++ .driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD, ++ }, ++ {} ++}; ++ + static const struct watchdog_info ident = { + .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING, + .firmware_version = 1, +@@ -261,8 +285,10 @@ static struct watchdog_device wdt_dev = { + + static int __init it87_wdt_init(void) + { ++ const struct dmi_system_id *dmi_id; + u8 chip_rev; + u8 ctrl; ++ int quirks = 0; + int rc; + + rc = superio_enter(); +@@ -273,6 +299,10 @@ static int __init it87_wdt_init(void) + chip_rev = superio_inb(CHIPREV) & 0x0f; + superio_exit(); + ++ dmi_id = dmi_first_match(it87_quirks); ++ if (dmi_id) ++ quirks = (long)dmi_id->driver_data; ++ + switch (chip_type) { + case IT8702_ID: + max_units = 255; +@@ -333,6 +363,15 @@ static int __init it87_wdt_init(void) + superio_outb(0x00, WDTCTRL); + } + ++ if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) { ++ superio_select(EC); ++ ctrl = superio_inb(SCR1); ++ if (!(ctrl & WDT_PWRGD)) { ++ ctrl |= WDT_PWRGD; ++ superio_outb(ctrl, SCR1); ++ } ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.39.5 + diff --git a/queue-6.12/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch b/queue-6.12/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch new file mode 100644 index 00000000000..04cfa639da9 --- /dev/null +++ b/queue-6.12/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch @@ -0,0 +1,57 @@ +From f4b6e6a6f9ce64304b876051ecde684a5c74e01b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 10:47:55 +0000 +Subject: watchdog: mediatek: Add support for MT6735 TOPRGU/WDT + +From: Yassine Oudjana + +[ Upstream commit 15ddf704f56f8c95ff74dfd1157ed8646b322fa1 ] + +Add support for the Top Reset Generation Unit/Watchdog Timer found on +MT6735. + +Signed-off-by: Yassine Oudjana +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241106104738.195968-3-y.oudjana@protonmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mtk_wdt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c +index e2d7a57d6ea2..91d110646e16 100644 +--- a/drivers/watchdog/mtk_wdt.c ++++ b/drivers/watchdog/mtk_wdt.c +@@ -10,6 +10,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -87,6 +88,10 @@ static const struct mtk_wdt_data mt2712_data = { + .toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM, + }; + ++static const struct mtk_wdt_data mt6735_data = { ++ .toprgu_sw_rst_num = MT6735_TOPRGU_RST_NUM, ++}; ++ + static const struct mtk_wdt_data mt6795_data = { + .toprgu_sw_rst_num = MT6795_TOPRGU_SW_RST_NUM, + }; +@@ -489,6 +494,7 @@ static int mtk_wdt_resume(struct device *dev) + static const struct of_device_id mtk_wdt_dt_ids[] = { + { .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data }, + { .compatible = "mediatek,mt6589-wdt" }, ++ { .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data }, + { .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data }, + { .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data }, + { .compatible = "mediatek,mt7988-wdt", .data = &mt7988_data }, +-- +2.39.5 + diff --git a/queue-6.12/watchdog-rzg2l_wdt-power-on-the-watchdog-domain-in-t.patch b/queue-6.12/watchdog-rzg2l_wdt-power-on-the-watchdog-domain-in-t.patch new file mode 100644 index 00000000000..3cba4bef5db --- /dev/null +++ b/queue-6.12/watchdog-rzg2l_wdt-power-on-the-watchdog-domain-in-t.patch @@ -0,0 +1,103 @@ +From 39b7e9295bddf2679ec9d1bade0e74f017d5d2af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 19:47:32 +0300 +Subject: watchdog: rzg2l_wdt: Power on the watchdog domain in the restart + handler + +From: Claudiu Beznea + +[ Upstream commit bad201b2ac4e238c6d4b6966a220240e3861640c ] + +On RZ/G3S the watchdog can be part of a software-controlled PM domain. In +this case, the watchdog device need to be powered on in +struct watchdog_ops::restart API. This can be done though +pm_runtime_resume_and_get() API if the watchdog PM domain and watchdog +device are marked as IRQ safe. We mark the watchdog PM domain as IRQ safe +with GENPD_FLAG_IRQ_SAFE when the watchdog PM domain is registered and the +watchdog device though pm_runtime_irq_safe(). + +Before commit e4cf89596c1f ("watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait +context'") pm_runtime_get_sync() was used in watchdog restart handler +(which is similar to pm_runtime_resume_and_get() except the later one +handles the runtime resume errors). + +Commit e4cf89596c1f ("watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait +context'") dropped the pm_runtime_get_sync() and replaced it with +clk_prepare_enable() to avoid invalid wait context due to genpd_lock() +in genpd_runtime_resume() being called from atomic context. But +clk_prepare_enable() doesn't fit for this either (as reported by +Ulf Hansson) as clk_prepare() can also sleep (it just not throw invalid +wait context warning as it is not written for this). + +Because the watchdog device is marked now as IRQ safe (though this patch) +the irq_safe_dev_in_sleep_domain() call from genpd_runtime_resume() returns +1 for devices not registering an IRQ safe PM domain for watchdog (as the +watchdog device is IRQ safe, PM domain is not and watchdog PM domain is +always-on), this being the case for RZ/G3S with old device trees and +the rest of the SoCs that use this driver, we can now drop also the +clk_prepare_enable() calls in restart handler and rely on +pm_runtime_resume_and_get(). + +Thus, drop clk_prepare_enable() and use pm_runtime_resume_and_get() in +watchdog restart handler. + +Signed-off-by: Claudiu Beznea +Reviewed-by: Ulf Hansson +Reviewed-by: Geert Uytterhoeven +Acked-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241015164732.4085249-5-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rzg2l_wdt.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/rzg2l_wdt.c b/drivers/watchdog/rzg2l_wdt.c +index 2a35f890a288..11bbe48160ec 100644 +--- a/drivers/watchdog/rzg2l_wdt.c ++++ b/drivers/watchdog/rzg2l_wdt.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -166,8 +167,22 @@ static int rzg2l_wdt_restart(struct watchdog_device *wdev, + struct rzg2l_wdt_priv *priv = watchdog_get_drvdata(wdev); + int ret; + +- clk_prepare_enable(priv->pclk); +- clk_prepare_enable(priv->osc_clk); ++ /* ++ * In case of RZ/G3S the watchdog device may be part of an IRQ safe power ++ * domain that is currently powered off. In this case we need to power ++ * it on before accessing registers. Along with this the clocks will be ++ * enabled. We don't undo the pm_runtime_resume_and_get() as the device ++ * need to be on for the reboot to happen. ++ * ++ * For the rest of SoCs not registering a watchdog IRQ safe power ++ * domain it is safe to call pm_runtime_resume_and_get() as the ++ * irq_safe_dev_in_sleep_domain() call in genpd_runtime_resume() ++ * returns non zero value and the genpd_lock() is avoided, thus, there ++ * will be no invalid wait context reported by lockdep. ++ */ ++ ret = pm_runtime_resume_and_get(wdev->parent); ++ if (ret) ++ return ret; + + if (priv->devtype == WDT_RZG2L) { + ret = reset_control_deassert(priv->rstc); +@@ -275,6 +290,7 @@ static int rzg2l_wdt_probe(struct platform_device *pdev) + + priv->devtype = (uintptr_t)of_device_get_match_data(dev); + ++ pm_runtime_irq_safe(&pdev->dev); + pm_runtime_enable(&pdev->dev); + + priv->wdev.info = &rzg2l_wdt_ident; +-- +2.39.5 + diff --git a/queue-6.12/watchdog-s3c2410_wdt-add-support-for-exynosautov920-.patch b/queue-6.12/watchdog-s3c2410_wdt-add-support-for-exynosautov920-.patch new file mode 100644 index 00000000000..3e376485f6f --- /dev/null +++ b/queue-6.12/watchdog-s3c2410_wdt-add-support-for-exynosautov920-.patch @@ -0,0 +1,105 @@ +From