From: Sasha Levin Date: Sat, 28 Dec 2024 14:19:51 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v6.1.123~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0da53585408b8d63f581c1d8ec4d429589945e30;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch b/queue-6.1/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch new file mode 100644 index 00000000000..80f29a13a34 --- /dev/null +++ b/queue-6.1/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch @@ -0,0 +1,100 @@ +From 30c182addef550b211c30b80bf44aaa6198ae384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 09:44:41 +0800 +Subject: ALSA: hda/conexant: fix Z60MR100 startup pop issue + +From: bo liu + +[ Upstream commit 947c4012f8f03a8bb946beb6e5294d5e32817d67 ] + +When Z60MR100 startup, speaker will output a pop. To fix this issue, +we mute codec by init verbs in bios when system startup, and set GPIO +to low to unmute codec in codec driver when it loaded . + +[ white space fixes and compile warning fix by tiwai ] + +Signed-off-by: bo liu +Link: https://patch.msgid.link/20241129014441.437205-1-bo.liu@senarytech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_conexant.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index a14b9cb48f69..7edb029f08a3 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -311,6 +311,7 @@ enum { + CXT_FIXUP_HP_MIC_NO_PRESENCE, + CXT_PINCFG_SWS_JS201D, + CXT_PINCFG_TOP_SPEAKER, ++ CXT_FIXUP_HP_A_U, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -778,6 +779,18 @@ static void cxt_setup_mute_led(struct hda_codec *codec, + } + } + ++static void cxt_setup_gpio_unmute(struct hda_codec *codec, ++ unsigned int gpio_mute_mask) ++{ ++ if (gpio_mute_mask) { ++ // set gpio data to 0. ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0); ++ } ++} ++ + static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -792,6 +805,15 @@ static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, + cxt_setup_mute_led(codec, 0x10, 0x20); + } + ++static void cxt_fixup_hp_a_u(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ // Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise, ++ // so need to unmute once by clearing the gpio data when runs into the system. ++ if (action == HDA_FIXUP_ACT_INIT) ++ cxt_setup_gpio_unmute(codec, 0x2); ++} ++ + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { + { 0x16, 0x042140ff }, /* HP (seq# overridden) */ +@@ -1016,6 +1038,10 @@ static const struct hda_fixup cxt_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, + }, ++ [CXT_FIXUP_HP_A_U] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_a_u, ++ }, + }; + + static const struct snd_pci_quirk cxt5045_fixups[] = { +@@ -1090,6 +1116,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), ++ SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U), + SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +@@ -1135,6 +1162,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { + { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" }, + { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" }, ++ { .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" }, + {} + }; + +-- +2.39.5 + diff --git a/queue-6.1/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch b/queue-6.1/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch new file mode 100644 index 00000000000..f0cabbf2c5d --- /dev/null +++ b/queue-6.1/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch @@ -0,0 +1,73 @@ +From 82c7dab53daf84bf1c3ec90df93dc0350cdca4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 19:16:06 +0800 +Subject: blk-mq: register cpuhp callback after hctx is added to xarray table + +From: Ming Lei + +[ Upstream commit 4bf485a7db5d82ddd0f3ad2b299893199090375e ] + +We need to retrieve 'hctx' from xarray table in the cpuhp callback, so the +callback should be registered after this 'hctx' is added to xarray table. + +Cc: Reinette Chatre +Cc: Fenghua Yu +Cc: Peter Newman +Cc: Babu Moger +Cc: Luck Tony +Signed-off-by: Ming Lei +Tested-by: Tony Luck +Link: https://lore.kernel.org/r/20241206111611.978870-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index a5ed12bd2b0a..373a67a630f3 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3671,16 +3671,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + { + hctx->queue_num = hctx_idx; + +- if (!(hctx->flags & BLK_MQ_F_STACKING)) +- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, +- &hctx->cpuhp_online); +- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); +- + hctx->tags = set->tags[hctx_idx]; + + if (set->ops->init_hctx && + set->ops->init_hctx(hctx, set->driver_data, hctx_idx)) +- goto unregister_cpu_notifier; ++ goto fail; + + if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx, + hctx->numa_node)) +@@ -3689,6 +3684,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL)) + goto exit_flush_rq; + ++ if (!