From: Sasha Levin Date: Fri, 30 Aug 2024 18:38:32 +0000 (-0400) Subject: Fixes for 6.10 X-Git-Tag: v4.19.321~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=14ea960854cf5f1c8e61d9d248036a3d9572cb89;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.10 Signed-off-by: Sasha Levin --- diff --git a/queue-6.10/afs-fix-post-setattr-file-edit-to-do-truncation-corr.patch b/queue-6.10/afs-fix-post-setattr-file-edit-to-do-truncation-corr.patch new file mode 100644 index 00000000000..0be96b4209b --- /dev/null +++ b/queue-6.10/afs-fix-post-setattr-file-edit-to-do-truncation-corr.patch @@ -0,0 +1,69 @@ +From f506ef34786cfa942c58cba206b210b0457944b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 21:08:10 +0100 +Subject: afs: Fix post-setattr file edit to do truncation correctly + +From: David Howells + +[ Upstream commit a74ee0e878e262c0276966528d72d4e887174410 ] + +At the end of an kAFS RPC operation, there is an "edit" phase (originally +intended for post-directory modification ops to edit the local image) that +the setattr VFS op uses to fix up the pagecache if the RPC that requested +truncation of a file was successful. + +afs_setattr_edit_file() calls truncate_setsize() which sets i_size, expands +the pagecache if needed and truncates the pagecache. The first two of +those, however, are redundant as they've already been done by +afs_setattr_success() under the io_lock and the first is also done under +the callback lock (cb_lock). + +Fix afs_setattr_edit_file() to call truncate_pagecache() instead (which is +called by truncate_setsize(), thereby skipping the redundant parts. + +Fixes: 100ccd18bb41 ("netfs: Optimise away reads above the point at which there can be no data") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240823200819.532106-3-dhowells@redhat.com +cc: Matthew Wilcox (Oracle) +cc: Pankaj Raghav +cc: Jeff Layton +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: netfs@lists.linux.dev +cc: linux-mm@kvack.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 3acf5e0500728..a95e77670b494 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -695,13 +695,18 @@ static void afs_setattr_edit_file(struct afs_operation *op) + { + struct afs_vnode_param *vp = &op->file[0]; + struct afs_vnode *vnode = vp->vnode; ++ struct inode *inode = &vnode->netfs.inode; + + if (op->setattr.attr->ia_valid & ATTR_SIZE) { + loff_t size = op->setattr.attr->ia_size; +- loff_t i_size = op->setattr.old_i_size; ++ loff_t old = op->setattr.old_i_size; ++ ++ /* Note: inode->i_size was updated by afs_apply_status() inside ++ * the I/O and callback locks. ++ */ + +- if (size != i_size) { +- truncate_setsize(&vnode->netfs.inode, size); ++ if (size != old) { ++ truncate_pagecache(inode, size); + netfs_resize_file(&vnode->netfs, size, true); + fscache_resize_cookie(afs_vnode_cache(vnode), size); + } +-- +2.43.0 + diff --git a/queue-6.10/alsa-hda-cs35l56-don-t-use-the-device-index-as-a-cal.patch b/queue-6.10/alsa-hda-cs35l56-don-t-use-the-device-index-as-a-cal.patch new file mode 100644 index 00000000000..ee54fb49ec4 --- /dev/null +++ b/queue-6.10/alsa-hda-cs35l56-don-t-use-the-device-index-as-a-cal.patch @@ -0,0 +1,40 @@ +From 86ec3fbd42faec02e86d1ec972d598c2f8bea4bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 12:47:11 +0000 +Subject: ALSA: hda: cs35l56: Don't use the device index as a calibration index + +From: Simon Trimmer + +[ Upstream commit 91191a6e50a2ff752da244493171037663536768 ] + +The HDA driver cannot assume that the order that the devices are +specified in the cirrus,dev-index matches the order of calibration +entries. + +Only a calibration entry with a matching silicon id will be used. + +Fixes: cfa43aaa7948 ("ALSA: hda: cs35l56: Apply amp calibration from EFI data") +Signed-off-by: Simon Trimmer +Link: https://patch.msgid.link/20240821124711.44325-1-simont@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/cs35l56_hda.