From: Sasha Levin Date: Tue, 23 Jul 2024 00:20:19 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.10.1~38 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0cc09656278d4d98cbef38deaa9df2771ab11dce;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/acpi-ec-abort-address-space-access-upon-error.patch b/queue-6.6/acpi-ec-abort-address-space-access-upon-error.patch new file mode 100644 index 00000000000..06b47467ad1 --- /dev/null +++ b/queue-6.6/acpi-ec-abort-address-space-access-upon-error.patch @@ -0,0 +1,45 @@ +From cd6302526fb9fd86dcdf1c334bd5f4356fa49ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 23:36:48 +0200 +Subject: ACPI: EC: Abort address space access upon error + +From: Armin Wolf + +[ Upstream commit f6f172dc6a6d7775b2df6adfd1350700e9a847ec ] + +When a multi-byte address space access is requested, acpi_ec_read()/ +acpi_ec_write() is being called multiple times. + +Abort such operations if a single call to acpi_ec_read() / +acpi_ec_write() fails, as the data read from / written to the EC +might be incomplete. + +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index bdeae6ca9f059..3a2103da6a21c 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1333,10 +1333,13 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + if (ec->busy_polling || bits > 8) + acpi_ec_burst_enable(ec); + +- for (i = 0; i < bytes; ++i, ++address, ++value) ++ for (i = 0; i < bytes; ++i, ++address, ++value) { + result = (function == ACPI_READ) ? + acpi_ec_read(ec, address, value) : + acpi_ec_write(ec, address, *value); ++ if (result < 0) ++ break; ++ } + + if (ec->busy_polling || bits > 8) + acpi_ec_burst_disable(ec); +-- +2.43.0 + diff --git a/queue-6.6/acpi-ec-avoid-returning-ae_ok-on-errors-in-address-s.patch b/queue-6.6/acpi-ec-avoid-returning-ae_ok-on-errors-in-address-s.patch new file mode 100644 index 00000000000..7a19e01038e --- /dev/null +++ b/queue-6.6/acpi-ec-avoid-returning-ae_ok-on-errors-in-address-s.patch @@ -0,0 +1,43 @@ +From bd8009acc6151219c98d852d05000803a972df44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 23:36:49 +0200 +Subject: ACPI: EC: Avoid returning AE_OK on errors in address space handler + +From: Armin Wolf + +[ Upstream commit c4bd7f1d78340e63de4d073fd3dbe5391e2996e5 ] + +If an error code other than EINVAL, ENODEV or ETIME is returned +by acpi_ec_read() / acpi_ec_write(), then AE_OK is incorrectly +returned by acpi_ec_space_handler(). + +Fix this by only returning AE_OK on success, and return AE_ERROR +otherwise. + +Signed-off-by: Armin Wolf +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 3a2103da6a21c..4e3a4d96797e0 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1351,8 +1351,10 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, + return AE_NOT_FOUND; + case -ETIME: + return AE_TIME; +- default: ++ case 0: + return AE_OK; ++ default: ++ return AE_ERROR; + } + } + +-- +2.43.0 + diff --git a/queue-6.6/alsa-dmaengine-synchronize-dma-channel-after-drop.patch b/queue-6.6/alsa-dmaengine-synchronize-dma-channel-after-drop.patch new file mode 100644 index 00000000000..9edbbe09e7d --- /dev/null +++ b/queue-6.6/alsa-dmaengine-synchronize-dma-channel-after-drop.patch @@ -0,0 +1,98 @@ +From c9bed3346db074656e8eae1988b385ec51532a1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 18:02:55 +0530 +Subject: ALSA: dmaengine: Synchronize dma channel after drop() + +From: Jai Luthra + +[ Upstream commit e8343410ddf08fc36a9b9cc7c51a4e53a262d4c6 ] + +Sometimes the stream may be stopped due to XRUN events, in which case +the userspace can call snd_pcm_drop() and snd_pcm_prepare() to stop and +start the stream again. + +In these cases, we must wait for the DMA channel to synchronize before +marking the stream as prepared for playback, as the DMA channel gets +stopped by drop() without any synchronization. Make sure the ALSA core +synchronizes the DMA channel by adding a sync_stop() hook. + +Reviewed-by: Peter Ujfalusi +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240611-asoc_next-v3-1-fcfd84b12164@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/dmaengine_pcm.h | 1 + + sound/core/pcm_dmaengine.c | 10 ++++++++++ + sound/soc/soc-generic-dmaengine-pcm.c | 8 ++++++++ + 3 files changed, 19 insertions(+) + +diff --git a/include/sound/dmaengine_pcm.h b/include/sound/dmaengine_pcm.h +index d70c55f17df7c..94dbb23580f2f 100644 +--- a/include/sound/dmaengine_pcm.h ++++ b/include/sound/dmaengine_pcm.h +@@ -36,6 +36,7 @@ snd_pcm_uframes_t snd_dmaengine_pcm_pointer_no_residue(struct snd_pcm_substream + int snd_dmaengine_pcm_open(struct snd_pcm_substream *substream, + struct dma_chan *chan); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream); ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream); + + int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + dma_filter_fn filter_fn, void *filter_data); +diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c +index 494ec0c207fad..d142609570347 100644 +--- a/sound/core/pcm_dmaengine.c ++++ b/sound/core/pcm_dmaengine.c +@@ -349,6 +349,16 @@ int snd_dmaengine_pcm_open_request_chan(struct snd_pcm_substream *substream, + } + EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_open_request_chan); + ++int snd_dmaengine_pcm_sync_stop(struct snd_pcm_substream *substream) ++{ ++ struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ ++ dmaengine_synchronize(prtd->dma_chan); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_sync_stop); ++ + /** + * snd_dmaengine_pcm_close - Close a dmaengine based PCM substream + * @substream: PCM substream +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index cad222eb9a293..30bb1b018aa89 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -318,6 +318,12 @@ static int dmaengine_copy(struct snd_soc_component *component, + return 0; + } + ++static int dmaengine_pcm_sync_stop(struct snd_soc_component *component, ++ struct snd_pcm_substream *substream) ++{ ++ return snd_dmaengine_pcm_sync_stop(substream); ++} ++ + static const struct snd_soc_component_driver dmaengine_pcm_component = { + .name = SND_DMAENGINE_PCM_DRV_NAME, + .probe_order = SND_SOC_COMP_ORDER_LATE, +@@ -327,6 +333,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component = { + .trigger = dmaengine_pcm_trigger, + .pointer = dmaengine_pcm_pointer, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const struct snd_soc_component_driver dmaengine_pcm_component_process = { +@@ -339,6 +346,7 @@ static const struct snd_soc_component_driver dmaengine_pcm_component_process = { + .pointer = dmaengine_pcm_pointer, + .copy = dmaengine_copy, + .pcm_construct = dmaengine_pcm_new, ++ .sync_stop = dmaengine_pcm_sync_stop, + }; + + static const char * const dmaengine_pcm_dma_channel_names[] = { +-- +2.43.0 + diff --git a/queue-6.6/alsa-dmaengine_pcm-terminate-dmaengine-before-synchr.patch b/queue-6.6/alsa-dmaengine_pcm-terminate-dmaengine-before-synchr.patch new file mode 100644 index 00000000000..ed4b8a7fa50 --- /dev/null +++ b/queue-6.6/alsa-dmaengine_pcm-terminate-dmaengine-before-synchr.patch @@ -0,0 +1,66 @@ +From cb45d92d54b2ed33c5e6d9c712638d70d58bb5da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 10:40:18 +0800 +Subject: ALSA: dmaengine_pcm: terminate dmaengine before synchronize + +From: Shengjiu Wang + +[ Upstream commit 6a7db25aad8ce6512b366d2ce1d0e60bac00a09d ] + +When dmaengine supports pause function, in suspend state, +dmaengine_pause() is called instead of dmaengine_terminate_async(), + +In end of playback stream, the runtime->state will go to +SNDRV_PCM_STATE_DRAINING, if system suspend & resume happen +at this time, application will not resume playback stream, the +stream will be closed directly, the dmaengine_terminate_async() +will not be called before the dmaengine_synchronize(), which +violates the call sequence for dmaengine_synchronize(). + +This behavior also happens for capture streams, but there is no +SNDRV_PCM_STATE_DRAINING state for capture. So use +dmaengine_tx_status() to check the DMA status if the status is +DMA_PAUSED, then call dmaengine_terminate_async() to terminate +dmaengine before dmaengine_synchronize(). + +Signed-off-by: Shengjiu Wang +Link: https://patch.msgid.link/1718851218-27803-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_dmaengine.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/core/pcm_dmaengine.c b/sound/core/pcm_dmaengine.c +index d142609570347..e299e8634751f 100644 +--- a/sound/core/pcm_dmaengine.c ++++ b/sound/core/pcm_dmaengine.c +@@ -368,6 +368,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_sync_stop); + int snd_dmaengine_pcm_close(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + kfree(prtd); +@@ -388,6 +394,12 @@ EXPORT_SYMBOL_GPL(snd_dmaengine_pcm_close); + int snd_dmaengine_pcm_close_release_chan(struct snd_pcm_substream *substream) + { + struct dmaengine_pcm_runtime_data *prtd = substream_to_prtd(substream); ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ status = dmaengine_tx_status(prtd->dma_chan, prtd->cookie, &state); ++ if (status == DMA_PAUSED) ++ dmaengine_terminate_async(prtd->dma_chan); + + dmaengine_synchronize(prtd->dma_chan); + dma_release_channel(prtd->dma_chan); +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-cs35l56-fix-lifecycle-of-codec-pointer.patch b/queue-6.6/alsa-hda-cs35l56-fix-lifecycle-of-codec-pointer.patch new file mode 100644 index 00000000000..13b9b536f2f --- /dev/null +++ b/queue-6.6/alsa-hda-cs35l56-fix-lifecycle-of-codec-pointer.patch @@ -0,0 +1,47 @@ +From 6bd6d7e322931cd7e142095a40b4ea325969cc68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 12:27:16 +0100 +Subject: ALSA: hda: cs35l56: Fix lifecycle of codec pointer + +From: Simon Trimmer + +[ Upstream commit d339131bf02d4ed918415574082caf5e8af6e664 ] + +The codec should be cleared when the amp driver is unbound and when +resuming it should be tested to prevent loading firmware into the device +and ALSA in a partially configured system state. + +Signed-off-by: Simon Trimmer +Link: https://lore.kernel.org/r/20240531112716.25323-1-simont@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c +index 78e2eeba49345..b84f3b3eb1409 100644 +--- a/sound/pci/hda/cs35l56_hda.c ++++ b/sound/pci/hda/cs35l56_hda.c +@@ -702,6 +702,8 @@ static void cs35l56_hda_unbind(struct device *dev, struct device *master, void * + if (comps[cs35l56->index].dev == dev) + memset(&comps[cs35l56->index], 0, sizeof(*comps)); + ++ cs35l56->codec = NULL; ++ + dev_dbg(cs35l56->base.dev, "Unbound\n"); + } + +@@ -807,6 +809,9 @@ static int cs35l56_hda_system_resume(struct device *dev) + + cs35l56->suspended = false; + ++ if (!cs35l56->codec) ++ return 0; ++ + ret = cs35l56_is_fw_reload_needed(&cs35l56->base); + dev_dbg(cs35l56->base.dev, "fw_reload_needed: %d\n", ret); + if (ret > 0) { +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-cs35l56-select-serial_multi_instantiate.patch b/queue-6.6/alsa-hda-cs35l56-select-serial_multi_instantiate.patch new file mode 100644 index 00000000000..3758258ca0e --- /dev/null +++ b/queue-6.6/alsa-hda-cs35l56-select-serial_multi_instantiate.patch @@ -0,0 +1,47 @@ +From ff93d32687a26713ee067b59c69dc235b5e2b545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 17:16:02 +0100 +Subject: ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE + +From: Simon Trimmer + +[ Upstream commit 9b1effff19cdf2230d3ecb07ff4038a0da32e9cc ] + +The ACPI IDs used in the CS35L56 HDA drivers are all handled by the +serial multi-instantiate driver which starts multiple Linux device +instances from a single ACPI Device() node. + +As serial multi-instantiate is not an optional part of the system add it +as a dependency in Kconfig so that it is not overlooked. + +Signed-off-by: Simon Trimmer +Link: https://lore.kernel.org/20240619161602.117452-1-simont@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index 21046f72cdca9..f8ef87a30cab2 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -141,6 +141,7 @@ config SND_HDA_SCODEC_CS35L56_I2C + depends on ACPI || COMPILE_TEST + depends on SND_SOC + select FW_CS_DSP ++ select SERIAL_MULTI_INSTANTIATE + select SND_HDA_GENERIC + select SND_SOC_CS35L56_SHARED + select SND_HDA_SCODEC_CS35L56 +@@ -155,6 +156,7 @@ config SND_HDA_SCODEC_CS35L56_SPI + depends on ACPI || COMPILE_TEST + depends on SND_SOC + select FW_CS_DSP ++ select SERIAL_MULTI_INSTANTIATE + select SND_HDA_GENERIC + select SND_SOC_CS35L56_SHARED + select SND_HDA_SCODEC_CS35L56 +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-realtek-add-more-codec-id-to-no-shutup-pins.patch b/queue-6.6/alsa-hda-realtek-add-more-codec-id-to-no-shutup-pins.patch new file mode 100644 index 00000000000..cc75b6eabb9 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-more-codec-id-to-no-shutup-pins.patch @@ -0,0 +1,41 @@ +From 59759934a2b9e337985de3eeb548ba5afbd109a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 14:16:04 +0800 +Subject: ALSA: hda/realtek: Add more codec ID to no shutup pins list + +From: Kailang Yang + +[ Upstream commit 70794b9563fe011988bcf6a081af9777e63e8d37 ] + +If it enter to runtime D3 state, it didn't shutup Headset MIC pin. + +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/r/8d86f61e7d6f4a03b311e4eb4e5caaef@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0624006bbaf40..20d5769fc0eaf 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -585,10 +585,14 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: ++ case 0x10ec0257: + case 0x19e58326: + case 0x10ec0283: ++ case 0x10ec0285: + case 0x10ec0286: ++ case 0x10ec0287: + case 0x10ec0288: ++ case 0x10ec0295: + case 0x10ec0298: + alc_headset_mic_no_shutup(codec); + break; +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-realtek-support-lenovo-thinkbook-16p-gen-5.patch b/queue-6.6/alsa-hda-realtek-support-lenovo-thinkbook-16p-gen-5.patch new file mode 100644 index 00000000000..37a36cd29af --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-support-lenovo-thinkbook-16p-gen-5.patch @@ -0,0 +1,39 @@ +From f8cb1c1b9e730de6c6eac706e3cfb8dcc143a301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 14:03:50 +0100 +Subject: ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5 + +From: Stefan Binding + +[ Upstream commit 75f2ea939b5c694b36aad8ef823a2f9bcf7b3d7d ] + +Add support for this laptop, which uses CS35L41 HDA amps. +The laptop does not contain valid _DSD for these amps, so requires +entries into the CS35L41 configuration table to function correctly. + +[ fixed to lower hex numbers in quirk entries -- tiwai ] + +Signed-off-by: Stefan Binding +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20240606130351.333495-4-sbinding@opensource.cirrus.com +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7743cb31b6e06..0624006bbaf40 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10288,6 +10288,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x38cd, "Y790 VECO DUAL", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x38d2, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x38d7, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN), ++ SND_PCI_QUIRK(0x17aa, 0x38f9, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-relatek-enable-mute-led-on-hp-laptop-15-gw0.patch b/queue-6.6/alsa-hda-relatek-enable-mute-led-on-hp-laptop-15-gw0.patch new file mode 100644 index 00000000000..f73202fcf84 --- /dev/null +++ b/queue-6.6/alsa-hda-relatek-enable-mute-led-on-hp-laptop-15-gw0.patch @@ -0,0 +1,35 @@ +From 918c3d21411281e2cebaa996110baf43fe5f72b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:12:02 +0500 +Subject: ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx + +From: Aivaz Latypov + +[ Upstream commit 1d091a98c399c17d0571fa1d91a7123a698446e4 ] + +This HP Laptop uses ALC236 codec with COEF 0x07 controlling +the mute LED. Enable existing quirk for this device. + +Signed-off-by: Aivaz Latypov +Link: https://patch.msgid.link/20240625081217.1049-1-reichaivaz@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 20d5769fc0eaf..e883f7a242b62 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9857,6 +9857,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x87b7, "HP Laptop 14-fq0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x87d3, "HP Laptop 15-gw0xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f1, "HP ProBook 630 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), +-- +2.43.0 + diff --git a/queue-6.6/alsa-hda-use-imply-for-suggesting-config_serial_mult.patch b/queue-6.6/alsa-hda-use-imply-for-suggesting-config_serial_mult.patch new file mode 100644 index 00000000000..01c551f4f3d --- /dev/null +++ b/queue-6.6/alsa-hda-use-imply-for-suggesting-config_serial_mult.patch @@ -0,0 +1,51 @@ +From f60b95d97f9931375a5b0f75e2b08556b39a9873 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 09:39:09 +0200 +Subject: ALSA: hda: Use imply for suggesting CONFIG_SERIAL_MULTI_INSTANTIATE + +From: Takashi Iwai + +[ Upstream commit 17563b4a19d1844bdbccc7a82d2f31c28ca9cfae ] + +The recent fix introduced a reverse selection of +CONFIG_SERIAL_MULTI_INSTANTIATE, but its condition isn't always met. +Use a weak reverse selection to suggest the config for avoiding such +inconsistencies, instead. + +Fixes: 9b1effff19cd ("ALSA: hda: cs35l56: Select SERIAL_MULTI_INSTANTIATE") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202406210732.ozgk8IMK-lkp@intel.com/ +Closes: https://lore.kernel.org/oe-kbuild-all/202406211244.oLhoF3My-lkp@intel.com/ +Reviewed-by: Richard Fitzgerald +Link: https://patch.msgid.link/20240621073915.19576-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index f8ef87a30cab2..9698ebe3fbc2e 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -141,7 +141,7 @@ config SND_HDA_SCODEC_CS35L56_I2C + depends on ACPI || COMPILE_TEST + depends on SND_SOC + select FW_CS_DSP +- select SERIAL_MULTI_INSTANTIATE ++ imply SERIAL_MULTI_INSTANTIATE + select SND_HDA_GENERIC + select SND_SOC_CS35L56_SHARED + select SND_HDA_SCODEC_CS35L56 +@@ -156,7 +156,7 @@ config SND_HDA_SCODEC_CS35L56_SPI + depends on ACPI || COMPILE_TEST + depends on SND_SOC + select FW_CS_DSP +- select SERIAL_MULTI_INSTANTIATE ++ imply SERIAL_MULTI_INSTANTIATE + select SND_HDA_GENERIC + select SND_SOC_CS35L56_SHARED + select SND_HDA_SCODEC_CS35L56 +-- +2.43.0 + diff --git a/queue-6.6/alsa-pcm-allow-resume-only-for-suspended-streams.patch b/queue-6.6/alsa-pcm-allow-resume-only-for-suspended-streams.patch new file mode 100644 index 00000000000..ee0a3fff149 --- /dev/null +++ b/queue-6.6/alsa-pcm-allow-resume-only-for-suspended-streams.patch @@ -0,0 +1,35 @@ +From bc4330016931261657a21ec9cfd0fa89b9a662e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 14:54:34 +0200 +Subject: ALSA: PCM: Allow resume only for suspended streams + +From: Takashi Iwai + +[ Upstream commit 1225675ca74c746f09211528588e83b3def1ff6a ] + +snd_pcm_resume() should bail out if the stream isn't in a suspended +state. Otherwise it'd allow doubly resume. + +Link: https://patch.msgid.link/20240624125443.27808-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_native.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index bd9ddf412b465..cc21c483c4a57 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1783,6 +1783,8 @@ static int snd_pcm_pre_resume(struct snd_pcm_substream *substream, + snd_pcm_state_t state) + { + struct snd_pcm_runtime *runtime = substream->runtime; ++ if (runtime->state != SNDRV_PCM_STATE_SUSPENDED) ++ return -EBADFD; + if (!(runtime->info & SNDRV_PCM_INFO_RESUME)) + return -ENOSYS; + runtime->trigger_master = substream; +-- +2.43.0 + diff --git a/queue-6.6/arm64-armv8_deprecated-fix-warning-in-isndep-cpuhp-s.patch b/queue-6.6/arm64-armv8_deprecated-fix-warning-in-isndep-cpuhp-s.patch new file mode 100644 index 00000000000..69556085189 --- /dev/null +++ b/queue-6.6/arm64-armv8_deprecated-fix-warning-in-isndep-cpuhp-s.patch @@ -0,0 +1,51 @@ +From 863c6997e3920dea4576a397de0362c6a3864fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 17:35:01 +0800 +Subject: arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process + +From: Wei Li + +[ Upstream commit 14951beaec93696b092a906baa0f29322cf34004 ] + +The function run_all_insn_set_hw_mode() is registered as startup callback +of 'CPUHP_AP_ARM64_ISNDEP_STARTING', it invokes set_hw_mode() methods of +all emulated instructions. + +As the STARTING callbacks are not expected to fail, if one of the +set_hw_mode() fails, e.g. due to el0 mixed-endian is not supported for +'setend', it will report a warning: + +``` +CPU[2] cannot support the emulation of setend +CPU 2 UP state arm64/isndep:starting (136) failed (-22) +CPU2: Booted secondary processor 0x0000000002 [0x414fd0c1] +``` + +To fix it, add a check for INSN_UNAVAILABLE status and skip the process. + +Signed-off-by: Wei Li +Tested-by: Huisong Li +Link: https://lore.kernel.org/r/20240423093501.3460764-1-liwei391@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/armv8_deprecated.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index e459cfd337117..d6b711e56df97 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -464,6 +464,9 @@ static int run_all_insn_set_hw_mode(unsigned int cpu) + for (int i = 0; i < ARRAY_SIZE(insn_emulations); i++) { + struct insn_emulation *insn = insn_emulations[i]; + bool enable = READ_ONCE(insn->current_mode) == INSN_HW; ++ if (insn->status == INSN_UNAVAILABLE) ++ continue; ++ + if (insn->set_hw_mode && insn->set_hw_mode(enable)) { + pr_warn("CPU[%u] cannot support the emulation of %s", + cpu, insn->name); +-- +2.43.0 + diff --git a/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-asus-m5602ra.patch b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-asus-m5602ra.patch new file mode 100644 index 00000000000..814246bd87a --- /dev/null +++ b/queue-6.6/asoc-amd-yc-fix-non-functional-mic-on-asus-m5602ra.patch @@ -0,0 +1,41 @@ +From 265cb8d43160a23a2547595998ae0e3b0b5a14a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 10:03:34 +0300 +Subject: ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA + +From: Vyacheslav Frantsishko + +[ Upstream commit 63b47f026cc841bd3d3438dd6fccbc394dfead87 ] + +The Vivobook S 16X IPS needs a quirks-table entry for the internal microphone to function properly. + +Signed-off-by: Vyacheslav Frantsishko +Reviewed-by: Mario Limonciello +Link: https://patch.msgid.link/20240626070334.45633-1-itmymaill@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 1760b5d42460a..4e3a8ce690a45 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -283,6 +283,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "M5602RA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt722-sdca-sdw-add-debounce-time-for-type-detec.patch b/queue-6.6/asoc-rt722-sdca-sdw-add-debounce-time-for-type-detec.patch new file mode 100644 index 00000000000..281ebbc5fa3 --- /dev/null +++ b/queue-6.6/asoc-rt722-sdca-sdw-add-debounce-time-for-type-detec.patch @@ -0,0 +1,35 @@ +From be02c1ff6969fe3017439c6566bfaf348a86176a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 09:01:07 +0000 +Subject: ASoC: rt722-sdca-sdw: add debounce time for type detection + +From: Jack Yu + +[ Upstream commit f3b198e4788fcc8d03ed0c8bd5e3856c6a5760c5 ] + +Add debounce time in headset type detection for better performance. + +Signed-off-by: Jack Yu +Link: https://lore.kernel.org/r/7e502e9a9dd94122a1b60deb5ceb60fb@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c +index cf2feb41c8354..32578a212642e 100644 +--- a/sound/soc/codecs/rt722-sdca-sdw.c ++++ b/sound/soc/codecs/rt722-sdca-sdw.c +@@ -349,7 +349,7 @@ static int rt722_sdca_interrupt_callback(struct sdw_slave *slave, + + if (status->sdca_cascade && !rt722->disable_irq) + mod_delayed_work(system_power_efficient_wq, +- &rt722->jack_detect_work, msecs_to_jiffies(30)); ++ &rt722->jack_detect_work, msecs_to_jiffies(280)); + + mutex_unlock(&rt722->disable_irq_lock); + +-- +2.43.0 + diff --git a/queue-6.6/asoc-rt722-sdca-sdw-add-silence-detection-register-a.patch b/queue-6.6/asoc-rt722-sdca-sdw-add-silence-detection-register-a.patch new file mode 100644 index 00000000000..75df81dd50e --- /dev/null +++ b/queue-6.6/asoc-rt722-sdca-sdw-add-silence-detection-register-a.patch @@ -0,0 +1,42 @@ +From 676b36bae69618d2002900485804bc5c1ee8781b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 10:47:16 +0000 +Subject: ASoC: rt722-sdca-sdw: add silence detection register as volatile + +From: Jack Yu + +[ Upstream commit 968c974c08106fcf911d8d390d0f049af855d348 ] + +Including silence detection register as volatile. + +Signed-off-by: Jack Yu +Link: https://msgid.link/r/c66a6bd6d220426793096b42baf85437@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt722-sdca-sdw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c +index 43a4e79e56966..cf2feb41c8354 100644 +--- a/sound/soc/codecs/rt722-sdca-sdw.c ++++ b/sound/soc/codecs/rt722-sdca-sdw.c +@@ -68,6 +68,7 @@ static bool rt722_sdca_mbq_readable_register(struct device *dev, unsigned int re + case 0x200007f: + case 0x2000082 ... 0x200008e: + case 0x2000090 ... 0x2000094: ++ case 0x3110000: + case 0x5300000 ... 0x5300002: + case 0x5400002: + case 0x5600000 ... 0x5600007: +@@ -125,6 +126,7 @@ static bool rt722_sdca_mbq_volatile_register(struct device *dev, unsigned int re + case 0x2000067: + case 0x2000084: + case 0x2000086: ++ case 0x3110000: + return true; + default: + return false; +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-intel-hda-pcm-limit-the-maximum-number-of-p.patch b/queue-6.6/asoc-sof-intel-hda-pcm-limit-the-maximum-number-of-p.patch new file mode 100644 index 00000000000..6046b7f1b0c --- /dev/null +++ b/queue-6.6/asoc-sof-intel-hda-pcm-limit-the-maximum-number-of-p.patch @@ -0,0 +1,43 @@ +From 80caf4ad3d243338777feb2d212d4fb075517712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 11:01:06 +0200 +Subject: ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods by + MAX_BDL_ENTRIES + +From: Peter Ujfalusi + +[ Upstream commit 82bb8db96610b558920b8c57cd250ec90567d79b ] + +The HDaudio specification Section 3.6.2 limits the number of BDL entries to 256. + +Make sure we don't allow more periods than this normative value. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Pierre-Louis Bossart +Link: https://patch.msgid.link/20240704090106.371497-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-pcm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-pcm.c b/sound/soc/sof/intel/hda-pcm.c +index f23c72cdff489..7d17d586ed9db 100644 +--- a/sound/soc/sof/intel/hda-pcm.c ++++ b/sound/soc/sof/intel/hda-pcm.c +@@ -254,6 +254,12 @@ int hda_dsp_pcm_open(struct snd_sof_dev *sdev, + snd_pcm_hw_constraint_integer(substream->runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + ++ /* Limit the maximum number of periods to not exceed the BDL entries count */ ++ if (runtime->hw.periods_max > HDA_DSP_MAX_BDL_ENTRIES) ++ snd_pcm_hw_constraint_minmax(runtime, SNDRV_PCM_HW_PARAM_PERIODS, ++ runtime->hw.periods_min, ++ HDA_DSP_MAX_BDL_ENTRIES); ++ + /* Only S16 and S32 supported by HDA hardware when used without DSP */ + if (sdev->dspless_mode_selected) + snd_pcm_hw_constraint_mask64(substream->runtime, SNDRV_PCM_HW_PARAM_FORMAT, +-- +2.43.0 + diff --git a/queue-6.6/asoc-sof-sof-audio-skip-unprepare-for-in-use-widgets.patch b/queue-6.6/asoc-sof-sof-audio-skip-unprepare-for-in-use-widgets.patch new file mode 100644 index 00000000000..7244e4639ca --- /dev/null +++ b/queue-6.6/asoc-sof-sof-audio-skip-unprepare-for-in-use-widgets.patch @@ -0,0 +1,46 @@ +From 9ddf7bcb7b2d3e60fc0d7c05c0e9e831477f46cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 15:12:03 +0300 +Subject: ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on error + rollback + +From: Peter Ujfalusi + +[ Upstream commit 6f2a43e3d14f6e31a3b041a1043195d02c54d615 ] + +If the ipc_prepare() callback fails for a module instance, on error rewind +we must skip the ipc_unprepare() call for ones that has positive use count. + +The positive use count means that the module instance is in active use, it +cannot be unprepared. + +The issue affects capture direction paths with branches (single dai with +multiple PCMs), the affected widgets are in the shared part of the paths. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20240612121203.15468-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/sof-audio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c +index 77cc64ac71131..5162625834725 100644 +--- a/sound/soc/sof/sof-audio.c ++++ b/sound/soc/sof/sof-audio.c +@@ -488,7 +488,7 @@ sof_prepare_widgets_in_path(struct snd_sof_dev *sdev, struct snd_soc_dapm_widget + if (ret < 0) { + /* unprepare the source widget */ + if (widget_ops[widget->id].ipc_unprepare && +- swidget && swidget->prepared) { ++ swidget && swidget->prepared && swidget->use_count == 0) { + widget_ops[widget->id].ipc_unprepare(swidget); + swidget->prepared = false; + } +-- +2.43.0 + diff --git a/queue-6.6/asoc-ti-davinci-mcasp-set-min-period-size-using-fifo.patch b/queue-6.6/asoc-ti-davinci-mcasp-set-min-period-size-using-fifo.patch new file mode 100644 index 00000000000..5ff2dd6a89a --- /dev/null +++ b/queue-6.6/asoc-ti-davinci-mcasp-set-min-period-size-using-fifo.patch @@ -0,0 +1,69 @@ +From dad3092ebaf1867d671428647cb7614a00033ffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 18:02:56 +0530 +Subject: ASoC: ti: davinci-mcasp: Set min period size using FIFO config + +From: Jai Luthra + +[ Upstream commit c5dcf8ab10606e76c1d8a0ec77f27d84a392e874 ] + +The minimum period size was enforced to 64 as older devices integrating +McASP with EDMA used an internal FIFO of 64 samples. + +With UDMA based platforms this internal McASP FIFO is optional, as the +DMA engine internally does some buffering which is already accounted for +when registering the platform. So we should read the actual FIFO +configuration (txnumevt/rxnumevt) instead of hardcoding frames.min to +64. + +Acked-by: Peter Ujfalusi +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240611-asoc_next-v3-2-fcfd84b12164@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/davinci-mcasp.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c +index a5c2cca38d01a..8c8b2a2f6f862 100644 +--- a/sound/soc/ti/davinci-mcasp.c ++++ b/sound/soc/ti/davinci-mcasp.c +@@ -1474,10 +1474,11 @@ static int davinci_mcasp_hw_rule_min_periodsize( + { + struct snd_interval *period_size = hw_param_interval(params, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE); ++ u8 numevt = *((u8 *)rule->private); + struct snd_interval frames; + + snd_interval_any(&frames); +- frames.min = 64; ++ frames.min = numevt; + frames.integer = 1; + + return snd_interval_refine(period_size, &frames); +@@ -1492,6 +1493,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + u32 max_channels = 0; + int i, dir, ret; + int tdm_slots = mcasp->tdm_slots; ++ u8 *numevt; + + /* Do not allow more then one stream per direction */ + if (mcasp->substreams[substream->stream]) +@@ -1591,9 +1593,12 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + return ret; + } + ++ numevt = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) ? ++ &mcasp->txnumevt : ++ &mcasp->rxnumevt; + snd_pcm_hw_rule_add(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, +- davinci_mcasp_hw_rule_min_periodsize, NULL, ++ davinci_mcasp_hw_rule_min_periodsize, numevt, + SNDRV_PCM_HW_PARAM_PERIOD_SIZE, -1); + + return 0; +-- +2.43.0 + diff --git a/queue-6.6/asoc-ti-omap-hdmi-fix-too-long-driver-name.patch b/queue-6.6/asoc-ti-omap-hdmi-fix-too-long-driver-name.patch new file mode 100644 index 00000000000..e4aaf80580a --- /dev/null +++ b/queue-6.6/asoc-ti-omap-hdmi-fix-too-long-driver-name.patch @@ -0,0 +1,43 @@ +From 9b55017841a4da0b71b49020829a3bb39daf6a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 14:58:47 +0200 +Subject: ASoC: ti: omap-hdmi: Fix too long driver name + +From: Primoz Fiser + +[ Upstream commit 524d3f126362b6033e92cbe107ae2158d7fbff94 ] + +Set driver name to "HDMI". This simplifies the code and gets rid of +the following error messages: + + ASoC: driver name too long 'HDMI 58040000.encoder' -> 'HDMI_58040000_e' + +Signed-off-by: Primoz Fiser +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20240610125847.773394-1-primoz.fiser@norik.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/omap-hdmi.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/sound/soc/ti/omap-hdmi.c b/sound/soc/ti/omap-hdmi.c +index a3663ab065ac2..0a731b21e5a58 100644 +--- a/sound/soc/ti/omap-hdmi.c ++++ b/sound/soc/ti/omap-hdmi.c +@@ -354,11 +354,7 @@ static int omap_hdmi_audio_probe(struct platform_device *pdev) + if (!card) + return -ENOMEM; + +- card->name = devm_kasprintf(dev, GFP_KERNEL, +- "HDMI %s", dev_name(ad->dssdev)); +- if (!card->name) +- return -ENOMEM; +- ++ card->name = "HDMI"; + card->owner = THIS_MODULE; + card->dai_link = + devm_kzalloc(dev, sizeof(*(card->dai_link)), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.6/asoc-topology-do-not-assign-fields-that-are-already-.patch b/queue-6.6/asoc-topology-do-not-assign-fields-that-are-already-.patch new file mode 100644 index 00000000000..9c3a4cef19b --- /dev/null +++ b/queue-6.6/asoc-topology-do-not-assign-fields-that-are-already-.patch @@ -0,0 +1,44 @@ +From aa7824c08fa79a08ec23a823c7a2a6d8ecb8d238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 12:28:17 +0200 +Subject: ASoC: topology: Do not assign fields that are already set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit daf0b99d4720c9f05bdb81c73b2efdb43fa9def3 ] + +The routes are allocated with kzalloc(), so all fields are zeroed by +default, skip unnecessary assignments. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20240603102818.36165-4-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-topology.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index c63545b27d450..8b58a7864703e 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1072,11 +1072,7 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg, + break; + } + +- /* set to NULL atm for tplg users */ +- route->connected = NULL; +- if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) { +- route->control = NULL; +- } else { ++ if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) != 0) { + route->control = devm_kmemdup(tplg->dev, elem->control, + min(strlen(elem->control), + SNDRV_CTL_ELEM_ID_NAME_MAXLEN), +-- +2.43.0 + diff --git a/queue-6.6/asoc-topology-fix-references-to-freed-memory.patch b/queue-6.6/asoc-topology-fix-references-to-freed-memory.patch new file mode 100644 index 00000000000..d6becea49a2 --- /dev/null +++ b/queue-6.6/asoc-topology-fix-references-to-freed-memory.patch @@ -0,0 +1,72 @@ +From b2929fca48f2aa8dddd45ce8026de135356015d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 12:28:15 +0200 +Subject: ASoC: topology: Fix references to freed memory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 97ab304ecd95c0b1703ff8c8c3956dc6e2afe8e1 ] + +Most users after parsing a topology file, release memory used by it, so +having pointer references directly into topology file contents is wrong. +Use devm_kmemdup(), to allocate memory as needed. + +Reported-by: Jason Montleon +Link: https://github.com/thesofproject/avs-topology-xml/issues/22#issuecomment-2127892605 +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20240603102818.36165-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-topology.