b4a1ba400db8ba3c210bc37b0f5838dc89535b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2024 15:39:02 +0900 +Subject: watchdog: s3c2410_wdt: add support for exynosautov920 SoC + +From: Byoungtae Cho + +[ Upstream commit a5cb13980e00e9c4fbc382d68eda250ab6a14d7c ] + +Adds the compatibles and drvdata for the ExynosAuto V920 SoC. This SoC +is almost similar to ExynosAutoV9, but some CPU configurations are quite +different, so it should be added. Plus it also support DBGACK like as +GS101 SoC. + +Signed-off-by: Byoungtae Cho +Signed-off-by: Taewan Kim +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241021063903.793166-3-trunixs.kim@samsung.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/s3c2410_wdt.c | 37 +++++++++++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c +index 349d30462c8c..30450e99e5e9 100644 +--- a/drivers/watchdog/s3c2410_wdt.c ++++ b/drivers/watchdog/s3c2410_wdt.c +@@ -63,6 +63,10 @@ + #define EXYNOS850_CLUSTER1_NONCPU_INT_EN 0x1644 + #define EXYNOSAUTOV9_CLUSTER1_NONCPU_OUT 0x1520 + #define EXYNOSAUTOV9_CLUSTER1_NONCPU_INT_EN 0x1544 ++#define EXYNOSAUTOV920_CLUSTER0_NONCPU_OUT 0x1420 ++#define EXYNOSAUTOV920_CLUSTER0_NONCPU_INT_EN 0x1444 ++#define EXYNOSAUTOV920_CLUSTER1_NONCPU_OUT 0x1720 ++#define EXYNOSAUTOV920_CLUSTER1_NONCPU_INT_EN 0x1744 + + #define EXYNOS850_CLUSTER0_WDTRESET_BIT 24 + #define EXYNOS850_CLUSTER1_WDTRESET_BIT 23 +@@ -303,6 +307,32 @@ static const struct s3c2410_wdt_variant drv_data_gs101_cl1 = { + QUIRK_HAS_DBGACK_BIT, + }; + ++static const struct s3c2410_wdt_variant drv_data_exynosautov920_cl0 = { ++ .mask_reset_reg = EXYNOSAUTOV920_CLUSTER0_NONCPU_INT_EN, ++ .mask_bit = 2, ++ .mask_reset_inv = true, ++ .rst_stat_reg = EXYNOS5_RST_STAT_REG_OFFSET, ++ .rst_stat_bit = EXYNOSAUTOV9_CLUSTER0_WDTRESET_BIT, ++ .cnt_en_reg = EXYNOSAUTOV920_CLUSTER0_NONCPU_OUT, ++ .cnt_en_bit = 7, ++ .quirks = QUIRK_HAS_WTCLRINT_REG | QUIRK_HAS_PMU_MASK_RESET | ++ QUIRK_HAS_PMU_RST_STAT | QUIRK_HAS_PMU_CNT_EN | ++ QUIRK_HAS_DBGACK_BIT, ++}; ++ ++static const struct s3c2410_wdt_variant drv_data_exynosautov920_cl1 = { ++ .mask_reset_reg = EXYNOSAUTOV920_CLUSTER1_NONCPU_INT_EN, ++ .mask_bit = 2, ++ .mask_reset_inv = true, ++ .rst_stat_reg = EXYNOS5_RST_STAT_REG_OFFSET, ++ .rst_stat_bit = EXYNOSAUTOV9_CLUSTER1_WDTRESET_BIT, ++ .cnt_en_reg = EXYNOSAUTOV920_CLUSTER1_NONCPU_OUT, ++ .cnt_en_bit = 7, ++ .quirks = QUIRK_HAS_WTCLRINT_REG | QUIRK_HAS_PMU_MASK_RESET | ++ QUIRK_HAS_PMU_RST_STAT | QUIRK_HAS_PMU_CNT_EN | ++ QUIRK_HAS_DBGACK_BIT, ++}; ++ + static const struct of_device_id s3c2410_wdt_match[] = { + { .compatible = "google,gs101-wdt", + .data = &drv_data_gs101_cl0 }, +@@ -320,6 +350,8 @@ static const struct of_device_id s3c2410_wdt_match[] = { + .data = &drv_data_exynos850_cl0 }, + { .compatible = "samsung,exynosautov9-wdt", + .data = &drv_data_exynosautov9_cl0 }, ++ { .compatible = "samsung,exynosautov920-wdt", ++ .data = &drv_data_exynosautov920_cl0 }, + {}, + }; + MODULE_DEVICE_TABLE(of, s3c2410_wdt_match); +@@ -643,7 +675,8 @@ s3c2410_get_wdt_drv_data(struct platform_device *pdev, struct s3c2410_wdt *wdt) + /* Choose Exynos850/ExynosAutov9 driver data w.r.t. cluster index */ + if (variant == &drv_data_exynos850_cl0 || + variant == &drv_data_exynosautov9_cl0 || +- variant == &drv_data_gs101_cl0) { ++ variant == &drv_data_gs101_cl0 || ++ variant == &drv_data_exynosautov920_cl0) { + u32 index; + int err; + +@@ -662,6 +695,8 @@ s3c2410_get_wdt_drv_data(struct platform_device *pdev, struct s3c2410_wdt *wdt) + variant = &drv_data_exynosautov9_cl1; + else if (variant == &drv_data_gs101_cl0) + variant = &drv_data_gs101_cl1; ++ else if (variant == &drv_data_exynosautov920_cl0) ++ variant = &drv_data_exynosautov920_cl1; + break; + default: + return dev_err_probe(dev, -EINVAL, "wrong cluster index: %u\n", index); +-- +2.39.5 +