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c +index e134ede6c5aa5..357fd59aa49e4 100644 +--- a/sound/pci/hda/cs35l56_hda.c ++++ b/sound/pci/hda/cs35l56_hda.c +@@ -980,7 +980,7 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id) + goto err; + } + +- cs35l56->base.cal_index = cs35l56->index; ++ cs35l56->base.cal_index = -1; + + cs35l56_init_cs_dsp(&cs35l56->base, &cs35l56->cs_dsp); + cs35l56->cs_dsp.client_ops = &cs35l56_hda_client_ops; +-- +2.43.0 + diff --git a/queue-6.10/asoc-amd-acp-fix-module-autoloading.patch b/queue-6.10/asoc-amd-acp-fix-module-autoloading.patch new file mode 100644 index 00000000000..d5ce0e77616 --- /dev/null +++ b/queue-6.10/asoc-amd-acp-fix-module-autoloading.patch @@ -0,0 +1,37 @@ +From 5460506ad535cd2a956424b45aad780e00016388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2024 08:49:23 +0000 +Subject: ASoC: amd: acp: fix module autoloading + +From: Yuntao Liu + +[ Upstream commit 164199615ae230ace4519141285f06766d6d8036 ] + +Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded +based on the alias from platform_device_id table. + +Fixes: 9d8a7be88b336 ("ASoC: amd: acp: Add legacy sound card support for Chrome audio") +Signed-off-by: Yuntao Liu +Link: https://patch.msgid.link/20240815084923.756476-1-liuyuntao12@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp/acp-legacy-mach.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/amd/acp/acp-legacy-mach.c b/sound/soc/amd/acp/acp-legacy-mach.c +index 47c3b5f167f59..0d529e32e552b 100644 +--- a/sound/soc/amd/acp/acp-legacy-mach.c ++++ b/sound/soc/amd/acp/acp-legacy-mach.c +@@ -227,6 +227,8 @@ static const struct platform_device_id board_ids[] = { + }, + { } + }; ++MODULE_DEVICE_TABLE(platform, board_ids); ++ + static struct platform_driver acp_asoc_audio = { + .driver = { + .pm = &snd_soc_pm_ops, +-- +2.43.0 + diff --git a/queue-6.10/asoc-cs-amp-lib-ignore-empty-uefi-calibration-entrie.patch b/queue-6.10/asoc-cs-amp-lib-ignore-empty-uefi-calibration-entrie.patch new file mode 100644 index 00000000000..209a15d0f4c --- /dev/null +++ b/queue-6.10/asoc-cs-amp-lib-ignore-empty-uefi-calibration-entrie.patch @@ -0,0 +1,54 @@ +From ffb393bdbd6237963a07e4fe9bcf62bf976c0f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 14:35:44 +0100 +Subject: ASoC: cs-amp-lib: Ignore empty UEFI calibration entries + +From: Richard Fitzgerald + +[ Upstream commit bb4485562f5907708f1c218b5d70dce04165d1e1 ] + +If the timestamp of a calibration entry is 0 it is an unused entry and +must be ignored. + +Some end-products reserve EFI space for calibration entries by shipping +with a zero-filled EFI file. When searching the file for calibration +data the driver must skip the empty entries. The timestamp of a valid +entry is always non-zero. + +Signed-off-by: Richard Fitzgerald +Fixes: 1cad8725f2b9 ("ASoC: cs-amp-lib: Add helpers for factory calibration data") +Link: https://patch.msgid.link/20240822133544.304421-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs-amp-lib.