(hctx->flags & BLK_MQ_F_STACKING)) ++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, ++ &hctx->cpuhp_online); ++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); ++ + return 0; + + exit_flush_rq: +@@ -3697,8 +3697,7 @@ static int blk_mq_init_hctx(struct request_queue *q, + exit_hctx: + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); +- unregister_cpu_notifier: +- blk_mq_remove_cpuhp(hctx); ++ fail: + return -1; + } + +-- +2.39.5 + diff --git a/queue-6.1/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch b/queue-6.1/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch new file mode 100644 index 00000000000..b0e0ee0786f --- /dev/null +++ b/queue-6.1/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch @@ -0,0 +1,99 @@ +From dea023a46a70d06cc5ca75ad537ece5dac82eaed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 15:20:07 +0200 +Subject: drm/dp_mst: Ensure mst_primary pointer is valid in + drm_dp_mst_handle_up_req() + +From: Imre Deak + +[ Upstream commit e54b00086f7473dbda1a7d6fc47720ced157c6a8 ] + +While receiving an MST up request message from one thread in +drm_dp_mst_handle_up_req(), the MST topology could be removed from +another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing +mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. +This could lead to a NULL deref/use-after-free of mst_primary in +drm_dp_mst_handle_up_req(). + +Avoid the above by holding a reference for mst_primary in +drm_dp_mst_handle_up_req() while it's used. + +v2: Fix kfreeing the request if getting an mst_primary reference fails. + +Cc: Lyude Paul +Reviewed-by: Lyude Paul (v1) +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20241204132007.3132494-1-imre.deak@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 24 ++++++++++++++----- + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 4f8fcfaa80fd..d8cbb4eadc5b 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4033,9 +4033,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work) + static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + { + struct drm_dp_pending_up_req *up_req; ++ struct drm_dp_mst_branch *mst_primary; + + if (!drm_dp_get_one_sb_msg(mgr, true, NULL)) +- goto out; ++ goto out_clear_reply; + + if (!mgr->up_req_recv.have_eomt) + return 0; +@@ -4053,10 +4054,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n", + up_req->msg.req_type); + kfree(up_req); +- goto out; ++ goto out_clear_reply; ++ } ++ ++ mutex_lock(&mgr->lock); ++ mst_primary = mgr->mst_primary; ++ if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) { ++ mutex_unlock(&mgr->lock); ++ kfree(up_req); ++ goto out_clear_reply; + } ++ mutex_unlock(&mgr->lock); + +- drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type, ++ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, + false); + + if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { +@@ -4073,13 +4083,13 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + conn_stat->peer_device_type); + + mutex_lock(&mgr->probe_lock); +- handle_csn = mgr->mst_primary->link_address_sent; ++ handle_csn = mst_primary->link_address_sent; + mutex_unlock(&mgr->probe_lock); + + if (!handle_csn) { + drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); + kfree(up_req); +- goto out; ++ goto out_put_primary; + } + } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { + const struct drm_dp_resource_status_notify *res_stat = +@@ -4096,7 +4106,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + mutex_unlock(&mgr->up_req_lock); + queue_work(system_long_wq, &mgr->up_req_work); + +-out: ++out_put_primary: ++ drm_dp_mst_topology_put_mstb(mst_primary); ++out_clear_reply: + memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.1/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch b/queue-6.1/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch new file mode 100644 index 00000000000..4251a92be1a --- /dev/null +++ b/queue-6.1/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch @@ -0,0 +1,70 @@ +From 5d0aee8ee6a37fe75fea5a09a80776c971f65939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Nov 2024 23:47:00 +0100 +Subject: platform/x86: asus-nb-wmi: Ignore unknown event 0xCF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit e9fba20c29e27dc99e55e1c550573a114561bf8c ] + +On the Asus X541UAK an unknown event 0xCF is emited when the charger +is plugged in. This is caused by the following AML code: + + If (ACPS ()) + { + ACPF = One + Local0 = 0x58 + If (ATKP) + { + ^^^^ATKD.IANE (0xCF) + } + } + Else + { + ACPF = Zero + Local0 = 0x57 + } + + Notify (AC0, 0x80) // Status Change + If (ATKP) + { + ^^^^ATKD.IANE (Local0) + } + + Sleep (0x64) + PNOT () + Sleep (0x0A) + NBAT (0x80) + +Ignore the 0xCF