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 2362c282ec8b3..c63545b27d450 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1060,15 +1060,32 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg, + break; + } + +- route->source = elem->source; +- route->sink = elem->sink; ++ route->source = devm_kmemdup(tplg->dev, elem->source, ++ min(strlen(elem->source), ++ SNDRV_CTL_ELEM_ID_NAME_MAXLEN), ++ GFP_KERNEL); ++ route->sink = devm_kmemdup(tplg->dev, elem->sink, ++ min(strlen(elem->sink), SNDRV_CTL_ELEM_ID_NAME_MAXLEN), ++ GFP_KERNEL); ++ if (!route->source || !route->sink) { ++ ret = -ENOMEM; ++ break; ++ } + + /* set to NULL atm for tplg users */ + route->connected = NULL; +- if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) ++ if (strnlen(elem->control, SNDRV_CTL_ELEM_ID_NAME_MAXLEN) == 0) { + route->control = NULL; +- else +- route->control = elem->control; ++ } else { ++ route->control = devm_kmemdup(tplg->dev, elem->control, ++ min(strlen(elem->control), ++ SNDRV_CTL_ELEM_ID_NAME_MAXLEN), ++ GFP_KERNEL); ++ if (!route->control) { ++ ret = -ENOMEM; ++ break; ++ } ++ } + + /* add route dobj to dobj_list */ + route->dobj.type = SND_SOC_DOBJ_GRAPH; +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-btnxpuart-enable-power-save-feature-on-sta.patch b/queue-6.6/bluetooth-btnxpuart-enable-power-save-feature-on-sta.patch new file mode 100644 index 00000000000..aafd8b184fb --- /dev/null +++ b/queue-6.6/bluetooth-btnxpuart-enable-power-save-feature-on-sta.patch @@ -0,0 +1,46 @@ +From d80b6a2e2c47c607eb0a1928098cb9b5278aeece Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 13:50:39 +0530 +Subject: Bluetooth: btnxpuart: Enable Power Save feature on startup + +From: Neeraj Sanjay Kale + +[ Upstream commit 4183a7be77009fc31c5760429fe095f163bf96a9 ] + +This sets the default power save mode setting to enabled. + +The power save feature is now stable and stress test issues, such as the +TX timeout error, have been resolved. +commit c7ee0bc8db32 ("Bluetooth: btnxpuart: Resolve TX timeout error in +power save stress test") + +With this setting, the driver will send the vendor command to FW at +startup, to enable power save feature. + +User can disable this feature using the following vendor command: +hcitool cmd 3f 23 03 00 00 (HCI_NXP_AUTO_SLEEP_MODE) + +Signed-off-by: Neeraj Sanjay Kale +Reviewed-by: Paul Menzel +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btnxpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c +index abccd571cf3ee..5c5a5b752419e 100644 +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -280,7 +280,7 @@ static u8 crc8_table[CRC8_TABLE_SIZE]; + + /* Default configurations */ + #define DEFAULT_H2C_WAKEUP_MODE WAKEUP_METHOD_BREAK +-#define DEFAULT_PS_MODE PS_MODE_DISABLE ++#define DEFAULT_PS_MODE PS_MODE_ENABLE + #define FW_INIT_BAUDRATE HCI_NXP_PRI_BAUDRATE + + static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode, +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch b/queue-6.6/bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch new file mode 100644 index 00000000000..69010762998 --- /dev/null +++ b/queue-6.6/bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch @@ -0,0 +1,54 @@ +From ce971dff8252ac4ef3e48bf4dc05fdd7f7ea51f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 20:00:32 +0900 +Subject: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() + +From: Tetsuo Handa + +[ Upstream commit 0d151a103775dd9645c78c97f77d6e2a5298d913 ] + +syzbot is reporting that calling hci_release_dev() from hci_error_reset() +due to hci_dev_put() from hci_error_reset() can cause deadlock at +destroy_workqueue(), for hci_error_reset() is called from +hdev->req_workqueue which destroy_workqueue() needs to flush. + +We need to make sure that hdev->{rx_work,cmd_work,tx_work} which are +queued into hdev->workqueue and hdev->{power_on,error_reset} which are +queued into hdev->req_workqueue are no longer running by the moment + + destroy_workqueue(hdev->workqueue); + destroy_workqueue(hdev->req_workqueue); + +are called from hci_release_dev(). + +Call cancel_work_sync() on these work items from hci_unregister_dev() +as soon as hdev->list is removed from hci_dev_list. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=da0a9c9721e36db712e8 +Signed-off-by: Tetsuo Handa +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 3817d6369f0cc..b4d5b7200ff9c 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2704,7 +2704,11 @@ void hci_unregister_dev(struct hci_dev *hdev) + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); + ++ cancel_work_sync(&hdev->rx_work); ++ cancel_work_sync(&hdev->cmd_work); ++ cancel_work_sync(&hdev->tx_work); + cancel_work_sync(&hdev->power_on); ++ cancel_work_sync(&hdev->error_reset); + + hci_cmd_sync_clear(hdev); + +-- +2.43.0 + diff --git a/queue-6.6/bluetooth-l2cap-sync-sock-recv-cb-and-release.patch b/queue-6.6/bluetooth-l2cap-sync-sock-recv-cb-and-release.patch new file mode 100644 index 00000000000..5edae236e9d --- /dev/null +++ b/queue-6.6/bluetooth-l2cap-sync-sock-recv-cb-and-release.patch @@ -0,0 +1,93 @@ +From 8137c152ac488995788dbdaa3e80bda3045cb1bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2024 09:45:54 +0800 +Subject: bluetooth/l2cap: sync sock recv cb and release + +From: Edward Adam Davis + +[ Upstream commit 89e856e124f9ae548572c56b1b70c2255705f8fe ] + +The problem occurs between the system call to close the sock and hci_rx_work, +where the former releases the sock and the latter accesses it without lock protection. + + CPU0 CPU1 + ---- ---- + sock_close hci_rx_work + l2cap_sock_release hci_acldata_packet + l2cap_sock_kill l2cap_recv_frame + sk_free l2cap_conless_channel + l2cap_sock_recv_cb + +If hci_rx_work processes the data that needs to be received before the sock is +closed, then everything is normal; Otherwise, the work thread may access the +released sock when receiving data. + +Add a chan mutex in the rx callback of the sock to achieve synchronization between +the sock release and recv cb. + +Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer. + +Reported-and-tested-by: syzbot+b7f6f8c9303466e16c8a@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_sock.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index 97d0a0f5829a6..ae19d5deba3ae 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1250,6 +1250,10 @@ static void l2cap_sock_kill(struct sock *sk) + + BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); + ++ /* Sock is dead, so set chan data to NULL, avoid other task use invalid ++ * sock pointer. ++ */ ++ l2cap_pi(sk)->chan->data = NULL; + /* Kill poor orphan */ + + l2cap_chan_put(l2cap_pi(sk)->chan); +@@ -1492,12 +1496,25 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) + + static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + { +- struct sock *sk = chan->data; +- struct l2cap_pinfo *pi = l2cap_pi(sk); ++ struct sock *sk; ++ struct l2cap_pinfo *pi; + int err; + +- lock_sock(sk); ++ /* To avoid race with sock_release, a chan lock needs to be added here ++ * to synchronize the sock. ++ */ ++ l2cap_chan_hold(chan); ++ l2cap_chan_lock(chan); ++ sk = chan->data; + ++ if (!sk) { ++ l2cap_chan_unlock(chan); ++ l2cap_chan_put(chan); ++ return -ENXIO; ++ } ++ ++ pi = l2cap_pi(sk); ++ lock_sock(sk); + if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { + err = -ENOMEM; + goto done; +@@ -1546,6 +1563,8 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + + done: + release_sock(sk); ++ l2cap_chan_unlock(chan); ++ l2cap_chan_put(chan); + + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/btrfs-qgroup-fix-quota-root-leak-after-quota-disable.patch b/queue-6.6/btrfs-qgroup-fix-quota-root-leak-after-quota-disable.patch new file mode 100644 index 00000000000..810d29f493e --- /dev/null +++ b/queue-6.6/btrfs-qgroup-fix-quota-root-leak-after-quota-disable.patch @@ -0,0 +1,59 @@ +From bd197c3664203396674bc4545addd4753f679deb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 12:32:00 +0100 +Subject: btrfs: qgroup: fix quota root leak after quota disable failure + +From: Filipe Manana + +[ Upstream commit a7e4c6a3031c74078dba7fa36239d0f4fe476c53 ] + +If during the quota disable we fail when cleaning the quota tree or when +deleting the root from the root tree, we jump to the 'out' label without +ever dropping the reference on the quota root, resulting in a leak of the +root since fs_info->quota_root is no longer pointing to the root (we have +set it to NULL just before those steps). + +Fix this by always doing a btrfs_put_root() call under the 'out' label. +This is a problem that exists since qgroups were first added in 2012 by +commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but +back then we missed a kfree on the quota root and free_extent_buffer() +calls on its root and commit root nodes, since back then roots were not +yet reference counted. + +Reviewed-by: Boris Burkov +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/qgroup.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 99ea2c6d31944..223dfbf009938 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -1228,7 +1228,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info) + + int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + { +- struct btrfs_root *quota_root; ++ struct btrfs_root *quota_root = NULL; + struct btrfs_trans_handle *trans = NULL; + int ret = 0; + +@@ -1323,9 +1323,9 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info) + btrfs_free_tree_block(trans, btrfs_root_id(quota_root), + quota_root->node, 0, 1); + +- btrfs_put_root(quota_root); + + out: ++ btrfs_put_root(quota_root); + mutex_unlock(&fs_info->qgroup_ioctl_lock); + if (ret && trans) + btrfs_end_transaction(trans); +-- +2.43.0 + diff --git a/queue-6.6/bytcr_rt5640-inverse-jack-detect-for-archos-101-cesi.patch b/queue-6.6/bytcr_rt5640-inverse-jack-detect-for-archos-101-cesi.patch new file mode 100644 index 00000000000..c3331f8bb91 --- /dev/null +++ b/queue-6.6/bytcr_rt5640-inverse-jack-detect-for-archos-101-cesi.patch @@ -0,0 +1,48 @@ +From b0b137adfe01b943e83cd08a186aead11dcabe57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jun 2024 19:02:51 +0200 +Subject: bytcr_rt5640 : inverse jack detect for Archos 101 cesium + +From: Thomas GENTY + +[ Upstream commit e3209a1827646daaab744aa6a5767b1f57fb5385 ] + +When headphones are plugged in, they appear absent; when they are removed, +they appear present. +Add a specific entry in bytcr_rt5640 for this device + +Signed-off-by: Thomas GENTY +Reviewed-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240608170251.99936-1-tomlohave@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 651408c6f399d..5b8b21ade9cfe 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -610,6 +610,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "ARCHOS 101 CESIUM"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_JD_NOT_INV | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ARCHOS"), +-- +2.43.0 + diff --git a/queue-6.6/cachefiles-add-consistency-check-for-copen-cread.patch b/queue-6.6/cachefiles-add-consistency-check-for-copen-cread.patch new file mode 100644 index 00000000000..f0693c2ac97 --- /dev/null +++ b/queue-6.6/cachefiles-add-consistency-check-for-copen-cread.patch @@ -0,0 +1,96 @@ +From c4558ab27f9d95c7dcdde50313daeac7cd92d195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 19:43:02 +0800 +Subject: cachefiles: add consistency check for copen/cread + +From: Baokun Li + +[ Upstream commit a26dc49df37e996876f50a0210039b2d211fdd6f ] + +This prevents malicious processes from completing random copen/cread +requests and crashing the system. Added checks are listed below: + + * Generic, copen can only complete open requests, and cread can only + complete read requests. + * For copen, ondemand_id must not be 0, because this indicates that the + request has not been read by the daemon. + * For cread, the object corresponding to fd and req should be the same. + +Signed-off-by: Baokun Li +Link: https://lore.kernel.org/r/20240522114308.2402121-7-libaokun@huaweicloud.com +Acked-by: Jeff Layton +Reviewed-by: Jingbo Xu +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/cachefiles/ondemand.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c +index 51173ab6dbd84..c3241cede5289 100644 +--- a/fs/cachefiles/ondemand.c ++++ b/fs/cachefiles/ondemand.c +@@ -97,12 +97,12 @@ static loff_t cachefiles_ondemand_fd_llseek(struct file *filp, loff_t pos, + } + + static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl, +- unsigned long arg) ++ unsigned long id) + { + struct cachefiles_object *object = filp->private_data; + struct cachefiles_cache *cache = object->volume->cache; + struct cachefiles_req *req; +- unsigned long id; ++ XA_STATE(xas, &cache->reqs, id); + + if (ioctl != CACHEFILES_IOC_READ_COMPLETE) + return -EINVAL; +@@ -110,10 +110,15 @@ static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl, + if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags)) + return -EOPNOTSUPP; + +- id = arg; +- req = xa_erase(&cache->reqs, id); +- if (!req) ++ xa_lock(&cache->reqs); ++ req = xas_load(&xas); ++ if (!req || req->msg.opcode != CACHEFILES_OP_READ || ++ req->object != object) { ++ xa_unlock(&cache->reqs); + return -EINVAL; ++ } ++ xas_store(&xas, NULL); ++ xa_unlock(&cache->reqs); + + trace_cachefiles_ondemand_cread(object, id); + complete(&req->done); +@@ -142,6 +147,7 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + unsigned long id; + long size; + int ret; ++ XA_STATE(xas, &cache->reqs, 0); + + if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags)) + return -EOPNOTSUPP; +@@ -165,9 +171,16 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + if (ret) + return ret; + +- req = xa_erase(&cache->reqs, id); +- if (!req) ++ xa_lock(&cache->reqs); ++ xas.xa_index = id; ++ req = xas_load(&xas); ++ if (!req || req->msg.opcode != CACHEFILES_OP_OPEN || ++ !req->object->ondemand->ondemand_id) { ++ xa_unlock(&cache->reqs); + return -EINVAL; ++ } ++ xas_store(&xas, NULL); ++ xa_unlock(&cache->reqs); + + /* fail OPEN request if copen format is invalid */ + ret = kstrtol(psize, 0, &size); +-- +2.43.0 + diff --git a/queue-6.6/cachefiles-make-on-demand-read-killable.patch b/queue-6.6/cachefiles-make-on-demand-read-killable.patch new file mode 100644 index 00000000000..2b26b07b4bd --- /dev/null +++ b/queue-6.6/cachefiles-make-on-demand-read-killable.patch @@ -0,0 +1,103 @@ +From 1b60621b3f3d46ea62f1d60965987775745c786c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 19:43:08 +0800 +Subject: cachefiles: make on-demand read killable + +From: Baokun Li + +[ Upstream commit bc9dde6155464e906e630a0a5c17a4cab241ffbb ] + +Replacing wait_for_completion() with wait_for_completion_killable() in +cachefiles_ondemand_send_req() allows us to kill processes that might +trigger a hunk_task if the daemon is abnormal. + +But now only CACHEFILES_OP_READ is killable, because OP_CLOSE and OP_OPEN +is initiated from kworker context and the signal is prohibited in these +kworker. + +Note that when the req in xas changes, i.e. xas_load(&xas) != req, it +means that a process will complete the current request soon, so wait +again for the request to be completed. + +In addition, add the cachefiles_ondemand_finish_req() helper function to +simplify the code. + +Suggested-by: Hou Tao +Signed-off-by: Baokun Li +Link: https://lore.kernel.org/r/20240522114308.2402121-13-libaokun@huaweicloud.com +Acked-by: Jeff Layton +Reviewed-by: Jia Zhu +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/cachefiles/ondemand.c | 40 ++++++++++++++++++++++++++++------------ + 1 file changed, 28 insertions(+), 12 deletions(-) + +diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c +index 37489ca2e8571..2185e2908dba8 100644 +--- a/fs/cachefiles/ondemand.c ++++ b/fs/cachefiles/ondemand.c +@@ -380,6 +380,20 @@ static struct cachefiles_req *cachefiles_ondemand_select_req(struct xa_state *xa + return NULL; + } + ++static inline bool cachefiles_ondemand_finish_req(struct cachefiles_req *req, ++ struct xa_state *xas, int err) ++{ ++ if (unlikely(!xas || !req)) ++ return false; ++ ++ if (xa_cmpxchg(xas->xa, xas->xa_index, req, NULL, 0) != req) ++ return false; ++ ++ req->error = err; ++ complete(&req->done); ++ return true; ++} ++ + ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache, + char __user *_buffer, size_t buflen) + { +@@ -443,16 +457,8 @@ ssize_t cachefiles_ondemand_daemon_read(struct cachefiles_cache *cache, + out: + cachefiles_put_object(req->object, cachefiles_obj_put_read_req); + /* Remove error request and CLOSE request has no reply */ +- if (ret || msg->opcode == CACHEFILES_OP_CLOSE) { +- xas_reset(&xas); +- xas_lock(&xas); +- if (xas_load(&xas) == req) { +- req->error = ret; +- complete(&req->done); +- xas_store(&xas, NULL); +- } +- xas_unlock(&xas); +- } ++ if (ret || msg->opcode == CACHEFILES_OP_CLOSE) ++ cachefiles_ondemand_finish_req(req, &xas, ret); + cachefiles_req_put(req); + return ret ? ret : n; + } +@@ -557,8 +563,18 @@ static int cachefiles_ondemand_send_req(struct cachefiles_object *object, + goto out; + + wake_up_all(&cache->daemon_pollwq); +- wait_for_completion(&req->done); +- ret = req->error; ++wait: ++ ret = wait_for_completion_killable(&req->done); ++ if (!ret) { ++ ret = req->error; ++ } else { ++ ret = -EINTR; ++ if (!cachefiles_ondemand_finish_req(req, &xas, ret)) { ++ /* Someone will complete it soon. */ ++ cpu_relax(); ++ goto wait; ++ } ++ } + cachefiles_req_put(req); + return ret; + out: +-- +2.43.0 + diff --git a/queue-6.6/cachefiles-set-object-to-close-if-ondemand_id-0-in-c.patch b/queue-6.6/cachefiles-set-object-to-close-if-ondemand_id-0-in-c.patch new file mode 100644 index 00000000000..71d8dec251c --- /dev/null +++ b/queue-6.6/cachefiles-set-object-to-close-if-ondemand_id-0-in-c.patch @@ -0,0 +1,65 @@ +From 30f3b92bc1da8d4c818923cc715f623647b6c6fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 19:43:06 +0800 +Subject: cachefiles: Set object to close if ondemand_id < 0 in copen + +From: Zizhi Wo + +[ Upstream commit 4f8703fb3482f92edcfd31661857b16fec89c2c0 ] + +If copen is maliciously called in the user mode, it may delete the request +corresponding to the random id. And the request may have not been read yet. + +Note that when the object is set to reopen, the open request will be done +with the still reopen state in above case. As a result, the request +corresponding to this object is always skipped in select_req function, so +the read request is never completed and blocks other process. + +Fix this issue by simply set object to close if its id < 0 in copen. + +Signed-off-by: Zizhi Wo +Signed-off-by: Baokun Li +Link: https://lore.kernel.org/r/20240522114308.2402121-11-libaokun@huaweicloud.com +Acked-by: Jeff Layton +Reviewed-by: Jia Zhu +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/cachefiles/ondemand.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c +index c3241cede5289..37489ca2e8571 100644 +--- a/fs/cachefiles/ondemand.c ++++ b/fs/cachefiles/ondemand.c +@@ -182,6 +182,7 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + xas_store(&xas, NULL); + xa_unlock(&cache->reqs); + ++ info = req->object->ondemand; + /* fail OPEN request if copen format is invalid */ + ret = kstrtol(psize, 0, &size); + if (ret) { +@@ -201,7 +202,6 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + goto out; + } + +- info = req->object->ondemand; + spin_lock(&info->lock); + /* + * The anonymous fd was closed before copen ? Fail the request. +@@ -241,6 +241,11 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) + wake_up_all(&cache->daemon_pollwq); + + out: ++ spin_lock(&info->lock); ++ /* Need to set object close to avoid reopen status continuing */ ++ if (info->ondemand_id == CACHEFILES_ONDEMAND_ID_CLOSED) ++ cachefiles_ondemand_set_object_close(req->object); ++ spin_unlock(&info->lock); + complete(&req->done); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.6/can-kvaser_usb-fix-return-value-for-hif_usb_send_reg.patch b/queue-6.6/can-kvaser_usb-fix-return-value-for-hif_usb_send_reg.patch new file mode 100644 index 00000000000..f5dfc02f12f --- /dev/null +++ b/queue-6.6/can-kvaser_usb-fix-return-value-for-hif_usb_send_reg.patch @@ -0,0 +1,36 @@ +From 9e30b051528b98408bb82a6744f9eb0f69c0180d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 12:10:20 +0800 +Subject: can: kvaser_usb: fix return value for hif_usb_send_regout + +From: Chen Ni + +[ Upstream commit 0d34d8163fd87978a6abd792e2d8ad849f4c3d57 ] + +As the potential failure of usb_submit_urb(), it should be better to +return the err variable to catch the error. + +Signed-off-by: Chen Ni +Link: https://lore.kernel.org/all/20240521041020.1519416-1-nichen@iscas.ac.cn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index 387edc8f89bfb..15f28b6fe758e 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -292,7 +292,7 @@ int kvaser_usb_send_cmd_async(struct kvaser_usb_net_priv *priv, void *cmd, + } + usb_free_urb(urb); + +- return 0; ++ return err; + } + + int kvaser_usb_can_rx_over_error(struct net_device *netdev) +-- +2.43.0 + diff --git a/queue-6.6/cpumask-limit-force_nr_cpus-to-just-the-up-case.patch b/queue-6.6/cpumask-limit-force_nr_cpus-to-just-the-up-case.patch new file mode 100644 index 00000000000..527bcb7ae36 --- /dev/null +++ b/queue-6.6/cpumask-limit-force_nr_cpus-to-just-the-up-case.patch @@ -0,0 +1,65 @@ +From 26d57975942b3b52adb7acf3b1f941458d72e1ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 09:00:04 -0700 +Subject: cpumask: limit FORCE_NR_CPUS to just the UP case + +From: Linus Torvalds + +[ Upstream commit 5d272dd1b3430bb31fa30042490fa081512424e4 ] + +Hardcoding the number of CPUs at compile time does improve code +generation, but if you get it wrong the result will be confusion. + +We already limited this earlier to only "experts" (see commit +fe5759d5bfda "cpumask: limit visibility of FORCE_NR_CPUS"), but with +distro kernel configs often having EXPERT enabled, that turns out to not +be much of a limit. + +To quote the philosophers at Disney: "Everyone can be an expert. And +when everyone's an expert, no one will be". + +There's a runtime warning if you then set nr_cpus to anything but the +forced number, but apparently that can be ignored too [1] and by then +it's pretty much too late anyway. + +If we had some real way to limit this to "embedded only", maybe it would +be worth it, but let's see if anybody even notices that the option is +gone. We need to simplify kernel configuration anyway. + +Link: https://lore.kernel.org/all/20240618105036.208a8860@rorschach.local.home/ [1] +Reported-by: Steven Rostedt +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Paul McKenney +Cc: Thomas Gleixner +Cc: Peter Zijlstra +Cc: Yury Norov +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/Kconfig | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/lib/Kconfig b/lib/Kconfig +index c686f4adc1246..ee365b7402f19 100644 +--- a/lib/Kconfig ++++ b/lib/Kconfig +@@ -539,13 +539,7 @@ config CPUMASK_OFFSTACK + stack overflow. + + config FORCE_NR_CPUS +- bool "Set number of CPUs at compile time" +- depends on SMP && EXPERT && !COMPILE_TEST +- help +- Say Yes if you have NR_CPUS set to an actual number of possible +- CPUs in your system, not to a default value. This forces the core +- code to rely on compile-time value and optimize kernel routines +- better. ++ def_bool !SMP + + config CPU_RMAP + bool +-- +2.43.0 + diff --git a/queue-6.6/drivers-perf-riscv-reset-the-counter-to-hpmevent-map.patch b/queue-6.6/drivers-perf-riscv-reset-the-counter-to-hpmevent-map.patch new file mode 100644 index 00000000000..babc0390e88 --- /dev/null +++ b/queue-6.6/drivers-perf-riscv-reset-the-counter-to-hpmevent-map.patch @@ -0,0 +1,40 @@ +From e8c4641877371370976eb2462e0cce0cbbdd13c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 00:51:42 -0700 +Subject: drivers/perf: riscv: Reset the counter to hpmevent mapping while + starting cpus + +From: Samuel Holland + +[ Upstream commit 7dd646cf745c34d31e7ed2a52265e9ca8308f58f ] + +Currently, we stop all the counters while a new cpu is brought online. +However, the hpmevent to counter mappings are not reset. The firmware may +have some stale encoding in their mapping structure which may lead to +undesirable results. We have not encountered such scenario though. + +Signed-off-by: Samuel Holland +Signed-off-by: Atish Patra +Link: https://lore.kernel.org/r/20240628-misc_perf_fixes-v4-2-e01cfddcf035@rivosinc.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + drivers/perf/riscv_pmu_sbi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c +index d80b4b09152df..ae16ecb15f2d9 100644 +--- a/drivers/perf/riscv_pmu_sbi.c ++++ b/drivers/perf/riscv_pmu_sbi.c +@@ -611,7 +611,7 @@ static inline void pmu_sbi_stop_all(struct riscv_pmu *pmu) + * which may include counters that are not enabled yet. + */ + sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_STOP, +- 0, pmu->cmask, 0, 0, 0, 0); ++ 0, pmu->cmask, SBI_PMU_STOP_FLAG_RESET, 0, 0, 0); + } + + static inline void pmu_sbi_stop_hw_ctrs(struct riscv_pmu *pmu) +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-account-for-cursor-prefetch-bw-in-dm.patch b/queue-6.6/drm-amd-display-account-for-cursor-prefetch-bw-in-dm.patch new file mode 100644 index 00000000000..7eaf32e8b0e --- /dev/null +++ b/queue-6.6/drm-amd-display-account-for-cursor-prefetch-bw-in-dm.patch @@ -0,0 +1,44 @@ +From 1f2ea0ce03f84c09ab08e585e4997e2f3231a8b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:11:38 -0400 +Subject: drm/amd/display: Account for cursor prefetch BW in DML1 mode support + +From: Alvin Lee + +[ Upstream commit 074b3a886713f69d98d30bb348b1e4cb3ce52b22 ] + +[Description] +We need to ensure to take into account cursor prefetch BW in +mode support or we may pass ModeQuery but fail an actual flip +which will cause a hang. Flip may fail because the cursor_pre_bw +is populated during mode programming (and mode programming is +never called prior to ModeQuery). + +Reviewed-by: Chaitanya Dhere +Reviewed-by: Nevenko Stupar +Signed-off-by: Jerry Zuo +Signed-off-by: Alvin Lee +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +index 6c84b0fa40f44..0782a34689a00 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +@@ -3364,6 +3364,9 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + &mode_lib->vba.UrgentBurstFactorLumaPre[k], + &mode_lib->vba.UrgentBurstFactorChromaPre[k], + &mode_lib->vba.NotUrgentLatencyHidingPre[k]); ++ ++ v->cursor_bw_pre[k] = mode_lib->vba.NumberOfCursors[k] * mode_lib->vba.CursorWidth[k][0] * mode_lib->vba.CursorBPP[k][0] / ++ 8.0 / (mode_lib->vba.HTotal[k] / mode_lib->vba.PixelClock[k]) * v->VRatioPreY[i][j][k]; + } + + { +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-add-refresh-rate-range-check.patch b/queue-6.6/drm-amd-display-add-refresh-rate-range-check.patch new file mode 100644 index 00000000000..38ca455d2ee --- /dev/null +++ b/queue-6.6/drm-amd-display-add-refresh-rate-range-check.patch @@ -0,0 +1,50 @@ +From 9471ca5080ff397e9a4c4c330cd33ae2dd9a5b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 14:03:55 +0800 +Subject: drm/amd/display: Add refresh rate range check + +From: Tom Chung + +[ Upstream commit 74ad26b36d303ac233eccadc5c3a8d7ee4709f31 ] + +[Why] +We only enable the VRR while monitor usable refresh rate range +is greater than 10 Hz. +But we did not check the range in DRM_EDID_FEATURE_CONTINUOUS_FREQ +case. + +[How] +Add a refresh rate range check before set the freesync_capable flag +in DRM_EDID_FEATURE_CONTINUOUS_FREQ case. + +Reviewed-by: Mario Limonciello +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Jerry Zuo +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c1a0fd47802a0..6e5ca0c755c3b 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10759,9 +10759,11 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, + if (is_dp_capable_without_timing_msa(adev->dm.dc, + amdgpu_dm_connector)) { + if (edid->features & DRM_EDID_FEATURE_CONTINUOUS_FREQ) { +- freesync_capable = true; + amdgpu_dm_connector->min_vfreq = connector->display_info.monitor_range.min_vfreq; + amdgpu_dm_connector->max_vfreq = connector->display_info.monitor_range.max_vfreq; ++ if (amdgpu_dm_connector->max_vfreq - ++ amdgpu_dm_connector->min_vfreq > 10) ++ freesync_capable = true; + } else { + edid_check_required = edid->version > 1 || + (edid->version == 1 && +-- +2.43.0 + diff --git a/queue-6.6/drm-amd-display-fix-refresh-rate-range-for-some-pane.patch b/queue-6.6/drm-amd-display-fix-refresh-rate-range-for-some-pane.patch new file mode 100644 index 00000000000..7c374a291e7 --- /dev/null +++ b/queue-6.6/drm-amd-display-fix-refresh-rate-range-for-some-pane.patch @@ -0,0 +1,98 @@ +From 1631edfccb4b501eab50539e5350175b04367164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 15:38:56 +0800 +Subject: drm/amd/display: Fix refresh rate range for some panel + +From: Tom Chung + +[ Upstream commit 9ef1548aeaa8858e7aee2152bf95cc71cdcd6dff ] + +[Why] +Some of the panels does not have the refresh rate range info +in base EDID and only have the refresh rate range info in +DisplayID block. +It will cause the max/min freesync refresh rate set to 0. + +[How] +Try to parse the refresh rate range info from DisplayID if the +max/min refresh rate is 0. + +Reviewed-by: Sun peng Li +Signed-off-by: Jerry Zuo +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 48 +++++++++++++++++++ + 1 file changed, 48 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6e5ca0c755c3b..60db3800666ec 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10630,6 +10630,49 @@ static bool parse_edid_cea(struct amdgpu_dm_connector *aconnector, + return ret; + } + ++static void parse_edid_displayid_vrr(struct drm_connector *connector, ++ struct edid *edid) ++{ ++ u8 *edid_ext = NULL; ++ int i; ++ int j = 0; ++ u16 min_vfreq; ++ u16 max_vfreq; ++ ++ if (edid == NULL || edid->extensions == 0) ++ return; ++ ++ /* Find DisplayID extension */ ++ for (i = 0; i < edid->extensions; i++) { ++ edid_ext = (void *)(edid + (i + 1)); ++ if (edid_ext[0] == DISPLAYID_EXT) ++ break; ++ } ++ ++ if (edid_ext == NULL) ++ return; ++ ++ while (j < EDID_LENGTH) { ++ /* Get dynamic video timing range from DisplayID if available */ ++ if (EDID_LENGTH - j > 13 && edid_ext[j] == 0x25 && ++ (edid_ext[j+1] & 0xFE) == 0 && (edid_ext[j+2] == 9)) { ++ min_vfreq = edid_ext[j+9]; ++ if (edid_ext[j+1] & 7) ++ max_vfreq = edid_ext[j+10] + ((edid_ext[j+11] & 3) << 8); ++ else ++ max_vfreq = edid_ext[j+10]; ++ ++ if (max_vfreq && min_vfreq) { ++ connector->display_info.monitor_range.max_vfreq = max_vfreq; ++ connector->display_info.monitor_range.min_vfreq = min_vfreq; ++ ++ return; ++ } ++ } ++ j++; ++ } ++} ++ + static int parse_amd_vsdb(struct amdgpu_dm_connector *aconnector, + struct edid *edid, struct amdgpu_hdmi_vsdb_info *vsdb_info) + { +@@ -10752,6 +10795,11 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector, + if (!adev->dm.freesync_module) + goto update; + ++ /* Some eDP panels only have the refresh rate range info in DisplayID */ ++ if ((connector->display_info.monitor_range.min_vfreq == 0 || ++ connector->display_info.monitor_range.max_vfreq == 0)) ++ parse_edid_displayid_vrr(connector, edid); ++ + if (edid && (sink->sink_signal == SIGNAL_TYPE_DISPLAY_PORT || + sink->sink_signal == SIGNAL_TYPE_EDP)) { + bool edid_check_required = false; +-- +2.43.0 + diff --git a/queue-6.6/drm-amdgpu-indicate-cu-havest-info-to-cp.patch b/queue-6.6/drm-amdgpu-indicate-cu-havest-info-to-cp.patch new file mode 100644 index 00000000000..cc02034540d --- /dev/null +++ b/queue-6.6/drm-amdgpu-indicate-cu-havest-info-to-cp.patch @@ -0,0 +1,66 @@ +From 373b53ee0ef40b37ed0f8aedcc6dfd6fe5bc7d88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 09:30:50 -0400 +Subject: drm/amdgpu: Indicate CU havest info to CP + +From: Harish Kasiviswanathan + +[ Upstream commit 49c9ffabde555c841392858d8b9e6cf58998a50c ] + +To achieve full occupancy CP hardware needs to know if CUs in SE are +symmetrically or asymmetrically harvested + +v2: Reset is_symmetric_cus for each loop + +Signed-off-by: Harish Kasiviswanathan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +index af46823e43367..caa04d897c2de 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +@@ -4290,9 +4290,10 @@ static u32 gfx_v9_4_3_get_cu_active_bitmap(struct amdgpu_device *adev, int xcc_i + static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev, + struct amdgpu_cu_info *cu_info) + { +- int i, j, k, counter, xcc_id, active_cu_number = 0; +- u32 mask, bitmap, ao_bitmap, ao_cu_mask = 0; ++ int i, j, k, prev_counter, counter, xcc_id, active_cu_number = 0; ++ u32 mask, bitmap, ao_bitmap, ao_cu_mask = 0, tmp; + unsigned disable_masks[4 * 4]; ++ bool is_symmetric_cus; + + if (!adev || !cu_info) + return -EINVAL; +@@ -4310,6 +4311,7 @@ static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev, + + mutex_lock(&adev->grbm_idx_mutex); + for (xcc_id = 0; xcc_id < NUM_XCC(adev->gfx.xcc_mask); xcc_id++) { ++ is_symmetric_cus = true; + for (i = 0; i < adev->gfx.config.max_shader_engines; i++) { + for (j = 0; j < adev->gfx.config.max_sh_per_se; j++) { + mask = 1; +@@ -4337,6 +4339,15 @@ static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev, + ao_cu_mask |= (ao_bitmap << (i * 16 + j * 8)); + cu_info->ao_cu_bitmap[i][j] = ao_bitmap; + } ++ if (i && is_symmetric_cus && prev_counter != counter) ++ is_symmetric_cus = false; ++ prev_counter = counter; ++ } ++ if (is_symmetric_cus) { ++ tmp = RREG32_SOC15(GC, GET_INST(GC, xcc_id), regCP_CPC_DEBUG); ++ tmp = REG_SET_FIELD(tmp, CP_CPC_DEBUG, CPC_HARVESTING_RELAUNCH_DISABLE, 1); ++ tmp = REG_SET_FIELD(tmp, CP_CPC_DEBUG, CPC_HARVESTING_DISPATCH_DISABLE, 1); ++ WREG32_SOC15(GC, GET_INST(GC, xcc_id), regCP_CPC_DEBUG, tmp); + } + gfx_v9_4_3_xcc_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff, + xcc_id); +-- +2.43.0 + diff --git a/queue-6.6/drm-exynos-dp-drop-driver-owner-initialization.patch b/queue-6.6/drm-exynos-dp-drop-driver-owner-initialization.patch new file mode 100644 index 00000000000..d87926fd8a2 --- /dev/null +++ b/queue-6.6/drm-exynos-dp-drop-driver-owner-initialization.patch @@ -0,0 +1,35 @@ +From 286362034ba872a0dbf574a3f29740dde42efc4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 15:11:29 +0200 +Subject: drm/exynos: dp: drop driver owner initialization + +From: Krzysztof Kozlowski + +[ Upstream commit 1f3512cdf8299f9edaea9046d53ea324a7730bab ] + +Core in platform_driver_register() already sets the .owner, so driver +does not need to. Whatever is set here will be anyway overwritten by +main driver calling platform_driver_register(). + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_dp.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/exynos_dp.c +index 3404ec1367fb9..71ee824c4140b 100644 +--- a/drivers/gpu/drm/exynos/exynos_dp.c ++++ b/drivers/gpu/drm/exynos/exynos_dp.c +@@ -288,7 +288,6 @@ struct platform_driver dp_driver = { + .remove = exynos_dp_remove, + .driver = { + .name = "exynos-dp", +- .owner = THIS_MODULE, + .pm = pm_ptr(&exynos_dp_pm_ops), + .of_match_table = exynos_dp_match, + }, +-- +2.43.0 + diff --git a/queue-6.6/drm-mediatek-call-drm_atomic_helper_shutdown-at-shut.patch b/queue-6.6/drm-mediatek-call-drm_atomic_helper_shutdown-at-shut.patch new file mode 100644 index 00000000000..2e961c6efb7 --- /dev/null +++ b/queue-6.6/drm-mediatek-call-drm_atomic_helper_shutdown-at-shut.patch @@ -0,0 +1,65 @@ +From 5fd98a2a423bdfceb7d832b3d4320674e2c5dd86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 10:27:44 -0700 +Subject: drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time + +From: Douglas Anderson + +[ Upstream commit c38896ca6318c2df20bbe6c8e3f633e071fda910 ] + +Based on grepping through the source code this driver appears to be +missing a call to drm_atomic_helper_shutdown() at system shutdown +time. Among other things, this means that if a panel is in use that it +won't be cleanly powered off at system shutdown time. + +The fact that we should call drm_atomic_helper_shutdown() in the case +of OS shutdown/restart comes straight out of the kernel doc "driver +instance overview" in drm_drv.c. + +This driver users the component model and shutdown happens in the base +driver. The "drvdata" for this driver will always be valid if +shutdown() is called and as of commit 2a073968289d +("drm/atomic-helper: drm_atomic_helper_shutdown(NULL) should be a +noop") we don't need to confirm that "drm" is non-NULL. + +Suggested-by: Maxime Ripard +Reviewed-by: Maxime Ripard +Reviewed-by: Fei Shao +Tested-by: Fei Shao +Signed-off-by: Douglas Anderson +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240611102744.v2.1.I2b014f90afc4729b6ecc7b5ddd1f6dedcea4625b@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index cdd506c803733..37d8113ba92f0 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -926,6 +926,13 @@ static void mtk_drm_remove(struct platform_device *pdev) + of_node_put(private->comp_node[i]); + } + ++static void mtk_drm_shutdown(struct platform_device *pdev) ++{ ++ struct mtk_drm_private *private = platform_get_drvdata(pdev); ++ ++ drm_atomic_helper_shutdown(private->drm); ++} ++ + static int mtk_drm_sys_prepare(struct device *dev) + { + struct mtk_drm_private *private = dev_get_drvdata(dev); +@@ -957,6 +964,7 @@ static const struct dev_pm_ops mtk_drm_pm_ops = { + static struct platform_driver mtk_drm_platform_driver = { + .probe = mtk_drm_probe, + .remove_new = mtk_drm_remove, ++ .shutdown = mtk_drm_shutdown, + .driver = { + .name = "mediatek-drm", + .pm = &mtk_drm_pm_ops, +-- +2.43.0 + diff --git a/queue-6.6/drm-panel-orientation-quirks-add-quirk-for-aya-neo-k.patch b/queue-6.6/drm-panel-orientation-quirks-add-quirk-for-aya-neo-k.patch new file mode 100644 index 00000000000..240e45e5733 --- /dev/null +++ b/queue-6.6/drm-panel-orientation-quirks-add-quirk-for-aya-neo-k.patch @@ -0,0 +1,42 @@ +From 30489f0d46c500f1c09acf25bf226023934b72da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Mar 2024 23:04:00 +0100 +Subject: drm: panel-orientation-quirks: Add quirk for Aya Neo KUN + +From: Tobias Jakobi + +[ Upstream commit f74fb5df429ebc6a614dc5aa9e44d7194d402e5a ] + +Similar to the other Aya Neo devices this one features +again a portrait screen, here with a native resolution +of 1600x2560. + +Signed-off-by: Tobias Jakobi +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20240310220401.895591-1-tjakobi@math.uni-bielefeld.