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs-amp-lib.c b/sound/soc/codecs/cs-amp-lib.c +index 605964af8afad..51b128c806718 100644 +--- a/sound/soc/codecs/cs-amp-lib.c ++++ b/sound/soc/codecs/cs-amp-lib.c +@@ -182,6 +182,10 @@ static int _cs_amp_get_efi_calibration_data(struct device *dev, u64 target_uid, + for (i = 0; i < efi_data->count; ++i) { + u64 cal_target = cs_amp_cal_target_u64(&efi_data->data[i]); + ++ /* Skip empty entries */ ++ if (!efi_data->data[i].calTime[0] && !efi_data->data[i].calTime[1]) ++ continue; ++ + /* Skip entries with unpopulated silicon ID */ + if (cal_target == 0) + continue; +@@ -193,7 +197,8 @@ static int _cs_amp_get_efi_calibration_data(struct device *dev, u64 target_uid, + } + } + +- if (!cal && (amp_index >= 0) && (amp_index < efi_data->count)) { ++ if (!cal && (amp_index >= 0) && (amp_index < efi_data->count) && ++ (efi_data->data[amp_index].calTime[0] || efi_data->data[amp_index].calTime[1])) { + u64 cal_target = cs_amp_cal_target_u64(&efi_data->data[amp_index]); + + /* +-- +2.43.0 + diff --git a/queue-6.10/asoc-cs-amp-lib-test-force-test-calibration-blob-ent.patch b/queue-6.10/asoc-cs-amp-lib-test-force-test-calibration-blob-ent.patch new file mode 100644 index 00000000000..707e8849740 --- /dev/null +++ b/queue-6.10/asoc-cs-amp-lib-test-force-test-calibration-blob-ent.patch @@ -0,0 +1,55 @@ +From dd34c240aef84c6f859bf281ea913e20359d249a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 12:57:25 +0100 +Subject: ASoC: cs-amp-lib-test: Force test calibration blob entries to be + valid + +From: Richard Fitzgerald + +[ Upstream commit bff980d8d9ca537fd5f3c0e9a99876c1e3713e81 ] + +For a normal calibration blob the calTarget values must be non-zero and +unique, and the calTime values must be non-zero. Don't rely on +get_random_bytes() to be random enough to guarantee this. Force the +calTarget and calTime values to be valid while retaining randomness +in the values. + +Signed-off-by: Richard Fitzgerald +Fixes: 177862317a98 ("ASoC: cs-amp-lib: Add KUnit test for calibration helpers") +Link: https://patch.msgid.link/20240822115725.259568-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs-amp-lib-test.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/codecs/cs-amp-lib-test.c b/sound/soc/codecs/cs-amp-lib-test.c +index 15f991b2e16e2..8169ec88a8ba8 100644 +--- a/sound/soc/codecs/cs-amp-lib-test.c ++++ b/sound/soc/codecs/cs-amp-lib-test.c +@@ -38,6 +38,7 @@ static void cs_amp_lib_test_init_dummy_cal_blob(struct kunit *test, int num_amps + { + struct cs_amp_lib_test_priv *priv = test->priv; + unsigned int blob_size; ++ int i; + + blob_size = offsetof(struct cirrus_amp_efi_data, data) + + sizeof(struct cirrus_amp_cal_data) * num_amps; +@@ -49,6 +50,14 @@ static void cs_amp_lib_test_init_dummy_cal_blob(struct kunit *test, int num_amps + priv->cal_blob->count = num_amps; + + get_random_bytes(priv->cal_blob->data, sizeof(struct cirrus_amp_cal_data) * num_amps); ++ ++ /* Ensure all timestamps are non-zero to mark the entry valid. */ ++ for (i = 0; i < num_amps; i++) ++ priv->cal_blob->data[i].calTime[0] |= 1; ++ ++ /* Ensure that all UIDs are non-zero and unique. */ ++ for (i = 0; i < num_amps; i++) ++ *(u8 *)&priv->cal_blob->data[i].calTarget[0] = i + 1; + } + + static u64 cs_amp_lib_test_get_target_uid(struct kunit *test) +-- +2.43.0 + diff --git a/queue-6.10/asoc-sof-amd-fix-for-acp-init-sequence.patch b/queue-6.10/asoc-sof-amd-fix-for-acp-init-sequence.patch new file mode 100644 index 00000000000..23316f9a472 --- /dev/null +++ b/queue-6.10/asoc-sof-amd-fix-for-acp-init-sequence.patch @@ -0,0 +1,86 @@ +From f968f79bd996991b3c76d57812751ede8be6d3bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2024 12:33:28 +0530 +Subject: ASoC: SOF: amd: Fix for acp init sequence + +From: Vijendar Mukunda + +[ Upstream commit a42db293e5983aa1508d12644f23d73f0553b32c ] + +When ACP is not powered on by default, acp power on sequence explicitly +invoked by programming pgfsm control mask. The existing implementation +checks the same PGFSM status mask and programs the same PGFSM control mask +in all ACP variants which breaks acp power on sequence