event to silence the unknown event warning. + +Reported-by: Pau Espin Pedrol +Closes: https://lore.kernel.org/platform-driver-x86/54d4860b-ec9c-4992-acf6-db3f90388293@espeweb.net +Signed-off-by: Armin Wolf +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241123224700.18530-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index af3da303e2b1..cba515ce3444 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -590,6 +590,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_IGNORE, 0xCF, }, /* AC mode */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ + { KE_END, 0}, +-- +2.39.5 + diff --git a/queue-6.1/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch b/queue-6.1/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch new file mode 100644 index 00000000000..2f69f435e72 --- /dev/null +++ b/queue-6.1/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch @@ -0,0 +1,155 @@ +From 638b5deaace6710c050e0a76d08303e4ab544f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 21:17:58 -0800 +Subject: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct + +From: Haren Myneni + +[ Upstream commit 05aa156e156ef3168e7ab8a68721945196495c17 ] + +The mapping VMA address is saved in VAS window struct when the +paste address is mapped. This VMA address is used during migration +to unmap the paste address if the window is active. The paste +address mapping will be removed when the window is closed or with +the munmap(). But the VMA address in the VAS window is not updated +with munmap() which is causing invalid access during migration. + +The KASAN report shows: +[16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8 +[16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928 + +[16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2 +[16386.255128] Tainted: [B]=BAD_PAGE +[16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries +[16386.255181] Call Trace: +[16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) +[16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764 +[16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8 +[16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0 +[16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8 +[16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc +[16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4 +... + +[16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: +[16386.256149] kasan_save_stack+0x34/0x68 +[16386.256163] kasan_save_track+0x34/0x80 +[16386.256175] kasan_save_alloc_info+0x58/0x74 +[16386.256196] __kasan_slab_alloc+0xb8/0xdc +[16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0 +[16386.256225] vm_area_alloc+0x44/0x150 +[16386.256245] mmap_region+0x214/0x10c4 +[16386.256265] do_mmap+0x5fc/0x750 +[16386.256277] vm_mmap_pgoff+0x14c/0x24c +[16386.256292] ksys_mmap_pgoff+0x20c/0x348 +[16386.256303] sys_mmap+0xd0/0x160 +... + +[16386.256350] Freed by task 0 on cpu 31 at 16386.204848s: +[16386.256363] kasan_save_stack+0x34/0x68 +[16386.256374] kasan_save_track+0x34/0x80 +[16386.256384] kasan_save_free_info+0x64/0x10c +[16386.256396] __kasan_slab_free+0x120/0x204 +[16386.256415] kmem_cache_free+0x128/0x450 +[16386.256428] vm_area_free_rcu_cb+0xa8/0xd8 +[16386.256441] rcu_do_batch+0x2c8/0xcf0 +[16386.256458] rcu_core+0x378/0x3c4 +[16386.256473] handle_softirqs+0x20c/0x60c +[16386.256495] do_softirq_own_stack+0x6c/0x88 +[16386.256509] do_softirq_own_stack+0x58/0x88 +[16386.256521] __irq_exit_rcu+0x1a4/0x20c +[16386.256533] irq_exit+0x20/0x38 +[16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c +... + +[16386.256717] Last potentially related work creation: +[16386.256729] kasan_save_stack+0x34/0x68 +[16386.256741] __kasan_record_aux_stack+0xcc/0x12c +[16386.256753] __call_rcu_common.constprop.0+0x94/0xd04 +[16386.256766] vm_area_free+0x28/0x3c +[16386.256778] remove_vma+0xf4/0x114 +[16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870 +[16386.256811] __vm_munmap+0xe0/0x1f8 +[16386.256821] sys_munmap+0x54/0x6c +[16386.256830] system_call_exception+0x1a0/0x4a0 +[16386.256841] system_call_vectored_common+0x15c/0x2ec + +[16386.256868] The buggy address belongs to the object at c00000014a819670 + which belongs to the cache vm_area_struct of size 168 +[16386.256887] The buggy address is located 0 bytes inside of + freed 168-byte region [c00000014a819670, c00000014a819718) + +[16386.256915] The buggy address belongs to the physical page: +[16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81 +[16386.256950] memcg:c0000000ba430001 +[16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff) +[16386.256975] page_type: 0xfdffffff(slab) +[16386.256990] raw: 043ffff800000000 c00000000501c080 0000000000000000 5deadbee00000001 +[16386.257003] raw: 0000000000000000 00000000011a011a 00000001fdffffff