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 426bbee2d9f5e..5db52d6c5c35c 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_BOARD_NAME, "NEXT"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* AYA NEO KUN */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_BOARD_NAME, "KUN"), ++ }, ++ .driver_data = (void *)&lcd1600x2560_rightside_up, + }, { /* Chuwi HiBook (CWI514) */ + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"), +-- +2.43.0 + diff --git a/queue-6.6/drm-radeon-check-bo_va-bo-is-non-null-before-using-i.patch b/queue-6.6/drm-radeon-check-bo_va-bo-is-non-null-before-using-i.patch new file mode 100644 index 00000000000..0fe5aa0f0cc --- /dev/null +++ b/queue-6.6/drm-radeon-check-bo_va-bo-is-non-null-before-using-i.patch @@ -0,0 +1,36 @@ +From 85233ba118ffe6c0dbbc5025c23888795975ebb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 14:31:34 +0200 +Subject: drm/radeon: check bo_va->bo is non-NULL before using it + +From: Pierre-Eric Pelloux-Prayer + +[ Upstream commit 6fb15dcbcf4f212930350eaee174bb60ed40a536 ] + +The call to radeon_vm_clear_freed might clear bo_va->bo, so +we have to check it before dereferencing it. + +Signed-off-by: Pierre-Eric Pelloux-Prayer +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c +index 3fec3acdaf284..27225d1fe8d2e 100644 +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -641,7 +641,7 @@ static void radeon_gem_va_update_vm(struct radeon_device *rdev, + if (r) + goto error_unlock; + +- if (bo_va->it.start) ++ if (bo_va->it.start && bo_va->bo) + r = radeon_vm_bo_update(rdev, bo_va, bo_va->bo->tbo.resource); + + error_unlock: +-- +2.43.0 + diff --git a/queue-6.6/drm-vmwgfx-fix-missing-hypervisor_guest-dependency.patch b/queue-6.6/drm-vmwgfx-fix-missing-hypervisor_guest-dependency.patch new file mode 100644 index 00000000000..da3c87ec057 --- /dev/null +++ b/queue-6.6/drm-vmwgfx-fix-missing-hypervisor_guest-dependency.patch @@ -0,0 +1,41 @@ +From dc3326b59bacc2816b76e49f36d13a0b2dd63702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2024 18:25:10 -0700 +Subject: drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency + +From: Alexey Makhalov + +[ Upstream commit 8c4d6945fe5bd04ff847c3c788abd34ca354ecee ] + +VMWARE_HYPERCALL alternative will not work as intended without VMware guest code +initialization. + + [ bp: note that this doesn't reproduce with newer gccs so it must be + something gcc-9-specific. ] + +Closes: https://lore.kernel.org/oe-kbuild-all/202406152104.FxakP1MB-lkp@intel.com/ +Reported-by: kernel test robot +Signed-off-by: Alexey Makhalov +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240616012511.198243-1-alexey.makhalov@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig +index faddae3d6ac2e..6f1ac940cbae7 100644 +--- a/drivers/gpu/drm/vmwgfx/Kconfig ++++ b/drivers/gpu/drm/vmwgfx/Kconfig +@@ -2,7 +2,7 @@ + config DRM_VMWGFX + tristate "DRM driver for VMware Virtual GPU" + depends on DRM && PCI && MMU +- depends on X86 || ARM64 ++ depends on (X86 && HYPERVISOR_GUEST) || ARM64 + select DRM_TTM + select DRM_TTM_HELPER + select MAPPING_DIRTY_HELPERS +-- +2.43.0 + diff --git a/queue-6.6/efi-libstub-zboot.lds-discard-.discard-sections.patch b/queue-6.6/efi-libstub-zboot.lds-discard-.discard-sections.patch new file mode 100644 index 00000000000..33ec25f71d5 --- /dev/null +++ b/queue-6.6/efi-libstub-zboot.lds-discard-.discard-sections.patch @@ -0,0 +1,54 @@ +From 74163ece3a8205f8f8200269214773d0931270d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 10:32:43 -0700 +Subject: efi/libstub: zboot.lds: Discard .discard sections + +From: Nathan Chancellor + +[ Upstream commit 5134acb15d9ef27aa2b90aad46d4e89fcef79fdc ] + +When building ARCH=loongarch defconfig + CONFIG_UNWINDER_ORC=y using +LLVM, there is a warning from ld.lld when linking the EFI zboot image +due to the use of unreachable() in number() in vsprintf.c: + + ld.lld: warning: drivers/firmware/efi/libstub/lib.a(vsprintf.stub.o):(.discard.unreachable+0x0): has non-ABS relocation R_LARCH_32_PCREL against symbol '' + +If the compiler cannot eliminate the default case for any reason, the +.discard.unreachable section will remain in the final binary but the +entire point of any section prefixed with .discard is that it is only +used at compile time, so it can be discarded via /DISCARD/ in a linker +script. The asm-generic vmlinux.lds.h includes .discard and .discard.* +in the COMMON_DISCARDS macro but that is not used for zboot.lds, as it +is not a kernel image linker script. + +Add .discard and .discard.* to /DISCARD/ in zboot.lds, so that any +sections meant to be discarded at link time are not included in the +final zboot image. This issue is not specific to LoongArch, it is just +the first architecture to select CONFIG_OBJTOOL, which defines +annotate_unreachable() as an asm statement to add the +.discard.unreachable section, and use the EFI stub. + +Closes: https://github.com/ClangBuiltLinux/linux/issues/2023 +Signed-off-by: Nathan Chancellor +Acked-by: Huacai Chen +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/zboot.lds | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/efi/libstub/zboot.lds b/drivers/firmware/efi/libstub/zboot.lds +index ac8c0ef851581..af2c82f7bd902 100644 +--- a/drivers/firmware/efi/libstub/zboot.lds ++++ b/drivers/firmware/efi/libstub/zboot.lds +@@ -41,6 +41,7 @@ SECTIONS + } + + /DISCARD/ : { ++ *(.discard .discard.*) + *(.modinfo .init.modinfo) + } + } +-- +2.43.0 + diff --git a/queue-6.6/erofs-ensure-m_llen-is-reset-to-0-if-metadata-is-inv.patch b/queue-6.6/erofs-ensure-m_llen-is-reset-to-0-if-metadata-is-inv.patch new file mode 100644 index 00000000000..76adf01675f --- /dev/null +++ b/queue-6.6/erofs-ensure-m_llen-is-reset-to-0-if-metadata-is-inv.patch @@ -0,0 +1,44 @@ +From 6bbdf850b1dfad27ff9a8871cb6a79c70d2e2bf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 02:57:43 +0800 +Subject: erofs: ensure m_llen is reset to 0 if metadata is invalid + +From: Gao Xiang + +[ Upstream commit 9b32b063be1001e322c5f6e01f2a649636947851 ] + +Sometimes, the on-disk metadata might be invalid due to user +interrupts, storage failures, or other unknown causes. + +In that case, z_erofs_map_blocks_iter() may still return a valid +m_llen while other fields remain invalid (e.g., m_plen can be 0). + +Due to the return value of z_erofs_scan_folio() in some path will +be ignored on purpose, the following z_erofs_scan_folio() could +then use the invalid value by accident. + +Let's reset m_llen to 0 to prevent this. + +Link: https://lore.kernel.org/r/20240629185743.2819229-1-hsiangkao@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index e313c936351d5..6bd435a565f61 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -723,6 +723,8 @@ int z_erofs_map_blocks_iter(struct inode *inode, struct erofs_map_blocks *map, + + err = z_erofs_do_map_blocks(inode, map, flags); + out: ++ if (err) ++ map->m_llen = 0; + trace_z_erofs_map_blocks_iter_exit(inode, map, flags, err); + return err; + } +-- +2.43.0 + diff --git a/queue-6.6/fs-better-handle-deep-ancestor-chains-in-is_subdir.patch b/queue-6.6/fs-better-handle-deep-ancestor-chains-in-is_subdir.patch new file mode 100644 index 00000000000..18af8ee2a13 --- /dev/null +++ b/queue-6.6/fs-better-handle-deep-ancestor-chains-in-is_subdir.patch @@ -0,0 +1,80 @@ +From 8bd8ebc314159a60e5932b658234f3c7f3e7969c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 21:03:26 +0200 +Subject: fs: better handle deep ancestor chains in is_subdir() + +From: Christian Brauner + +[ Upstream commit 391b59b045004d5b985d033263ccba3e941a7740 ] + +Jan reported that 'cd ..' may take a long time in deep directory +hierarchies under a bind-mount. If concurrent renames happen it is +possible to livelock in is_subdir() because it will keep retrying. + +Change is_subdir() from simply retrying over and over to retry once and +then acquire the rename lock to handle deep ancestor chains better. The +list of alternatives to this approach were less then pleasant. Change +the scope of rcu lock to cover the whole walk while at it. + +A big thanks to Jan and Linus. Both Jan and Linus had proposed +effectively the same thing just that one version ended up being slightly +more elegant. + +Reported-by: Jan Kara +Signed-off-by: Linus Torvalds +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/dcache.c | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/fs/dcache.c b/fs/dcache.c +index 186c0e1b5713f..4030c010a7682 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -3208,28 +3208,25 @@ EXPORT_SYMBOL(d_splice_alias); + + bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry) + { +- bool result; ++ bool subdir; + unsigned seq; + + if (new_dentry == old_dentry) + return true; + +- do { +- /* for restarting inner loop in case of seq retry */ +- seq = read_seqbegin(&rename_lock); +- /* +- * Need rcu_readlock to protect against the d_parent trashing +- * due to d_move +- */ +- rcu_read_lock(); +- if (d_ancestor(old_dentry, new_dentry)) +- result = true; +- else +- result = false; +- rcu_read_unlock(); +- } while (read_seqretry(&rename_lock, seq)); +- +- return result; ++ /* Access d_parent under rcu as d_move() may change it. */ ++ rcu_read_lock(); ++ seq = read_seqbegin(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ /* Try lockless once... */ ++ if (read_seqretry(&rename_lock, seq)) { ++ /* ...else acquire lock for progress even on deep chains. */ ++ read_seqlock_excl(&rename_lock); ++ subdir = d_ancestor(old_dentry, new_dentry); ++ read_sequnlock_excl(&rename_lock); ++ } ++ rcu_read_unlock(); ++ return subdir; + } + EXPORT_SYMBOL(is_subdir); + +-- +2.43.0 + diff --git a/queue-6.6/fs-file-fix-the-check-in-find_next_fd.patch b/queue-6.6/fs-file-fix-the-check-in-find_next_fd.patch new file mode 100644 index 00000000000..094a17ac6ed --- /dev/null +++ b/queue-6.6/fs-file-fix-the-check-in-find_next_fd.patch @@ -0,0 +1,51 @@ +From 13b4629da0b0d454a2cad6faf9a432ccc1571a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 00:06:56 +0800 +Subject: fs/file: fix the check in find_next_fd() + +From: Yuntao Wang + +[ Upstream commit ed8c7fbdfe117abbef81f65428ba263118ef298a ] + +The maximum possible return value of find_next_zero_bit(fdt->full_fds_bits, +maxbit, bitbit) is maxbit. This return value, multiplied by BITS_PER_LONG, +gives the value of bitbit, which can never be greater than maxfd, it can +only be equal to maxfd at most, so the following check 'if (bitbit > maxfd)' +will never be true. + +Moreover, when bitbit equals maxfd, it indicates that there are no unused +fds, and the function can directly return. + +Fix this check. + +Signed-off-by: Yuntao Wang +Link: https://lore.kernel.org/r/20240529160656.209352-1-yuntao.wang@linux.dev +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/file.c b/fs/file.c +index 3e4a4dfa38fca..a815f6eddc511 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -481,12 +481,12 @@ struct files_struct init_files = { + + static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start) + { +- unsigned int maxfd = fdt->max_fds; ++ unsigned int maxfd = fdt->max_fds; /* always multiple of BITS_PER_LONG */ + unsigned int maxbit = maxfd / BITS_PER_LONG; + unsigned int bitbit = start / BITS_PER_LONG; + + bitbit = find_next_zero_bit(fdt->full_fds_bits, maxbit, bitbit) * BITS_PER_LONG; +- if (bitbit > maxfd) ++ if (bitbit >= maxfd) + return maxfd; + if (bitbit > start) + start = bitbit; +-- +2.43.0 + diff --git a/queue-6.6/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch b/queue-6.6/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch new file mode 100644 index 00000000000..084960afe99 --- /dev/null +++ b/queue-6.6/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch @@ -0,0 +1,56 @@ +From 7134f8bc5196e0639aba8c5bda6ff0d5105cc96e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 07:29:15 +0300 +Subject: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race + +From: Ian Ray + +[ Upstream commit bfc6444b57dc7186b6acc964705d7516cbaf3904 ] + +Ensure that `i2c_lock' is held when setting interrupt latch and mask in +pca953x_irq_bus_sync_unlock() in order to avoid races. + +The other (non-probe) call site pca953x_gpio_set_multiple() ensures the +lock is held before calling pca953x_write_regs(). + +The problem occurred when a request raced against irq_bus_sync_unlock() +approximately once per thousand reboots on an i.MX8MP based system. + + * Normal case + + 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 + 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 + 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 + 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 + + * Race case + + 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 + 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** + 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 + 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 + +Signed-off-by: Ian Ray +Link: https://lore.kernel.org/r/20240620042915.2173-1-ian.ray@gehealthcare.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index bdd50a78e4142..ce9a94e332801 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -766,6 +766,8 @@ static void pca953x_irq_bus_sync_unlock(struct irq_data *d) + int level; + + if (chip->driver_data & PCA_PCAL) { ++ guard(mutex)(&chip->i2c_lock); ++ + /* Enable latch on interrupt-enabled inputs */ + pca953x_write_regs(chip, PCAL953X_IN_LATCH, chip->irq_mask); + +-- +2.43.0 + diff --git a/queue-6.6/hfsplus-fix-uninit-value-in-copy_name.patch b/queue-6.6/hfsplus-fix-uninit-value-in-copy_name.patch new file mode 100644 index 00000000000..ef1d153f7f9 --- /dev/null +++ b/queue-6.6/hfsplus-fix-uninit-value-in-copy_name.patch @@ -0,0 +1,70 @@ +From ea9f5f1058362d2303990f4eb75f6cb206d144c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 13:21:46 +0800 +Subject: hfsplus: fix uninit-value in copy_name + +From: Edward Adam Davis + +[ Upstream commit 0570730c16307a72f8241df12363f76600baf57d ] + +[syzbot reported] +BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 + sized_strscpy+0xc4/0x160 + copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 + hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750 + vfs_listxattr fs/xattr.c:493 [inline] + listxattr+0x1f3/0x6b0 fs/xattr.c:840 + path_listxattr fs/xattr.c:864 [inline] + __do_sys_listxattr fs/xattr.c:876 [inline] + __se_sys_listxattr fs/xattr.c:873 [inline] + __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 + x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Uninit was created at: + slab_post_alloc_hook mm/slub.c:3877 [inline] + slab_alloc_node mm/slub.c:3918 [inline] + kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065 + kmalloc include/linux/slab.h:628 [inline] + hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699 + vfs_listxattr fs/xattr.c:493 [inline] + listxattr+0x1f3/0x6b0 fs/xattr.c:840 + path_listxattr fs/xattr.c:864 [inline] + __do_sys_listxattr fs/xattr.c:876 [inline] + __se_sys_listxattr fs/xattr.c:873 [inline] + __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873 + x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f +[Fix] +When allocating memory to strbuf, initialize memory to 0. + +Reported-and-tested-by: syzbot+efde959319469ff8d4d7@syzkaller.appspotmail.com +Signed-off-by: Edward Adam Davis +Link: https://lore.kernel.org/r/tencent_8BBB6433BC9E1C1B7B4BDF1BF52574BA8808@qq.com +Reported-and-tested-by: syzbot+01ade747b16e9c8030e0@syzkaller.appspotmail.com +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/hfsplus/xattr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/hfsplus/xattr.c b/fs/hfsplus/xattr.c +index 58021e73c00bf..f7f9d0889df34 100644 +--- a/fs/hfsplus/xattr.c ++++ b/fs/hfsplus/xattr.c +@@ -698,7 +698,7 @@ ssize_t hfsplus_listxattr(struct dentry *dentry, char *buffer, size_t size) + return err; + } + +- strbuf = kmalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + ++ strbuf = kzalloc(NLS_MAX_CHARSET_SIZE * HFSPLUS_ATTR_MAX_STRLEN + + XATTR_MAC_OSX_PREFIX_LEN + 1, GFP_KERNEL); + if (!strbuf) { + res = -ENOMEM; +-- +2.43.0 + diff --git a/queue-6.6/hid-ignore-battery-for-elan-touchscreens-2f2c-and-41.patch b/queue-6.6/hid-ignore-battery-for-elan-touchscreens-2f2c-and-41.patch new file mode 100644 index 00000000000..5783edff488 --- /dev/null +++ b/queue-6.6/hid-ignore-battery-for-elan-touchscreens-2f2c-and-41.patch @@ -0,0 +1,56 @@ +From cc501163117a3ef65e8e82033a6416823648042b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:53:43 +0200 +Subject: HID: Ignore battery for ELAN touchscreens 2F2C and 4116 + +From: Louis Dalibard + +[ Upstream commit a3a5a37efba11b7cf1a86abe7bccfbcdb521764e ] + +At least ASUS Zenbook 14 (2023) and ASUS Zenbook 14 Pro (2023) are affected. + +The touchscreen reports a battery status of 0% and jumps to 1% when a +stylus is used. + +The device ID was added and the battery ignore quirk was enabled for it. + +[jkosina@suse.com: reformatted changelog a bit] +Signed-off-by: Louis Dalibard +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 ++ + drivers/hid/hid-input.c | 4 ++++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 89aef5874202c..4246348ca16e9 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -418,6 +418,8 @@ + #define I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG 0x29DF + #define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8 + #define I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN 0x2C82 ++#define I2C_DEVICE_ID_ASUS_UX3402_TOUCHSCREEN 0x2F2C ++#define I2C_DEVICE_ID_ASUS_UX6404_TOUCHSCREEN 0x4116 + #define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544 + #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706 + #define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 8bb16e9b94aa5..c9094a4f281e9 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -377,6 +377,10 @@ static const struct hid_device_id hid_battery_quirks[] = { + HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_UX3402_TOUCHSCREEN), ++ HID_BATTERY_QUIRK_IGNORE }, ++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_UX6404_TOUCHSCREEN), ++ HID_BATTERY_QUIRK_IGNORE }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN), + HID_BATTERY_QUIRK_IGNORE }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN), +-- +2.43.0 + diff --git a/queue-6.6/ibmvnic-add-tx-check-to-prevent-skb-leak.patch b/queue-6.6/ibmvnic-add-tx-check-to-prevent-skb-leak.patch new file mode 100644 index 00000000000..3dda6278af1 --- /dev/null +++ b/queue-6.6/ibmvnic-add-tx-check-to-prevent-skb-leak.patch @@ -0,0 +1,63 @@ +From 2b87ccbd3c872618302b1d2560c7bfedb7e5937e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 10:23:11 -0500 +Subject: ibmvnic: Add tx check to prevent skb leak + +From: Nick Child + +[ Upstream commit 0983d288caf984de0202c66641577b739caad561 ] + +Below is a summary of how the driver stores a reference to an skb during +transmit: + tx_buff[free_map[consumer_index]]->skb = new_skb; + free_map[consumer_index] = IBMVNIC_INVALID_MAP; + consumer_index ++; +Where variable data looks like this: + free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3] + consumer_index^ + tx_buff == [skb=null, skb=, skb=, skb=null, skb=null] + +The driver has checks to ensure that free_map[consumer_index] pointed to +a valid index but there was no check to ensure that this index pointed +to an unused/null skb address. So, if, by some chance, our free_map and +tx_buff lists become out of sync then we were previously risking an +skb memory leak. This could then cause tcp congestion control to stop +sending packets, eventually leading to ETIMEDOUT. + +Therefore, add a conditional to ensure that the skb address is null. If +not then warn the user (because this is still a bug that should be +patched) and free the old pointer to prevent memleak/tcp problems. + +Signed-off-by: Nick Child +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index ca21e55335b23..61685c3053ad7 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2478,6 +2478,18 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + (tx_pool->consumer_index + 1) % tx_pool->num_buffers; + + tx_buff = &tx_pool->tx_buff[bufidx]; ++ ++ /* Sanity checks on our free map to make sure it points to an index ++ * that is not being occupied by another skb. If skb memory is ++ * not freed then we see congestion control kick in and halt tx. ++ */ ++ if (unlikely(tx_buff->skb)) { ++ dev_warn_ratelimited(dev, "TX free map points to untracked skb (%s %d idx=%d)\n", ++ skb_is_gso(skb) ? "tso_pool" : "tx_pool", ++ queue_num, bufidx); ++ dev_kfree_skb_any(tx_buff->skb); ++ } ++ + tx_buff->skb = skb; + tx_buff->index = bufidx; + tx_buff->pool_index = queue_num; +-- +2.43.0 + diff --git a/queue-6.6/ila-block-bh-in-ila_output.patch b/queue-6.6/ila-block-bh-in-ila_output.patch new file mode 100644 index 00000000000..bc6bd7857bb --- /dev/null +++ b/queue-6.6/ila-block-bh-in-ila_output.patch @@ -0,0 +1,60 @@ +From e0e8f240025141455bc767efb49d77319154a771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 13:26:35 +0000 +Subject: ila: block BH in ila_output() + +From: Eric Dumazet + +[ Upstream commit cf28ff8e4c02e1ffa850755288ac954b6ff0db8c ] + +As explained in commit 1378817486d6 ("tipc: block BH +before using dst_cache"), net/core/dst_cache.c +helpers need to be called with BH disabled. + +ila_output() is called from lwtunnel_output() +possibly from process context, and under rcu_read_lock(). + +We might be interrupted by a softirq, re-enter ila_output() +and corrupt dst_cache data structures. + +Fix the race by using local_bh_disable(). + +Signed-off-by: Eric Dumazet +Acked-by: Paolo Abeni +Link: https://lore.kernel.org/r/20240531132636.2637995-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/ila/ila_lwt.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c +index 8c1ce78956bae..9d37f7164e732 100644 +--- a/net/ipv6/ila/ila_lwt.c ++++ b/net/ipv6/ila/ila_lwt.c +@@ -58,7 +58,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + return orig_dst->lwtstate->orig_output(net, sk, skb); + } + ++ local_bh_disable(); + dst = dst_cache_get(&ilwt->dst_cache); ++ local_bh_enable(); + if (unlikely(!dst)) { + struct ipv6hdr *ip6h = ipv6_hdr(skb); + struct flowi6 fl6; +@@ -86,8 +88,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- if (ilwt->connected) ++ if (ilwt->connected) { ++ local_bh_disable(); + dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr); ++ local_bh_enable(); ++ } + } + + skb_dst_set(skb, dst); +-- +2.43.0 + diff --git a/queue-6.6/input-add-event-code-for-accessibility-key.patch b/queue-6.6/input-add-event-code-for-accessibility-key.patch new file mode 100644 index 00000000000..318913191ac --- /dev/null +++ b/queue-6.6/input-add-event-code-for-accessibility-key.patch @@ -0,0 +1,63 @@ +From 0d7802a6b40af0d734830b3ab987d3b1da530b5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 23:10:47 +0000 +Subject: input: Add event code for accessibility key + +From: Aseda Aboagye + +[ Upstream commit 0c7dd00de018ff70b3452c424901816e26366a8a ] + +HUTRR116 added support for a new usage titled "System Accessibility +Binding" which toggles a system-wide bound accessibility UI or command. +This commit simply adds a new event code for the usage. + +Signed-off-by: Aseda Aboagye +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/Zl-e97O9nvudco5z@google.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-debug.c | 1 + + drivers/hid/hid-input.c | 1 + + include/uapi/linux/input-event-codes.h | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index 7dd83ec74f8a9..c629ab161d5b2 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -974,6 +974,7 @@ static const char *keys[KEY_MAX + 1] = { + [KEY_CAMERA_ACCESS_ENABLE] = "CameraAccessEnable", + [KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable", + [KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle", ++ [KEY_ACCESSIBILITY] = "Accessibility", + [KEY_DICTATE] = "Dictate", + [KEY_MICMUTE] = "MicrophoneMute", + [KEY_BRIGHTNESS_MIN] = "BrightnessMin", +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index e03d300d2bac4..d5a6e89c3086e 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -836,6 +836,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */ + switch (usage->hid & 0xf) { + case 0x9: map_key_clear(KEY_MICMUTE); break; ++ case 0xa: map_key_clear(KEY_ACCESSIBILITY); break; + default: goto ignore; + } + break; +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index 03edf2ccdf6c8..39f11ec676fae 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -618,6 +618,7 @@ + #define KEY_CAMERA_ACCESS_ENABLE 0x24b /* Enables programmatic access to camera devices. (HUTRR72) */ + #define KEY_CAMERA_ACCESS_DISABLE 0x24c /* Disables programmatic access to camera devices. (HUTRR72) */ + #define KEY_CAMERA_ACCESS_TOGGLE 0x24d /* Toggles the current state of the camera access control. (HUTRR72) */ ++#define KEY_ACCESSIBILITY 0x24e /* Toggles the system bound accessibility UI/command (HUTRR116) */ + + #define KEY_BRIGHTNESS_MIN 0x250 /* Set Brightness to Minimum */ + #define KEY_BRIGHTNESS_MAX 0x251 /* Set Brightness to Maximum */ +-- +2.43.0 + diff --git a/queue-6.6/input-add-support-for-do-not-disturb.patch b/queue-6.6/input-add-support-for-do-not-disturb.patch new file mode 100644 index 00000000000..2e8130fc833 --- /dev/null +++ b/queue-6.6/input-add-support-for-do-not-disturb.patch @@ -0,0 +1,70 @@ +From 94f3addb48ab3b4e30a6c274dd36dc45af4b1dab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 23:16:32 +0000 +Subject: input: Add support for "Do Not Disturb" + +From: Aseda Aboagye + +[ Upstream commit 22d6d060ac77955291deb43efc2f3f4f9632c6cb ] + +HUTRR94 added support for a new usage titled "System Do Not Disturb" +which toggles a system-wide Do Not Disturb setting. This commit simply +adds a new event code for the usage. + +Signed-off-by: Aseda Aboagye +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/Zl-gUHE70s7wCAoB@google.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-debug.c | 1 + + drivers/hid/hid-input.c | 8 ++++++++ + include/uapi/linux/input-event-codes.h | 1 + + 3 files changed, 10 insertions(+) + +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index c629ab161d5b2..5302bfd527d86 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -975,6 +975,7 @@ static const char *keys[KEY_MAX + 1] = { + [KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable", + [KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle", + [KEY_ACCESSIBILITY] = "Accessibility", ++ [KEY_DO_NOT_DISTURB] = "DoNotDisturb", + [KEY_DICTATE] = "Dictate", + [KEY_MICMUTE] = "MicrophoneMute", + [KEY_BRIGHTNESS_MIN] = "BrightnessMin", +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index d5a6e89c3086e..8bb16e9b94aa5 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -833,6 +833,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + break; + } + ++ if ((usage->hid & 0xf0) == 0x90) { /* SystemControl*/ ++ switch (usage->hid & 0xf) { ++ case 0xb: map_key_clear(KEY_DO_NOT_DISTURB); break; ++ default: goto ignore; ++ } ++ break; ++ } ++ + if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */ + switch (usage->hid & 0xf) { + case 0x9: map_key_clear(KEY_MICMUTE); break; +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index 39f11ec676fae..a4206723f5033 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -619,6 +619,7 @@ + #define KEY_CAMERA_ACCESS_DISABLE 0x24c /* Disables programmatic access to camera devices. (HUTRR72) */ + #define KEY_CAMERA_ACCESS_TOGGLE 0x24d /* Toggles the current state of the camera access control. (HUTRR72) */ + #define KEY_ACCESSIBILITY 0x24e /* Toggles the system bound accessibility UI/command (HUTRR116) */ ++#define KEY_DO_NOT_DISTURB 0x24f /* Toggles the system-wide "Do Not Disturb" control (HUTRR94)*/ + + #define KEY_BRIGHTNESS_MIN 0x250 /* Set Brightness to Minimum */ + #define KEY_BRIGHTNESS_MAX 0x251 /* Set Brightness to Maximum */ +-- +2.43.0 + diff --git a/queue-6.6/input-ads7846-use-spi_device_id-table.patch b/queue-6.6/input-ads7846-use-spi_device_id-table.patch new file mode 100644 index 00000000000..720c51462a6 --- /dev/null +++ b/queue-6.6/input-ads7846-use-spi_device_id-table.patch @@ -0,0 +1,63 @@ +From fc99eade92d8689b0b21d36a85d773fc7c5cbb8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 14:27:02 +0200 +Subject: Input: ads7846 - use spi_device_id table + +From: Alexander Stein + +[ Upstream commit 7c7b1be19b228b450c2945ec379d7fc6bfef9852 ] + +As the driver supports more devices over time the single MODULE_ALIAS +is complete and raises several warnings: +SPI driver ads7846 has no spi_device_id for ti,tsc2046 +SPI driver ads7846 has no spi_device_id for ti,ads7843 +SPI driver ads7846 has no spi_device_id for ti,ads7845 +SPI driver ads7846 has no spi_device_id for ti,ads7873 + +Fix this by adding a spi_device_id table and removing the manual +MODULE_ALIAS. + +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20240619122703.2081476-1-alexander.stein@ew.tq-group.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index faea40dd66d01..a66375700a630 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -1114,6 +1114,16 @@ static const struct of_device_id ads7846_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, ads7846_dt_ids); + ++static const struct spi_device_id ads7846_spi_ids[] = { ++ { "tsc2046", 7846 }, ++ { "ads7843", 7843 }, ++ { "ads7845", 7845 }, ++ { "ads7846", 7846 }, ++ { "ads7873", 7873 }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, ads7846_spi_ids); ++ + static const struct ads7846_platform_data *ads7846_get_props(struct device *dev) + { + struct ads7846_platform_data *pdata; +@@ -1392,10 +1402,10 @@ static struct spi_driver ads7846_driver = { + }, + .probe = ads7846_probe, + .remove = ads7846_remove, ++ .id_table = ads7846_spi_ids, + }; + + module_spi_driver(ads7846_driver); + + MODULE_DESCRIPTION("ADS7846 TouchScreen Driver"); + MODULE_LICENSE("GPL"); +-MODULE_ALIAS("spi:ads7846"); +-- +2.43.0 + diff --git a/queue-6.6/input-elantech-fix-touchpad-state-on-resume-for-leno.patch b/queue-6.6/input-elantech-fix-touchpad-state-on-resume-for-leno.patch new file mode 100644 index 00000000000..0fe9f8b157f --- /dev/null +++ b/queue-6.6/input-elantech-fix-touchpad-state-on-resume-for-leno.patch @@ -0,0 +1,79 @@ +From 7c4d86c307a4281430cb25a9ebfc78a0b4157313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 16:12:07 +0000 +Subject: Input: elantech - fix touchpad state on resume for Lenovo N24 + +From: Jonathan Denose + +[ Upstream commit a69ce592cbe0417664bc5a075205aa75c2ec1273 ] + +The Lenovo N24 on resume becomes stuck in a state where it +sends incorrect packets, causing elantech_packet_check_v4 to fail. +The only way for the device to resume sending the correct packets is for +it to be disabled and then re-enabled. + +This change adds a dmi check to trigger this behavior on resume. + +Signed-off-by: Jonathan Denose +Link: https://lore.kernel.org/r/20240503155020.v2.1.Ifa0e25ebf968d8f307f58d678036944141ab17e6@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elantech.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 4e38229404b4b..b4723ea395eb9 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1476,16 +1476,47 @@ static void elantech_disconnect(struct psmouse *psmouse) + psmouse->private = NULL; + } + ++/* ++ * Some hw_version 4 models fail to properly activate absolute mode on ++ * resume without going through disable/enable cycle. ++ */ ++static const struct dmi_system_id elantech_needs_reenable[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Lenovo N24 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "81AF"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + /* + * Put the touchpad back into absolute mode when reconnecting + */ + static int elantech_reconnect(struct psmouse *psmouse) + { ++ int err; ++ + psmouse_reset(psmouse); + + if (elantech_detect(psmouse, 0)) + return -1; + ++ if (dmi_check_system(elantech_needs_reenable)) { ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to deactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ ++ err = ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ if (err) ++ psmouse_warn(psmouse, "failed to reactivate mouse on %s: %d\n", ++ psmouse->ps2dev.serio->phys, err); ++ } ++ + if (elantech_set_absolute_mode(psmouse)) { + psmouse_err(psmouse, + "failed to put touchpad back into absolute mode.\n"); +-- +2.43.0 + diff --git a/queue-6.6/input-i8042-add-ayaneo-kun-to-i8042-quirk-table.patch b/queue-6.6/input-i8042-add-ayaneo-kun-to-i8042-quirk-table.patch new file mode 100644 index 00000000000..dedfc519b8b --- /dev/null +++ b/queue-6.6/input-i8042-add-ayaneo-kun-to-i8042-quirk-table.patch @@ -0,0 +1,66 @@ +From eaf00f1437af0aa163787a340b5ba65706c00c38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 15:43:07 -0700 +Subject: Input: i8042 - add Ayaneo Kun to i8042 quirk table + +From: Tobias Jakobi + +[ Upstream commit 955af6355ddfe35140f9706a635838212a32513b ] + +See the added comment for details. Also fix a typo in the +quirk's define. + +Signed-off-by: Tobias Jakobi +Link: https://lore.kernel.org/r/20240531190100.3874731-1-tjakobi@math.uni-bielefeld.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index dfc6c581873b7..5b50475ec4140 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -76,7 +76,7 @@ static inline void i8042_write_command(int val) + #define SERIO_QUIRK_PROBE_DEFER BIT(5) + #define SERIO_QUIRK_RESET_ALWAYS BIT(6) + #define SERIO_QUIRK_RESET_NEVER BIT(7) +-#define SERIO_QUIRK_DIECT BIT(8) ++#define SERIO_QUIRK_DIRECT BIT(8) + #define SERIO_QUIRK_DUMBKBD BIT(9) + #define SERIO_QUIRK_NOLOOP BIT(10) + #define SERIO_QUIRK_NOTIMEOUT BIT(11) +@@ -1332,6 +1332,20 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, ++ { ++ /* ++ * The Ayaneo Kun is a handheld device where some the buttons ++ * are handled by an AT keyboard. The keyboard is usually ++ * detected as raw, but sometimes, usually after a cold boot, ++ * it is detected as translated. Make sure that the keyboard ++ * is always in raw mode. ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"), ++ DMI_MATCH(DMI_BOARD_NAME, "KUN"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_DIRECT) ++ }, + { } + }; + +@@ -1655,7 +1669,7 @@ static void __init i8042_check_quirks(void) + if (quirks & SERIO_QUIRK_RESET_NEVER) + i8042_reset = I8042_RESET_NEVER; + } +- if (quirks & SERIO_QUIRK_DIECT) ++ if (quirks & SERIO_QUIRK_DIRECT) + i8042_direct = true; + if (quirks & SERIO_QUIRK_DUMBKBD) + i8042_dumbkbd = true; +-- +2.43.0 + diff --git a/queue-6.6/input-silead-always-support-10-fingers.patch b/queue-6.6/input-silead-always-support-10-fingers.patch new file mode 100644 index 00000000000..ee0f5eaa5d6 --- /dev/null +++ b/queue-6.6/input-silead-always-support-10-fingers.patch @@ -0,0 +1,100 @@ +From 65f27cad33060cdff40bb1622086f9b034360111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 May 2024 21:38:53 +0200 +Subject: Input: silead - Always support 10 fingers + +From: Hans de Goede + +[ Upstream commit 38a38f5a36da9820680d413972cb733349400532 ] + +When support for Silead touchscreens was orginal added some touchscreens +with older firmware versions only supported 5 fingers and this was made +the default requiring the setting of a "silead,max-fingers=10" uint32 +device-property for all touchscreen models which do support 10 fingers. + +There are very few models with the old 5 finger fw, so in practice the +setting of the "silead,max-fingers=10" is boilerplate which needs to +be copy and pasted to every touchscreen config. + +Reporting that 10 fingers are supported on devices which only support +5 fingers doesn't cause any problems for userspace in practice, since +at max 4 finger gestures are supported anyways. Drop the max_fingers +configuration and simply always assume 10 fingers. + +Signed-off-by: Hans de Goede +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20240525193854.39130-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/silead.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index 62f562ad50263..050fa9ca4ec94 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -71,7 +71,6 @@ struct silead_ts_data { + struct regulator_bulk_data regulators[2]; + char fw_name[64]; + struct touchscreen_properties prop; +- u32 max_fingers; + u32 chip_id; + struct input_mt_pos pos[SILEAD_MAX_FINGERS]; + int slots[SILEAD_MAX_FINGERS]; +@@ -136,7 +135,7 @@ static int silead_ts_request_input_dev(struct silead_ts_data *data) + touchscreen_parse_properties(data->input, true, &data->prop); + silead_apply_efi_fw_min_max(data); + +- input_mt_init_slots(data->input, data->max_fingers, ++ input_mt_init_slots(data->input, SILEAD_MAX_FINGERS, + INPUT_MT_DIRECT | INPUT_MT_DROP_UNUSED | + INPUT_MT_TRACK); + +@@ -256,10 +255,10 @@ static void silead_ts_read_data(struct i2c_client *client) + return; + } + +- if (buf[0] > data->max_fingers) { ++ if (buf[0] > SILEAD_MAX_FINGERS) { + dev_warn(dev, "More touches reported then supported %d > %d\n", +- buf[0], data->max_fingers); +- buf[0] = data->max_fingers; ++ buf[0], SILEAD_MAX_FINGERS); ++ buf[0] = SILEAD_MAX_FINGERS; + } + + if (silead_ts_handle_pen_data(data, buf)) +@@ -315,7 +314,6 @@ static void silead_ts_read_data(struct i2c_client *client) + + static int silead_ts_init(struct i2c_client *client) + { +- struct silead_ts_data *data = i2c_get_clientdata(client); + int error; + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_RESET, +@@ -325,7 +323,7 @@ static int silead_ts_init(struct i2c_client *client) + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); + + error = i2c_smbus_write_byte_data(client, SILEAD_REG_TOUCH_NR, +- data->max_fingers); ++ SILEAD_MAX_FINGERS); + if (error) + goto i2c_write_err; + usleep_range(SILEAD_CMD_SLEEP_MIN, SILEAD_CMD_SLEEP_MAX); +@@ -591,13 +589,6 @@ static void silead_ts_read_props(struct i2c_client *client) + const char *str; + int error; + +- error = device_property_read_u32(dev, "silead,max-fingers", +- &data->max_fingers); +- if (error) { +- dev_dbg(dev, "Max fingers read error %d\n", error); +- data->max_fingers = 5; /* Most devices handle up-to 5 fingers */ +- } +- + error = device_property_read_string(dev, "firmware-name", &str); + if (!error) + snprintf(data->fw_name, sizeof(data->fw_name), +-- +2.43.0 + diff --git a/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri-pro.patch b/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri-pro.patch new file mode 100644 index 00000000000..6d02c8cd4bf --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-asus-rog-raikiri-pro.patch @@ -0,0 +1,34 @@ +From 775afb073d774d293c7e0c1b7a54e6fd12226044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:37:48 -0700 +Subject: Input: xpad - add support for ASUS ROG RAIKIRI PRO + +From: Luke D. Jones + +[ Upstream commit cee77149ebe9cd971ba238d87aa10e09bd98f1c9 ] + +Add the VID/PID for ASUS ROG RAIKIRI PRO to the list of known devices. + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20240607223722.1170776-1-luke@ljones.dev +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index cd97a7a9f812d..daf2a46521f01 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -208,6 +208,7 @@ static const struct xpad_device { + { 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 }, + { 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 }, + { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", 0, XTYPE_XBOXONE }, ++ { 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE }, + { 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX }, + { 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, +-- +2.43.0 + diff --git a/queue-6.6/iomap-fix-iomap_adjust_read_range-for-plen-calculati.patch b/queue-6.6/iomap-fix-iomap_adjust_read_range-for-plen-calculati.patch new file mode 100644 index 00000000000..8b5406457fb --- /dev/null +++ b/queue-6.6/iomap-fix-iomap_adjust_read_range-for-plen-calculati.patch @@ -0,0 +1,55 @@ +From f77fded7a1a7db5e35db2023a63d32431d9d612a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 14:25:42 +0530 +Subject: iomap: Fix iomap_adjust_read_range for plen calculation + +From: Ritesh Harjani (IBM) + +[ Upstream commit f5ceb1bbc98c69536d4673a97315e8427e67de1b ] + +If the extent spans the block that contains i_size, we need to handle +both halves separately so that we properly zero data in the page cache +for blocks that are entirely outside of i_size. But this is needed only +when i_size is within the current folio under processing. +"orig_pos + length > isize" can be true for all folios if the mapped +extent length is greater than the folio size. That is making plen to +break for every folio instead of only the last folio. + +So use orig_plen for checking if "orig_pos + orig_plen > isize". + +Signed-off-by: Ritesh Harjani (IBM) +Link: https://lore.kernel.org/r/a32e5f9a4fcfdb99077300c4020ed7ae61d6e0f9.1715067055.git.ritesh.list@gmail.com +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Reviewed-by: Jan Kara +cc: Ojaswin Mujoo +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index 129a85633797a..975fd88c1f0f4 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -201,6 +201,7 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio, + unsigned block_size = (1 << block_bits); + size_t poff = offset_in_folio(folio, *pos); + size_t plen = min_t(loff_t, folio_size(folio) - poff, length); ++ size_t orig_plen = plen; + unsigned first = poff >> block_bits; + unsigned last = (poff + plen - 1) >> block_bits; + +@@ -237,7 +238,7 @@ static void iomap_adjust_read_range(struct inode *inode, struct folio *folio, + * handle both halves separately so that we properly zero data in the + * page cache for blocks that are entirely outside of i_size. + */ +- if (orig_pos <= isize && orig_pos + length > isize) { ++ if (orig_pos <= isize && orig_pos + orig_plen > isize) { + unsigned end = offset_in_folio(folio, isize - 1) >> block_bits; + + if (first <= end && last > end) +-- +2.43.0 + diff --git a/queue-6.6/kconfig-gconf-give-a-proper-initial-state-to-the-sav.patch b/queue-6.6/kconfig-gconf-give-a-proper-initial-state-to-the-sav.patch new file mode 100644 index 00000000000..f20285df197 --- /dev/null +++ b/queue-6.6/kconfig-gconf-give-a-proper-initial-state-to-the-sav.patch @@ -0,0 +1,46 @@ +From 5c78fc1c3468ed6ca70177470dcf635dfc467e0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jun 2024 03:20:40 +0900 +Subject: kconfig: gconf: give a proper initial state to the Save button + +From: Masahiro Yamada + +[ Upstream commit 46edf4372e336ef3a61c3126e49518099d2e2e6d ] + +Currently, the initial state of the "Save" button is always active. + +If none of the CONFIG options are changed while loading the .config +file, the "Save" button should be greyed out. + +This can be fixed by calling conf_read() after widget initialization. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/gconf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c +index 9709aca3a30fe..9e52c7360e55b 100644 +--- a/scripts/kconfig/gconf.c ++++ b/scripts/kconfig/gconf.c +@@ -1478,7 +1478,6 @@ int main(int ac, char *av[]) + + conf_parse(name); + fixup_rootmenu(&rootmenu); +- conf_read(NULL); + + /* Load the interface and connect signals */ + init_main_window(glade_file); +@@ -1486,6 +1485,8 @@ int main(int ac, char *av[]) + init_left_tree(); + init_right_tree(); + ++ conf_read(NULL); ++ + switch (view_mode) { + case SINGLE_VIEW: + display_tree_part(); +-- +2.43.0 + diff --git a/queue-6.6/kconfig-remove-wrong-expr_trans_bool.patch b/queue-6.6/kconfig-remove-wrong-expr_trans_bool.patch new file mode 100644 index 00000000000..8658d5db5f2 --- /dev/null +++ b/queue-6.6/kconfig-remove-wrong-expr_trans_bool.patch @@ -0,0 +1,158 @@ +From f38a0c6ed00feaefec0a04417095f7ee8835dad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 01:19:04 +0900 +Subject: kconfig: remove wrong expr_trans_bool() + +From: Masahiro Yamada + +[ Upstream commit 77a92660d8fe8d29503fae768d9f5eb529c88b36 ] + +expr_trans_bool() performs an incorrect transformation. + +[Test Code] + + config MODULES + def_bool y + modules + + config A + def_bool y + select C if B != n + + config B + def_tristate m + + config C + tristate + +[Result] + + CONFIG_MODULES=y + CONFIG_A=y + CONFIG_B=m + CONFIG_C=m + +This output is incorrect because CONFIG_C=y is expected. + +Documentation/kbuild/kconfig-language.rst clearly explains the function +of the '!=' operator: + + If the values of both symbols are equal, it returns 'n', + otherwise 'y'. + +Therefore, the statement: + + select C if B != n + +should be equivalent to: + + select C if y + +Or, more simply: + + select C + +Hence, the symbol C should be selected by the value of A, which is 'y'. + +However, expr_trans_bool() wrongly transforms it to: + + select C if B + +Therefore, the symbol C is selected by (A && B), which is 'm'. + +The comment block of expr_trans_bool() correctly explains its intention: + + * bool FOO!=n => FOO + ^^^^ + +If FOO is bool, FOO!=n can be simplified into FOO. This is correct. + +However, the actual code performs this transformation when FOO is +tristate: + + if (e->left.sym->type == S_TRISTATE) { + ^^^^^^^^^^ + +While it can be fixed to S_BOOLEAN, there is no point in doing so +because expr_tranform() already transforms FOO!=n to FOO when FOO is +bool. (see the "case E_UNEQUAL" part) + +expr_trans_bool() is wrong and unnecessary. + +Signed-off-by: Masahiro Yamada +Acked-by: Randy Dunlap +Signed-off-by: Sasha Levin +--- + scripts/kconfig/expr.c | 29 ----------------------------- + scripts/kconfig/expr.h | 1 - + scripts/kconfig/menu.c | 2 -- + 3 files changed, 32 deletions(-) + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index 81ebf8108ca74..81dfdf4470f75 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -396,35 +396,6 @@ static struct expr *expr_eliminate_yn(struct expr *e) + return e; + } + +-/* +- * bool FOO!=n => FOO +- */ +-struct expr *expr_trans_bool(struct expr *e) +-{ +- if (!e) +- return NULL; +- switch (e->type) { +- case E_AND: +- case E_OR: +- case E_NOT: +- e->left.expr = expr_trans_bool(e->left.expr); +- e->right.expr = expr_trans_bool(e->right.expr); +- break; +- case E_UNEQUAL: +- // FOO!=n -> FOO +- if (e->left.sym->type == S_TRISTATE) { +- if (e->right.sym == &symbol_no) { +- e->type = E_SYMBOL; +- e->right.sym = NULL; +- } +- } +- break; +- default: +- ; +- } +- return e; +-} +- + /* + * e1 || e2 -> ? + */ +diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h +index 4a9a23b1b7e1f..fa38f9f263f7e 100644 +--- a/scripts/kconfig/expr.h ++++ b/scripts/kconfig/expr.h +@@ -295,7 +295,6 @@ void expr_free(struct expr *e); + void expr_eliminate_eq(struct expr **ep1, struct expr **ep2); + int expr_eq(struct expr *e1, struct expr *e2); + tristate expr_calc_value(struct expr *e); +-struct expr *expr_trans_bool(struct expr *e); + struct expr *expr_eliminate_dups(struct expr *e); + struct expr *expr_transform(struct expr *e); + int expr_contains_symbol(struct expr *dep, struct symbol *sym); +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index 61c442d84aef4..69a77f308fdc1 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -380,8 +380,6 @@ void menu_finalize(struct menu *parent) + dep = expr_transform(dep); + dep = expr_alloc_and(expr_copy(basedep), dep); + dep = expr_eliminate_dups(dep); +- if (menu->sym && menu->sym->type != S_TRISTATE) +- dep = expr_trans_bool(dep); + prop->visible.expr = dep; + + /* +-- +2.43.0 + diff --git a/queue-6.6/ksmbd-return-file_device_disk-instead-of-super-magic.patch b/queue-6.6/ksmbd-return-file_device_disk-instead-of-super-magic.patch new file mode 100644 index 00000000000..9d62e543760 --- /dev/null +++ b/queue-6.6/ksmbd-return-file_device_disk-instead-of-super-magic.patch @@ -0,0 +1,89 @@ +From f275d5e4ee4367ce7e8dee47854deecea64c6f3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 08:39:23 +0900 +Subject: ksmbd: return FILE_DEVICE_DISK instead of super magic + +From: Namjae Jeon + +[ Upstream commit 25a6e135569b3901452e4863c94560df7c11c492 ] + +MS-SMB2 specification describes setting ->DeviceType to FILE_DEVICE_DISK +or FILE_DEVICE_CD_ROM. Set FILE_DEVICE_DISK instead of super magic in +FS_DEVICE_INFORMATION. And Set FILE_READ_ONLY_DEVICE for read-only share. + +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/common/smb2pdu.h | 34 ++++++++++++++++++++++++++++++++++ + fs/smb/server/smb2pdu.c | 9 +++++++-- + 2 files changed, 41 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/common/smb2pdu.h b/fs/smb/common/smb2pdu.h +index 8d10be1fe18a8..c3ee42188d252 100644 +--- a/fs/smb/common/smb2pdu.h ++++ b/fs/smb/common/smb2pdu.h +@@ -917,6 +917,40 @@ struct smb2_query_directory_rsp { + __u8 Buffer[]; + } __packed; + ++/* DeviceType Flags */ ++#define FILE_DEVICE_CD_ROM 0x00000002 ++#define FILE_DEVICE_CD_ROM_FILE_SYSTEM 0x00000003 ++#define FILE_DEVICE_DFS 0x00000006 ++#define FILE_DEVICE_DISK 0x00000007 ++#define FILE_DEVICE_DISK_FILE_SYSTEM 0x00000008 ++#define FILE_DEVICE_FILE_SYSTEM 0x00000009 ++#define FILE_DEVICE_NAMED_PIPE 0x00000011 ++#define FILE_DEVICE_NETWORK 0x00000012 ++#define FILE_DEVICE_NETWORK_FILE_SYSTEM 0x00000014 ++#define FILE_DEVICE_NULL 0x00000015 ++#define FILE_DEVICE_PARALLEL_PORT 0x00000016 ++#define FILE_DEVICE_PRINTER 0x00000018 ++#define FILE_DEVICE_SERIAL_PORT 0x0000001b ++#define FILE_DEVICE_STREAMS 0x0000001e ++#define FILE_DEVICE_TAPE 0x0000001f ++#define FILE_DEVICE_TAPE_FILE_SYSTEM 0x00000020 ++#define FILE_DEVICE_VIRTUAL_DISK 0x00000024 ++#define FILE_DEVICE_NETWORK_REDIRECTOR 0x00000028 ++ ++/* Device Characteristics */ ++#define FILE_REMOVABLE_MEDIA 0x00000001 ++#define FILE_READ_ONLY_DEVICE 0x00000002 ++#define FILE_FLOPPY_DISKETTE 0x00000004 ++#define FILE_WRITE_ONCE_MEDIA 0x00000008 ++#define FILE_REMOTE_DEVICE 0x00000010 ++#define FILE_DEVICE_IS_MOUNTED 0x00000020 ++#define FILE_VIRTUAL_VOLUME 0x00000040 ++#define FILE_DEVICE_SECURE_OPEN 0x00000100 ++#define FILE_CHARACTERISTIC_TS_DEVICE 0x00001000 ++#define FILE_CHARACTERISTIC_WEBDAV_DEVICE 0x00002000 ++#define FILE_PORTABLE_DEVICE 0x00004000 ++#define FILE_DEVICE_ALLOW_APPCONTAINER_TRAVERSAL 0x00020000 ++ + /* + * Maximum number of iovs we need for a set-info request. + * The largest one is rename/hardlink +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 74e1971dc4851..592a2cdfd0670 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5323,8 +5323,13 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, + + info = (struct filesystem_device_info *)rsp->Buffer; + +- info->DeviceType = cpu_to_le32(stfs.f_type); +- info->DeviceCharacteristics = cpu_to_le32(0x00000020); ++ info->DeviceType = cpu_to_le32(FILE_DEVICE_DISK); ++ info->DeviceCharacteristics = ++ cpu_to_le32(FILE_DEVICE_IS_MOUNTED); ++ if (!test_tree_conn_flag(work->tcon, ++ KSMBD_TREE_CONN_FLAG_WRITABLE)) ++ info->DeviceCharacteristics |= ++ cpu_to_le32(FILE_READ_ONLY_DEVICE); + rsp->OutputBufferLength = cpu_to_le32(8); + break; + } +-- +2.43.0 + diff --git a/queue-6.6/kvm-ppc-book3s-hv-prevent-uaf-in-kvm_spapr_tce_attac.patch b/queue-6.6/kvm-ppc-book3s-hv-prevent-uaf-in-kvm_spapr_tce_attac.patch new file mode 100644 index 00000000000..2bbe30752cd --- /dev/null +++ b/queue-6.6/kvm-ppc-book3s-hv-prevent-uaf-in-kvm_spapr_tce_attac.patch @@ -0,0 +1,148 @@ +From 5890280dd50808ba54e39cb4feb72808430d7355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 22:29:10 +1000 +Subject: KVM: PPC: Book3S HV: Prevent UAF in + kvm_spapr_tce_attach_iommu_group() + +From: Michael Ellerman + +[ Upstream commit a986fa57fd81a1430e00b3c6cf8a325d6f894a63 ] + +Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group(). + +It looks up `stt` from tablefd, but then continues to use it after doing +fdput() on the returned fd. After the fdput() the tablefd is free to be +closed by another thread. The close calls kvm_spapr_tce_release() and +then release_spapr_tce_table() (via call_rcu()) which frees `stt`. + +Although there are calls to rcu_read_lock() in +kvm_spapr_tce_attach_iommu_group() they are not sufficient to prevent +the UAF, because `stt` is used outside the locked regions. + +With an artifcial delay after the fdput() and a userspace program which +triggers the race, KASAN detects the UAF: + + BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm] + Read of size 4 at addr c000200027552c30 by task kvm-vfio/2505 + CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1 + Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV + Call Trace: + dump_stack_lvl+0xb4/0x108 (unreliable) + print_report+0x2b4/0x6ec + kasan_report+0x118/0x2b0 + __asan_load4+0xb8/0xd0 + kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm] + kvm_vfio_set_attr+0x524/0xac0 [kvm] + kvm_device_ioctl+0x144/0x240 [kvm] + sys_ioctl+0x62c/0x1810 + system_call_exception+0x190/0x440 + system_call_vectored_common+0x15c/0x2ec + ... + Freed by task 0: + ... + kfree+0xec/0x3e0 + release_spapr_tce_table+0xd4/0x11c [kvm] + rcu_core+0x568/0x16a0 + handle_softirqs+0x23c/0x920 + do_softirq_own_stack+0x6c/0x90 + do_softirq_own_stack+0x58/0x90 + __irq_exit_rcu+0x218/0x2d0 + irq_exit+0x30/0x80 + arch_local_irq_restore+0x128/0x230 + arch_local_irq_enable+0x1c/0x30 + cpuidle_enter_state+0x134/0x5cc + cpuidle_enter+0x6c/0xb0 + call_cpuidle+0x7c/0x100 + do_idle+0x394/0x410 + cpu_startup_entry+0x60/0x70 + start_secondary+0x3fc/0x410 + start_secondary_prolog+0x10/0x14 + +Fix it by delaying the fdput() until `stt` is no longer in use, which +is effectively the entire function. To keep the patch minimal add a call +to fdput() at each of the existing return paths. Future work can convert +the function to goto or __cleanup style cleanup. + +With the fix in place the test case no longer triggers the UAF. + +Reported-by: Al Viro +Closes: https://lore.kernel.org/all/20240610024437.GA1464458@ZenIV/ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240614122910.3499489-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_64_vio.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 93b695b289e99..395659f2f4c8e 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -129,14 +129,16 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + } + rcu_read_unlock(); + +- fdput(f); +- +- if (!found) ++ if (!found) { ++ fdput(f); + return -EINVAL; ++ } + + table_group = iommu_group_get_iommudata(grp); +- if (WARN_ON(!table_group)) ++ if (WARN_ON(!table_group)) { ++ fdput(f); + return -EFAULT; ++ } + + for (i = 0; i < IOMMU_TABLE_GROUP_MAX_TABLES; ++i) { + struct iommu_table *tbltmp = table_group->tables[i]; +@@ -157,8 +159,10 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + break; + } + } +- if (!tbl) ++ if (!tbl) { ++ fdput(f); + return -EINVAL; ++ } + + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { +@@ -169,6 +173,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + /* stit is being destroyed */ + iommu_tce_table_put(tbl); + rcu_read_unlock(); ++ fdput(f); + return -ENOTTY; + } + /* +@@ -176,6 +181,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + * its KVM reference counter and can return. + */ + rcu_read_unlock(); ++ fdput(f); + return 0; + } + rcu_read_unlock(); +@@ -183,6 +189,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + stit = kzalloc(sizeof(*stit), GFP_KERNEL); + if (!stit) { + iommu_tce_table_put(tbl); ++ fdput(f); + return -ENOMEM; + } + +@@ -191,6 +198,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + + list_add_rcu(&stit->next, &stt->iommu_tables); + ++ fdput(f); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.6/mei-demote-client-disconnect-warning-on-suspend-to-d.patch b/queue-6.6/mei-demote-client-disconnect-warning-on-suspend-to-d.patch new file mode 100644 index 00000000000..d5a1280c24f --- /dev/null +++ b/queue-6.6/mei-demote-client-disconnect-warning-on-suspend-to-d.patch @@ -0,0 +1,48 @@ +From a4e22ff2bff41925d79f2a314ae68b08c0f200cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 12:14:15 +0300 +Subject: mei: demote client disconnect warning on suspend to debug + +From: Alexander Usyskin + +[ Upstream commit 1db5322b7e6b58e1b304ce69a50e9dca798ca95b ] + +Change level for the "not connected" client message in the write +callback from error to debug. + +The MEI driver currently disconnects all clients upon system suspend. +This behavior is by design and user-space applications with +open connections before the suspend are expected to handle errors upon +resume, by reopening their handles, reconnecting, +and retrying their operations. + +However, the current driver implementation logs an error message every +time a write operation is attempted on a disconnected client. +Since this is a normal and expected flow after system resume +logging this as an error can be misleading. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20240530091415.725247-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mei/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index bb4e9eabda978..c018534c780f9 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -329,7 +329,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf, + } + + if (!mei_cl_is_connected(cl)) { +- cl_err(dev, cl, "is not connected"); ++ cl_dbg(dev, cl, "is not connected"); + rets = -ENODEV; + goto out; + } +-- +2.43.0 + diff --git a/queue-6.6/mips-fix-compat_sys_lseek-syscall.patch b/queue-6.6/mips-fix-compat_sys_lseek-syscall.patch new file mode 100644 index 00000000000..fd6c47be76d --- /dev/null +++ b/queue-6.6/mips-fix-compat_sys_lseek-syscall.patch @@ -0,0 +1,38 @@ +From abda2e1805cb42bcde2ebb3ea98d0ac605a48f6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 18:23:04 +0200 +Subject: mips: fix compat_sys_lseek syscall + +From: Arnd Bergmann + +[ Upstream commit 0d5679a0aae2d8cda72169452c32e5cb88a7ab33 ] + +This is almost compatible, but passing a negative offset should result +in a EINVAL error, but on mips o32 compat mode would seek to a large +32-bit byte offset. + +Use compat_sys_lseek() to correctly sign-extend the argument. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/syscalls/syscall_o32.tbl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/kernel/syscalls/syscall_o32.tbl b/arch/mips/kernel/syscalls/syscall_o32.tbl +index 37bbc8d9a94cc..1ee62a861380a 100644 +--- a/arch/mips/kernel/syscalls/syscall_o32.tbl ++++ b/arch/mips/kernel/syscalls/syscall_o32.tbl +@@ -27,7 +27,7 @@ + 17 o32 break sys_ni_syscall + # 18 was sys_stat + 18 o32 unused18 sys_ni_syscall +-19 o32 lseek sys_lseek ++19 o32 lseek sys_lseek compat_sys_lseek + 20 o32 getpid sys_getpid + 21 o32 mount sys_mount + 22 o32 umount sys_oldumount +-- +2.43.0 + diff --git a/queue-6.6/net-ipv6-rpl_iptunnel-block-bh-in-rpl_output-and-rpl.patch b/queue-6.6/net-ipv6-rpl_iptunnel-block-bh-in-rpl_output-and-rpl.patch new file mode 100644 index 00000000000..86db7e39baf --- /dev/null +++ b/queue-6.6/net-ipv6-rpl_iptunnel-block-bh-in-rpl_output-and-rpl.patch @@ -0,0 +1,92 @@ +From 7a5dcd2ba9fef250e6f5ee976a8bbf2867fab3b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 13:26:33 +0000 +Subject: net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input() + +From: Eric Dumazet + +[ Upstream commit db0090c6eb12c31246438b7fe2a8f1b833e7a653 ] + +As explained in commit 1378817486d6 ("tipc: block BH +before using dst_cache"), net/core/dst_cache.c +helpers need to be called with BH disabled. + +Disabling preemption in rpl_output() is not good enough, +because rpl_output() is called from process context, +lwtunnel_output() only uses rcu_read_lock(). + +We might be interrupted by a softirq, re-enter rpl_output() +and corrupt dst_cache data structures. + +Fix the race by using local_bh_disable() instead of +preempt_disable(). + +Apply a similar change in rpl_input(). + +Signed-off-by: Eric Dumazet +Cc: Alexander Aring +Acked-by: Paolo Abeni +Link: https://lore.kernel.org/r/20240531132636.2637995-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/rpl_iptunnel.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c +index a013b92cbb860..2c83b7586422d 100644 +--- a/net/ipv6/rpl_iptunnel.c ++++ b/net/ipv6/rpl_iptunnel.c +@@ -212,9 +212,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + if (unlikely(err)) + goto drop; + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); ++ local_bh_enable(); + + if (unlikely(!dst)) { + struct ipv6hdr *hdr = ipv6_hdr(skb); +@@ -234,9 +234,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) + goto drop; + } + +- preempt_disable(); ++ local_bh_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr); +- preempt_enable(); ++ local_bh_enable(); + } + + skb_dst_drop(skb); +@@ -268,23 +268,21 @@ static int rpl_input(struct sk_buff *skb) + return err; + } + +- preempt_disable(); ++ local_bh_disable(); + dst = dst_cache_get(&rlwt->cache); +- preempt_enable(); + + if (!dst) { + ip6_route_input(skb); + dst = skb_dst(skb); + if (!dst->error) { +- preempt_disable(); + dst_cache_set_ip6(&rlwt->cache, dst, + &ipv6_hdr(skb)->saddr); +- preempt_enable(); + } + } else { + skb_dst_drop(skb); + skb_dst_set(skb, dst); + } ++ local_bh_enable(); + + err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); + if (unlikely(err)) +-- +2.43.0 + diff --git a/queue-6.6/net-mac802154-fix-racy-device-stats-updates-by-dev_s.patch b/queue-6.6/net-mac802154-fix-racy-device-stats-updates-by-dev_s.patch new file mode 100644 index 00000000000..3051cdc4755 --- /dev/null +++ b/queue-6.6/net-mac802154-fix-racy-device-stats-updates-by-dev_s.patch @@ -0,0 +1,51 @@ +From d528f4cf7802dca19566cec75c6e29812b260842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 16:07:39 +0800 +Subject: net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and + DEV_STATS_ADD() + +From: Yunshui Jiang + +[ Upstream commit b8ec0dc3845f6c9089573cb5c2c4b05f7fc10728 ] + +mac802154 devices update their dev->stats fields locklessly. Therefore +these counters should be updated atomically. Adopt SMP safe DEV_STATS_INC() +and DEV_STATS_ADD() to achieve this. + +Signed-off-by: Yunshui Jiang +Message-ID: <20240531080739.2608969-1-jiangyunshui@kylinos.cn> +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + net/mac802154/tx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c +index 2a6f1ed763c9b..6fbed5bb5c3e0 100644 +--- a/net/mac802154/tx.c ++++ b/net/mac802154/tx.c +@@ -34,8 +34,8 @@ void ieee802154_xmit_sync_worker(struct work_struct *work) + if (res) + goto err_tx; + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, skb->len); + + ieee802154_xmit_complete(&local->hw, skb, false); + +@@ -90,8 +90,8 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb) + if (ret) + goto err_wake_netif_queue; + +- dev->stats.tx_packets++; +- dev->stats.tx_bytes += len; ++ DEV_STATS_INC(dev, tx_packets); ++ DEV_STATS_ADD(dev, tx_bytes, len); + } else { + local->tx_skb = skb; + queue_work(local->workqueue, &local->sync_tx_work); +-- +2.43.0 + diff --git a/queue-6.6/net-usb-qmi_wwan-add-telit-fn912-compositions.patch b/queue-6.6/net-usb-qmi_wwan-add-telit-fn912-compositions.patch new file mode 100644 index 00000000000..0d6ecfeda42 --- /dev/null +++ b/queue-6.6/net-usb-qmi_wwan-add-telit-fn912-compositions.patch @@ -0,0 +1,88 @@ +From dcdb952abcff99636e599c5d8840b27f31c5c00e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 12:22:36 +0200 +Subject: net: usb: qmi_wwan: add Telit FN912 compositions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniele Palmas + +[ Upstream commit 77453e2b015b5ced5b3f45364dd5a72dfc3bdecb ] + +Add the following Telit FN912 compositions: + +0x3000: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag) +T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=3000 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN912 +S: SerialNumber=92c4c4d8 +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x3001: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb +T: Bus=03 Lev=01 Prnt=03 Port=07 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=3001 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN912 +S: SerialNumber=92c4c4d8 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Daniele Palmas +Acked-by: Bjørn Mork +Link: https://patch.msgid.link/20240625102236.69539-1-dnlplm@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index a5469cf5cf670..befbca01bfe37 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1380,6 +1380,8 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3000, 0)}, /* Telit FN912 series */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x3001, 0)}, /* Telit FN912 series */ + {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */ + {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ +-- +2.43.0 + diff --git a/queue-6.6/nfs-avoid-flushing-many-pages-with-nfs_file_sync.patch b/queue-6.6/nfs-avoid-flushing-many-pages-with-nfs_file_sync.patch new file mode 100644 index 00000000000..41f8e344d8c --- /dev/null +++ b/queue-6.6/nfs-avoid-flushing-many-pages-with-nfs_file_sync.patch @@ -0,0 +1,54 @@ +From 4285b095ea13eae13eceb21c125763c0430715d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 18:14:19 +0200 +Subject: nfs: Avoid flushing many pages with NFS_FILE_SYNC + +From: Jan Kara + +[ Upstream commit a527c3ba41c4c61e2069bfce4091e5515f06a8dd ] + +When we are doing WB_SYNC_ALL writeback, nfs submits write requests with +NFS_FILE_SYNC flag to the server (which then generally treats it as an +O_SYNC write). This helps to reduce latency for single requests but when +submitting more requests, additional fsyncs on the server side hurt +latency. NFS generally avoids this additional overhead by not setting +NFS_FILE_SYNC if desc->pg_moreio is set. + +However this logic doesn't always work. When we do random 4k writes to a huge +file and then call fsync(2), each page writeback is going to be sent with +NFS_FILE_SYNC because after preparing one page for writeback, we start writing +back next, nfs_do_writepage() will call nfs_pageio_cond_complete() which finds +the page is not contiguous with previously prepared IO and submits is *without* +setting desc->pg_moreio. Hence NFS_FILE_SYNC is used resulting in poor +performance. + +Fix the problem by setting desc->pg_moreio in nfs_pageio_cond_complete() before +submitting outstanding IO. This improves throughput of +fsync-after-random-writes on my test SSD from ~70MB/s to ~250MB/s. + +Signed-off-by: Jan Kara +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pagelist.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 6efb5068c116e..040b6b79c75e5 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -1545,6 +1545,11 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index) + continue; + } else if (index == prev->wb_index + 1) + continue; ++ /* ++ * We will submit more requests after these. Indicate ++ * this to the underlying layers. ++ */ ++ desc->pg_moreio = 1; + nfs_pageio_complete(desc); + break; + } +-- +2.43.0 + diff --git a/queue-6.6/nfs-don-t-invalidate-dentries-on-transient-errors.patch b/queue-6.6/nfs-don-t-invalidate-dentries-on-transient-errors.patch new file mode 100644 index 00000000000..1fc453fefff --- /dev/null +++ b/queue-6.6/nfs-don-t-invalidate-dentries-on-transient-errors.patch @@ -0,0 +1,123 @@ +From 2e1a7bbdec42e38939d00d4a20337ffe2564429e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 15:01:22 -0400 +Subject: nfs: don't invalidate dentries on transient errors + +From: Scott Mayhew + +[ Upstream commit 0c8c7c559740d2d8b66048162af6c4dba8f0c88c ] + +This is a slight variation on a patch previously proposed by Neil Brown +that never got merged. + +Prior to commit 5ceb9d7fdaaf ("NFS: Refactor nfs_lookup_revalidate()"), +any error from nfs_lookup_verify_inode() other than -ESTALE would result +in nfs_lookup_revalidate() returning that error (-ESTALE is mapped to +zero). + +Since that commit, all errors result in nfs_lookup_revalidate() +returning zero, resulting in dentries being invalidated where they +previously were not (particularly in the case of -ERESTARTSYS). + +Fix it by passing the actual error code to nfs_lookup_revalidate_done(), +and leaving the decision on whether to map the error code to zero or +one to nfs_lookup_revalidate_done(). + +A simple reproducer is to run the following python code in a +subdirectory of an NFS mount (not in the root of the NFS mount): + +---8<--- +import os +import multiprocessing +import time + +if __name__=="__main__": + multiprocessing.set_start_method("spawn") + + count = 0 + while True: + try: + os.getcwd() + pool = multiprocessing.Pool(10) + pool.close() + pool.terminate() + count += 1 + except Exception as e: + print(f"Failed after {count} iterations") + print(e) + break +---8<--- + +Prior to commit 5ceb9d7fdaaf, the above code would run indefinitely. +After commit 5ceb9d7fdaaf, it fails almost immediately with -ENOENT. + +Signed-off-by: Scott Mayhew +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/dir.