c0000000ba430001 +[16386.257018] page dumped because: kasan: bad access detected + +This patch adds close() callback in vas_vm_ops vm_operations_struct +which will be executed during munmap() before freeing VMA. The VMA +address in the VAS window is set to NULL after holding the window +mmap_mutex. + +Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler") +Signed-off-by: Haren Myneni +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241214051758.997759-1-haren@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/book3s/vas-api.c | 36 +++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c +index 92e60cb3163f..d954ddf7f059 100644 +--- a/arch/powerpc/platforms/book3s/vas-api.c ++++ b/arch/powerpc/platforms/book3s/vas-api.c +@@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf) + return VM_FAULT_SIGBUS; + } + ++/* ++ * During mmap() paste address, mapping VMA is saved in VAS window ++ * struct which is used to unmap during migration if the window is ++ * still open. But the user space can remove this mapping with ++ * munmap() before closing the window and the VMA address will ++ * be invalid. Set VAS window VMA to NULL in this function which ++ * is called before VMA free. ++ */ ++static void vas_mmap_close(struct vm_area_struct *vma) ++{ ++ struct file *fp = vma->vm_file; ++ struct coproc_instance *cp_inst = fp->private_data; ++ struct vas_window *txwin; ++ ++ /* Should not happen */ ++ if (!cp_inst || !cp_inst->txwin) { ++ pr_err("No attached VAS window for the paste address mmap\n"); ++ return; ++ } ++ ++ txwin = cp_inst->txwin; ++ /* ++ * task_ref.vma is set in coproc_mmap() during mmap paste ++ * address. So it has to be the same VMA that is getting freed. ++ */ ++ if (WARN_ON(txwin->task_ref.vma != vma)) { ++ pr_err("Invalid paste address mmaping\n"); ++ return; ++ } ++ ++ mutex_lock(&txwin->task_ref.mmap_mutex); ++ txwin->task_ref.vma = NULL; ++ mutex_unlock(&txwin->task_ref.mmap_mutex); ++} ++ + static const struct vm_operations_struct vas_vm_ops = { ++ .close = vas_mmap_close, + .fault = vas_mmap_fault, + }; + +-- +2.39.5 + diff --git a/queue-6.1/regmap-use-correct-format-specifier-for-logging-rang.patch b/queue-6.1/regmap-use-correct-format-specifier-for-logging-rang.patch new file mode 100644 index 00000000000..bb7d5ad66f1 --- /dev/null +++ b/queue-6.1/regmap-use-correct-format-specifier-for-logging-rang.patch @@ -0,0 +1,43 @@ +From 56e63f11b7fa7fc73d0cf68e4627aba068ad3b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:35:06 +0000 +Subject: regmap: Use correct format specifier for logging range errors + +From: Mark Brown + +[ Upstream commit 3f1aa0c533d9dd8a835caf9a6824449c463ee7e2 ] + +The register addresses are unsigned ints so we should use %u not %d to +log them. + +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20241127-regmap-test-high-addr-v1-1-74a48a9e0dc5@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index c822af48d2c9..8748cea3bc38 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1155,13 +1155,13 @@ struct regmap *__regmap_init(struct device *dev, + + /* Sanity check */ + if (range_cfg->range_max < range_cfg->range_min) { +- dev_err(map->dev, "Invalid range %d: %d < %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u < %u\n", i, + range_cfg->range_max, range_cfg->range_min); + goto err_range; + } + + if (range_cfg->range_max > map->max_register) { +- dev_err(map->dev, "Invalid range %d: %d > %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u > %u\n", i, + range_cfg->range_max, map->max_register); + goto err_range; + } +-- +2.39.5 + diff --git a/queue-6.1/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch b/queue-6.1/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch new file mode 100644 index 00000000000..a4dbcf38cfb --- /dev/null +++ b/queue-6.1/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch @@ -0,0 +1,48 @@ +From e57d2dd86ca9c219c190acf5011ae044be30d85d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2024 19:48:33 +0200 +Subject: scsi: megaraid_sas: Fix for a potential deadlock + +From: Tomas Henzl + +[ Upstream commit 50740f4dc78b41dec7c8e39772619d5ba841ddd7 ] + +This fixes a 'possible circular locking dependency detected' warning + CPU0 CPU1 + ---- ---- + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + +Fix this by temporarily releasing the reset_mutex. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20240923174833.45345-1-thenzl@redhat.com +Acked-by: Chandrakanth Patil +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 37208bc08c66..f4b32ce45ce0 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -8905,8 +8905,11 @@ megasas_aen_polling(struct work_struct *work) + (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), + (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL), + 0); +- if (sdev1) ++ if (sdev1) { ++ mutex_unlock(&instance->reset_mutex); + megasas_remove_scsi_device(sdev1); ++ mutex_lock(&instance->reset_mutex); ++ } + + event_type = SCAN_VD_CHANNEL; + break; +-- +2.39.5 + diff --git a/queue-6.1/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch b/queue-6.1/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch new file mode 100644 index 00000000000..b51d567eeaf --- /dev/null +++ b/queue-6.1/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch @@ -0,0 +1,53 @@ +From aad9f34036d73b903203f7ee27898abcc5cd40d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2024 23:03:40 +0530 +Subject: scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during + driver load time + +From: Ranjan Kumar + +[ Upstream commit 3f5eb062e8aa335643181c480e6c590c6cedfd22 ] + +Issue a Diag-Reset when the "Doorbell-In-Use" bit is set during the +driver load/initialization. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110173341.11595-2-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 03fcaf735939..5c13358416c4 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7061,11 +7061,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + int i; + u8 failed; + __le32 *mfp; ++ int ret_val; + + /* make sure doorbell is not in use */ + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); +- return -EFAULT; ++ goto doorbell_diag_reset; + } + + /* clear pending doorbell interrupts from previous state changes */ +@@ -7155,6 +7156,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + le32_to_cpu(mfp[i])); + } + return 0; ++ ++doorbell_diag_reset: ++ ret_val = _base_diag_reset(ioc); ++ return ret_val; + } + + /** +-- +2.39.5 + diff --git a/queue-6.1/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch b/queue-6.1/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch new file mode 100644 index 00000000000..53f5e0bc85e --- /dev/null +++ b/queue-6.1/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch @@ -0,0 +1,49 @@ +From c4c8219af5c5e99b99594b16b9d386084dfb0fc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 23:51:49 +0100 +Subject: scsi: qla1280: Fix hw revision numbering for ISP1020/1040 + +From: Magnus Lindholm + +[ Upstream commit c064de86d2a3909222d5996c5047f64c7a8f791b ] + +Fix the hardware revision numbering for Qlogic ISP1020/1040 boards. HWMASK +suggests that the revision number only needs four bits, this is consistent +with how NetBSD does things in their ISP driver. Verified on a IPS1040B +which is seen as rev 5 not as BIT_4. + +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20241113225636.2276-1-linmag7@gmail.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla1280.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h +index d309e2ca14de..dea2290b37d4 100644 +--- a/drivers/scsi/qla1280.h ++++ b/drivers/scsi/qla1280.h +@@ -116,12 +116,12 @@ struct device_reg { + uint16_t id_h; /* ID high */ + uint16_t cfg_0; /* Configuration 0 */ + #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */ +-#define ISP_CFG0_1020 BIT_0 /* ISP1020 */ +-#define ISP_CFG0_1020A BIT_1 /* ISP1020A */ +-#define ISP_CFG0_1040 BIT_2 /* ISP1040 */ +-#define ISP_CFG0_1040A BIT_3 /* ISP1040A */ +-#define ISP_CFG0_1040B BIT_4 /* ISP1040B */ +-#define ISP_CFG0_1040C BIT_5 /* ISP1040C */ ++#define ISP_CFG0_1020 1 /* ISP1020 */ ++#define ISP_CFG0_1020A 2 /* ISP1020A */ ++#define ISP_CFG0_1040 3 /* ISP1040 */ ++#define ISP_CFG0_1040A 4 /* ISP1040A */ ++#define ISP_CFG0_1040B 5 /* ISP1040B */ ++#define ISP_CFG0_1040C 6 /* ISP1040C */ + uint16_t cfg_1; /* Configuration 1 */ + #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */ + #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */ +-- +2.39.5 + diff --git a/queue-6.1/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch b/queue-6.1/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch new file mode 100644 index 00000000000..facd75736b8 --- /dev/null +++ b/queue-6.1/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch @@ -0,0 +1,72 @@ +From 4ee412c1b12663eed5fd0d38d40c0202c10bab74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:13:24 -0500 +Subject: scsi: storvsc: Do not flag MAINTENANCE_IN return of + SRB_STATUS_DATA_OVERRUN as an error + +From: Cathy Avery + +[ Upstream commit b1aee7f034615b6824d2c70ddb37ef9fc23493b7 ] + +This partially reverts commit 812fe6420a6e ("scsi: storvsc: Handle +additional SRB status values"). + +HyperV does not support MAINTENANCE_IN resulting in FC passthrough +returning the SRB_STATUS_DATA_OVERRUN value. Now that +SRB_STATUS_DATA_OVERRUN is treated as an error, multipath ALUA paths go +into a faulty state as multipath ALUA submits RTPG commands via +MAINTENANCE_IN. + +[ 3.215560] hv_storvsc 1d69d403-9692-4460-89f9-a8cbcc0f94f3: +tag#230 cmd 0xa3 status: scsi 0x0 