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 2a0f069d5a096..39f7549afcf5b 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -1625,7 +1625,16 @@ nfs_lookup_revalidate_done(struct inode *dir, struct dentry *dentry, + switch (error) { + case 1: + break; +- case 0: ++ case -ETIMEDOUT: ++ if (inode && (IS_ROOT(dentry) || ++ NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL)) ++ error = 1; ++ break; ++ case -ESTALE: ++ case -ENOENT: ++ error = 0; ++ fallthrough; ++ default: + /* + * We can't d_drop the root of a disconnected tree: + * its d_hash is on the s_anon list and d_drop() would hide +@@ -1680,18 +1689,8 @@ static int nfs_lookup_revalidate_dentry(struct inode *dir, + + dir_verifier = nfs_save_change_attribute(dir); + ret = NFS_PROTO(dir)->lookup(dir, dentry, fhandle, fattr); +- if (ret < 0) { +- switch (ret) { +- case -ESTALE: +- case -ENOENT: +- ret = 0; +- break; +- case -ETIMEDOUT: +- if (NFS_SERVER(inode)->flags & NFS_MOUNT_SOFTREVAL) +- ret = 1; +- } ++ if (ret < 0) + goto out; +- } + + /* Request help from readdirplus */ + nfs_lookup_advise_force_readdirplus(dir, flags); +@@ -1735,7 +1734,7 @@ nfs_do_lookup_revalidate(struct inode *dir, struct dentry *dentry, + unsigned int flags) + { + struct inode *inode; +- int error; ++ int error = 0; + + nfs_inc_stats(dir, NFSIOS_DENTRYREVALIDATE); + inode = d_inode(dentry); +@@ -1780,7 +1779,7 @@ nfs_do_lookup_revalidate(struct inode *dir, struct dentry *dentry, + out_bad: + if (flags & LOOKUP_RCU) + return -ECHILD; +- return nfs_lookup_revalidate_done(dir, dentry, inode, 0); ++ return nfs_lookup_revalidate_done(dir, dentry, inode, error); + } + + static int +-- +2.43.0 + diff --git a/queue-6.6/nfs-propagate-readlink-errors-in-nfs_symlink_filler.patch b/queue-6.6/nfs-propagate-readlink-errors-in-nfs_symlink_filler.patch new file mode 100644 index 00000000000..87b5c733648 --- /dev/null +++ b/queue-6.6/nfs-propagate-readlink-errors-in-nfs_symlink_filler.patch @@ -0,0 +1,40 @@ +From 8819a7bd2d53b5e46acb3d2db13bf52e8013b0c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 15:58:40 +0300 +Subject: nfs: propagate readlink errors in nfs_symlink_filler + +From: Sagi Grimberg + +[ Upstream commit 134d0b3f2440cdddd12fc3444c9c0f62331ce6fc ] + +There is an inherent race where a symlink file may have been overriden +(by a different client) between lookup and readlink, resulting in a +spurious EIO error returned to userspace. Fix this by propagating back +ESTALE errors such that the vfs will retry the lookup/get_link (similar +to nfs4_file_open) at least once. + +Cc: Dan Aloni +Signed-off-by: Sagi Grimberg +Reviewed-by: Jeff Layton +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/symlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/symlink.c b/fs/nfs/symlink.c +index 0e27a2e4e68b8..13818129d268f 100644 +--- a/fs/nfs/symlink.c ++++ b/fs/nfs/symlink.c +@@ -41,7 +41,7 @@ static int nfs_symlink_filler(struct file *file, struct folio *folio) + error: + folio_set_error(folio); + folio_unlock(folio); +- return -EIO; ++ return error; + } + + static const char *nfs_get_link(struct dentry *dentry, +-- +2.43.0 + diff --git a/queue-6.6/nfsv4-fix-memory-leak-in-nfs4_set_security_label.patch b/queue-6.6/nfsv4-fix-memory-leak-in-nfs4_set_security_label.patch new file mode 100644 index 00000000000..a9d4778e140 --- /dev/null +++ b/queue-6.6/nfsv4-fix-memory-leak-in-nfs4_set_security_label.patch @@ -0,0 +1,33 @@ +From cd56098b58e0b31b61bf213c9316239ce7739674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 10:45:24 +0300 +Subject: NFSv4: Fix memory leak in nfs4_set_security_label + +From: Dmitry Mastykin + +[ Upstream commit aad11473f8f4be3df86461081ce35ec5b145ba68 ] + +We leak nfs_fattr and nfs4_label every time we set a security xattr. + +Signed-off-by: Dmitry Mastykin +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index f0953200acd08..05490d4784f1a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -6268,6 +6268,7 @@ nfs4_set_security_label(struct inode *inode, const void *buf, size_t buflen) + if (status == 0) + nfs_setsecurity(inode, fattr); + ++ nfs_free_fattr(fattr); + return status; + } + #endif /* CONFIG_NFS_V4_SECURITY_LABEL */ +-- +2.43.0 + diff --git a/queue-6.6/null_blk-fix-validation-of-block-size.patch b/queue-6.6/null_blk-fix-validation-of-block-size.patch new file mode 100644 index 00000000000..f7544acf3b4 --- /dev/null +++ b/queue-6.6/null_blk-fix-validation-of-block-size.patch @@ -0,0 +1,45 @@ +From 5efc9f924a95b1efbadaf01b7ce1a0a13776d492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 21:26:45 +0200 +Subject: null_blk: fix validation of block size + +From: Andreas Hindborg + +[ Upstream commit c462ecd659b5fce731f1d592285832fd6ad54053 ] + +Block size should be between 512 and PAGE_SIZE and be a power of 2. The current +check does not validate this, so update the check. + +Without this patch, null_blk would Oops due to a null pointer deref when +loaded with bs=1536 [1]. + +Link: https://lore.kernel.org/all/87wmn8mocd.fsf@metaspace.dk/ + +Signed-off-by: Andreas Hindborg +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20240603192645.977968-1-nmi@metaspace.dk +[axboe: remove unnecessary braces and != 0 check] +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 561706fc2cd8e..f1b7d7fdffec8 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -2013,8 +2013,8 @@ static int null_validate_conf(struct nullb_device *dev) + return -EINVAL; + } + +- dev->blocksize = round_down(dev->blocksize, 512); +- dev->blocksize = clamp_t(unsigned int, dev->blocksize, 512, 4096); ++ if (blk_validate_block_size(dev->blocksize)) ++ return -EINVAL; + + if (dev->queue_mode == NULL_Q_MQ && dev->use_per_node_hctx) { + if (dev->submit_queues != nr_online_nodes) +-- +2.43.0 + diff --git a/queue-6.6/nvme-avoid-double-free-special-payload.patch b/queue-6.6/nvme-avoid-double-free-special-payload.patch new file mode 100644 index 00000000000..e65b41dbfcf --- /dev/null +++ b/queue-6.6/nvme-avoid-double-free-special-payload.patch @@ -0,0 +1,37 @@ +From 367ba201c90fd6608da21a1c22dad6555a95a1bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 18:02:08 +0800 +Subject: nvme: avoid double free special payload + +From: Chunguang Xu + +[ Upstream commit e5d574ab37f5f2e7937405613d9b1a724811e5ad ] + +If a discard request needs to be retried, and that retry may fail before +a new special payload is added, a double free will result. Clear the +RQF_SPECIAL_LOAD when the request is cleaned. + +Signed-off-by: Chunguang Xu +Reviewed-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 94a0916f9cb78..e969da0a681b4 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -938,6 +938,7 @@ void nvme_cleanup_cmd(struct request *req) + clear_bit_unlock(0, &ctrl->discard_page_busy); + else + kfree(bvec_virt(&req->special_vec)); ++ req->rq_flags &= ~RQF_SPECIAL_PAYLOAD; + } + } + EXPORT_SYMBOL_GPL(nvme_cleanup_cmd); +-- +2.43.0 + diff --git a/queue-6.6/nvme-fix-nvme_ns_deac-may-incorrectly-identifying-th.patch b/queue-6.6/nvme-fix-nvme_ns_deac-may-incorrectly-identifying-th.patch new file mode 100644 index 00000000000..f40e876c711 --- /dev/null +++ b/queue-6.6/nvme-fix-nvme_ns_deac-may-incorrectly-identifying-th.patch @@ -0,0 +1,39 @@ +From c852a601c3b1af1f728bd2df85817af7f49bbb73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 21:11:44 +0800 +Subject: nvme: fix NVME_NS_DEAC may incorrectly identifying the disk as + EXT_LBA. + +From: Boyang Yu + +[ Upstream commit 9570a48847e3acfa1a741cef431c923325ddc637 ] + +The value of NVME_NS_DEAC is 3, +which means NVME_NS_METADATA_SUPPORTED | NVME_NS_EXT_LBAS. Provide a +unique value for this feature flag. + +Fixes 1b96f862eccc ("nvme: implement the DEAC bit for the Write Zeroes command") +Signed-off-by: Boyang Yu +Reviewed-by: Kanchan Joshi +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/nvme.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index fd67240795e3a..21c24cd8b1e8a 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -485,7 +485,7 @@ static inline bool nvme_ns_head_multipath(struct nvme_ns_head *head) + enum nvme_ns_features { + NVME_NS_EXT_LBAS = 1 << 0, /* support extended LBA format */ + NVME_NS_METADATA_SUPPORTED = 1 << 1, /* support getting generated md */ +- NVME_NS_DEAC, /* DEAC bit in Write Zeores supported */ ++ NVME_NS_DEAC = 1 << 2, /* DEAC bit in Write Zeores supported */ + }; + + struct nvme_ns { +-- +2.43.0 + diff --git a/queue-6.6/nvmet-always-initialize-cqe.result.patch b/queue-6.6/nvmet-always-initialize-cqe.result.patch new file mode 100644 index 00000000000..5c6221c2acd --- /dev/null +++ b/queue-6.6/nvmet-always-initialize-cqe.result.patch @@ -0,0 +1,87 @@ +From be744c881b4f880dde4c8d7c2814f75b6c67be79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 16:11:59 +0200 +Subject: nvmet: always initialize cqe.result + +From: Daniel Wagner + +[ Upstream commit cd0c1b8e045a8d2785342b385cb2684d9b48e426 ] + +The spec doesn't mandate that the first two double words (aka results) +for the command queue entry need to be set to 0 when they are not +used (not specified). Though, the target implemention returns 0 for TCP +and FC but not for RDMA. + +Let's make RDMA behave the same and thus explicitly initializing the +result field. This prevents leaking any data from the stack. + +Signed-off-by: Daniel Wagner +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 1 + + drivers/nvme/target/fabrics-cmd-auth.c | 3 --- + drivers/nvme/target/fabrics-cmd.c | 6 ------ + 3 files changed, 1 insertion(+), 9 deletions(-) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index cfba3ec7add84..1cf6dfac18361 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -945,6 +945,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, + req->metadata_sg_cnt = 0; + req->transfer_len = 0; + req->metadata_len = 0; ++ req->cqe->result.u64 = 0; + req->cqe->status = 0; + req->cqe->sq_head = 0; + req->ns = NULL; +diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c +index 1d9854484e2e8..c103eba96350e 100644 +--- a/drivers/nvme/target/fabrics-cmd-auth.c ++++ b/drivers/nvme/target/fabrics-cmd-auth.c +@@ -332,7 +332,6 @@ void nvmet_execute_auth_send(struct nvmet_req *req) + pr_debug("%s: ctrl %d qid %d nvme status %x error loc %d\n", + __func__, ctrl->cntlid, req->sq->qid, + status, req->error_loc); +- req->cqe->result.u64 = 0; + if (req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2 && + req->sq->dhchap_step != NVME_AUTH_DHCHAP_MESSAGE_FAILURE2) { + unsigned long auth_expire_secs = ctrl->kato ? ctrl->kato : 120; +@@ -515,8 +514,6 @@ void nvmet_execute_auth_receive(struct nvmet_req *req) + status = nvmet_copy_to_sgl(req, 0, d, al); + kfree(d); + done: +- req->cqe->result.u64 = 0; +- + if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_SUCCESS2) + nvmet_auth_sq_free(req->sq); + else if (req->sq->dhchap_step == NVME_AUTH_DHCHAP_MESSAGE_FAILURE1) { +diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c +index d8da840a1c0ed..fa9e8dc921539 100644 +--- a/drivers/nvme/target/fabrics-cmd.c ++++ b/drivers/nvme/target/fabrics-cmd.c +@@ -225,9 +225,6 @@ static void nvmet_execute_admin_connect(struct nvmet_req *req) + if (status) + goto out; + +- /* zero out initial completion result, assign values as needed */ +- req->cqe->result.u32 = 0; +- + if (c->recfmt != 0) { + pr_warn("invalid connect version (%d).\n", + le16_to_cpu(c->recfmt)); +@@ -305,9 +302,6 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) + if (status) + goto out; + +- /* zero out initial completion result, assign values as needed */ +- req->cqe->result.u32 = 0; +- + if (c->recfmt != 0) { + pr_warn("invalid connect version (%d).\n", + le16_to_cpu(c->recfmt)); +-- +2.43.0 + diff --git a/queue-6.6/octeontx2-pf-fix-coverity-and-klockwork-issues-in-oc.patch b/queue-6.6/octeontx2-pf-fix-coverity-and-klockwork-issues-in-oc.patch new file mode 100644 index 00000000000..951d56a697b --- /dev/null +++ b/queue-6.6/octeontx2-pf-fix-coverity-and-klockwork-issues-in-oc.patch @@ -0,0 +1,170 @@ +From 4c308c45062e3666746980af2e83209a613b216d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 12:14:37 +0530 +Subject: octeontx2-pf: Fix coverity and klockwork issues in octeon PF driver + +From: Ratheesh Kannoth + +[ Upstream commit 02ea312055da84e08e3e5bce2539c1ff11c8b5f2 ] + +Fix unintended sign extension and klockwork issues. These are not real +issue but for sanity checks. + +Signed-off-by: Ratheesh Kannoth +Signed-off-by: Suman Ghosh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../marvell/octeontx2/nic/otx2_common.c | 10 ++-- + .../ethernet/marvell/octeontx2/nic/otx2_reg.h | 55 ++++++++++--------- + .../marvell/octeontx2/nic/otx2_txrx.c | 2 +- + .../net/ethernet/marvell/octeontx2/nic/qos.c | 3 +- + 4 files changed, 35 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index af62d66470d5e..b3064377510ed 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -648,14 +648,14 @@ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl, int prio, bool txschq_for + } else if (lvl == NIX_TXSCH_LVL_TL4) { + parent = schq_list[NIX_TXSCH_LVL_TL3][prio]; + req->reg[0] = NIX_AF_TL4X_PARENT(schq); +- req->regval[0] = parent << 16; ++ req->regval[0] = (u64)parent << 16; + req->num_regs++; + req->reg[1] = NIX_AF_TL4X_SCHEDULE(schq); + req->regval[1] = dwrr_val; + } else if (lvl == NIX_TXSCH_LVL_TL3) { + parent = schq_list[NIX_TXSCH_LVL_TL2][prio]; + req->reg[0] = NIX_AF_TL3X_PARENT(schq); +- req->regval[0] = parent << 16; ++ req->regval[0] = (u64)parent << 16; + req->num_regs++; + req->reg[1] = NIX_AF_TL3X_SCHEDULE(schq); + req->regval[1] = dwrr_val; +@@ -670,11 +670,11 @@ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl, int prio, bool txschq_for + } else if (lvl == NIX_TXSCH_LVL_TL2) { + parent = schq_list[NIX_TXSCH_LVL_TL1][prio]; + req->reg[0] = NIX_AF_TL2X_PARENT(schq); +- req->regval[0] = parent << 16; ++ req->regval[0] = (u64)parent << 16; + + req->num_regs++; + req->reg[1] = NIX_AF_TL2X_SCHEDULE(schq); +- req->regval[1] = TXSCH_TL1_DFLT_RR_PRIO << 24 | dwrr_val; ++ req->regval[1] = (u64)hw->txschq_aggr_lvl_rr_prio << 24 | dwrr_val; + + if (lvl == hw->txschq_link_cfg_lvl) { + req->num_regs++; +@@ -698,7 +698,7 @@ int otx2_txschq_config(struct otx2_nic *pfvf, int lvl, int prio, bool txschq_for + + req->num_regs++; + req->reg[1] = NIX_AF_TL1X_TOPOLOGY(schq); +- req->regval[1] = (TXSCH_TL1_DFLT_RR_PRIO << 1); ++ req->regval[1] = hw->txschq_aggr_lvl_rr_prio << 1; + + req->num_regs++; + req->reg[2] = NIX_AF_TL1X_CIR(schq); +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h +index 45a32e4b49d1c..e3aee6e362151 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_reg.h +@@ -139,33 +139,34 @@ + #define NIX_LF_CINTX_ENA_W1C(a) (NIX_LFBASE | 0xD50 | (a) << 12) + + /* NIX AF transmit scheduler registers */ +-#define NIX_AF_SMQX_CFG(a) (0x700 | (a) << 16) +-#define NIX_AF_TL1X_SCHEDULE(a) (0xC00 | (a) << 16) +-#define NIX_AF_TL1X_CIR(a) (0xC20 | (a) << 16) +-#define NIX_AF_TL1X_TOPOLOGY(a) (0xC80 | (a) << 16) +-#define NIX_AF_TL2X_PARENT(a) (0xE88 | (a) << 16) +-#define NIX_AF_TL2X_SCHEDULE(a) (0xE00 | (a) << 16) +-#define NIX_AF_TL2X_TOPOLOGY(a) (0xE80 | (a) << 16) +-#define NIX_AF_TL2X_CIR(a) (0xE20 | (a) << 16) +-#define NIX_AF_TL2X_PIR(a) (0xE30 | (a) << 16) +-#define NIX_AF_TL3X_PARENT(a) (0x1088 | (a) << 16) +-#define NIX_AF_TL3X_SCHEDULE(a) (0x1000 | (a) << 16) +-#define NIX_AF_TL3X_SHAPE(a) (0x1010 | (a) << 16) +-#define NIX_AF_TL3X_CIR(a) (0x1020 | (a) << 16) +-#define NIX_AF_TL3X_PIR(a) (0x1030 | (a) << 16) +-#define NIX_AF_TL3X_TOPOLOGY(a) (0x1080 | (a) << 16) +-#define NIX_AF_TL4X_PARENT(a) (0x1288 | (a) << 16) +-#define NIX_AF_TL4X_SCHEDULE(a) (0x1200 | (a) << 16) +-#define NIX_AF_TL4X_SHAPE(a) (0x1210 | (a) << 16) +-#define NIX_AF_TL4X_CIR(a) (0x1220 | (a) << 16) +-#define NIX_AF_TL4X_PIR(a) (0x1230 | (a) << 16) +-#define NIX_AF_TL4X_TOPOLOGY(a) (0x1280 | (a) << 16) +-#define NIX_AF_MDQX_SCHEDULE(a) (0x1400 | (a) << 16) +-#define NIX_AF_MDQX_SHAPE(a) (0x1410 | (a) << 16) +-#define NIX_AF_MDQX_CIR(a) (0x1420 | (a) << 16) +-#define NIX_AF_MDQX_PIR(a) (0x1430 | (a) << 16) +-#define NIX_AF_MDQX_PARENT(a) (0x1480 | (a) << 16) +-#define NIX_AF_TL3_TL2X_LINKX_CFG(a, b) (0x1700 | (a) << 16 | (b) << 3) ++#define NIX_AF_SMQX_CFG(a) (0x700 | (u64)(a) << 16) ++#define NIX_AF_TL4X_SDP_LINK_CFG(a) (0xB10 | (u64)(a) << 16) ++#define NIX_AF_TL1X_SCHEDULE(a) (0xC00 | (u64)(a) << 16) ++#define NIX_AF_TL1X_CIR(a) (0xC20 | (u64)(a) << 16) ++#define NIX_AF_TL1X_TOPOLOGY(a) (0xC80 | (u64)(a) << 16) ++#define NIX_AF_TL2X_PARENT(a) (0xE88 | (u64)(a) << 16) ++#define NIX_AF_TL2X_SCHEDULE(a) (0xE00 | (u64)(a) << 16) ++#define NIX_AF_TL2X_TOPOLOGY(a) (0xE80 | (u64)(a) << 16) ++#define NIX_AF_TL2X_CIR(a) (0xE20 | (u64)(a) << 16) ++#define NIX_AF_TL2X_PIR(a) (0xE30 | (u64)(a) << 16) ++#define NIX_AF_TL3X_PARENT(a) (0x1088 | (u64)(a) << 16) ++#define NIX_AF_TL3X_SCHEDULE(a) (0x1000 | (u64)(a) << 16) ++#define NIX_AF_TL3X_SHAPE(a) (0x1010 | (u64)(a) << 16) ++#define NIX_AF_TL3X_CIR(a) (0x1020 | (u64)(a) << 16) ++#define NIX_AF_TL3X_PIR(a) (0x1030 | (u64)(a) << 16) ++#define NIX_AF_TL3X_TOPOLOGY(a) (0x1080 | (u64)(a) << 16) ++#define NIX_AF_TL4X_PARENT(a) (0x1288 | (u64)(a) << 16) ++#define NIX_AF_TL4X_SCHEDULE(a) (0x1200 | (u64)(a) << 16) ++#define NIX_AF_TL4X_SHAPE(a) (0x1210 | (u64)(a) << 16) ++#define NIX_AF_TL4X_CIR(a) (0x1220 | (u64)(a) << 16) ++#define NIX_AF_TL4X_PIR(a) (0x1230 | (u64)(a) << 16) ++#define NIX_AF_TL4X_TOPOLOGY(a) (0x1280 | (u64)(a) << 16) ++#define NIX_AF_MDQX_SCHEDULE(a) (0x1400 | (u64)(a) << 16) ++#define NIX_AF_MDQX_SHAPE(a) (0x1410 | (u64)(a) << 16) ++#define NIX_AF_MDQX_CIR(a) (0x1420 | (u64)(a) << 16) ++#define NIX_AF_MDQX_PIR(a) (0x1430 | (u64)(a) << 16) ++#define NIX_AF_MDQX_PARENT(a) (0x1480 | (u64)(a) << 16) ++#define NIX_AF_TL3_TL2X_LINKX_CFG(a, b) (0x1700 | (u64)(a) << 16 | (b) << 3) + + /* LMT LF registers */ + #define LMT_LFBASE BIT_ULL(RVU_FUNC_BLKADDR_SHIFT) +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +index 04a49b9b545f3..0ca9f2ffd932d 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +@@ -510,7 +510,7 @@ static int otx2_tx_napi_handler(struct otx2_nic *pfvf, + + static void otx2_adjust_adaptive_coalese(struct otx2_nic *pfvf, struct otx2_cq_poll *cq_poll) + { +- struct dim_sample dim_sample; ++ struct dim_sample dim_sample = { 0 }; + u64 rx_frames, rx_bytes; + u64 tx_frames, tx_bytes; + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c +index 6cddb4da85b71..4995a2d54d7d0 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/qos.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/qos.c +@@ -153,7 +153,6 @@ static void __otx2_qos_txschq_cfg(struct otx2_nic *pfvf, + num_regs++; + + otx2_config_sched_shaping(pfvf, node, cfg, &num_regs); +- + } else if (level == NIX_TXSCH_LVL_TL4) { + otx2_config_sched_shaping(pfvf, node, cfg, &num_regs); + } else if (level == NIX_TXSCH_LVL_TL3) { +@@ -176,7 +175,7 @@ static void __otx2_qos_txschq_cfg(struct otx2_nic *pfvf, + /* check if node is root */ + if (node->qid == OTX2_QOS_QID_INNER && !node->parent) { + cfg->reg[num_regs] = NIX_AF_TL2X_SCHEDULE(node->schq); +- cfg->regval[num_regs] = TXSCH_TL1_DFLT_RR_PRIO << 24 | ++ cfg->regval[num_regs] = (u64)hw->txschq_aggr_lvl_rr_prio << 24 | + mtu_to_dwrr_weight(pfvf, + pfvf->tx_max_pktlen); + num_regs++; +-- +2.43.0 + diff --git a/queue-6.6/of-irq-factor-out-parsing-of-interrupt-map-parent-ph.patch b/queue-6.6/of-irq-factor-out-parsing-of-interrupt-map-parent-ph.patch new file mode 100644 index 00000000000..0da47d3529c --- /dev/null +++ b/queue-6.6/of-irq-factor-out-parsing-of-interrupt-map-parent-ph.patch @@ -0,0 +1,241 @@ +From 5fcbacc9cad6332d94f25235b62a26a85e953937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 14:59:20 -0500 +Subject: of/irq: Factor out parsing of interrupt-map parent phandle+args from + of_irq_parse_raw() + +From: Rob Herring (Arm) + +[ Upstream commit 935df1bd40d43c4ee91838c42a20e9af751885cc ] + +Factor out the parsing of interrupt-map interrupt parent phandle and its +arg cells to a separate function, of_irq_parse_imap_parent(), so that it +can be used in other parsing scenarios (e.g. fw_devlink). + +There was a refcount leak on non-matching entries when iterating thru +"interrupt-map" which is fixed. + +Tested-by: Marc Zyngier +Tested-by: Anup Patel +Link: https://lore.kernel.org/r/20240529-dt-interrupt-map-fix-v2-1-ef86dc5bcd2a@kernel.org +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/irq.c | 125 ++++++++++++++++++++++++---------------- + drivers/of/of_private.h | 3 + + 2 files changed, 77 insertions(+), 51 deletions(-) + +diff --git a/drivers/of/irq.c b/drivers/of/irq.c +index 174900072c18c..462375b293e47 100644 +--- a/drivers/of/irq.c ++++ b/drivers/of/irq.c +@@ -25,6 +25,8 @@ + #include + #include + ++#include "of_private.h" ++ + /** + * irq_of_parse_and_map - Parse and map an interrupt into linux virq space + * @dev: Device node of the device whose interrupt is to be mapped +@@ -96,6 +98,57 @@ static const char * const of_irq_imap_abusers[] = { + NULL, + }; + ++const __be32 *of_irq_parse_imap_parent(const __be32 *imap, int len, struct of_phandle_args *out_irq) ++{ ++ u32 intsize, addrsize; ++ struct device_node *np; ++ ++ /* Get the interrupt parent */ ++ if (of_irq_workarounds & OF_IMAP_NO_PHANDLE) ++ np = of_node_get(of_irq_dflt_pic); ++ else ++ np = of_find_node_by_phandle(be32_to_cpup(imap)); ++ imap++; ++ ++ /* Check if not found */ ++ if (!np) { ++ pr_debug(" -> imap parent not found !\n"); ++ return NULL; ++ } ++ ++ /* Get #interrupt-cells and #address-cells of new parent */ ++ if (of_property_read_u32(np, "#interrupt-cells", ++ &intsize)) { ++ pr_debug(" -> parent lacks #interrupt-cells!\n"); ++ of_node_put(np); ++ return NULL; ++ } ++ if (of_property_read_u32(np, "#address-cells", ++ &addrsize)) ++ addrsize = 0; ++ ++ pr_debug(" -> intsize=%d, addrsize=%d\n", ++ intsize, addrsize); ++ ++ /* Check for malformed properties */ ++ if (WARN_ON(addrsize + intsize > MAX_PHANDLE_ARGS) ++ || (len < (addrsize + intsize))) { ++ of_node_put(np); ++ return NULL; ++ } ++ ++ pr_debug(" -> imaplen=%d\n", len); ++ ++ imap += addrsize + intsize; ++ ++ out_irq->np = np; ++ for (int i = 0; i < intsize; i++) ++ out_irq->args[i] = be32_to_cpup(imap - intsize + i); ++ out_irq->args_count = intsize; ++ ++ return imap; ++} ++ + /** + * of_irq_parse_raw - Low level interrupt tree parsing + * @addr: address specifier (start of "reg" property of the device) in be32 format +@@ -112,12 +165,12 @@ static const char * const of_irq_imap_abusers[] = { + */ + int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + { +- struct device_node *ipar, *tnode, *old = NULL, *newpar = NULL; ++ struct device_node *ipar, *tnode, *old = NULL; + __be32 initial_match_array[MAX_PHANDLE_ARGS]; + const __be32 *match_array = initial_match_array; +- const __be32 *tmp, *imap, *imask, dummy_imask[] = { [0 ... MAX_PHANDLE_ARGS] = cpu_to_be32(~0) }; +- u32 intsize = 1, addrsize, newintsize = 0, newaddrsize = 0; +- int imaplen, match, i, rc = -EINVAL; ++ const __be32 *tmp, dummy_imask[] = { [0 ... MAX_PHANDLE_ARGS] = cpu_to_be32(~0) }; ++ u32 intsize = 1, addrsize; ++ int i, rc = -EINVAL; + + #ifdef DEBUG + of_print_phandle_args("of_irq_parse_raw: ", out_irq); +@@ -176,6 +229,9 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + + /* Now start the actual "proper" walk of the interrupt tree */ + while (ipar != NULL) { ++ int imaplen, match; ++ const __be32 *imap, *oldimap, *imask; ++ struct device_node *newpar; + /* + * Now check if cursor is an interrupt-controller and + * if it is then we are done, unless there is an +@@ -216,7 +272,7 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + + /* Parse interrupt-map */ + match = 0; +- while (imaplen > (addrsize + intsize + 1) && !match) { ++ while (imaplen > (addrsize + intsize + 1)) { + /* Compare specifiers */ + match = 1; + for (i = 0; i < (addrsize + intsize); i++, imaplen--) +@@ -224,48 +280,17 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + + pr_debug(" -> match=%d (imaplen=%d)\n", match, imaplen); + +- /* Get the interrupt parent */ +- if (of_irq_workarounds & OF_IMAP_NO_PHANDLE) +- newpar = of_node_get(of_irq_dflt_pic); +- else +- newpar = of_find_node_by_phandle(be32_to_cpup(imap)); +- imap++; +- --imaplen; +- +- /* Check if not found */ +- if (newpar == NULL) { +- pr_debug(" -> imap parent not found !\n"); +- goto fail; +- } +- +- if (!of_device_is_available(newpar)) +- match = 0; +- +- /* Get #interrupt-cells and #address-cells of new +- * parent +- */ +- if (of_property_read_u32(newpar, "#interrupt-cells", +- &newintsize)) { +- pr_debug(" -> parent lacks #interrupt-cells!\n"); +- goto fail; +- } +- if (of_property_read_u32(newpar, "#address-cells", +- &newaddrsize)) +- newaddrsize = 0; +- +- pr_debug(" -> newintsize=%d, newaddrsize=%d\n", +- newintsize, newaddrsize); +- +- /* Check for malformed properties */ +- if (WARN_ON(newaddrsize + newintsize > MAX_PHANDLE_ARGS) +- || (imaplen < (newaddrsize + newintsize))) { +- rc = -EFAULT; ++ oldimap = imap; ++ imap = of_irq_parse_imap_parent(oldimap, imaplen, out_irq); ++ if (!imap) + goto fail; +- } + +- imap += newaddrsize + newintsize; +- imaplen -= newaddrsize + newintsize; ++ match &= of_device_is_available(out_irq->np); ++ if (match) ++ break; + ++ of_node_put(out_irq->np); ++ imaplen -= imap - oldimap; + pr_debug(" -> imaplen=%d\n", imaplen); + } + if (!match) { +@@ -287,11 +312,11 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + * Successfully parsed an interrupt-map translation; copy new + * interrupt specifier into the out_irq structure + */ +- match_array = imap - newaddrsize - newintsize; +- for (i = 0; i < newintsize; i++) +- out_irq->args[i] = be32_to_cpup(imap - newintsize + i); +- out_irq->args_count = intsize = newintsize; +- addrsize = newaddrsize; ++ match_array = oldimap + 1; ++ ++ newpar = out_irq->np; ++ intsize = out_irq->args_count; ++ addrsize = (imap - match_array) - intsize; + + if (ipar == newpar) { + pr_debug("%pOF interrupt-map entry to self\n", ipar); +@@ -300,7 +325,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + + skiplevel: + /* Iterate again with new parent */ +- out_irq->np = newpar; + pr_debug(" -> new parent: %pOF\n", newpar); + of_node_put(ipar); + ipar = newpar; +@@ -310,7 +334,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq) + + fail: + of_node_put(ipar); +- of_node_put(newpar); + + return rc; + } +diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h +index f38397c7b5824..21f8f5e80917d 100644 +--- a/drivers/of/of_private.h ++++ b/drivers/of/of_private.h +@@ -158,6 +158,9 @@ extern void __of_sysfs_remove_bin_file(struct device_node *np, + extern int of_bus_n_addr_cells(struct device_node *np); + extern int of_bus_n_size_cells(struct device_node *np); + ++const __be32 *of_irq_parse_imap_parent(const __be32 *imap, int len, ++ struct of_phandle_args *out_irq); ++ + struct bus_dma_region; + #if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_HAS_DMA) + int of_dma_get_range(struct device_node *np, +-- +2.43.0 + diff --git a/queue-6.6/platform-mellanox-nvsw-sn2201-add-check-for-platform.patch b/queue-6.6/platform-mellanox-nvsw-sn2201-add-check-for-platform.patch new file mode 100644 index 00000000000..91331d897bf --- /dev/null +++ b/queue-6.6/platform-mellanox-nvsw-sn2201-add-check-for-platform.patch @@ -0,0 +1,49 @@ +From 4391c1752735971568396ea7c8aaac4f145603db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 11:27:45 +0800 +Subject: platform/mellanox: nvsw-sn2201: Add check for + platform_device_add_resources + +From: Chen Ni + +[ Upstream commit d56fbfbaf592a115b2e11c1044829afba34069d2 ] + +Add check for the return value of platform_device_add_resources() and +return the error if it fails in order to catch the error. + +Signed-off-by: Chen Ni +Link: https://lore.kernel.org/r/20240605032745.2916183-1-nichen@iscas.ac.cn +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/nvsw-sn2201.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/nvsw-sn2201.c b/drivers/platform/mellanox/nvsw-sn2201.c +index 75b699676ca6d..1a7c45aa41bbf 100644 +--- a/drivers/platform/mellanox/nvsw-sn2201.c ++++ b/drivers/platform/mellanox/nvsw-sn2201.c +@@ -1198,6 +1198,7 @@ static int nvsw_sn2201_config_pre_init(struct nvsw_sn2201 *nvsw_sn2201) + static int nvsw_sn2201_probe(struct platform_device *pdev) + { + struct nvsw_sn2201 *nvsw_sn2201; ++ int ret; + + nvsw_sn2201 = devm_kzalloc(&pdev->dev, sizeof(*nvsw_sn2201), GFP_KERNEL); + if (!nvsw_sn2201) +@@ -1205,8 +1206,10 @@ static int nvsw_sn2201_probe(struct platform_device *pdev) + + nvsw_sn2201->dev = &pdev->dev; + platform_set_drvdata(pdev, nvsw_sn2201); +- platform_device_add_resources(pdev, nvsw_sn2201_lpc_io_resources, ++ ret = platform_device_add_resources(pdev, nvsw_sn2201_lpc_io_resources, + ARRAY_SIZE(nvsw_sn2201_lpc_io_resources)); ++ if (ret) ++ return ret; + + nvsw_sn2201->main_mux_deferred_nr = NVSW_SN2201_MAIN_MUX_DEFER_NR; + nvsw_sn2201->main_mux_devs = nvsw_sn2201_main_mux_brdinfo; +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-lg-laptop-change-acpi-device-id.patch b/queue-6.6/platform-x86-lg-laptop-change-acpi-device-id.patch new file mode 100644 index 00000000000..086cc3e84a4 --- /dev/null +++ b/queue-6.6/platform-x86-lg-laptop-change-acpi-device-id.patch @@ -0,0 +1,46 @@ +From 09d1e9bad368411967a8cd4c37682141bb2dbf7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 01:35:39 +0200 +Subject: platform/x86: lg-laptop: Change ACPI device id +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 58a54f27a0dac81f7fd3514be01012635219a53c ] + +The LGEX0815 ACPI device id is used for handling hotkey events, but +this functionality is already handled by the wireless-hotkey driver. + +The LGEX0820 ACPI device id however is used to manage various +platform features using the WMAB/WMBB ACPI methods. Use this ACPI +device id to avoid blocking the wireless-hotkey driver from probing. + +Tested-by: Agathe Boutmy +Signed-off-by: Armin Wolf +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240606233540.9774-4-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lg-laptop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c +index 545872adbc52a..8f8eb13b2a6b2 100644 +--- a/drivers/platform/x86/lg-laptop.c ++++ b/drivers/platform/x86/lg-laptop.c +@@ -768,7 +768,7 @@ static void acpi_remove(struct acpi_device *device) + } + + static const struct acpi_device_id device_ids[] = { +- {"LGEX0815", 0}, ++ {"LGEX0820", 0}, + {"", 0} + }; + MODULE_DEVICE_TABLE(acpi, device_ids); +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-lg-laptop-remove-lgex0815-hotkey-handli.patch b/queue-6.6/platform-x86-lg-laptop-remove-lgex0815-hotkey-handli.patch new file mode 100644 index 00000000000..e74b8158374 --- /dev/null +++ b/queue-6.6/platform-x86-lg-laptop-remove-lgex0815-hotkey-handli.patch @@ -0,0 +1,60 @@ +From 98209655285d82c555df373e96a462c6bc73460b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 01:35:38 +0200 +Subject: platform/x86: lg-laptop: Remove LGEX0815 hotkey handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 413c204595ca98a4f33414a948c18d7314087342 ] + +The rfkill hotkey handling is already provided by the wireless-hotkey +driver. Remove the now unnecessary rfkill hotkey handling to avoid +duplicating functionality. + +The ACPI notify handler still prints debugging information when +receiving ACPI notifications to aid in reverse-engineering. + +Tested-by: Agathe Boutmy +Signed-off-by: Armin Wolf +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240606233540.9774-3-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lg-laptop.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c +index ad3c39e9e9f58..545872adbc52a 100644 +--- a/drivers/platform/x86/lg-laptop.c ++++ b/drivers/platform/x86/lg-laptop.c +@@ -84,7 +84,6 @@ static const struct key_entry wmi_keymap[] = { + * this key both sends an event and + * changes backlight level. + */ +- {KE_KEY, 0x80, {KEY_RFKILL} }, + {KE_END, 0} + }; + +@@ -272,14 +271,7 @@ static void wmi_input_setup(void) + + static void acpi_notify(struct acpi_device *device, u32 event) + { +- struct key_entry *key; +- + acpi_handle_debug(device->handle, "notify: %d\n", event); +- if (inited & INIT_SPARSE_KEYMAP) { +- key = sparse_keymap_entry_from_scancode(wmi_input_dev, 0x80); +- if (key && key->type == KE_KEY) +- sparse_keymap_report_entry(wmi_input_dev, key, 1, true); +- } + } + + static ssize_t fan_mode_store(struct device *dev, +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-lg-laptop-use-acpi-device-handle-when-e.patch b/queue-6.6/platform-x86-lg-laptop-use-acpi-device-handle-when-e.patch new file mode 100644 index 00000000000..e3837b5e61a --- /dev/null +++ b/queue-6.6/platform-x86-lg-laptop-use-acpi-device-handle-when-e.patch @@ -0,0 +1,311 @@ +From 9b1e470fffcccc5eeacda0054ac62c05a1d8c8b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 01:35:40 +0200 +Subject: platform/x86: lg-laptop: Use ACPI device handle when evaluating + WMAB/WMBB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit b27ea279556121b54d3f45d0529706cf100cdb3a ] + +On the LG Gram 16Z90S, the WMAB and WMBB ACPI methods are not mapped +under \XINI, but instead are mapped under \_SB.XINI. + +The reason for this is that the LGEX0820 ACPI device used by this +driver is mapped at \_SB.XINI, so the ACPI methods where moved as well +to appear below the LGEX0820 ACPI device. + +Fix this by using the ACPI handle from the ACPI device when evaluating +both methods. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218901 +Tested-by: Agathe Boutmy +Signed-off-by: Armin Wolf +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240606233540.9774-5-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lg-laptop.c | 79 +++++++++++++------------------- + 1 file changed, 33 insertions(+), 46 deletions(-) + +diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c +index 8f8eb13b2a6b2..a1e27334cdf54 100644 +--- a/drivers/platform/x86/lg-laptop.c ++++ b/drivers/platform/x86/lg-laptop.c +@@ -39,8 +39,6 @@ MODULE_LICENSE("GPL"); + #define WMI_METHOD_WMBB "2B4F501A-BD3C-4394-8DCF-00A7D2BC8210" + #define WMI_EVENT_GUID WMI_EVENT_GUID0 + +-#define WMAB_METHOD "\\XINI.WMAB" +-#define WMBB_METHOD "\\XINI.WMBB" + #define SB_GGOV_METHOD "\\_SB.GGOV" + #define GOV_TLED 0x2020008 + #define WM_GET 1 +@@ -74,7 +72,7 @@ static u32 inited; + + static int battery_limit_use_wmbb; + static struct led_classdev kbd_backlight; +-static enum led_brightness get_kbd_backlight_level(void); ++static enum led_brightness get_kbd_backlight_level(struct device *dev); + + static const struct key_entry wmi_keymap[] = { + {KE_KEY, 0x70, {KEY_F15} }, /* LG control panel (F1) */ +@@ -127,11 +125,10 @@ static int ggov(u32 arg0) + return res; + } + +-static union acpi_object *lg_wmab(u32 method, u32 arg1, u32 arg2) ++static union acpi_object *lg_wmab(struct device *dev, u32 method, u32 arg1, u32 arg2) + { + union acpi_object args[3]; + acpi_status status; +- acpi_handle handle; + struct acpi_object_list arg; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + +@@ -142,29 +139,22 @@ static union acpi_object *lg_wmab(u32 method, u32 arg1, u32 arg2) + args[2].type = ACPI_TYPE_INTEGER; + args[2].integer.value = arg2; + +- status = acpi_get_handle(NULL, (acpi_string) WMAB_METHOD, &handle); +- if (ACPI_FAILURE(status)) { +- pr_err("Cannot get handle"); +- return NULL; +- } +- + arg.count = 3; + arg.pointer = args; + +- status = acpi_evaluate_object(handle, NULL, &arg, &buffer); ++ status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMAB", &arg, &buffer); + if (ACPI_FAILURE(status)) { +- acpi_handle_err(handle, "WMAB: call failed.\n"); ++ dev_err(dev, "WMAB: call failed.\n"); + return NULL; + } + + return buffer.pointer; + } + +-static union acpi_object *lg_wmbb(u32 method_id, u32 arg1, u32 arg2) ++static union acpi_object *lg_wmbb(struct device *dev, u32 method_id, u32 arg1, u32 arg2) + { + union acpi_object args[3]; + acpi_status status; +- acpi_handle handle; + struct acpi_object_list arg; + struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + u8 buf[32]; +@@ -180,18 +170,12 @@ static union acpi_object *lg_wmbb(u32 method_id, u32 arg1, u32 arg2) + args[2].buffer.length = 32; + args[2].buffer.pointer = buf; + +- status = acpi_get_handle(NULL, (acpi_string)WMBB_METHOD, &handle); +- if (ACPI_FAILURE(status)) { +- pr_err("Cannot get handle"); +- return NULL; +- } +- + arg.count = 3; + arg.pointer = args; + +- status = acpi_evaluate_object(handle, NULL, &arg, &buffer); ++ status = acpi_evaluate_object(ACPI_HANDLE(dev), "WMBB", &arg, &buffer); + if (ACPI_FAILURE(status)) { +- acpi_handle_err(handle, "WMAB: call failed.\n"); ++ dev_err(dev, "WMBB: call failed.\n"); + return NULL; + } + +@@ -222,7 +206,7 @@ static void wmi_notify(u32 value, void *context) + + if (eventcode == 0x10000000) { + led_classdev_notify_brightness_hw_changed( +- &kbd_backlight, get_kbd_backlight_level()); ++ &kbd_backlight, get_kbd_backlight_level(kbd_backlight.dev->parent)); + } else { + key = sparse_keymap_entry_from_scancode( + wmi_input_dev, eventcode); +@@ -287,7 +271,7 @@ static ssize_t fan_mode_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_FAN_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -298,9 +282,9 @@ static ssize_t fan_mode_store(struct device *dev, + + m = r->integer.value; + kfree(r); +- r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4)); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4)); + kfree(r); +- r = lg_wmab(WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value); + kfree(r); + + return count; +@@ -312,7 +296,7 @@ static ssize_t fan_mode_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_FAN_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -339,7 +323,7 @@ static ssize_t usb_charge_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmbb(WMBB_USB_CHARGE, WM_SET, value); ++ r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_SET, value); + if (!r) + return -EIO; + +@@ -353,7 +337,7 @@ static ssize_t usb_charge_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmbb(WMBB_USB_CHARGE, WM_GET, 0); ++ r = lg_wmbb(dev, WMBB_USB_CHARGE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -381,7 +365,7 @@ static ssize_t reader_mode_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_READER_MODE, WM_SET, value); ++ r = lg_wmab(dev, WM_READER_MODE, WM_SET, value); + if (!r) + return -EIO; + +@@ -395,7 +379,7 @@ static ssize_t reader_mode_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_READER_MODE, WM_GET, 0); ++ r = lg_wmab(dev, WM_READER_MODE, WM_GET, 0); + if (!r) + return -EIO; + +@@ -423,7 +407,7 @@ static ssize_t fn_lock_store(struct device *dev, + if (ret) + return ret; + +- r = lg_wmab(WM_FN_LOCK, WM_SET, value); ++ r = lg_wmab(dev, WM_FN_LOCK, WM_SET, value); + if (!r) + return -EIO; + +@@ -437,7 +421,7 @@ static ssize_t fn_lock_show(struct device *dev, + unsigned int status; + union acpi_object *r; + +- r = lg_wmab(WM_FN_LOCK, WM_GET, 0); ++ r = lg_wmab(dev, WM_FN_LOCK, WM_GET, 0); + if (!r) + return -EIO; + +@@ -467,9 +451,9 @@ static ssize_t charge_control_end_threshold_store(struct device *dev, + union acpi_object *r; + + if (battery_limit_use_wmbb) +- r = lg_wmbb(WMBB_BATT_LIMIT, WM_SET, value); ++ r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_SET, value); + else +- r = lg_wmab(WM_BATT_LIMIT, WM_SET, value); ++ r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_SET, value); + if (!r) + return -EIO; + +@@ -488,7 +472,7 @@ static ssize_t charge_control_end_threshold_show(struct device *device, + union acpi_object *r; + + if (battery_limit_use_wmbb) { +- r = lg_wmbb(WMBB_BATT_LIMIT, WM_GET, 0); ++ r = lg_wmbb(&pf_device->dev, WMBB_BATT_LIMIT, WM_GET, 0); + if (!r) + return -EIO; + +@@ -499,7 +483,7 @@ static ssize_t charge_control_end_threshold_show(struct device *device, + + status = r->buffer.pointer[0x10]; + } else { +- r = lg_wmab(WM_BATT_LIMIT, WM_GET, 0); ++ r = lg_wmab(&pf_device->dev, WM_BATT_LIMIT, WM_GET, 0); + if (!r) + return -EIO; + +@@ -578,7 +562,7 @@ static void tpad_led_set(struct led_classdev *cdev, + { + union acpi_object *r; + +- r = lg_wmab(WM_TLED, WM_SET, brightness > LED_OFF); ++ r = lg_wmab(cdev->dev->parent, WM_TLED, WM_SET, brightness > LED_OFF); + kfree(r); + } + +@@ -600,16 +584,16 @@ static void kbd_backlight_set(struct led_classdev *cdev, + val = 0; + if (brightness >= LED_FULL) + val = 0x24; +- r = lg_wmab(WM_KEY_LIGHT, WM_SET, val); ++ r = lg_wmab(cdev->dev->parent, WM_KEY_LIGHT, WM_SET, val); + kfree(r); + } + +-static enum led_brightness get_kbd_backlight_level(void) ++static enum led_brightness get_kbd_backlight_level(struct device *dev) + { + union acpi_object *r; + int val; + +- r = lg_wmab(WM_KEY_LIGHT, WM_GET, 0); ++ r = lg_wmab(dev, WM_KEY_LIGHT, WM_GET, 0); + + if (!r) + return LED_OFF; +@@ -637,7 +621,7 @@ static enum led_brightness get_kbd_backlight_level(void) + + static enum led_brightness kbd_backlight_get(struct led_classdev *cdev) + { +- return get_kbd_backlight_level(); ++ return get_kbd_backlight_level(cdev->dev->parent); + } + + static LED_DEVICE(kbd_backlight, 255, LED_BRIGHT_HW_CHANGED); +@@ -664,6 +648,11 @@ static struct platform_driver pf_driver = { + + static int acpi_add(struct acpi_device *device) + { ++ struct platform_device_info pdev_info = { ++ .fwnode = acpi_fwnode_handle(device), ++ .name = PLATFORM_NAME, ++ .id = PLATFORM_DEVID_NONE, ++ }; + int ret; + const char *product; + int year = 2017; +@@ -675,9 +664,7 @@ static int acpi_add(struct acpi_device *device) + if (ret) + return ret; + +- pf_device = platform_device_register_simple(PLATFORM_NAME, +- PLATFORM_DEVID_NONE, +- NULL, 0); ++ pf_device = platform_device_register_full(&pdev_info); + if (IS_ERR(pf_device)) { + ret = PTR_ERR(pf_device); + pf_device = NULL; +-- +2.43.0 + diff --git a/queue-6.6/platform-x86-wireless-hotkey-add-support-for-lg-airp.patch b/queue-6.6/platform-x86-wireless-hotkey-add-support-for-lg-airp.patch new file mode 100644 index 00000000000..5fb55351d44 --- /dev/null +++ b/queue-6.6/platform-x86-wireless-hotkey-add-support-for-lg-airp.patch @@ -0,0 +1,53 @@ +From 79922018e6426ed3d49cc08a98652a5a5f43406f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 01:35:37 +0200 +Subject: platform/x86: wireless-hotkey: Add support for LG Airplane Button +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 151e78a0b89ee6dec93382dbdf5b1ef83f9c4716 ] + +The LGEX0815 ACPI device is used by the "LG Airplane Mode Button" +Windows driver for handling rfkill requests. When the ACPI device +receives an 0x80 ACPI notification, an rfkill event is to be +send to userspace. + +Add support for the LGEX0815 ACPI device to the driver. + +Tested-by: Agathe Boutmy +Signed-off-by: Armin Wolf +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240606233540.9774-2-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wireless-hotkey.