srb 0x12 hv 0xc0000001 +[ 3.215572] scsi 1:0:0:32: alua: rtpg failed, result 458752 + +Make MAINTENANCE_IN return success to avoid the error path as is +currently done with INQUIRY and MODE_SENSE. + +Suggested-by: Michael Kelley +Signed-off-by: Cathy Avery +Link: https://lore.kernel.org/r/20241127181324.3318443-1-cavery@redhat.com +Reviewed-by: Michael Kelley +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 4fad9d85bd6f..0685cbe7f0eb 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -149,6 +149,8 @@ struct hv_fc_wwn_packet { + */ + static int vmstor_proto_version; + ++static bool hv_dev_is_fc(struct hv_device *hv_dev); ++ + #define STORVSC_LOGGING_NONE 0 + #define STORVSC_LOGGING_ERROR 1 + #define STORVSC_LOGGING_WARN 2 +@@ -1129,6 +1131,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + * not correctly handle: + * INQUIRY command with page code parameter set to 0x80 + * MODE_SENSE command with cmd[2] == 0x1c ++ * MAINTENANCE_IN is not supported by HyperV FC passthrough + * + * Setup srb and scsi status so this won't be fatal. + * We do this so we can distinguish truly fatal failues +@@ -1136,7 +1139,9 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + */ + + if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || +- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) { ++ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || ++ (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && ++ hv_dev_is_fc(device))) { + vstor_packet->vm_srb.scsi_status = 0; + vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; + } +-- +2.39.5 + diff --git a/queue-6.1/series b/queue-6.1/series index 1a6692ce432..e7cbe0af576 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -21,3 +21,18 @@ dmaengine-tegra-return-correct-dma-status-when-paused.patch dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch +powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch +stddef-make-__struct_group-uapi-c-friendly.patch +tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch +watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch +scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch +scsi-megaraid_sas-fix-for-a-potential-deadlock.patch +alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch +smb-server-fix-building-with-gcc-15.patch +regmap-use-correct-format-specifier-for-logging-rang.patch +platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch +scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch +scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch +drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch +virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch +blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch diff --git a/queue-6.1/smb-server-fix-building-with-gcc-15.patch b/queue-6.1/smb-server-fix-building-with-gcc-15.patch new file mode 100644 index 00000000000..20b9861d412 --- /dev/null +++ b/queue-6.1/smb-server-fix-building-with-gcc-15.patch @@ -0,0 +1,47 @@ +From 05ac8bfba9416e628126219bedae330bf7bd26af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 11:41:35 +0530 +Subject: smb: server: Fix building with GCC 15 + +From: Brahmajit Das + +[ Upstream commit e18655cf35a5958fbf4ae9ca3ebf28871a3a1801 ] + +GCC 15 introduces -Werror=unterminated-string-initialization by default, +this results in the following build error + +fs/smb/server/smb_common.c:21:35: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-ini +tialization] + 21 | static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +To this we are replacing char basechars[43] with a character pointer +and then using strlen to get the length. + +Signed-off-by: Brahmajit Das +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index bdcdc0fc9cad..7134abeeb53e 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -18,8 +18,8 @@ + #include "mgmt/share_config.h" + + /*for shortname implementation */ +-static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; +-#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1) ++static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; ++#define MANGLE_BASE (strlen(basechars) - 1) + #define MAGIC_CHAR '~' + #define PERIOD '.' + #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE])) +-- +2.39.5 + diff --git a/queue-6.1/stddef-make-__struct_group-uapi-c-friendly.patch b/queue-6.1/stddef-make-__struct_group-uapi-c-friendly.patch new file mode 100644 index 00000000000..9020fa26978 --- /dev/null +++ b/queue-6.1/stddef-make-__struct_group-uapi-c-friendly.patch @@ -0,0 +1,116 @@ +From 1f130cc3685ce1b0a8e09bdfa7daa07d42c2b10f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 14:57:34 +0100 +Subject: stddef: make __struct_group() UAPI C++-friendly + +From: Alexander Lobakin + +[ Upstream commit 724c6ce38bbaeb4b3f109b0e066d6c0ecd15446c ] + +For the most part of the C++ history, it couldn't have type +declarations inside anonymous unions for different reasons. At the +same time, __struct_group() relies on the latters, so when the @TAG +argument is not empty, C++ code doesn't want to build (even under +`extern "C"`): + +../linux/include/uapi/linux/pkt_cls.h:25:24: error: +'struct tc_u32_sel::::tc_u32_sel_hdr,' invalid; +an anonymous union may only have public non-static data members +[-fpermissive] + +The safest way to fix this without trying to switch standards (which +is impossible in UAPI anyway) etc., is to disable tag declaration +for that language. This won't break anything since for now it's not +buildable at all. +Use a separate definition for __struct_group() when __cplusplus is +defined to mitigate the error, including the version from tools/. + +Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro") +Reported-by: Christopher Ferris +Closes: https://lore.kernel.org/linux-hardening/Z1HZpe3WE5As8UAz@google.com +Suggested-by: Kees Cook # __struct_group_tag() +Signed-off-by: Alexander Lobakin +Reviewed-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/20241219135734.2130002-1-aleksander.lobakin@intel.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/uapi/linux/stddef.h | 13 ++++++++++--- + tools/include/uapi/linux/stddef.h | 15 +++++++++++---- + 2 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h +index dcd50fb2164a..ef892cb1cbb7 100644 +--- a/include/uapi/linux/stddef.h ++++ b/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline inline + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,13 +27,13 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ + } ATTRS + + /** +diff --git a/tools/include/uapi/linux/stddef.h b/tools/include/uapi/linux/stddef.h +index bb6ea517efb5..c53cde425406 100644 +--- a/tools/include/uapi/linux/stddef.h ++++ b/tools/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline __inline__ + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,14 +27,14 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ +- } ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ ++ } ATTRS + + /** + * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union +-- +2.39.5 + diff --git a/queue-6.1/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch b/queue-6.1/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch new file mode 100644 index 00000000000..754897b7807 --- /dev/null +++ b/queue-6.1/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch @@ -0,0 +1,41 @@ +From 6aeb5fad2ab627bdd2c1878df187b62d80c2e373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 09:10:55 +0900 +Subject: tracing/kprobe: Make trace_kprobe's module callback called after + jump_label update + +From: Masami Hiramatsu (Google) + +[ Upstream commit d685d55dfc86b1a4bdcec77c3c1f8a83f181264e ] + +Make sure the trace_kprobe's module notifer callback function is called +after jump_label's callback is called. Since the trace_kprobe's callback +eventually checks jump_label address during registering new kprobe on +the loading module, jump_label must be updated before this registration +happens. + +Link: https://lore.kernel.org/all/173387585556.995044.3157941002975446119.stgit@devnote2/ + +Fixes: 614243181050 ("tracing/kprobes: Support module init function probing") +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 8657c9b1448e..72655d81b37d 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -702,7 +702,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb, + + static struct notifier_block trace_kprobe_module_nb = { + .notifier_call = trace_kprobe_module_callback, +- .priority = 1 /* Invoked after kprobe module callback */ ++ .priority = 2 /* Invoked after kprobe and jump_label module callback */ + }; + + static int count_symbols(void *data, unsigned long unused) +-- +2.39.5 + diff --git a/queue-6.1/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch b/queue-6.1/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch new file mode 100644 index 00000000000..8769c50a991 --- /dev/null +++ b/queue-6.1/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch @@ -0,0 +1,72 @@ +From 026643b2ab4e6bd68f150a3e261348afadfa64ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 20:58:21 +0800 +Subject: virtio-blk: don't keep queue frozen during system suspend + +From: Ming Lei + +[ Upstream commit 7678abee0867e6b7fb89aa40f6e9f575f755fb37 ] + +Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before +deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's +PM callbacks. And the motivation is to drain inflight IOs before suspending. + +block layer's queue freeze looks very handy, but it is also easy to cause +deadlock, such as, any attempt to call into bio_queue_enter() may run into +deadlock if the