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/wireless-hotkey.c b/drivers/platform/x86/wireless-hotkey.c +index 4422863f47bbe..01feb6e6787f2 100644 +--- a/drivers/platform/x86/wireless-hotkey.c ++++ b/drivers/platform/x86/wireless-hotkey.c +@@ -19,6 +19,7 @@ MODULE_AUTHOR("Alex Hung"); + MODULE_ALIAS("acpi*:HPQ6001:*"); + MODULE_ALIAS("acpi*:WSTADEF:*"); + MODULE_ALIAS("acpi*:AMDI0051:*"); ++MODULE_ALIAS("acpi*:LGEX0815:*"); + + struct wl_button { + struct input_dev *input_dev; +@@ -29,6 +30,7 @@ static const struct acpi_device_id wl_ids[] = { + {"HPQ6001", 0}, + {"WSTADEF", 0}, + {"AMDI0051", 0}, ++ {"LGEX0815", 0}, + {"", 0}, + }; + +-- +2.43.0 + diff --git a/queue-6.6/powerpc-eeh-avoid-possible-crash-when-edev-pdev-chan.patch b/queue-6.6/powerpc-eeh-avoid-possible-crash-when-edev-pdev-chan.patch new file mode 100644 index 00000000000..1199451273b --- /dev/null +++ b/queue-6.6/powerpc-eeh-avoid-possible-crash-when-edev-pdev-chan.patch @@ -0,0 +1,50 @@ +From 523e9e1234ea15b2a0e653720ce0bd07a15ed78a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 19:32:40 +0530 +Subject: powerpc/eeh: avoid possible crash when edev->pdev changes + +From: Ganesh Goudar + +[ Upstream commit a1216e62d039bf63a539bbe718536ec789a853dd ] + +If a PCI device is removed during eeh_pe_report_edev(), edev->pdev +will change and can cause a crash, hold the PCI rescan/remove lock +while taking a copy of edev->pdev->bus. + +Signed-off-by: Ganesh Goudar +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240617140240.580453-1-ganeshgr@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh_pe.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c +index e0ce812796241..7d1b50599dd6c 100644 +--- a/arch/powerpc/kernel/eeh_pe.c ++++ b/arch/powerpc/kernel/eeh_pe.c +@@ -849,6 +849,7 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + { + struct eeh_dev *edev; + struct pci_dev *pdev; ++ struct pci_bus *bus = NULL; + + if (pe->type & EEH_PE_PHB) + return pe->phb->bus; +@@ -859,9 +860,11 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe) + + /* Retrieve the parent PCI bus of first (top) PCI device */ + edev = list_first_entry_or_null(&pe->edevs, struct eeh_dev, entry); ++ pci_lock_rescan_remove(); + pdev = eeh_dev_to_pci_dev(edev); + if (pdev) +- return pdev->bus; ++ bus = pdev->bus; ++ pci_unlock_rescan_remove(); + +- return NULL; ++ return bus; + } +-- +2.43.0 + diff --git a/queue-6.6/powerpc-pseries-whitelist-dtl-slub-object-for-copyin.patch b/queue-6.6/powerpc-pseries-whitelist-dtl-slub-object-for-copyin.patch new file mode 100644 index 00000000000..95493b7db22 --- /dev/null +++ b/queue-6.6/powerpc-pseries-whitelist-dtl-slub-object-for-copyin.patch @@ -0,0 +1,77 @@ +From 396ee9ccd9a8fee0b6f823b91ce0524ca11ec4fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 23:08:44 +0530 +Subject: powerpc/pseries: Whitelist dtl slub object for copying to userspace + +From: Anjali K + +[ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ] + +Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* +results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as +shown below. + + kernel BUG at mm/usercopy.c:102! + Oops: Exception in kernel mode, sig: 5 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries + Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc + scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse + CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 + Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries + NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 + REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) + MSR: 8000000000029033 CR: 2828220f XER: 0000000e + CFAR: c0000000001fdc80 IRQMASK: 0 + [ ... GPRs omitted ... ] + NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 + LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 + Call Trace: + usercopy_abort+0x74/0xb0 (unreliable) + __check_heap_object+0xf8/0x120 + check_heap_object+0x218/0x240 + __check_object_size+0x84/0x1a4 + dtl_file_read+0x17c/0x2c4 + full_proxy_read+0x8c/0x110 + vfs_read+0xdc/0x3a0 + ksys_read+0x84/0x144 + system_call_exception+0x124/0x330 + system_call_vectored_common+0x15c/0x2ec + --- interrupt: 3000 at 0x7fff81f3ab34 + +Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") +requires that only whitelisted areas in slab/slub objects can be copied to +userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. +Dtl contains hypervisor dispatch events which are expected to be read by +privileged users. Hence mark this safe for user access. +Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the +entire object. + +Co-developed-by: Vishal Chourasia +Signed-off-by: Vishal Chourasia +Signed-off-by: Anjali K +Reviewed-by: Srikar Dronamraju +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240614173844.746818-1-anjalik@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/setup.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index ad4d4d38e50ae..1feb6b919bd97 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -343,8 +343,8 @@ static int alloc_dispatch_log_kmem_cache(void) + { + void (*ctor)(void *) = get_dtl_cache_ctor(); + +- dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES, +- DISPATCH_LOG_BYTES, 0, ctor); ++ dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES, ++ DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor); + if (!dtl_cache) { + pr_warn("Failed to create dispatch trace log buffer cache\n"); + pr_warn("Stolen time statistics will be unreliable\n"); +-- +2.43.0 + diff --git a/queue-6.6/riscv-stacktrace-fix-usage-of-ftrace_graph_ret_addr.patch b/queue-6.6/riscv-stacktrace-fix-usage-of-ftrace_graph_ret_addr.patch new file mode 100644 index 00000000000..069cc5a7f24 --- /dev/null +++ b/queue-6.6/riscv-stacktrace-fix-usage-of-ftrace_graph_ret_addr.patch @@ -0,0 +1,49 @@ +From 938b8ca1c11f70725f5307f2acbc324ef8bcc509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 14:58:20 +0000 +Subject: riscv: stacktrace: fix usage of ftrace_graph_ret_addr() + +From: Puranjay Mohan + +[ Upstream commit 393da6cbb2ff89aadc47683a85269f913aa1c139 ] + +ftrace_graph_ret_addr() takes an `idx` integer pointer that is used to +optimize the stack unwinding. Pass it a valid pointer to utilize the +optimizations that might be available in the future. + +The commit is making riscv's usage of ftrace_graph_ret_addr() match +x86_64. + +Signed-off-by: Puranjay Mohan +Reviewed-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20240618145820.62112-1-puranjay@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/stacktrace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c +index 0d3f00eb0baee..10e311b2759d3 100644 +--- a/arch/riscv/kernel/stacktrace.c ++++ b/arch/riscv/kernel/stacktrace.c +@@ -32,6 +32,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + bool (*fn)(void *, unsigned long), void *arg) + { + unsigned long fp, sp, pc; ++ int graph_idx = 0; + int level = 0; + + if (regs) { +@@ -68,7 +69,7 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs, + pc = regs->ra; + } else { + fp = frame->fp; +- pc = ftrace_graph_ret_addr(current, NULL, frame->ra, ++ pc = ftrace_graph_ret_addr(current, &graph_idx, frame->ra, + &frame->ra); + if (pc == (unsigned long)ret_from_exception) { + if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc))) +-- +2.43.0 + diff --git a/queue-6.6/s390-sclp-fix-sclp_init-cleanup-on-failure.patch b/queue-6.6/s390-sclp-fix-sclp_init-cleanup-on-failure.patch new file mode 100644 index 00000000000..45b3f8135fa --- /dev/null +++ b/queue-6.6/s390-sclp-fix-sclp_init-cleanup-on-failure.patch @@ -0,0 +1,57 @@ +From 304f42f94defc889530d63dc1aef9ec5546d3114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 18:09:01 +0200 +Subject: s390/sclp: Fix sclp_init() cleanup on failure + +From: Heiko Carstens + +[ Upstream commit 6434b33faaa063df500af355ee6c3942e0f8d982 ] + +If sclp_init() fails it only partially cleans up: if there are multiple +failing calls to sclp_init() sclp_state_change_event will be added several +times to sclp_reg_list, which results in the following warning: + +------------[ cut here ]------------ +list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. +WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 +Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) + R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 +... +Call Trace: + [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8 +([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) + [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 + [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 + [<000003ffe15b77a6>] do_initcalls+0x126/0x150 + [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 + [<000003ffe0d6650e>] kernel_init+0x2e/0x180 + [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 + [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 + +Fix this by removing sclp_state_change_event from sclp_reg_list when +sclp_init() fails. + +Reviewed-by: Peter Oberparleiter +Signed-off-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/char/sclp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c +index 8f74db689a0c2..ba10f9b8fac72 100644 +--- a/drivers/s390/char/sclp.c ++++ b/drivers/s390/char/sclp.c +@@ -1293,6 +1293,7 @@ sclp_init(void) + fail_unregister_reboot_notifier: + unregister_reboot_notifier(&sclp_reboot_notifier); + fail_init_state_uninitialized: ++ list_del(&sclp_state_change_event.list); + sclp_init_state = sclp_init_state_uninitialized; + free_page((unsigned long) sclp_read_sccb); + free_page((unsigned long) sclp_init_sccb); +-- +2.43.0 + diff --git a/queue-6.6/scsi-core-alua-i-o-errors-for-alua-state-transitions.patch b/queue-6.6/scsi-core-alua-i-o-errors-for-alua-state-transitions.patch new file mode 100644 index 00000000000..f92fa6a20d6 --- /dev/null +++ b/queue-6.6/scsi-core-alua-i-o-errors-for-alua-state-transitions.patch @@ -0,0 +1,110 @@ +From 11798e37719678d7f799db9bb18d028ab7c9257b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 16:03:44 +0200 +Subject: scsi: core: alua: I/O errors for ALUA state transitions + +From: Martin Wilck + +[ Upstream commit 10157b1fc1a762293381e9145041253420dfc6ad ] + +When a host is configured with a few LUNs and I/O is running, injecting FC +faults repeatedly leads to path recovery problems. The LUNs have 4 paths +each and 3 of them come back active after say an FC fault which makes 2 of +the paths go down, instead of all 4. This happens after several iterations +of continuous FC faults. + +Reason here is that we're returning an I/O error whenever we're +encountering sense code 06/04/0a (LOGICAL UNIT NOT ACCESSIBLE, ASYMMETRIC +ACCESS STATE TRANSITION) instead of retrying. + +[mwilck: The original patch was developed by Rajashekhar M A and Hannes +Reinecke. I moved the code to alua_check_sense() as suggested by Mike +Christie [1]. Evan Milne had raised the question whether pg->state should +be set to transitioning in the UA case [2]. I believe that doing this is +correct. SCSI_ACCESS_STATE_TRANSITIONING by itself doesn't cause I/O +errors. Our handler schedules an RTPG, which will only result in an I/O +error condition if the transitioning timeout expires.] + +[1] https://lore.kernel.org/all/0bc96e82-fdda-4187-148d-5b34f81d4942@oracle.com/ +[2] https://lore.kernel.org/all/CAGtn9r=kicnTDE2o7Gt5Y=yoidHYD7tG8XdMHEBJTBraVEoOCw@mail.gmail.com/ + +Co-developed-by: Rajashekhar M A +Co-developed-by: Hannes Reinecke +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin Wilck +Link: https://lore.kernel.org/r/20240514140344.19538-1-mwilck@suse.com +Reviewed-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 31 +++++++++++++++------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index a226dc1b65d71..4eb0837298d4d 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -414,28 +414,40 @@ static char print_alua_state(unsigned char state) + } + } + +-static enum scsi_disposition alua_check_sense(struct scsi_device *sdev, +- struct scsi_sense_hdr *sense_hdr) ++static void alua_handle_state_transition(struct scsi_device *sdev) + { + struct alua_dh_data *h = sdev->handler_data; + struct alua_port_group *pg; + ++ rcu_read_lock(); ++ pg = rcu_dereference(h->pg); ++ if (pg) ++ pg->state = SCSI_ACCESS_STATE_TRANSITIONING; ++ rcu_read_unlock(); ++ alua_check(sdev, false); ++} ++ ++static enum scsi_disposition alua_check_sense(struct scsi_device *sdev, ++ struct scsi_sense_hdr *sense_hdr) ++{ + switch (sense_hdr->sense_key) { + case NOT_READY: + if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) { + /* + * LUN Not Accessible - ALUA state transition + */ +- rcu_read_lock(); +- pg = rcu_dereference(h->pg); +- if (pg) +- pg->state = SCSI_ACCESS_STATE_TRANSITIONING; +- rcu_read_unlock(); +- alua_check(sdev, false); ++ alua_handle_state_transition(sdev); + return NEEDS_RETRY; + } + break; + case UNIT_ATTENTION: ++ if (sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x0a) { ++ /* ++ * LUN Not Accessible - ALUA state transition ++ */ ++ alua_handle_state_transition(sdev); ++ return NEEDS_RETRY; ++ } + if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00) { + /* + * Power On, Reset, or Bus Device Reset. +@@ -502,7 +514,8 @@ static int alua_tur(struct scsi_device *sdev) + + retval = scsi_test_unit_ready(sdev, ALUA_FAILOVER_TIMEOUT * HZ, + ALUA_FAILOVER_RETRIES, &sense_hdr); +- if (sense_hdr.sense_key == NOT_READY && ++ if ((sense_hdr.sense_key == NOT_READY || ++ sense_hdr.sense_key == UNIT_ATTENTION) && + sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) + return SCSI_DH_RETRY; + else if (retval) +-- +2.43.0 + diff --git a/queue-6.6/scsi-libsas-fix-exp-attached-device-scan-after-probe.patch b/queue-6.6/scsi-libsas-fix-exp-attached-device-scan-after-probe.patch new file mode 100644 index 00000000000..92f4978e417 --- /dev/null +++ b/queue-6.6/scsi-libsas-fix-exp-attached-device-scan-after-probe.patch @@ -0,0 +1,75 @@ +From 65592e06cb47f10d384abda442f613c15ed12b58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 09:17:42 +0000 +Subject: scsi: libsas: Fix exp-attached device scan after probe failure + scanned in again after probe failed + +From: Xingui Yang + +[ Upstream commit ab2068a6fb84751836a84c26ca72b3beb349619d ] + +The expander phy will be treated as broadcast flutter in the next +revalidation after the exp-attached end device probe failed, as follows: + +[78779.654026] sas: broadcast received: 0 +[78779.654037] sas: REVALIDATING DOMAIN on port 0, pid:10 +[78779.654680] sas: ex 500e004aaaaaaa1f phy05 change count has changed +[78779.662977] sas: ex 500e004aaaaaaa1f phy05 originated BROADCAST(CHANGE) +[78779.662986] sas: ex 500e004aaaaaaa1f phy05 new device attached +[78779.663079] sas: ex 500e004aaaaaaa1f phy05:U:8 attached: 500e004aaaaaaa05 (stp) +[78779.693542] hisi_sas_v3_hw 0000:b4:02.0: dev[16:5] found +[78779.701155] sas: done REVALIDATING DOMAIN on port 0, pid:10, res 0x0 +[78779.707864] sas: Enter sas_scsi_recover_host busy: 0 failed: 0 +... +[78835.161307] sas: --- Exit sas_scsi_recover_host: busy: 0 failed: 0 tries: 1 +[78835.171344] sas: sas_probe_sata: for exp-attached device 500e004aaaaaaa05 returned -19 +[78835.180879] hisi_sas_v3_hw 0000:b4:02.0: dev[16:5] is gone +[78835.187487] sas: broadcast received: 0 +[78835.187504] sas: REVALIDATING DOMAIN on port 0, pid:10 +[78835.188263] sas: ex 500e004aaaaaaa1f phy05 change count has changed +[78835.195870] sas: ex 500e004aaaaaaa1f phy05 originated BROADCAST(CHANGE) +[78835.195875] sas: ex 500e004aaaaaaa1f rediscovering phy05 +[78835.196022] sas: ex 500e004aaaaaaa1f phy05:U:A attached: 500e004aaaaaaa05 (stp) +[78835.196026] sas: ex 500e004aaaaaaa1f phy05 broadcast flutter +[78835.197615] sas: done REVALIDATING DOMAIN on port 0, pid:10, res 0x0 + +The cause of the problem is that the related ex_phy's attached_sas_addr was +not cleared after the end device probe failed, so reset it. + +Signed-off-by: Xingui Yang +Link: https://lore.kernel.org/r/20240619091742.25465-1-yangxingui@huawei.com +Reviewed-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_internal.h | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h +index a6dc7dc07fce3..277e45fed85d6 100644 +--- a/drivers/scsi/libsas/sas_internal.h ++++ b/drivers/scsi/libsas/sas_internal.h +@@ -133,6 +133,20 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i + func, dev->parent ? "exp-attached" : + "direct-attached", + SAS_ADDR(dev->sas_addr), err); ++ ++ /* ++ * If the device probe failed, the expander phy attached address ++ * needs to be reset so that the phy will not be treated as flutter ++ * in the next revalidation ++ */ ++ if (dev->parent && !dev_is_expander(dev->dev_type)) { ++ struct sas_phy *phy = dev->phy; ++ struct domain_device *parent = dev->parent; ++ struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; ++ ++ memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); ++ } ++ + sas_unregister_dev(dev->port, dev); + } + +-- +2.43.0 + diff --git a/queue-6.6/scsi-qedf-don-t-process-stag-work-during-unload-and-.patch b/queue-6.6/scsi-qedf-don-t-process-stag-work-during-unload-and-.patch new file mode 100644 index 00000000000..c54fc5847cd --- /dev/null +++ b/queue-6.6/scsi-qedf-don-t-process-stag-work-during-unload-and-.patch @@ -0,0 +1,51 @@ +From e23105988af17e8ec5c630fa6fd982ad785609f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 14:40:59 +0530 +Subject: scsi: qedf: Don't process stag work during unload and recovery + +From: Saurav Kashyap + +[ Upstream commit 51071f0831ea975fc045526dd7e17efe669dc6e1 ] + +Stag work can cause issues during unload and recovery, hence don't process +it. + +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20240515091101.18754-2-skashyap@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 91f3f1d7098eb..c27e27cff0790 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3996,6 +3996,22 @@ void qedf_stag_change_work(struct work_struct *work) + struct qedf_ctx *qedf = + container_of(work, struct qedf_ctx, stag_work.work); + ++ if (!qedf) { ++ QEDF_ERR(&qedf->dbg_ctx, "qedf is NULL"); ++ return; ++ } ++ ++ if (test_bit(QEDF_IN_RECOVERY, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, ++ "Already is in recovery, hence not calling software context reset.\n"); ++ return; ++ } ++ ++ if (test_bit(QEDF_UNLOADING, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n"); ++ return; ++ } ++ + printk_ratelimited("[%s]:[%s:%d]:%d: Performing software context reset.", + dev_name(&qedf->pdev->dev), __func__, __LINE__, + qedf->dbg_ctx.host_no); +-- +2.43.0 + diff --git a/queue-6.6/scsi-qedf-set-qed_slowpath_params-to-zero-before-use.patch b/queue-6.6/scsi-qedf-set-qed_slowpath_params-to-zero-before-use.patch new file mode 100644 index 00000000000..e90ea5a4355 --- /dev/null +++ b/queue-6.6/scsi-qedf-set-qed_slowpath_params-to-zero-before-use.patch @@ -0,0 +1,35 @@ +From 94a95f394e55b42d2544bcf59d15b1e44334dae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 14:41:01 +0530 +Subject: scsi: qedf: Set qed_slowpath_params to zero before use + +From: Saurav Kashyap + +[ Upstream commit 6c3bb589debd763dc4b94803ddf3c13b4fcca776 ] + +Zero qed_slowpath_params before use. + +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20240515091101.18754-4-skashyap@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index c97e129194f78..14625e6bc8824 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3472,6 +3472,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + } + + /* Start the Slowpath-process */ ++ memset(&slowpath_params, 0, sizeof(struct qed_slowpath_params)); + slowpath_params.int_mode = QED_INT_MODE_MSIX; + slowpath_params.drv_major = QEDF_DRIVER_MAJOR_VER; + slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER; +-- +2.43.0 + diff --git a/queue-6.6/scsi-qedf-wait-for-stag-work-during-unload.patch b/queue-6.6/scsi-qedf-wait-for-stag-work-during-unload.patch new file mode 100644 index 00000000000..cb2674e9c1d --- /dev/null +++ b/queue-6.6/scsi-qedf-wait-for-stag-work-during-unload.patch @@ -0,0 +1,130 @@ +From e52df9f15f7a237a58162169196095cfd6b747fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 14:41:00 +0530 +Subject: scsi: qedf: Wait for stag work during unload + +From: Saurav Kashyap + +[ Upstream commit 78e88472b60936025b83eba57cffa59d3501dc07 ] + +If stag work is already scheduled and unload is called, it can lead to +issues as unload cleans up the work element. Wait for stag work to get +completed before cleanup during unload. + +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20240515091101.18754-3-skashyap@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf.h | 1 + + drivers/scsi/qedf/qedf_main.c | 30 +++++++++++++++++++++++++++--- + 2 files changed, 28 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h +index 1619cc33034f2..c5d06d16c490f 100644 +--- a/drivers/scsi/qedf/qedf.h ++++ b/drivers/scsi/qedf/qedf.h +@@ -362,6 +362,7 @@ struct qedf_ctx { + #define QEDF_IN_RECOVERY 5 + #define QEDF_DBG_STOP_IO 6 + #define QEDF_PROBING 8 ++#define QEDF_STAG_IN_PROGRESS 9 + unsigned long flags; /* Miscellaneous state flags */ + int fipvlan_retries; + u8 num_queues; +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index c27e27cff0790..c97e129194f78 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -318,11 +318,18 @@ static struct fc_seq *qedf_elsct_send(struct fc_lport *lport, u32 did, + */ + if (resp == fc_lport_flogi_resp) { + qedf->flogi_cnt++; ++ qedf->flogi_pending++; ++ ++ if (test_bit(QEDF_UNLOADING, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Driver unloading\n"); ++ qedf->flogi_pending = 0; ++ } ++ + if (qedf->flogi_pending >= QEDF_FLOGI_RETRY_CNT) { + schedule_delayed_work(&qedf->stag_work, 2); + return NULL; + } +- qedf->flogi_pending++; ++ + return fc_elsct_send(lport, did, fp, op, qedf_flogi_resp, + arg, timeout); + } +@@ -911,13 +918,14 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + struct qedf_ctx *qedf; + struct qed_link_output if_link; + ++ qedf = lport_priv(lport); ++ + if (lport->vport) { ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + printk_ratelimited("Cannot issue host reset on NPIV port.\n"); + return; + } + +- qedf = lport_priv(lport); +- + qedf->flogi_pending = 0; + /* For host reset, essentially do a soft link up/down */ + atomic_set(&qedf->link_state, QEDF_LINK_DOWN); +@@ -937,6 +945,7 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + if (!if_link.link_up) { + QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, + "Physical link is not up.\n"); ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + return; + } + /* Flush and wait to make sure link down is processed */ +@@ -949,6 +958,7 @@ void qedf_ctx_soft_reset(struct fc_lport *lport) + "Queue link up work.\n"); + queue_delayed_work(qedf->link_update_wq, &qedf->link_update, + 0); ++ clear_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); + } + + /* Reset the host by gracefully logging out and then logging back in */ +@@ -3720,6 +3730,7 @@ static void __qedf_remove(struct pci_dev *pdev, int mode) + { + struct qedf_ctx *qedf; + int rc; ++ int cnt = 0; + + if (!pdev) { + QEDF_ERR(NULL, "pdev is NULL.\n"); +@@ -3737,6 +3748,17 @@ static void __qedf_remove(struct pci_dev *pdev, int mode) + return; + } + ++stag_in_prog: ++ if (test_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags)) { ++ QEDF_ERR(&qedf->dbg_ctx, "Stag in progress, cnt=%d.\n", cnt); ++ cnt++; ++ ++ if (cnt < 5) { ++ msleep(500); ++ goto stag_in_prog; ++ } ++ } ++ + if (mode != QEDF_MODE_RECOVERY) + set_bit(QEDF_UNLOADING, &qedf->flags); + +@@ -4012,6 +4034,8 @@ void qedf_stag_change_work(struct work_struct *work) + return; + } + ++ set_bit(QEDF_STAG_IN_PROGRESS, &qedf->flags); ++ + printk_ratelimited("[%s]:[%s:%d]:%d: Performing software context reset.", + dev_name(&qedf->pdev->dev), __func__, __LINE__, + qedf->dbg_ctx.host_no); +-- +2.43.0 + diff --git a/queue-6.6/scsi-sr-fix-unintentional-arithmetic-wraparound.patch b/queue-6.6/scsi-sr-fix-unintentional-arithmetic-wraparound.patch new file mode 100644 index 00000000000..889b7088a31 --- /dev/null +++ b/queue-6.6/scsi-sr-fix-unintentional-arithmetic-wraparound.patch @@ -0,0 +1,136 @@ +From 2dbe6128626c8168590d0130e56405def701980d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 17:22:51 +0000 +Subject: scsi: sr: Fix unintentional arithmetic wraparound + +From: Justin Stitt + +[ Upstream commit 9fad9d560af5c654bb38e0b07ee54a4e9acdc5cd ] + +Running syzkaller with the newly reintroduced signed integer overflow +sanitizer produces this report: + +[ 65.194362] ------------[ cut here ]------------ +[ 65.197752] UBSAN: signed-integer-overflow in ../drivers/scsi/sr_ioctl.c:436:9 +[ 65.203607] -2147483648 * 177 cannot be represented in type 'int' +[ 65.207911] CPU: 2 PID: 10416 Comm: syz-executor.1 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 +[ 65.213585] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +[ 65.219923] Call Trace: +[ 65.221556] +[ 65.223029] dump_stack_lvl+0x93/0xd0 +[ 65.225573] handle_overflow+0x171/0x1b0 +[ 65.228219] sr_select_speed+0xeb/0xf0 +[ 65.230786] ? __pm_runtime_resume+0xe6/0x130 +[ 65.233606] sr_block_ioctl+0x15d/0x1d0 +... + +Historically, the signed integer overflow sanitizer did not work in the +kernel due to its interaction with `-fwrapv` but this has since been +changed [1] in the newest version of Clang. It was re-enabled in the kernel +with Commit 557f8c582a9b ("ubsan: Reintroduce signed overflow sanitizer"). + +Firstly, let's change the type of "speed" to unsigned long as +sr_select_speed()'s only caller passes in an unsigned long anyways. + +$ git grep '\.select_speed' +| drivers/scsi/sr.c: .select_speed = sr_select_speed, +... +| static int cdrom_ioctl_select_speed(struct cdrom_device_info *cdi, +| unsigned long arg) +| { +| ... +| return cdi->ops->select_speed(cdi, arg); +| } + +Next, let's add an extra check to make sure we don't exceed 0xffff/177 +(350) since 0xffff is the max speed. This has two benefits: 1) we deal +with integer overflow before it happens and 2) we properly respect the +max speed of 0xffff. There are some "magic" numbers here but I did not +want to change more than what was necessary. + +Link: https://github.com/llvm/llvm-project/pull/82432 [1] +Closes: https://github.com/KSPP/linux/issues/357 +Cc: linux-hardening@vger.kernel.org +Signed-off-by: Justin Stitt +Link: https://lore.kernel.org/r/20240508-b4-b4-sio-sr_select_speed-v2-1-00b68f724290@google.com +Reviewed-by: Kees Cook +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + Documentation/cdrom/cdrom-standard.rst | 4 ++-- + drivers/scsi/sr.h | 2 +- + drivers/scsi/sr_ioctl.c | 5 ++++- + include/linux/cdrom.h | 2 +- + 4 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/Documentation/cdrom/cdrom-standard.rst b/Documentation/cdrom/cdrom-standard.rst +index 7964fe134277b..6c1303cff159e 100644 +--- a/Documentation/cdrom/cdrom-standard.rst ++++ b/Documentation/cdrom/cdrom-standard.rst +@@ -217,7 +217,7 @@ current *struct* is:: + int (*media_changed)(struct cdrom_device_info *, int); + int (*tray_move)(struct cdrom_device_info *, int); + int (*lock_door)(struct cdrom_device_info *, int); +- int (*select_speed)(struct cdrom_device_info *, int); ++ int (*select_speed)(struct cdrom_device_info *, unsigned long); + int (*get_last_session) (struct cdrom_device_info *, + struct cdrom_multisession *); + int (*get_mcn)(struct cdrom_device_info *, struct cdrom_mcn *); +@@ -396,7 +396,7 @@ action need be taken, and the return value should be 0. + + :: + +- int select_speed(struct cdrom_device_info *cdi, int speed) ++ int select_speed(struct cdrom_device_info *cdi, unsigned long speed) + + Some CD-ROM drives are capable of changing their head-speed. There + are several reasons for changing the speed of a CD-ROM drive. Badly +diff --git a/drivers/scsi/sr.h b/drivers/scsi/sr.h +index 1175f2e213b56..dc899277b3a44 100644 +--- a/drivers/scsi/sr.h ++++ b/drivers/scsi/sr.h +@@ -65,7 +65,7 @@ int sr_disk_status(struct cdrom_device_info *); + int sr_get_last_session(struct cdrom_device_info *, struct cdrom_multisession *); + int sr_get_mcn(struct cdrom_device_info *, struct cdrom_mcn *); + int sr_reset(struct cdrom_device_info *); +-int sr_select_speed(struct cdrom_device_info *cdi, int speed); ++int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed); + int sr_audio_ioctl(struct cdrom_device_info *, unsigned int, void *); + + int sr_is_xa(Scsi_CD *); +diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c +index 5b0b35e60e61f..a0d2556a27bba 100644 +--- a/drivers/scsi/sr_ioctl.c ++++ b/drivers/scsi/sr_ioctl.c +@@ -425,11 +425,14 @@ int sr_reset(struct cdrom_device_info *cdi) + return 0; + } + +-int sr_select_speed(struct cdrom_device_info *cdi, int speed) ++int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed) + { + Scsi_CD *cd = cdi->handle; + struct packet_command cgc; + ++ /* avoid exceeding the max speed or overflowing integer bounds */ ++ speed = clamp(0, speed, 0xffff / 177); ++ + if (speed == 0) + speed = 0xffff; /* set to max */ + else +diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h +index 98c6fd0b39b63..fdfb61ccf55ae 100644 +--- a/include/linux/cdrom.h ++++ b/include/linux/cdrom.h +@@ -77,7 +77,7 @@ struct cdrom_device_ops { + unsigned int clearing, int slot); + int (*tray_move) (struct cdrom_device_info *, int); + int (*lock_door) (struct cdrom_device_info *, int); +- int (*select_speed) (struct cdrom_device_info *, int); ++ int (*select_speed) (struct cdrom_device_info *, unsigned long); + int (*get_last_session) (struct cdrom_device_info *, + struct cdrom_multisession *); + int (*get_mcn) (struct cdrom_device_info *, +-- +2.43.0 + diff --git a/queue-6.6/selftest-timerns-fix-clang-build-failures-for-abs-ca.patch b/queue-6.6/selftest-timerns-fix-clang-build-failures-for-abs-ca.patch new file mode 100644 index 00000000000..606828d4ece --- /dev/null +++ b/queue-6.6/selftest-timerns-fix-clang-build-failures-for-abs-ca.patch @@ -0,0 +1,114 @@ +From d0e62c6ca4ad425c7b22e82625103131c451b435 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 19:52:47 -0700 +Subject: selftest/timerns: fix clang build failures for abs() calls + +From: John Hubbard + +[ Upstream commit f76f9bc616b7320df6789241ca7d26cedcf03cf3 ] + +When building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...clang warns about mismatches between the expected and required +integer length being supplied to abs(3). + +Fix this by using the correct variant of abs(3): labs(3) or llabs(3), in +these cases. + +Reviewed-by: Dmitry Safonov +Reviewed-by: Muhammad Usama Anjum +Signed-off-by: John Hubbard +Acked-by: Andrei Vagin +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/timens/exec.c | 6 +++--- + tools/testing/selftests/timens/timer.c | 2 +- + tools/testing/selftests/timens/timerfd.c | 2 +- + tools/testing/selftests/timens/vfork_exec.c | 4 ++-- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/timens/exec.c b/tools/testing/selftests/timens/exec.c +index e40dc5be2f668..d12ff955de0d8 100644 +--- a/tools/testing/selftests/timens/exec.c ++++ b/tools/testing/selftests/timens/exec.c +@@ -30,7 +30,7 @@ int main(int argc, char *argv[]) + + for (i = 0; i < 2; i++) { + _gettime(CLOCK_MONOTONIC, &tst, i); +- if (abs(tst.tv_sec - now.tv_sec) > 5) ++ if (labs(tst.tv_sec - now.tv_sec) > 5) + return pr_fail("%ld %ld\n", now.tv_sec, tst.tv_sec); + } + return 0; +@@ -50,7 +50,7 @@ int main(int argc, char *argv[]) + + for (i = 0; i < 2; i++) { + _gettime(CLOCK_MONOTONIC, &tst, i); +- if (abs(tst.tv_sec - now.tv_sec) > 5) ++ if (labs(tst.tv_sec - now.tv_sec) > 5) + return pr_fail("%ld %ld\n", + now.tv_sec, tst.tv_sec); + } +@@ -70,7 +70,7 @@ int main(int argc, char *argv[]) + /* Check that a child process is in the new timens. */ + for (i = 0; i < 2; i++) { + _gettime(CLOCK_MONOTONIC, &tst, i); +- if (abs(tst.tv_sec - now.tv_sec - OFFSET) > 5) ++ if (labs(tst.tv_sec - now.tv_sec - OFFSET) > 5) + return pr_fail("%ld %ld\n", + now.tv_sec + OFFSET, tst.tv_sec); + } +diff --git a/tools/testing/selftests/timens/timer.c b/tools/testing/selftests/timens/timer.c +index 5e7f0051bd7be..5b939f59dfa4d 100644 +--- a/tools/testing/selftests/timens/timer.c ++++ b/tools/testing/selftests/timens/timer.c +@@ -56,7 +56,7 @@ int run_test(int clockid, struct timespec now) + return pr_perror("timerfd_gettime"); + + elapsed = new_value.it_value.tv_sec; +- if (abs(elapsed - 3600) > 60) { ++ if (llabs(elapsed - 3600) > 60) { + ksft_test_result_fail("clockid: %d elapsed: %lld\n", + clockid, elapsed); + return 1; +diff --git a/tools/testing/selftests/timens/timerfd.c b/tools/testing/selftests/timens/timerfd.c +index 9edd43d6b2c13..a4196bbd6e33f 100644 +--- a/tools/testing/selftests/timens/timerfd.c ++++ b/tools/testing/selftests/timens/timerfd.c +@@ -61,7 +61,7 @@ int run_test(int clockid, struct timespec now) + return pr_perror("timerfd_gettime(%d)", clockid); + + elapsed = new_value.it_value.tv_sec; +- if (abs(elapsed - 3600) > 60) { ++ if (llabs(elapsed - 3600) > 60) { + ksft_test_result_fail("clockid: %d elapsed: %lld\n", + clockid, elapsed); + return 1; +diff --git a/tools/testing/selftests/timens/vfork_exec.c b/tools/testing/selftests/timens/vfork_exec.c +index beb7614941fb1..5b8907bf451dd 100644 +--- a/tools/testing/selftests/timens/vfork_exec.c ++++ b/tools/testing/selftests/timens/vfork_exec.c +@@ -32,7 +32,7 @@ static void *tcheck(void *_args) + + for (i = 0; i < 2; i++) { + _gettime(CLOCK_MONOTONIC, &tst, i); +- if (abs(tst.tv_sec - now->tv_sec) > 5) { ++ if (labs(tst.tv_sec - now->tv_sec) > 5) { + pr_fail("%s: in-thread: unexpected value: %ld (%ld)\n", + args->tst_name, tst.tv_sec, now->tv_sec); + return (void *)1UL; +@@ -64,7 +64,7 @@ static int check(char *tst_name, struct timespec *now) + + for (i = 0; i < 2; i++) { + _gettime(CLOCK_MONOTONIC, &tst, i); +- if (abs(tst.tv_sec - now->tv_sec) > 5) ++ if (labs(tst.tv_sec - now->tv_sec) > 5) + return pr_fail("%s: unexpected value: %ld (%ld)\n", + tst_name, tst.tv_sec, now->tv_sec); + } +-- +2.43.0 + diff --git a/queue-6.6/selftests-bpf-extend-tcx-tests-to-cover-late-tcx_ent.patch b/queue-6.6/selftests-bpf-extend-tcx-tests-to-cover-late-tcx_ent.patch new file mode 100644 index 00000000000..1006f1f6780 --- /dev/null +++ b/queue-6.6/selftests-bpf-extend-tcx-tests-to-cover-late-tcx_ent.patch @@ -0,0 +1,142 @@ +From 4762c46fbda1d151f63dc12530bd80abdd675e24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 15:31:30 +0200 +Subject: selftests/bpf: Extend tcx tests to cover late tcx_entry release + +From: Daniel Borkmann + +[ Upstream commit 5f1d18de79180deac2822c93e431bbe547f7d3ce ] + +Add a test case which replaces an active ingress qdisc while keeping the +miniq in-tact during the transition period to the new clsact qdisc. + + # ./vmtest.sh -- ./test_progs -t tc_link + [...] + ./test_progs -t tc_link + [ 3.412871] bpf_testmod: loading out-of-tree module taints kernel. + [ 3.413343] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel + #332 tc_links_after:OK + #333 tc_links_append:OK + #334 tc_links_basic:OK + #335 tc_links_before:OK + #336 tc_links_chain_classic:OK + #337 tc_links_chain_mixed:OK + #338 tc_links_dev_chain0:OK + #339 tc_links_dev_cleanup:OK + #340 tc_links_dev_mixed:OK + #341 tc_links_ingress:OK + #342 tc_links_invalid:OK + #343 tc_links_prepend:OK + #344 tc_links_replace:OK + #345 tc_links_revision:OK + Summary: 14/0 PASSED, 0 SKIPPED, 0 FAILED + +Signed-off-by: Daniel Borkmann +Cc: Martin KaFai Lau +Link: https://lore.kernel.org/r/20240708133130.11609-2-daniel@iogearbox.net +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/config | 3 + + .../selftests/bpf/prog_tests/tc_links.c | 61 +++++++++++++++++++ + 2 files changed, 64 insertions(+) + +diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config +index e41eb33b27046..5751614aef6a5 100644 +--- a/tools/testing/selftests/bpf/config ++++ b/tools/testing/selftests/bpf/config +@@ -52,9 +52,12 @@ CONFIG_MPLS=y + CONFIG_MPLS_IPTUNNEL=y + CONFIG_MPLS_ROUTING=y + CONFIG_MPTCP=y ++CONFIG_NET_ACT_SKBMOD=y ++CONFIG_NET_CLS=y + CONFIG_NET_CLS_ACT=y + CONFIG_NET_CLS_BPF=y + CONFIG_NET_CLS_FLOWER=y ++CONFIG_NET_CLS_MATCHALL=y + CONFIG_NET_FOU=y + CONFIG_NET_FOU_IP_TUNNELS=y + CONFIG_NET_IPGRE=y +diff --git a/tools/testing/selftests/bpf/prog_tests/tc_links.c b/tools/testing/selftests/bpf/prog_tests/tc_links.c +index bc98411446855..1af9ec1149aab 100644 +--- a/tools/testing/selftests/bpf/prog_tests/tc_links.c ++++ b/tools/testing/selftests/bpf/prog_tests/tc_links.c +@@ -9,6 +9,8 @@ + #define ping_cmd "ping -q -c1 -w1 127.0.0.1 > /dev/null" + + #include "test_tc_link.skel.h" ++ ++#include "netlink_helpers.h" + #include "tc_helpers.h" + + void serial_test_tc_links_basic(void) +@@ -1787,6 +1789,65 @@ void serial_test_tc_links_ingress(void) + test_tc_links_ingress(BPF_TCX_INGRESS, false, false); + } + ++struct qdisc_req { ++ struct nlmsghdr n; ++ struct tcmsg t; ++ char buf[1024]; ++}; ++ ++static int qdisc_replace(int ifindex, const char *kind, bool block) ++{ ++ struct rtnl_handle rth = { .fd = -1 }; ++ struct qdisc_req req; ++ int err; ++ ++ err = rtnl_open(&rth, 0); ++ if (!ASSERT_OK(err, "open_rtnetlink")) ++ return err; ++ ++ memset(&req, 0, sizeof(req)); ++ req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg)); ++ req.n.nlmsg_flags = NLM_F_CREATE | NLM_F_REPLACE | NLM_F_REQUEST; ++ req.n.nlmsg_type = RTM_NEWQDISC; ++ req.t.tcm_family = AF_UNSPEC; ++ req.t.tcm_ifindex = ifindex; ++ req.t.tcm_parent = 0xfffffff1; ++ ++ addattr_l(&req.n, sizeof(req), TCA_KIND, kind, strlen(kind) + 1); ++ if (block) ++ addattr32(&req.n, sizeof(req), TCA_INGRESS_BLOCK, 1); ++ ++ err = rtnl_talk(&rth, &req.n, NULL); ++ ASSERT_OK(err, "talk_rtnetlink"); ++ rtnl_close(&rth); ++ return err; ++} ++ ++void serial_test_tc_links_dev_chain0(void) ++{ ++ int err, ifindex; ++ ++ ASSERT_OK(system("ip link add dev foo type veth peer name bar"), "add veth"); ++ ifindex = if_nametoindex("foo"); ++ ASSERT_NEQ(ifindex, 0, "non_zero_ifindex"); ++ err = qdisc_replace(ifindex, "ingress", true); ++ if (!ASSERT_OK(err, "attaching ingress")) ++ goto cleanup; ++ ASSERT_OK(system("tc filter add block 1 matchall action skbmod swap mac"), "add block"); ++ err = qdisc_replace(ifindex, "clsact", false); ++ if (!ASSERT_OK(err, "attaching clsact")) ++ goto cleanup; ++ /* Heuristic: kern_sync_rcu() alone does not work; a wait-time of ~5s ++ * triggered the issue without the fix reliably 100% of the time. ++ */ ++ sleep(5); ++ ASSERT_OK(system("tc filter add dev foo ingress matchall action skbmod swap mac"), "add filter"); ++cleanup: ++ ASSERT_OK(system("ip link del dev foo"), "del veth"); ++ ASSERT_EQ(if_nametoindex("foo"), 0, "foo removed"); ++ ASSERT_EQ(if_nametoindex("bar"), 0, "bar removed"); ++} ++ + static void test_tc_links_dev_mixed(int target) + { + LIBBPF_OPTS(bpf_tc_opts, tc_opts, .handle = 1, .priority = 1); +-- +2.43.0 + diff --git a/queue-6.6/selftests-cachestat-fix-build-warnings-on-ppc64.patch b/queue-6.6/selftests-cachestat-fix-build-warnings-on-ppc64.patch new file mode 100644 index 00000000000..527d832a304 --- /dev/null +++ b/queue-6.6/selftests-cachestat-fix-build-warnings-on-ppc64.patch @@ -0,0 +1,41 @@ +From 86026f47ac20795bfbba2f015ce22fbbc7a99bcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 13:01:11 +1000 +Subject: selftests: cachestat: Fix build warnings on ppc64 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit bc4d5f5d2debf8bb65fba188313481549ead8576 ] + +Fix warnings like: + test_cachestat.c: In function ‘print_cachestat’: + test_cachestat.c:30:38: warning: format ‘%llu’ expects argument of + type ‘long long unsigned int’, but argument 2 has type ‘__u64’ {aka + ‘long unsigned int’} [-Wformat=] + +By switching to unsigned long long for u64 for ppc64 builds. + +Signed-off-by: Michael Ellerman +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/cachestat/test_cachestat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/cachestat/test_cachestat.c b/tools/testing/selftests/cachestat/test_cachestat.c +index 4804c7dc7b312..ddb70d418c6a8 100644 +--- a/tools/testing/selftests/cachestat/test_cachestat.c ++++ b/tools/testing/selftests/cachestat/test_cachestat.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #define _GNU_SOURCE ++#define __SANE_USERSPACE_TYPES__ // Use ll64 + + #include + #include +-- +2.43.0 + diff --git a/queue-6.6/selftests-futex-pass-_gnu_source-without-a-value-to-.patch b/queue-6.6/selftests-futex-pass-_gnu_source-without-a-value-to-.patch new file mode 100644 index 00000000000..3d9df0466c4 --- /dev/null +++ b/queue-6.6/selftests-futex-pass-_gnu_source-without-a-value-to-.patch @@ -0,0 +1,53 @@ +From ac531686745f5563e14fd2a4f4b9a327d9b9c9ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 19:29:38 -0700 +Subject: selftests/futex: pass _GNU_SOURCE without a value to the compiler + +From: John Hubbard + +[ Upstream commit cb708ab9f584f159798b60853edcf0c8b67ce295 ] + +It's slightly better to set _GNU_SOURCE in the source code, but if one +must do it via the compiler invocation, then the best way to do so is +this: + + $(CC) -D_GNU_SOURCE= + +...because otherwise, if this form is used: + + $(CC) -D_GNU_SOURCE + +...then that leads the compiler to set a value, as if you had passed in: + + $(CC) -D_GNU_SOURCE=1 + +That, in turn, leads to warnings under both gcc and clang, like this: + + futex_requeue_pi.c:20: warning: "_GNU_SOURCE" redefined + +Fix this by using the "-D_GNU_SOURCE=" form. + +Reviewed-by: Edward Liaw +Reviewed-by: Davidlohr Bueso +Signed-off-by: John Hubbard +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/futex/functional/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile +index a392d0917b4e5..994fa3468f170 100644 +--- a/tools/testing/selftests/futex/functional/Makefile ++++ b/tools/testing/selftests/futex/functional/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + INCLUDES := -I../include -I../../ $(KHDR_INCLUDES) +-CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES) $(KHDR_INCLUDES) ++CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE= -pthread $(INCLUDES) $(KHDR_INCLUDES) + LDLIBS := -lpthread -lrt + + LOCAL_HDRS := \ +-- +2.43.0 + diff --git a/queue-6.6/selftests-openat2-fix-build-warnings-on-ppc64.patch b/queue-6.6/selftests-openat2-fix-build-warnings-on-ppc64.patch new file mode 100644 index 00000000000..15dfcb246ab --- /dev/null +++ b/queue-6.6/selftests-openat2-fix-build-warnings-on-ppc64.patch @@ -0,0 +1,44 @@ +From 8684791db0e9326fd5a7164e85b70e75a0c2535f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 13:03:25 +1000 +Subject: selftests/openat2: Fix build warnings on ppc64 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit 84b6df4c49a1cc2854a16937acd5fd3e6315d083 ] + +Fix warnings like: + + openat2_test.c: In function ‘test_openat2_flags’: + openat2_test.c:303:73: warning: format ‘%llX’ expects argument of type + ‘long long unsigned int’, but argument 5 has type ‘__u64’ {aka ‘long + unsigned int’} [-Wformat=] + +By switching to unsigned long long for u64 for ppc64 builds. + +Signed-off-by: Michael Ellerman +Reviewed-by: Muhammad Usama Anjum +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/openat2/openat2_test.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/openat2/openat2_test.c b/tools/testing/selftests/openat2/openat2_test.c +index 7fb902099de45..f9d2b0ec77564 100644 +--- a/tools/testing/selftests/openat2/openat2_test.c ++++ b/tools/testing/selftests/openat2/openat2_test.c +@@ -5,6 +5,7 @@ + */ + + #define _GNU_SOURCE ++#define __SANE_USERSPACE_TYPES__ // Use ll64 + #include + #include + #include +-- +2.43.0 + diff --git a/queue-6.6/selftests-openvswitch-set-value-to-nla-flags.patch b/queue-6.6/selftests-openvswitch-set-value-to-nla-flags.patch new file mode 100644 index 00000000000..2c8eac5a385 --- /dev/null +++ b/queue-6.6/selftests-openvswitch-set-value-to-nla-flags.patch @@ -0,0 +1,71 @@ +From 622dd7ce14bd500be1673e085e2a9265db33665a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 09:29:21 +0200 +Subject: selftests: openvswitch: Set value to nla flags. + +From: Adrian Moreno + +[ Upstream commit a8763466669d21b570b26160d0a5e0a2ee529d22 ] + +Netlink flags, although they don't have payload at the netlink level, +are represented as having "True" as value in pyroute2. + +Without it, trying to add a flow with a flag-type action (e.g: pop_vlan) +fails with the following traceback: + +Traceback (most recent call last): + File "[...]/ovs-dpctl.py", line 2498, in + sys.exit(main(sys.argv)) + ^^^^^^^^^^^^^^ + File "[...]/ovs-dpctl.py", line 2487, in main + ovsflow.add_flow(rep["dpifindex"], flow) + File "[...]/ovs-dpctl.py", line 2136, in add_flow + reply = self.nlm_request( + ^^^^^^^^^^^^^^^^^ + File "[...]/pyroute2/netlink/nlsocket.py", line 822, in nlm_request + return tuple(self._genlm_request(*argv, **kwarg)) + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "[...]/pyroute2/netlink/generic/__init__.py", line 126, in +nlm_request + return tuple(super().nlm_request(*argv, **kwarg)) + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "[...]/pyroute2/netlink/nlsocket.py", line 1124, in nlm_request + self.put(msg, msg_type, msg_flags, msg_seq=msg_seq) + File "[...]/pyroute2/netlink/nlsocket.py", line 389, in put + self.sendto_gate(msg, addr) + File "[...]/pyroute2/netlink/nlsocket.py", line 1056, in sendto_gate + msg.encode() + File "[...]/pyroute2/netlink/__init__.py", line 1245, in encode + offset = self.encode_nlas(offset) + ^^^^^^^^^^^^^^^^^^^^^^^^ + File "[...]/pyroute2/netlink/__init__.py", line 1560, in encode_nlas + nla_instance.setvalue(cell[1]) + File "[...]/pyroute2/netlink/__init__.py", line 1265, in setvalue + nlv.setvalue(nla_tuple[1]) + ~~~~~~~~~^^^ +IndexError: list index out of range + +Signed-off-by: Adrian Moreno +Acked-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/openvswitch/ovs-dpctl.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +index 5e0e539a323d5..8b120718768ec 100644 +--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py ++++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py +@@ -531,7 +531,7 @@ class ovsactions(nla): + for flat_act in parse_flat_map: + if parse_starts_block(actstr, flat_act[0], False): + actstr = actstr[len(flat_act[0]):] +- self["attrs"].append([flat_act[1]]) ++ self["attrs"].append([flat_act[1], True]) + actstr = actstr[strspn(actstr, ", ") :] + parsed = True + +-- +2.43.0 + diff --git a/queue-6.6/selftests-vdso-fix-clang-build-errors-and-warnings.patch b/queue-6.6/selftests-vdso-fix-clang-build-errors-and-warnings.patch new file mode 100644 index 00000000000..98910ebc8c4 --- /dev/null +++ b/queue-6.6/selftests-vdso-fix-clang-build-errors-and-warnings.patch @@ -0,0 +1,123 @@ +From 088d0ecdf9daaf4504a38a5c8694910dd9f4d88f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 09:57:34 -1000 +Subject: selftests/vDSO: fix clang build errors and warnings + +From: John Hubbard + +[ Upstream commit 73810cd45b99c6c418e1c6a487b52c1e74edb20d ] + +When building with clang, via: + + make LLVM=1 -C tools/testing/selftests + +...there are several warnings, and an error. This fixes all of those and +allows these tests to run and pass. + +1. Fix linker error (undefined reference to memcpy) by providing a local + version of memcpy. + +2. clang complains about using this form: + + if (g = h & 0xf0000000) + +...so factor out the assignment into a separate step. + +3. The code is passing a signed const char* to elf_hash(), which expects + a const unsigned char *. There are several callers, so fix this at + the source by allowing the function to accept a signed argument, and + then converting to unsigned operations, once inside the function. + +4. clang doesn't have __attribute__((externally_visible)) and generates + a warning to that effect. Fortunately, gcc 12 and gcc 13 do not seem + to require that attribute in order to build, run and pass tests here, + so remove it. + +Reviewed-by: Carlos Llamas +Reviewed-by: Edward Liaw +Reviewed-by: Muhammad Usama Anjum +Tested-by: Muhammad Usama Anjum +Signed-off-by: John Hubbard +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vDSO/parse_vdso.c | 16 +++++++++++----- + .../selftests/vDSO/vdso_standalone_test_x86.c | 18 ++++++++++++++++-- + 2 files changed, 27 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/vDSO/parse_vdso.c b/tools/testing/selftests/vDSO/parse_vdso.c +index 413f75620a35b..4ae417372e9eb 100644 +--- a/tools/testing/selftests/vDSO/parse_vdso.c ++++ b/tools/testing/selftests/vDSO/parse_vdso.c +@@ -55,14 +55,20 @@ static struct vdso_info + ELF(Verdef) *verdef; + } vdso_info; + +-/* Straight from the ELF specification. */ +-static unsigned long elf_hash(const unsigned char *name) ++/* ++ * Straight from the ELF specification...and then tweaked slightly, in order to ++ * avoid a few clang warnings. ++ */ ++static unsigned long elf_hash(const char *name) + { + unsigned long h = 0, g; +- while (*name) ++ const unsigned char *uch_name = (const unsigned char *)name; ++ ++ while (*uch_name) + { +- h = (h << 4) + *name++; +- if (g = h & 0xf0000000) ++ h = (h << 4) + *uch_name++; ++ g = h & 0xf0000000; ++ if (g) + h ^= g >> 24; + h &= ~g; + } +diff --git a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +index 8a44ff973ee17..27f6fdf119691 100644 +--- a/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c ++++ b/tools/testing/selftests/vDSO/vdso_standalone_test_x86.c +@@ -18,7 +18,7 @@ + + #include "parse_vdso.h" + +-/* We need a libc functions... */ ++/* We need some libc functions... */ + int strcmp(const char *a, const char *b) + { + /* This implementation is buggy: it never returns -1. */ +@@ -34,6 +34,20 @@ int strcmp(const char *a, const char *b) + return 0; + } + ++/* ++ * The clang build needs this, although gcc does not. ++ * Stolen from lib/string.c. ++ */ ++void *memcpy(void *dest, const void *src, size_t count) ++{ ++ char *tmp = dest; ++ const char *s = src; ++ ++ while (count--) ++ *tmp++ = *s++; ++ return dest; ++} ++ + /* ...and two syscalls. This is x86-specific. */ + static inline long x86_syscall3(long nr, long a0, long a1, long a2) + { +@@ -70,7 +84,7 @@ void to_base10(char *lastdig, time_t n) + } + } + +-__attribute__((externally_visible)) void c_main(void **stack) ++void c_main(void **stack) + { + /* Parse the stack */ + long argc = (long)*stack; +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 9d8a95e2700..589202ba2eb 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -1 +1,119 @@ filelock-remove-locks-reliably-when-fcntl-close-race-is-detected.patch +scsi-core-alua-i-o-errors-for-alua-state-transitions.patch +scsi-sr-fix-unintentional-arithmetic-wraparound.patch +scsi-qedf-don-t-process-stag-work-during-unload-and-.patch +scsi-qedf-wait-for-stag-work-during-unload.patch +scsi-qedf-set-qed_slowpath_params-to-zero-before-use.patch +efi-libstub-zboot.lds-discard-.discard-sections.patch +acpi-ec-abort-address-space-access-upon-error.patch +acpi-ec-avoid-returning-ae_ok-on-errors-in-address-s.patch +tools-power-cpupower-fix-pstate-frequency-reporting-.patch +wifi-mac80211-mesh-init-nonpeer_pm-to-active-by-defa.patch +wifi-mac80211-apply-mcast-rate-only-if-interface-is-.patch +wifi-mac80211-handle-tasklet-frames-before-stopping.patch +wifi-cfg80211-fix-6-ghz-scan-request-building.patch +wifi-iwlwifi-mvm-d3-fix-wowlan-command-version-looku.patch +wifi-iwlwifi-mvm-remove-stale-sta-link-data-during-r.patch +wifi-iwlwifi-mvm-handle-bigtk-cipher-in-kek_kck-cmd.patch +wifi-iwlwifi-mvm-handle-ba-session-teardown-in-rf-ki.patch +wifi-iwlwifi-mvm-properly-set-6-ghz-channel-direct-p.patch +wifi-iwlwifi-mvm-fix-scan-abort-handling-with-hw-rfk.patch +wifi-mac80211-fix-ubsan-noise-in-ieee80211_prep_hw_s.patch +selftests-cachestat-fix-build-warnings-on-ppc64.patch +selftests-openat2-fix-build-warnings-on-ppc64.patch +selftests-futex-pass-_gnu_source-without-a-value-to-.patch +of-irq-factor-out-parsing-of-interrupt-map-parent-ph.patch +input-silead-always-support-10-fingers.patch +net-ipv6-rpl_iptunnel-block-bh-in-rpl_output-and-rpl.patch +ila-block-bh-in-ila_output.patch +arm64-armv8_deprecated-fix-warning-in-isndep-cpuhp-s.patch +null_blk-fix-validation-of-block-size.patch +kconfig-gconf-give-a-proper-initial-state-to-the-sav.patch +kconfig-remove-wrong-expr_trans_bool.patch +input-add-event-code-for-accessibility-key.patch +input-add-support-for-do-not-disturb.patch +hid-ignore-battery-for-elan-touchscreens-2f2c-and-41.patch +nfsv4-fix-memory-leak-in-nfs4_set_security_label.patch +nfs-propagate-readlink-errors-in-nfs_symlink_filler.patch +nfs-avoid-flushing-many-pages-with-nfs_file_sync.patch +nfs-don-t-invalidate-dentries-on-transient-errors.patch +cachefiles-add-consistency-check-for-copen-cread.patch +cachefiles-set-object-to-close-if-ondemand_id-0-in-c.patch +cachefiles-make-on-demand-read-killable.patch +fs-file-fix-the-check-in-find_next_fd.patch +vfio-create-vfio_fs_type-with-inode-per-device.patch +mei-demote-client-disconnect-warning-on-suspend-to-d.patch +iomap-fix-iomap_adjust_read_range-for-plen-calculati.patch +drm-exynos-dp-drop-driver-owner-initialization.patch +drm-panel-orientation-quirks-add-quirk-for-aya-neo-k.patch +drm-mediatek-call-drm_atomic_helper_shutdown-at-shut.patch +nvme-avoid-double-free-special-payload.patch +nvmet-always-initialize-cqe.result.patch +alsa-hda-cs35l56-fix-lifecycle-of-codec-pointer.patch +wifi-cfg80211-wext-add-extra-siocsiwscan-data-check.patch +alsa-hda-realtek-support-lenovo-thinkbook-16p-gen-5.patch +kvm-ppc-book3s-hv-prevent-uaf-in-kvm_spapr_tce_attac.patch +drm-vmwgfx-fix-missing-hypervisor_guest-dependency.patch +alsa-hda-realtek-add-more-codec-id-to-no-shutup-pins.patch +spi-fix-octal-mode-support.patch +cpumask-limit-force_nr_cpus-to-just-the-up-case.patch +selftests-openvswitch-set-value-to-nla-flags.patch +drm-amdgpu-indicate-cu-havest-info-to-cp.patch +alsa-hda-cs35l56-select-serial_multi_instantiate.patch +mips-fix-compat_sys_lseek-syscall.patch +input-elantech-fix-touchpad-state-on-resume-for-leno.patch +input-i8042-add-ayaneo-kun-to-i8042-quirk-table.patch +asoc-rt722-sdca-sdw-add-silence-detection-register-a.patch +input-xpad-add-support-for-asus-rog-raikiri-pro.patch +asoc-topology-fix-references-to-freed-memory.patch +asoc-topology-do-not-assign-fields-that-are-already-.patch +bytcr_rt5640-inverse-jack-detect-for-archos-101-cesi.patch +alsa-dmaengine-synchronize-dma-channel-after-drop.patch +asoc-ti-davinci-mcasp-set-min-period-size-using-fifo.patch +asoc-ti-omap-hdmi-fix-too-long-driver-name.patch +asoc-sof-sof-audio-skip-unprepare-for-in-use-widgets.patch +asoc-rt722-sdca-sdw-add-debounce-time-for-type-detec.patch +nvme-fix-nvme_ns_deac-may-incorrectly-identifying-th.patch +input-ads7846-use-spi_device_id-table.patch +can-kvaser_usb-fix-return-value-for-hif_usb_send_reg.patch +gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch +octeontx2-pf-fix-coverity-and-klockwork-issues-in-oc.patch +s390-sclp-fix-sclp_init-cleanup-on-failure.patch +platform-mellanox-nvsw-sn2201-add-check-for-platform.patch +platform-x86-wireless-hotkey-add-support-for-lg-airp.patch +platform-x86-lg-laptop-remove-lgex0815-hotkey-handli.patch +platform-x86-lg-laptop-change-acpi-device-id.patch +platform-x86-lg-laptop-use-acpi-device-handle-when-e.patch +btrfs-qgroup-fix-quota-root-leak-after-quota-disable.patch +ibmvnic-add-tx-check-to-prevent-skb-leak.patch +alsa-pcm-allow-resume-only-for-suspended-streams.patch +alsa-hda-relatek-enable-mute-led-on-hp-laptop-15-gw0.patch +alsa-dmaengine_pcm-terminate-dmaengine-before-synchr.patch +asoc-amd-yc-fix-non-functional-mic-on-asus-m5602ra.patch +net-usb-qmi_wwan-add-telit-fn912-compositions.patch +net-mac802154-fix-racy-device-stats-updates-by-dev_s.patch +powerpc-pseries-whitelist-dtl-slub-object-for-copyin.patch +powerpc-eeh-avoid-possible-crash-when-edev-pdev-chan.patch +scsi-libsas-fix-exp-attached-device-scan-after-probe.patch +tee-optee-ffa-fix-missing-field-initializers-warning.patch +bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch +bluetooth-btnxpuart-enable-power-save-feature-on-sta.patch +bluetooth-l2cap-sync-sock-recv-cb-and-release.patch +erofs-ensure-m_llen-is-reset-to-0-if-metadata-is-inv.patch +drm-amd-display-add-refresh-rate-range-check.patch +drm-amd-display-account-for-cursor-prefetch-bw-in-dm.patch +drm-amd-display-fix-refresh-rate-range-for-some-pane.patch +drm-radeon-check-bo_va-bo-is-non-null-before-using-i.patch +fs-better-handle-deep-ancestor-chains-in-is_subdir.patch +wifi-iwlwifi-properly-set-wiphy_flag_supports_ext_ke.patch +drivers-perf-riscv-reset-the-counter-to-hpmevent-map.patch +riscv-stacktrace-fix-usage-of-ftrace_graph_ret_addr.patch +spi-imx-don-t-expect-dma-for-i.mx-25-35-50-51-53-csp.patch +ksmbd-return-file_device_disk-instead-of-super-magic.patch +asoc-sof-intel-hda-pcm-limit-the-maximum-number-of-p.patch +selftest-timerns-fix-clang-build-failures-for-abs-ca.patch +selftests-vdso-fix-clang-build-errors-and-warnings.patch +hfsplus-fix-uninit-value-in-copy_name.patch +selftests-bpf-extend-tcx-tests-to-cover-late-tcx_ent.patch +spi-mux-set-ctlr-bits_per_word_mask.patch +alsa-hda-use-imply-for-suggesting-config_serial_mult.patch diff --git a/queue-6.6/spi-fix-octal-mode-support.patch b/queue-6.6/spi-fix-octal-mode-support.patch new file mode 100644 index 00000000000..8b68612c5bf --- /dev/null +++ b/queue-6.6/spi-fix-octal-mode-support.patch @@ -0,0 +1,68 @@ +From 503f604290325c7d24c802b9b6bab3b5eebf555a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 15:29:51 +0200 +Subject: spi: Fix OCTAL mode support + +From: Patrice Chotard + +[ Upstream commit d6a711a898672dd873aab3844f754a3ca40723a5 ] + +Add OCTAL mode support. +Issue detected using "--octal" spidev_test's option. + +Signed-off-by: Patrice Chotard +Link: https://msgid.link/r/20240618132951.2743935-4-patrice.chotard@foss.st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 6 ++++-- + include/linux/spi/spi.h | 5 +++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index da15c3f388d1f..5c57c7378ee70 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -4000,7 +4000,8 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message) + return -EINVAL; + if (xfer->tx_nbits != SPI_NBITS_SINGLE && + xfer->tx_nbits != SPI_NBITS_DUAL && +- xfer->tx_nbits != SPI_NBITS_QUAD) ++ xfer->tx_nbits != SPI_NBITS_QUAD && ++ xfer->tx_nbits != SPI_NBITS_OCTAL) + return -EINVAL; + if ((xfer->tx_nbits == SPI_NBITS_DUAL) && + !(spi->mode & (SPI_TX_DUAL | SPI_TX_QUAD))) +@@ -4015,7 +4016,8 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message) + return -EINVAL; + if (xfer->rx_nbits != SPI_NBITS_SINGLE && + xfer->rx_nbits != SPI_NBITS_DUAL && +- xfer->rx_nbits != SPI_NBITS_QUAD) ++ xfer->rx_nbits != SPI_NBITS_QUAD && ++ xfer->rx_nbits != SPI_NBITS_OCTAL) + return -EINVAL; + if ((xfer->rx_nbits == SPI_NBITS_DUAL) && + !(spi->mode & (SPI_RX_DUAL | SPI_RX_QUAD))) +diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h +index 8cc7a99927f95..e5baf43bcfbb6 100644 +--- a/include/linux/spi/spi.h ++++ b/include/linux/spi/spi.h +@@ -1049,12 +1049,13 @@ struct spi_transfer { + unsigned dummy_data:1; + unsigned cs_off:1; + unsigned cs_change:1; +- unsigned tx_nbits:3; +- unsigned rx_nbits:3; ++ unsigned tx_nbits:4; ++ unsigned rx_nbits:4; + unsigned timestamped:1; + #define SPI_NBITS_SINGLE 0x01 /* 1-bit transfer */ + #define SPI_NBITS_DUAL 0x02 /* 2-bit transfer */ + #define SPI_NBITS_QUAD 0x04 /* 4-bit transfer */ ++#define SPI_NBITS_OCTAL 0x08 /* 8-bit transfer */ + u8 bits_per_word; + struct spi_delay delay; + struct spi_delay cs_change_delay; +-- +2.43.0 + diff --git a/queue-6.6/spi-imx-don-t-expect-dma-for-i.mx-25-35-50-51-53-csp.patch b/queue-6.6/spi-imx-don-t-expect-dma-for-i.mx-25-35-50-51-53-csp.patch new file mode 100644 index 00000000000..f2607eefade --- /dev/null +++ b/queue-6.6/spi-imx-don-t-expect-dma-for-i.mx-25-35-50-51-53-csp.patch @@ -0,0 +1,50 @@ +From a190341015e1e741e4f9c5cced797abff4890865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 11:56:10 +0200 +Subject: spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit ce1dac560a74220f2e53845ec0723b562288aed4 ] + +While in commit 2dd33f9cec90 ("spi: imx: support DMA for imx35") it was +claimed that DMA works on i.MX25, i.MX31 and i.MX35 the respective +device trees don't add DMA channels. The Reference manuals of i.MX31 and +i.MX25 also don't mention the CSPI core being DMA capable. (I didn't +check the others.) + +Since commit e267a5b3ec59 ("spi: spi-imx: Use dev_err_probe for failed +DMA channel requests") this results in an error message + + spi_imx 43fa4000.spi: error -ENODEV: can't get the TX DMA channel! + +during boot. However that isn't fatal and the driver gets loaded just +fine, just without using DMA. + +Signed-off-by: Uwe Kleine-König +Link: https://patch.msgid.link/20240508095610.2146640-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index d323b37723929..006860ee03ca0 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1050,7 +1050,7 @@ static struct spi_imx_devtype_data imx35_cspi_devtype_data = { + .rx_available = mx31_rx_available, + .reset = mx31_reset, + .fifo_size = 8, +- .has_dmamode = true, ++ .has_dmamode = false, + .dynamic_burst = false, + .has_targetmode = false, + .devtype = IMX35_CSPI, +-- +2.43.0 + diff --git a/queue-6.6/spi-mux-set-ctlr-bits_per_word_mask.patch b/queue-6.6/spi-mux-set-ctlr-bits_per_word_mask.patch new file mode 100644 index 00000000000..b73fba1baea --- /dev/null +++ b/queue-6.6/spi-mux-set-ctlr-bits_per_word_mask.patch @@ -0,0 +1,36 @@ +From f559dbb62a467f9a2966e6752c301ebdddab06e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 20:05:30 -0500 +Subject: spi: mux: set ctlr->bits_per_word_mask + +From: David Lechner + +[ Upstream commit c8bd922d924bb4ab6c6c488310157d1a27996f31 ] + +Like other SPI controller flags, bits_per_word_mask may be used by a +peripheral driver, so it needs to reflect the capabilities of the +underlying controller. + +Signed-off-by: David Lechner +Link: https://patch.msgid.link/20240708-spi-mux-fix-v1-3-6c8845193128@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mux.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-mux.c b/drivers/spi/spi-mux.c +index fa8c1f740c702..804b911f2baf1 100644 +--- a/drivers/spi/spi-mux.c ++++ b/drivers/spi/spi-mux.c +@@ -156,6 +156,7 @@ static int spi_mux_probe(struct spi_device *spi) + /* supported modes are the same as our parent's */ + ctlr->mode_bits = spi->controller->mode_bits; + ctlr->flags = spi->controller->flags; ++ ctlr->bits_per_word_mask = spi->controller->bits_per_word_mask; + ctlr->transfer_one_message = spi_mux_transfer_one_message; + ctlr->setup = spi_mux_setup; + ctlr->num_chipselect = mux_control_states(priv->mux); +-- +2.43.0 + diff --git a/queue-6.6/tee-optee-ffa-fix-missing-field-initializers-warning.patch b/queue-6.6/tee-optee-ffa-fix-missing-field-initializers-warning.patch new file mode 100644 index 00000000000..bc6099392ca --- /dev/null +++ b/queue-6.6/tee-optee-ffa-fix-missing-field-initializers-warning.patch @@ -0,0 +1,63 @@ +From 72641d140107ecb413cd576040772f7cc2fc165b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 14:59:09 +0800 +Subject: tee: optee: ffa: Fix missing-field-initializers warning + +From: Mark-PK Tsai + +[ Upstream commit e0556255a53d6d3d406a28362dffd972018a997c ] + +The 'missing-field-initializers' warning was reported +when building with W=2. +This patch use designated initializers for +'struct ffa_send_direct_data' to suppress the warning +and clarify the initialization intent. + +Signed-off-by: ming-jen.chang +Signed-off-by: Mark-PK Tsai +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index 0828240f27e62..b8ba360e863ed 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -657,7 +657,9 @@ static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, + const struct ffa_ops *ops) + { + const struct ffa_msg_ops *msg_ops = ops->msg_ops; +- struct ffa_send_direct_data data = { OPTEE_FFA_GET_API_VERSION }; ++ struct ffa_send_direct_data data = { ++ .data0 = OPTEE_FFA_GET_API_VERSION, ++ }; + int rc; + + msg_ops->mode_32bit_set(ffa_dev); +@@ -674,7 +676,9 @@ static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev, + return false; + } + +- data = (struct ffa_send_direct_data){ OPTEE_FFA_GET_OS_VERSION }; ++ data = (struct ffa_send_direct_data){ ++ .data0 = OPTEE_FFA_GET_OS_VERSION, ++ }; + rc = msg_ops->sync_send_receive(ffa_dev, &data); + if (rc) { + pr_err("Unexpected error %d\n", rc); +@@ -694,7 +698,9 @@ static bool optee_ffa_exchange_caps(struct ffa_device *ffa_dev, + u32 *sec_caps, + unsigned int *rpc_param_count) + { +- struct ffa_send_direct_data data = { OPTEE_FFA_EXCHANGE_CAPABILITIES }; ++ struct ffa_send_direct_data data = { ++ .data0 = OPTEE_FFA_EXCHANGE_CAPABILITIES, ++ }; + int rc; + + rc = ops->msg_ops->sync_send_receive(ffa_dev, &data); +-- +2.43.0 + diff --git a/queue-6.6/tools-power-cpupower-fix-pstate-frequency-reporting-.patch b/queue-6.6/tools-power-cpupower-fix-pstate-frequency-reporting-.patch new file mode 100644 index 00000000000..58abd555776 --- /dev/null +++ b/queue-6.6/tools-power-cpupower-fix-pstate-frequency-reporting-.patch @@ -0,0 +1,82 @@ +From a0d1ad69b5c71b54cab3a48575c3e652b1196671 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 14:07:06 +0530 +Subject: tools/power/cpupower: Fix Pstate frequency reporting on AMD Family + 1Ah CPUs + +From: Dhananjay Ugwekar + +[ Upstream commit 43cad521c6d228ea0c51e248f8e5b3a6295a2849 ] + +Update cpupower's P-State frequency calculation and reporting with AMD +Family 1Ah+ processors, when using the acpi-cpufreq driver. This is due +to a change in the PStateDef MSR layout in AMD Family 1Ah+. + +Tested on 4th and 5th Gen AMD EPYC system + +Signed-off-by: Ananth Narayan +Signed-off-by: Dhananjay Ugwekar +Reviewed-by: Mario Limonciello +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/power/cpupower/utils/helpers/amd.c | 26 +++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c +index c519cc89c97f4..0a56e22240fc8 100644 +--- a/tools/power/cpupower/utils/helpers/amd.c ++++ b/tools/power/cpupower/utils/helpers/amd.c +@@ -41,6 +41,16 @@ union core_pstate { + unsigned res1:31; + unsigned en:1; + } pstatedef; ++ /* since fam 1Ah: */ ++ struct { ++ unsigned fid:12; ++ unsigned res1:2; ++ unsigned vid:8; ++ unsigned iddval:8; ++ unsigned idddiv:2; ++ unsigned res2:31; ++ unsigned en:1; ++ } pstatedef2; + unsigned long long val; + }; + +@@ -48,6 +58,10 @@ static int get_did(union core_pstate pstate) + { + int t; + ++ /* Fam 1Ah onward do not use did */ ++ if (cpupower_cpu_info.family >= 0x1A) ++ return 0; ++ + if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF) + t = pstate.pstatedef.did; + else if (cpupower_cpu_info.family == 0x12) +@@ -61,12 +75,18 @@ static int get_did(union core_pstate pstate) + static int get_cof(union core_pstate pstate) + { + int t; +- int fid, did, cof; ++ int fid, did, cof = 0; + + did = get_did(pstate); + if (cpupower_cpu_info.caps & CPUPOWER_CAP_AMD_PSTATEDEF) { +- fid = pstate.pstatedef.fid; +- cof = 200 * fid / did; ++ if (cpupower_cpu_info.family >= 0x1A) { ++ fid = pstate.pstatedef2.fid; ++ if (fid > 0x0f) ++ cof = (fid * 5); ++ } else { ++ fid = pstate.pstatedef.fid; ++ cof = 200 * fid / did; ++ } + } else { + t = 0x10; + fid = pstate.pstate.fid; +-- +2.43.0 + diff --git a/queue-6.6/vfio-create-vfio_fs_type-with-inode-per-device.patch b/queue-6.6/vfio-create-vfio_fs_type-with-inode-per-device.patch new file mode 100644 index 00000000000..f5ba3abb8f4 --- /dev/null +++ b/queue-6.6/vfio-create-vfio_fs_type-with-inode-per-device.patch @@ -0,0 +1,172 @@ +From 56dfef22cb2a76445cfd60268ac5addbc48c1b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 22:52:30 -0600 +Subject: vfio: Create vfio_fs_type with inode per device + +From: Alex Williamson + +[ Upstream commit b7c5e64fecfa88764791679cca4786ac65de739e ] + +By linking all the device fds we provide to userspace to an +address space through a new pseudo fs, we can use tools like +unmap_mapping_range() to zap all vmas associated with a device. + +Suggested-by: Jason Gunthorpe +Reviewed-by: Jason Gunthorpe +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240530045236.1005864-2-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/device_cdev.c | 7 ++++++ + drivers/vfio/group.c | 7 ++++++ + drivers/vfio/vfio_main.c | 44 ++++++++++++++++++++++++++++++++++++++ + include/linux/vfio.h | 1 + + 4 files changed, 59 insertions(+) + +diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c +index e75da0a70d1f8..bb1817bd4ff31 100644 +--- a/drivers/vfio/device_cdev.c ++++ b/drivers/vfio/device_cdev.c +@@ -39,6 +39,13 @@ int vfio_device_fops_cdev_open(struct inode *inode, struct file *filep) + + filep->private_data = df; + ++ /* ++ * Use the pseudo fs inode on the device to link all mmaps ++ * to the same address space, allowing us to unmap all vmas ++ * associated to this device using unmap_mapping_range(). ++ */ ++ filep->f_mapping = device->inode->i_mapping; ++ + return 0; + + err_put_registration: +diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c +index 610a429c61912..ded364588d297 100644 +--- a/drivers/vfio/group.c ++++ b/drivers/vfio/group.c +@@ -286,6 +286,13 @@ static struct file *vfio_device_open_file(struct vfio_device *device) + */ + filep->f_mode |= (FMODE_PREAD | FMODE_PWRITE); + ++ /* ++ * Use the pseudo fs inode on the device to link all mmaps ++ * to the same address space, allowing us to unmap all vmas ++ * associated to this device using unmap_mapping_range(). ++ */ ++ filep->f_mapping = device->inode->i_mapping; ++ + if (device->group->type == VFIO_NO_IOMMU) + dev_warn(device->dev, "vfio-noiommu device opened by user " + "(%s:%d)\n", current->comm, task_pid_nr(current)); +diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c +index 40732e8ed4c6f..a205d3a4e379e 100644 +--- a/drivers/vfio/vfio_main.c ++++ b/drivers/vfio/vfio_main.c +@@ -22,8 +22,10 @@ + #include + #include + #include ++#include + #include + #include ++#include + #include + #include + #include +@@ -43,9 +45,13 @@ + #define DRIVER_AUTHOR "Alex Williamson " + #define DRIVER_DESC "VFIO - User Level meta-driver" + ++#define VFIO_MAGIC 0x5646494f /* "VFIO" */ ++ + static struct vfio { + struct class *device_class; + struct ida device_ida; ++ struct vfsmount *vfs_mount; ++ int fs_count; + } vfio; + + #ifdef CONFIG_VFIO_NOIOMMU +@@ -186,6 +192,8 @@ static void vfio_device_release(struct device *dev) + if (device->ops->release) + device->ops->release(device); + ++ iput(device->inode); ++ simple_release_fs(&vfio.vfs_mount, &vfio.fs_count); + kvfree(device); + } + +@@ -228,6 +236,34 @@ struct vfio_device *_vfio_alloc_device(size_t size, struct device *dev, + } + EXPORT_SYMBOL_GPL(_vfio_alloc_device); + ++static int vfio_fs_init_fs_context(struct fs_context *fc) ++{ ++ return init_pseudo(fc, VFIO_MAGIC) ? 