queue is frozen in current context. There are all kinds +of ->suspend() called in suspend context, so keeping queue frozen in the +whole suspend context isn't one good idea. And Marek reported lockdep +warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). + +[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ + +Given the motivation is to drain in-flight IOs, it can be done by calling +freeze & unfreeze, meantime restore to previous behavior by keeping queue +quiesced during suspend. + +Cc: Yi Sun +Cc: Michael S. Tsirkin +Cc: Jason Wang +Cc: Stefan Hajnoczi +Cc: virtualization@lists.linux.dev +Reported-by: Marek Szyprowski +Signed-off-by: Ming Lei +Acked-by: Stefan Hajnoczi +Link: https://lore.kernel.org/r/20241112125821.1475793-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 28644729dc97..0ba56caa41ef 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1201,9 +1201,12 @@ static void virtblk_remove(struct virtio_device *vdev) + static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; ++ struct request_queue *q = vblk->disk->queue; + + /* Ensure no requests in virtqueues before deleting vqs. */ +- blk_mq_freeze_queue(vblk->disk->queue); ++ blk_mq_freeze_queue(q); ++ blk_mq_quiesce_queue_nowait(q); ++ blk_mq_unfreeze_queue(q); + + /* Ensure we don't receive any more interrupts */ + virtio_reset_device(vdev); +@@ -1227,8 +1230,8 @@ static int virtblk_restore(struct virtio_device *vdev) + return ret; + + virtio_device_ready(vdev); ++ blk_mq_unquiesce_queue(vblk->disk->queue); + +- blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +-- +2.39.5 + diff --git a/queue-6.1/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch b/queue-6.1/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch new file mode 100644 index 00000000000..0df3ca8a94f --- /dev/null +++ b/queue-6.1/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch @@ -0,0 +1,121 @@ +From b1e9711a81bc33a414bc0021d8ed0e3f61dfd0aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 00:34:40 -0600 +Subject: watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 + +From: James Hilliard + +[ Upstream commit 43439076383a7611300334d1357c0f8883f40816 ] + +For the watchdog timer to work properly on the QCML04 board we need to +set PWRGD enable in the Environment Controller Configuration Registers +Special Configuration Register 1 when it is not already set, this may +be the case when the watchdog is not enabled from within the BIOS. + +Signed-off-by: James Hilliard +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241025063441.3494837-1-james.hilliard1@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 39 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 843f9f8e3917..239947df613d 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -20,6 +20,8 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include ++#include + #include + #include + #include +@@ -40,6 +42,7 @@ + #define VAL 0x2f + + /* Logical device Numbers LDN */ ++#define EC 0x04 + #define GPIO 0x07 + + /* Configuration Registers and Functions */ +@@ -71,6 +74,12 @@ + #define IT8784_ID 0x8784 + #define IT8786_ID 0x8786 + ++/* Environment Controller Configuration Registers LDN=0x04 */ ++#define SCR1 0xfa ++ ++/* Environment Controller Bits SCR1 */ ++#define WDT_PWRGD 0x20 ++ + /* GPIO Configuration Registers LDN=0x07 */ + #define WDTCTRL 0x71 + #define WDTCFG 0x72 +@@ -233,6 +242,21 @@ static int wdt_set_timeout(struct watchdog_device *wdd, unsigned int t) + return ret; + } + ++enum { ++ IT87_WDT_OUTPUT_THROUGH_PWRGD = BIT(0), ++}; ++ ++static const struct dmi_system_id it87_quirks[] = { ++ { ++ /* Qotom Q30900P (IT8786) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"), ++ }, ++ .driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD, ++ }, ++ {} ++}; ++ + static const struct watchdog_info ident = { + .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING, + .firmware_version = 1, +@@ -254,8 +278,10 @@ static struct watchdog_device wdt_dev = { + + static int __init it87_wdt_init(void) + { ++ const struct dmi_system_id *dmi_id; + u8 chip_rev; + u8 ctrl; ++ int quirks = 0; + int rc; + + rc = superio_enter(); +@@ -266,6 +292,10 @@ static int __init it87_wdt_init(void) + chip_rev = superio_inb(CHIPREV) & 0x0f; + superio_exit(); + ++ dmi_id = dmi_first_match(it87_quirks); ++ if (dmi_id) ++ quirks = (long)dmi_id->driver_data; ++ + switch (chip_type) { + case IT8702_ID: + max_units = 255; +@@ -326,6 +356,15 @@ static int __init it87_wdt_init(void) + superio_outb(0x00, WDTCTRL); + } + ++ if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) { ++ superio_select(EC); ++ ctrl = superio_inb(SCR1); ++ if (!(ctrl & WDT_PWRGD)) { ++ ctrl |= WDT_PWRGD; ++ superio_outb(ctrl, SCR1); ++ } ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.39.5 +