0 : -ENOMEM; ++} ++ ++static struct file_system_type vfio_fs_type = { ++ .name = "vfio", ++ .owner = THIS_MODULE, ++ .init_fs_context = vfio_fs_init_fs_context, ++ .kill_sb = kill_anon_super, ++}; ++ ++static struct inode *vfio_fs_inode_new(void) ++{ ++ struct inode *inode; ++ int ret; ++ ++ ret = simple_pin_fs(&vfio_fs_type, &vfio.vfs_mount, &vfio.fs_count); ++ if (ret) ++ return ERR_PTR(ret); ++ ++ inode = alloc_anon_inode(vfio.vfs_mount->mnt_sb); ++ if (IS_ERR(inode)) ++ simple_release_fs(&vfio.vfs_mount, &vfio.fs_count); ++ ++ return inode; ++} ++ + /* + * Initialize a vfio_device so it can be registered to vfio core. + */ +@@ -246,6 +282,11 @@ static int vfio_init_device(struct vfio_device *device, struct device *dev, + init_completion(&device->comp); + device->dev = dev; + device->ops = ops; ++ device->inode = vfio_fs_inode_new(); ++ if (IS_ERR(device->inode)) { ++ ret = PTR_ERR(device->inode); ++ goto out_inode; ++ } + + if (ops->init) { + ret = ops->init(device); +@@ -260,6 +301,9 @@ static int vfio_init_device(struct vfio_device *device, struct device *dev, + return 0; + + out_uninit: ++ iput(device->inode); ++ simple_release_fs(&vfio.vfs_mount, &vfio.fs_count); ++out_inode: + vfio_release_device_set(device); + ida_free(&vfio.device_ida, device->index); + return ret; +diff --git a/include/linux/vfio.h b/include/linux/vfio.h +index 5ac5f182ce0bb..514a7f9b3ef4b 100644 +--- a/include/linux/vfio.h ++++ b/include/linux/vfio.h +@@ -64,6 +64,7 @@ struct vfio_device { + struct completion comp; + struct iommufd_access *iommufd_access; + void (*put_kvm)(struct kvm *kvm); ++ struct inode *inode; + #if IS_ENABLED(CONFIG_IOMMUFD) + struct iommufd_device *iommufd_device; + u8 iommufd_attached:1; +-- +2.43.0 + diff --git a/queue-6.6/wifi-cfg80211-fix-6-ghz-scan-request-building.patch b/queue-6.6/wifi-cfg80211-fix-6-ghz-scan-request-building.patch new file mode 100644 index 00000000000..5d8621d72db --- /dev/null +++ b/queue-6.6/wifi-cfg80211-fix-6-ghz-scan-request-building.patch @@ -0,0 +1,165 @@ +From 718acf9334c2847acd1dec18dfb230ef58d7c007 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 11:37:38 +0200 +Subject: wifi: cfg80211: fix 6 GHz scan request building + +From: Johannes Berg + +[ Upstream commit f7a8b10bfd614d7a9a16fbe80d28ead4f063cb00 ] + +The 6 GHz scan request struct allocated by cfg80211_scan_6ghz() is +meant to be formed this way: + + [base struct][channels][ssids][6ghz_params] + +It is allocated with [channels] as the maximum number of channels +supported by the driver in the 6 GHz band, since allocation is +before knowing how many there will be. + +However, the inner pointers are set incorrectly: initially, the +6 GHz scan parameters pointer is set: + + [base struct][channels] + ^ scan_6ghz_params + +and later the SSID pointer is set to the end of the actually +_used_ channels. + + [base struct][channels] + ^ ssids + +If many APs were to be discovered, and many channels used, and +there were many SSIDs, then the SSIDs could overlap the 6 GHz +parameters. + +Additionally, the request->ssids for most of the function points +to the original request still (given the struct copy) but is used +normally, which is confusing. + +Clear this up, by actually using the allocated space for 6 GHz +parameters _after_ the SSIDs, and set up the SSIDs initially so +they are used more clearly. Just like in nl80211.c, set them +only if there actually are SSIDs though. + +Finally, also copy the elements (ie/ie_len) so they're part of +the same request, not pointing to the old request. + +Co-developed-by: Miri Korenblit +Signed-off-by: Miri Korenblit +Reviewed-by: Ilan Peer +Signed-off-by: Johannes Berg +Link: https://msgid.link/20240510113738.4190692ef4ee.I0cb19188be17a8abd029805e3373c0a7777c214c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/rdev-ops.h | 6 +++++- + net/wireless/scan.c | 47 +++++++++++++++++++++++++++-------------- + 2 files changed, 36 insertions(+), 17 deletions(-) + +diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h +index 90bb7ac4b930b..f8f114a8dc02a 100644 +--- a/net/wireless/rdev-ops.h ++++ b/net/wireless/rdev-ops.h +@@ -2,7 +2,7 @@ + /* + * Portions of this file + * Copyright(c) 2016-2017 Intel Deutschland GmbH +- * Copyright (C) 2018, 2021-2023 Intel Corporation ++ * Copyright (C) 2018, 2021-2024 Intel Corporation + */ + #ifndef __CFG80211_RDEV_OPS + #define __CFG80211_RDEV_OPS +@@ -458,6 +458,10 @@ static inline int rdev_scan(struct cfg80211_registered_device *rdev, + struct cfg80211_scan_request *request) + { + int ret; ++ ++ if (WARN_ON_ONCE(!request->n_ssids && request->ssids)) ++ return -EINVAL; ++ + trace_rdev_scan(&rdev->wiphy, request); + ret = rdev->ops->scan(&rdev->wiphy, request); + trace_rdev_return_int(&rdev->wiphy, ret); +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index c646094a5fc47..ab559ff0909a2 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -810,6 +810,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + LIST_HEAD(coloc_ap_list); + bool need_scan_psc = true; + const struct ieee80211_sband_iftype_data *iftd; ++ size_t size, offs_ssids, offs_6ghz_params, offs_ies; + + rdev_req->scan_6ghz = true; + +@@ -838,10 +839,15 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + spin_unlock_bh(&rdev->bss_lock); + } + +- request = kzalloc(struct_size(request, channels, n_channels) + +- sizeof(*request->scan_6ghz_params) * count + +- sizeof(*request->ssids) * rdev_req->n_ssids, +- GFP_KERNEL); ++ size = struct_size(request, channels, n_channels); ++ offs_ssids = size; ++ size += sizeof(*request->ssids) * rdev_req->n_ssids; ++ offs_6ghz_params = size; ++ size += sizeof(*request->scan_6ghz_params) * count; ++ offs_ies = size; ++ size += rdev_req->ie_len; ++ ++ request = kzalloc(size, GFP_KERNEL); + if (!request) { + cfg80211_free_coloc_ap_list(&coloc_ap_list); + return -ENOMEM; +@@ -849,8 +855,26 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + + *request = *rdev_req; + request->n_channels = 0; +- request->scan_6ghz_params = +- (void *)&request->channels[n_channels]; ++ request->n_6ghz_params = 0; ++ if (rdev_req->n_ssids) { ++ /* ++ * Add the ssids from the parent scan request to the new ++ * scan request, so the driver would be able to use them ++ * in its probe requests to discover hidden APs on PSC ++ * channels. ++ */ ++ request->ssids = (void *)request + offs_ssids; ++ memcpy(request->ssids, rdev_req->ssids, ++ sizeof(*request->ssids) * request->n_ssids); ++ } ++ request->scan_6ghz_params = (void *)request + offs_6ghz_params; ++ ++ if (rdev_req->ie_len) { ++ void *ie = (void *)request + offs_ies; ++ ++ memcpy(ie, rdev_req->ie, rdev_req->ie_len); ++ request->ie = ie; ++ } + + /* + * PSC channels should not be scanned in case of direct scan with 1 SSID +@@ -939,17 +963,8 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + + if (request->n_channels) { + struct cfg80211_scan_request *old = rdev->int_scan_req; +- rdev->int_scan_req = request; + +- /* +- * Add the ssids from the parent scan request to the new scan +- * request, so the driver would be able to use them in its +- * probe requests to discover hidden APs on PSC channels. +- */ +- request->ssids = (void *)&request->channels[request->n_channels]; +- request->n_ssids = rdev_req->n_ssids; +- memcpy(request->ssids, rdev_req->ssids, sizeof(*request->ssids) * +- request->n_ssids); ++ rdev->int_scan_req = request; + + /* + * If this scan follows a previous scan, save the scan start +-- +2.43.0 + diff --git a/queue-6.6/wifi-cfg80211-wext-add-extra-siocsiwscan-data-check.patch b/queue-6.6/wifi-cfg80211-wext-add-extra-siocsiwscan-data-check.patch new file mode 100644 index 00000000000..29034eba38a --- /dev/null +++ b/queue-6.6/wifi-cfg80211-wext-add-extra-siocsiwscan-data-check.patch @@ -0,0 +1,47 @@ +From cb7219b0333a6e90a0433b0e69f896aea5348b8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 06:20:10 +0300 +Subject: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check + +From: Dmitry Antipov + +[ Upstream commit 6ef09cdc5ba0f93826c09d810c141a8d103a80fc ] + +In 'cfg80211_wext_siwscan()', add extra check whether number of +channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed +IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise. + +Reported-by: syzbot+253cd2d2491df77c93ac@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=253cd2d2491df77c93ac +Signed-off-by: Dmitry Antipov +Link: https://msgid.link/20240531032010.451295-1-dmantipov@yandex.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index ab559ff0909a2..7fccb5c0e4c6a 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -3178,10 +3178,14 @@ int cfg80211_wext_siwscan(struct net_device *dev, + wiphy = &rdev->wiphy; + + /* Determine number of channels, needed to allocate creq */ +- if (wreq && wreq->num_channels) ++ if (wreq && wreq->num_channels) { ++ /* Passed from userspace so should be checked */ ++ if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES)) ++ return -EINVAL; + n_channels = wreq->num_channels; +- else ++ } else { + n_channels = ieee80211_get_num_supported_channels(wiphy); ++ } + + creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) + + n_channels * sizeof(void *), +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-d3-fix-wowlan-command-version-looku.patch b/queue-6.6/wifi-iwlwifi-mvm-d3-fix-wowlan-command-version-looku.patch new file mode 100644 index 00000000000..21daa380186 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-d3-fix-wowlan-command-version-looku.patch @@ -0,0 +1,42 @@ +From 61eca282d068c21f8e2a4600e8514bc564a70df1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 17:06:29 +0300 +Subject: wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup + +From: Yedidya Benshimol + +[ Upstream commit b7ffca99313d856f7d1cc89038d9061b128e8e97 ] + +After moving from commands to notificaitons in the d3 resume flow, +removing the WOWLAN_GET_STATUSES and REPLY_OFFLOADS_QUERY_CMD causes +the return of the default value when looking up their version. +Returning zero here results in the driver sending the not supported +NON_QOS_TX_COUNTER_CMD. + +Signed-off-by: Yedidya Benshimol +Reviewed-by: Gregory Greenman +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240510170500.8cabfd580614.If3a0db9851f56041f8f5360959354abd5379224a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index cfc239b272eb7..66aed6635d92c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -2102,7 +2102,8 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm, + + out: + if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, +- WOWLAN_GET_STATUSES, 0) < 10) { ++ WOWLAN_GET_STATUSES, ++ IWL_FW_CMD_VER_UNKNOWN) < 10) { + mvmvif->seqno_valid = true; + /* +0x10 because the set API expects next-to-use, not last-used */ + mvmvif->seqno = status->non_qos_seq_ctr + 0x10; +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-fix-scan-abort-handling-with-hw-rfk.patch b/queue-6.6/wifi-iwlwifi-mvm-fix-scan-abort-handling-with-hw-rfk.patch new file mode 100644 index 00000000000..66db1572333 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-fix-scan-abort-handling-with-hw-rfk.patch @@ -0,0 +1,51 @@ +From 18c64aa114ecb2df5d3572b3df87c172a6fcddc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:27:13 +0300 +Subject: wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill + +From: Ilan Peer + +[ Upstream commit e6dd2936ce7ce94a1915b799f8af8193ec628e87 ] + +When HW rfkill is toggled to disable the RF, the flow to stop scan is +called. When trying to send the command to abort the scan, since +HW rfkill is toggled, the command is not sent due to rfkill being +asserted, and -ERFKILL is returned from iwl_trans_send_cmd(), but this +is silently ignored in iwl_mvm_send_cmd() and thus the scan abort flow +continues to wait for scan complete notification and fails. Since it +fails, the UID to type mapping is not cleared, and thus a warning is +later fired when trying to stop the interface. + +To fix this, modify the UMAC scan abort flow to force sending the +scan abort command even when in rfkill, so stop the FW from accessing +the radio etc. + +Signed-off-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240513132416.8cbe2f8c1a97.Iffe235c12a919dafec88eef399eb1f7bae2c5bdb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 150beeb9df117..6ef932e6299da 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -3242,10 +3242,11 @@ static int iwl_mvm_umac_scan_abort(struct iwl_mvm *mvm, int type) + + ret = iwl_mvm_send_cmd_pdu(mvm, + WIDE_ID(IWL_ALWAYS_LONG_GROUP, SCAN_ABORT_UMAC), +- 0, sizeof(cmd), &cmd); ++ CMD_SEND_IN_RFKILL, sizeof(cmd), &cmd); + if (!ret) + mvm->scan_uid_status[uid] = type << IWL_MVM_SCAN_STOPPING_SHIFT; + ++ IWL_DEBUG_SCAN(mvm, "Scan abort: ret=%d\n", ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-handle-ba-session-teardown-in-rf-ki.patch b/queue-6.6/wifi-iwlwifi-mvm-handle-ba-session-teardown-in-rf-ki.patch new file mode 100644 index 00000000000..837f9fd3b9b --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-handle-ba-session-teardown-in-rf-ki.patch @@ -0,0 +1,95 @@ +From 6ebb65830f837d46bd54b1b50b82d413fc223847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:27:10 +0300 +Subject: wifi: iwlwifi: mvm: handle BA session teardown in RF-kill + +From: Johannes Berg + +[ Upstream commit 4d08c0b3357cba0aeffaf3abc62cae0c154f2816 ] + +When entering RF-kill, mac80211 tears down BA sessions, but +due to RF-kill the commands aren't sent to the device. As a +result, there can be frames pending on the reorder buffer or +perhaps even received while doing so, leading to warnings. + +Avoid the warnings by doing the BA session teardown normally +even in RF-kill, which also requires queue sync. + +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240513132416.0762cd80fb3d.I43c5877f3b546159b2db4f36d6d956b333c41cf0@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- + drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 3 ++- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 12 ++++++++---- + 3 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index e281e07be73fc..37f628a9b8115 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -6069,7 +6069,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm, + .len[0] = sizeof(cmd), + .data[1] = data, + .len[1] = size, +- .flags = sync ? 0 : CMD_ASYNC, ++ .flags = CMD_SEND_IN_RFKILL | (sync ? 0 : CMD_ASYNC), + }; + int ret; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 2dcc13d4a4a79..e87cc1ddb9c2f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -1007,7 +1007,8 @@ static int iwl_mvm_mld_update_sta_baids(struct iwl_mvm *mvm, + + cmd.modify.tid = cpu_to_le32(data->tid); + +- ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd); ++ ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, CMD_SEND_IN_RFKILL, ++ sizeof(cmd), &cmd); + data->sta_mask = new_sta_mask; + if (ret) + return ret; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 2c231f4623893..84f4a9576cbda 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -2819,7 +2819,12 @@ static int iwl_mvm_fw_baid_op_cmd(struct iwl_mvm *mvm, + .action = start ? cpu_to_le32(IWL_RX_BAID_ACTION_ADD) : + cpu_to_le32(IWL_RX_BAID_ACTION_REMOVE), + }; +- u32 cmd_id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD); ++ struct iwl_host_cmd hcmd = { ++ .id = WIDE_ID(DATA_PATH_GROUP, RX_BAID_ALLOCATION_CONFIG_CMD), ++ .flags = CMD_SEND_IN_RFKILL, ++ .len[0] = sizeof(cmd), ++ .data[0] = &cmd, ++ }; + int ret; + + BUILD_BUG_ON(sizeof(struct iwl_rx_baid_cfg_resp) != sizeof(baid)); +@@ -2831,7 +2836,7 @@ static int iwl_mvm_fw_baid_op_cmd(struct iwl_mvm *mvm, + cmd.alloc.ssn = cpu_to_le16(ssn); + cmd.alloc.win_size = cpu_to_le16(buf_size); + baid = -EIO; +- } else if (iwl_fw_lookup_cmd_ver(mvm->fw, cmd_id, 1) == 1) { ++ } else if (iwl_fw_lookup_cmd_ver(mvm->fw, hcmd.id, 1) == 1) { + cmd.remove_v1.baid = cpu_to_le32(baid); + BUILD_BUG_ON(sizeof(cmd.remove_v1) > sizeof(cmd.remove)); + } else { +@@ -2840,8 +2845,7 @@ static int iwl_mvm_fw_baid_op_cmd(struct iwl_mvm *mvm, + cmd.remove.tid = cpu_to_le32(tid); + } + +- ret = iwl_mvm_send_cmd_pdu_status(mvm, cmd_id, sizeof(cmd), +- &cmd, &baid); ++ ret = iwl_mvm_send_cmd_status(mvm, &hcmd, &baid); + if (ret) + return ret; + +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-handle-bigtk-cipher-in-kek_kck-cmd.patch b/queue-6.6/wifi-iwlwifi-mvm-handle-bigtk-cipher-in-kek_kck-cmd.patch new file mode 100644 index 00000000000..06c20c3c3eb --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-handle-bigtk-cipher-in-kek_kck-cmd.patch @@ -0,0 +1,58 @@ +From 63f970b08a2387ce1503d37f1135a8a535347a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:27:09 +0300 +Subject: wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd + +From: Yedidya Benshimol + +[ Upstream commit 08b16d1b5997dc378533318e2a9cd73c7a898284 ] + +The BIGTK cipher field was added to the kek_kck_material_cmd +but wasn't assigned. Fix that by differentiating between the +IGTK/BIGTK keys and assign the ciphers fields accordingly. + +Signed-off-by: Yedidya Benshimol +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240513132416.7fd0b22b7267.Ie9b581652b74bd7806980364d59e1b2e78e682c0@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index 66aed6635d92c..9c89f0dd69c86 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -595,6 +595,12 @@ static void iwl_mvm_wowlan_gtk_type_iter(struct ieee80211_hw *hw, + void *_data) + { + struct wowlan_key_gtk_type_iter *data = _data; ++ __le32 *cipher = NULL; ++ ++ if (key->keyidx == 4 || key->keyidx == 5) ++ cipher = &data->kek_kck_cmd->igtk_cipher; ++ if (key->keyidx == 6 || key->keyidx == 7) ++ cipher = &data->kek_kck_cmd->bigtk_cipher; + + switch (key->cipher) { + default: +@@ -606,10 +612,13 @@ static void iwl_mvm_wowlan_gtk_type_iter(struct ieee80211_hw *hw, + return; + case WLAN_CIPHER_SUITE_BIP_GMAC_256: + case WLAN_CIPHER_SUITE_BIP_GMAC_128: +- data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_GCMP); ++ if (cipher) ++ *cipher = cpu_to_le32(STA_KEY_FLG_GCMP); + return; + case WLAN_CIPHER_SUITE_AES_CMAC: +- data->kek_kck_cmd->igtk_cipher = cpu_to_le32(STA_KEY_FLG_CCM); ++ case WLAN_CIPHER_SUITE_BIP_CMAC_256: ++ if (cipher) ++ *cipher = cpu_to_le32(STA_KEY_FLG_CCM); + return; + case WLAN_CIPHER_SUITE_CCMP: + if (!sta) +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-properly-set-6-ghz-channel-direct-p.patch b/queue-6.6/wifi-iwlwifi-mvm-properly-set-6-ghz-channel-direct-p.patch new file mode 100644 index 00000000000..a96e5e34d64 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-properly-set-6-ghz-channel-direct-p.patch @@ -0,0 +1,41 @@ +From b38917866fc4732ad9e1c3dfa8fff5eda65be29a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:27:11 +0300 +Subject: wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe option + +From: Ayala Beker + +[ Upstream commit 989830d1cf16bd149bf0690d889a9caef95fb5b1 ] + +Ensure that the 6 GHz channel is configured with a valid direct BSSID, +avoiding any invalid or multicast BSSID addresses. + +Signed-off-by: Ayala Beker +Reviewed-by: Ilan Peer +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240513132416.91a631a0fe60.I2ea2616af9b8a2eaf959b156c69cf65a2f1204d4@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 0841f1d6dc475..150beeb9df117 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1718,7 +1718,10 @@ iwl_mvm_umac_scan_fill_6g_chan_list(struct iwl_mvm *mvm, + break; + } + +- if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE) { ++ if (k == idex_b && idex_b < SCAN_BSSID_MAX_SIZE && ++ !WARN_ONCE(!is_valid_ether_addr(scan_6ghz_params[j].bssid), ++ "scan: invalid BSSID at index %u, index_b=%u\n", ++ j, idex_b)) { + memcpy(&pp->bssid_array[idex_b++], + scan_6ghz_params[j].bssid, ETH_ALEN); + } +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-mvm-remove-stale-sta-link-data-during-r.patch b/queue-6.6/wifi-iwlwifi-mvm-remove-stale-sta-link-data-during-r.patch new file mode 100644 index 00000000000..bcdb8f605d8 --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-mvm-remove-stale-sta-link-data-during-r.patch @@ -0,0 +1,125 @@ +From 6892ef974a08a363287aef3f355b674ab9f9a36d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 13:27:08 +0300 +Subject: wifi: iwlwifi: mvm: remove stale STA link data during restart + +From: Benjamin Berg + +[ Upstream commit cc3ba78f202de9752aceb16342ab62bdfbffac7e ] + +If pre-recovery mac80211 tried to disable a link but this disablement +failed, then there might be a mismatch between mac80211 assuming the +link has been disabled and the driver still having the data around. +During recover itself, that is not a problem, but should the link be +activated again at a later point, iwlwifi will refuse the activation as +it detects the inconsistent state. + +Solve this corner-case by iterating the station in the restart cleanup +handler. + +Signed-off-by: Benjamin Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240513132416.d2fd60338055.I840d4fdce5fd49fe69896d928b071067e3730259@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 37 +++++++++++++++++++ + .../net/wireless/intel/iwlwifi/mvm/mld-sta.c | 10 ++--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 5 +++ + 3 files changed, 47 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 375f401b14535..e281e07be73fc 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -1051,6 +1051,39 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac, + RCU_INIT_POINTER(mvmvif->deflink.probe_resp_data, NULL); + } + ++static void iwl_mvm_cleanup_sta_iterator(void *data, struct ieee80211_sta *sta) ++{ ++ struct iwl_mvm *mvm = data; ++ struct iwl_mvm_sta *mvm_sta; ++ struct ieee80211_vif *vif; ++ int link_id; ++ ++ mvm_sta = iwl_mvm_sta_from_mac80211(sta); ++ vif = mvm_sta->vif; ++ ++ if (!sta->valid_links) ++ return; ++ ++ for (link_id = 0; link_id < ARRAY_SIZE((sta)->link); link_id++) { ++ struct iwl_mvm_link_sta *mvm_link_sta; ++ ++ mvm_link_sta = ++ rcu_dereference_check(mvm_sta->link[link_id], ++ lockdep_is_held(&mvm->mutex)); ++ if (mvm_link_sta && !(vif->active_links & BIT(link_id))) { ++ /* ++ * We have a link STA but the link is inactive in ++ * mac80211. This will happen if we failed to ++ * deactivate the link but mac80211 roll back the ++ * deactivation of the link. ++ * Delete the stale data to avoid issues later on. ++ */ ++ iwl_mvm_mld_free_sta_link(mvm, mvm_sta, mvm_link_sta, ++ link_id, false); ++ } ++ } ++} ++ + static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm) + { + iwl_mvm_stop_device(mvm); +@@ -1073,6 +1106,10 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm) + */ + ieee80211_iterate_interfaces(mvm->hw, 0, iwl_mvm_cleanup_iterator, mvm); + ++ /* cleanup stations as links may be gone after restart */ ++ ieee80211_iterate_stations_atomic(mvm->hw, ++ iwl_mvm_cleanup_sta_iterator, mvm); ++ + mvm->p2p_device_vif = NULL; + + iwl_mvm_reset_phy_ctxts(mvm); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +index 121da93e99c6a..2dcc13d4a4a79 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c +@@ -515,11 +515,11 @@ static int iwl_mvm_mld_cfg_sta(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + return iwl_mvm_mld_send_sta_cmd(mvm, &cmd); + } + +-static void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm, +- struct iwl_mvm_sta *mvm_sta, +- struct iwl_mvm_link_sta *mvm_sta_link, +- unsigned int link_id, +- bool is_in_fw) ++void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm, ++ struct iwl_mvm_sta *mvm_sta, ++ struct iwl_mvm_link_sta *mvm_sta_link, ++ unsigned int link_id, ++ bool is_in_fw) + { + RCU_INIT_POINTER(mvm->fw_id_to_mac_id[mvm_sta_link->sta_id], + is_in_fw ? ERR_PTR(-EINVAL) : NULL); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +index 7364346a1209f..95ef60daa62f0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +@@ -642,6 +642,11 @@ int iwl_mvm_mld_update_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + struct ieee80211_sta *sta); + int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + struct ieee80211_sta *sta); ++void iwl_mvm_mld_free_sta_link(struct iwl_mvm *mvm, ++ struct iwl_mvm_sta *mvm_sta, ++ struct iwl_mvm_link_sta *mvm_sta_link, ++ unsigned int link_id, ++ bool is_in_fw); + int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id); + int iwl_mvm_mld_update_sta_links(struct iwl_mvm *mvm, + struct ieee80211_vif *vif, +-- +2.43.0 + diff --git a/queue-6.6/wifi-iwlwifi-properly-set-wiphy_flag_supports_ext_ke.patch b/queue-6.6/wifi-iwlwifi-properly-set-wiphy_flag_supports_ext_ke.patch new file mode 100644 index 00000000000..72c709eda6e --- /dev/null +++ b/queue-6.6/wifi-iwlwifi-properly-set-wiphy_flag_supports_ext_ke.patch @@ -0,0 +1,39 @@ +From 3181fc7bbadfa2ab59f27718c326296ee11fca81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 06:43:13 +0300 +Subject: wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK + +From: Daniel Gabay + +[ Upstream commit 4ec17ce716bdaf680288ce680b4621b52483cc96 ] + +The WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK should be set based on the +WOWLAN_KEK_KCK_MATERIAL command version. Currently, the command +version in the firmware has advanced to 4, which prevents the +flag from being set correctly, fix that. + +Signed-off-by: Daniel Gabay +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240703064026.a0f162108575.If1a9785727d2a1b0197a396680965df1b53d4096@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 37f628a9b8115..7d0032a51f2d3 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -600,7 +600,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm) + hw->wiphy->features |= NL80211_FEATURE_WFA_TPC_IE_IN_PROBES; + + if (iwl_fw_lookup_cmd_ver(mvm->fw, WOWLAN_KEK_KCK_MATERIAL, +- IWL_FW_CMD_VER_UNKNOWN) == 3) ++ IWL_FW_CMD_VER_UNKNOWN) >= 3) + hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK; + + if (fw_has_api(&mvm->fw->ucode_capa, +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-apply-mcast-rate-only-if-interface-is-.patch b/queue-6.6/wifi-mac80211-apply-mcast-rate-only-if-interface-is-.patch new file mode 100644 index 00000000000..d99a3dec236 --- /dev/null +++ b/queue-6.6/wifi-mac80211-apply-mcast-rate-only-if-interface-is-.patch @@ -0,0 +1,39 @@ +From 9cef937efa13fc4ace528ccbe25e2993dc3b9ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 13:34:10 +0200 +Subject: wifi: mac80211: apply mcast rate only if interface is up + +From: Johannes Berg + +[ Upstream commit 02c665f048a439c0d58cc45334c94634bd7c18e6 ] + +If the interface isn't enabled, don't apply multicast +rate changes immediately. + +Reported-by: syzbot+de87c09cc7b964ea2e23@syzkaller.appspotmail.com +Link: https://msgid.link/20240515133410.d6cffe5756cc.I47b624a317e62bdb4609ff7fa79403c0c444d32d@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 505f1d6ccd16c..f3fc0be9d8eac 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2953,8 +2953,9 @@ static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev, + memcpy(sdata->vif.bss_conf.mcast_rate, rate, + sizeof(int) * NUM_NL80211_BANDS); + +- ieee80211_link_info_change_notify(sdata, &sdata->deflink, +- BSS_CHANGED_MCAST_RATE); ++ if (ieee80211_sdata_running(sdata)) ++ ieee80211_link_info_change_notify(sdata, &sdata->deflink, ++ BSS_CHANGED_MCAST_RATE); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-fix-ubsan-noise-in-ieee80211_prep_hw_s.patch b/queue-6.6/wifi-mac80211-fix-ubsan-noise-in-ieee80211_prep_hw_s.patch new file mode 100644 index 00000000000..b8e06861e71 --- /dev/null +++ b/queue-6.6/wifi-mac80211-fix-ubsan-noise-in-ieee80211_prep_hw_s.patch @@ -0,0 +1,80 @@ +From bae7cf685a336cc67140787b5b8f25e0eb135d71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 18:33:32 +0300 +Subject: wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() + +From: Dmitry Antipov + +[ Upstream commit 92ecbb3ac6f3fe8ae9edf3226c76aa17b6800699 ] + +When testing the previous patch with CONFIG_UBSAN_BOUNDS, I've +noticed the following: + +UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:372:4 +index 0 is out of range for type 'struct ieee80211_channel *[]' +CPU: 0 PID: 1435 Comm: wpa_supplicant Not tainted 6.9.0+ #1 +Hardware name: LENOVO 20UN005QRT/20UN005QRT <...BIOS details...> +Call Trace: + + dump_stack_lvl+0x2d/0x90 + __ubsan_handle_out_of_bounds+0xe7/0x140 + ? timerqueue_add+0x98/0xb0 + ieee80211_prep_hw_scan+0x2db/0x480 [mac80211] + ? __kmalloc+0xe1/0x470 + __ieee80211_start_scan+0x541/0x760 [mac80211] + rdev_scan+0x1f/0xe0 [cfg80211] + nl80211_trigger_scan+0x9b6/0xae0 [cfg80211] + ... + +Since '__ieee80211_start_scan()' leaves 'hw_scan_req->req.n_channels' +uninitialized, actual boundaries of 'hw_scan_req->req.channels' can't +be checked in 'ieee80211_prep_hw_scan()'. Although an initialization +of 'hw_scan_req->req.n_channels' introduces some confusion around +allocated vs. used VLA members, this shouldn't be a problem since +everything is correctly adjusted soon in 'ieee80211_prep_hw_scan()'. + +Cleanup 'kmalloc()' math in '__ieee80211_start_scan()' by using the +convenient 'struct_size()' as well. + +Signed-off-by: Dmitry Antipov +Link: https://msgid.link/20240517153332.18271-2-dmantipov@yandex.ru +[improve (imho) indentation a bit] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/scan.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index b68214f159838..3d68db738cde4 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -722,15 +722,21 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata, + local->hw_scan_ies_bufsize *= n_bands; + } + +- local->hw_scan_req = kmalloc( +- sizeof(*local->hw_scan_req) + +- req->n_channels * sizeof(req->channels[0]) + +- local->hw_scan_ies_bufsize, GFP_KERNEL); ++ local->hw_scan_req = kmalloc(struct_size(local->hw_scan_req, ++ req.channels, ++ req->n_channels) + ++ local->hw_scan_ies_bufsize, ++ GFP_KERNEL); + if (!local->hw_scan_req) + return -ENOMEM; + + local->hw_scan_req->req.ssids = req->ssids; + local->hw_scan_req->req.n_ssids = req->n_ssids; ++ /* None of the channels are actually set ++ * up but let UBSAN know the boundaries. ++ */ ++ local->hw_scan_req->req.n_channels = req->n_channels; ++ + ies = (u8 *)local->hw_scan_req + + sizeof(*local->hw_scan_req) + + req->n_channels * sizeof(req->channels[0]); +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-handle-tasklet-frames-before-stopping.patch b/queue-6.6/wifi-mac80211-handle-tasklet-frames-before-stopping.patch new file mode 100644 index 00000000000..abe76dfc9c9 --- /dev/null +++ b/queue-6.6/wifi-mac80211-handle-tasklet-frames-before-stopping.patch @@ -0,0 +1,83 @@ +From b7cc67509fcc47bcbd4d5add6fabbbd5b60db17e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 13:53:19 +0200 +Subject: wifi: mac80211: handle tasklet frames before stopping + +From: Johannes Berg + +[ Upstream commit 177c6ae9725d783f9e96f02593ce8fb2639be22f ] + +The code itself doesn't want to handle frames from the driver +if it's already stopped, but if the tasklet was queued before +and runs after the stop, then all bets are off. Flush queues +before actually stopping, RX should be off at this point since +all the interfaces are removed already, etc. + +Reported-by: syzbot+8830db5d3593b5546d2e@syzkaller.appspotmail.com +Link: https://msgid.link/20240515135318.b05f11385c9a.I41c1b33a2e1814c3a7ef352cd7f2951b91785617@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/ieee80211_i.h | 2 ++ + net/mac80211/main.c | 10 ++++++++-- + net/mac80211/util.c | 2 ++ + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index fefaa9e902a2f..fb55014c0e898 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1846,6 +1846,8 @@ void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata, + void ieee80211_configure_filter(struct ieee80211_local *local); + u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata); + ++void ieee80211_handle_queued_frames(struct ieee80211_local *local); ++ + u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local); + int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb, + u64 *cookie, gfp_t gfp); +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 4548f84451095..d7f67d81d5af9 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -301,9 +301,8 @@ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata) + BSS_CHANGED_ERP_SLOT; + } + +-static void ieee80211_tasklet_handler(struct tasklet_struct *t) ++void ieee80211_handle_queued_frames(struct ieee80211_local *local) + { +- struct ieee80211_local *local = from_tasklet(local, t, tasklet); + struct sk_buff *skb; + + while ((skb = skb_dequeue(&local->skb_queue)) || +@@ -328,6 +327,13 @@ static void ieee80211_tasklet_handler(struct tasklet_struct *t) + } + } + ++static void ieee80211_tasklet_handler(struct tasklet_struct *t) ++{ ++ struct ieee80211_local *local = from_tasklet(local, t, tasklet); ++ ++ ieee80211_handle_queued_frames(local); ++} ++ + static void ieee80211_restart_work(struct work_struct *work) + { + struct ieee80211_local *local = +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 172173b2a9eb8..62c8b4342136e 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -2313,6 +2313,8 @@ u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata, + + void ieee80211_stop_device(struct ieee80211_local *local) + { ++ ieee80211_handle_queued_frames(local); ++ + ieee80211_led_radio(local, false); + ieee80211_mod_tpt_led_trig(local, 0, IEEE80211_TPT_LEDTRIG_FL_RADIO); + +-- +2.43.0 + diff --git a/queue-6.6/wifi-mac80211-mesh-init-nonpeer_pm-to-active-by-defa.patch b/queue-6.6/wifi-mac80211-mesh-init-nonpeer_pm-to-active-by-defa.patch new file mode 100644 index 00000000000..85e02c1360d --- /dev/null +++ b/queue-6.6/wifi-mac80211-mesh-init-nonpeer_pm-to-active-by-defa.patch @@ -0,0 +1,53 @@ +From 8e809360db312511df2d81aadd341c26f7814e5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 16:17:59 +0200 +Subject: wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh + sdata + +From: Nicolas Escande + +[ Upstream commit 6f6291f09a322c1c1578badac8072d049363f4e6 ] + +With a ath9k device I can see that: + iw phy phy0 interface add mesh0 type mp + ip link set mesh0 up + iw dev mesh0 scan + +Will start a scan with the Power Management bit set in the Frame Control Field. +This is because we set this bit depending on the nonpeer_pm variable of the mesh +iface sdata and when there are no active links on the interface it remains to +NL80211_MESH_POWER_UNKNOWN. + +As soon as links starts to be established, it wil switch to +NL80211_MESH_POWER_ACTIVE as it is the value set by befault on the per sta +nonpeer_pm field. +As we want no power save by default, (as expressed with the per sta ini values), +lets init it to the expected default value of NL80211_MESH_POWER_ACTIVE. + +Also please note that we cannot change the default value from userspace prior to +establishing a link as using NL80211_CMD_SET_MESH_CONFIG will not work before +NL80211_CMD_JOIN_MESH has been issued. So too late for our initial scan. + +Signed-off-by: Nicolas Escande +Link: https://msgid.link/20240527141759.299411-1-nico.escande@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 7b3ecc288f09d..25223184d6e5b 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -1792,6 +1792,7 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata) + ifmsh->last_preq = jiffies; + ifmsh->next_perr = jiffies; + ifmsh->csa_role = IEEE80211_MESH_CSA_ROLE_NONE; ++ ifmsh->nonpeer_pm = NL80211_MESH_POWER_ACTIVE; + /* Allocate all mesh structures when creating the first mesh interface. */ + if (!mesh_allocated) + ieee80211s_init(); +-- +2.43.0 +