for ACP6.0 and +ACP6.3 variants. So to fix this issue, update ACP pgfsm control mask and +status mask based on acp descriptor rev field, which will vary based on +acp variant. + +Fixes: 846aef1d7cc0 ("ASoC: SOF: amd: Add Renoir ACP HW support") +Signed-off-by: Vijendar Mukunda +Link: https://patch.msgid.link/20240816070328.610360-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 19 +++++++++++++++++-- + sound/soc/sof/amd/acp.h | 7 +++++-- + 2 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index d95f865669a69..85b58c8ccd0da 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -433,6 +433,7 @@ static int acp_power_on(struct snd_sof_dev *sdev) + const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata); + unsigned int base = desc->pgfsm_base; + unsigned int val; ++ unsigned int acp_pgfsm_status_mask, acp_pgfsm_cntl_mask; + int ret; + + val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET); +@@ -440,9 +441,23 @@ static int acp_power_on(struct snd_sof_dev *sdev) + if (val == ACP_POWERED_ON) + return 0; + +- if (val & ACP_PGFSM_STATUS_MASK) ++ switch (desc->rev) { ++ case 3: ++ case 5: ++ acp_pgfsm_status_mask = ACP3X_PGFSM_STATUS_MASK; ++ acp_pgfsm_cntl_mask = ACP3X_PGFSM_CNTL_POWER_ON_MASK; ++ break; ++ case 6: ++ acp_pgfsm_status_mask = ACP6X_PGFSM_STATUS_MASK; ++ acp_pgfsm_cntl_mask = ACP6X_PGFSM_CNTL_POWER_ON_MASK; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ if (val & acp_pgfsm_status_mask) + snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + PGFSM_CONTROL_OFFSET, +- ACP_PGFSM_CNTL_POWER_ON_MASK); ++ acp_pgfsm_cntl_mask); + + ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, base + PGFSM_STATUS_OFFSET, val, + !val, ACP_REG_POLL_INTERVAL, ACP_REG_POLL_TIMEOUT_US); +diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h +index 1af86b5b28db8..61b28df8c9081 100644 +--- a/sound/soc/sof/amd/acp.h ++++ b/sound/soc/sof/amd/acp.h +@@ -25,8 +25,11 @@ + #define ACP_REG_POLL_TIMEOUT_US 2000 + #define ACP_DMA_COMPLETE_TIMEOUT_US 5000 + +-#define ACP_PGFSM_CNTL_POWER_ON_MASK 0x01 +-#define ACP_PGFSM_STATUS_MASK 0x03 ++#define ACP3X_PGFSM_CNTL_POWER_ON_MASK 0x01 ++#define ACP3X_PGFSM_STATUS_MASK 0x03 ++#define ACP6X_PGFSM_CNTL_POWER_ON_MASK 0x07 ++#define ACP6X_PGFSM_STATUS_MASK 0x0F ++ + #define ACP_POWERED_ON 0x00 + #define ACP_ASSERT_RESET 0x01 + #define ACP_RELEASE_RESET 0x00 +-- +2.43.0 + diff --git a/queue-6.10/asoc-sof-amd-fix-for-incorrect-acp-error-register-of.patch b/queue-6.10/asoc-sof-amd-fix-for-incorrect-acp-error-register-of.patch new file mode 100644 index 00000000000..8b5331aa63b --- /dev/null +++ b/queue-6.10/asoc-sof-amd-fix-for-incorrect-acp-error-register-of.patch @@ -0,0 +1,146 @@ +From 4860ad49ee6f5bc47e59c4a54c18e6006c7055e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 16:29:44 +0530 +Subject: ASoC: SOF: amd: Fix for incorrect acp error register offsets + +From: Vijendar Mukunda + +[ Upstream commit 897e91e995b338002b00454fd0018af26a098148 ] + +Addition of 'dsp_intr_base' to ACP error register offsets points to +wrong register offsets in irq handler. Correct the acp error register +offsets. ACP error status register offset and acp error reason register +offset got changed from ACP6.0 onwards. Add 'acp_error_stat' and +'acp_sw0_i2s_err_reason' as descriptor fields in sof_amd_acp_desc +structure and update the values based on the ACP variant. +>From Rembrandt platform onwards, errors related to SW1 Soundwire manager +instance/I2S controller connected on P1 power tile is reported with +ACP_SW1_I2S_ERROR_REASON register. Add conditional check for the same. + +Fixes: 96eb81851012 ("ASoC: SOF: amd: add interrupt handling for SoundWire manager devices") +Signed-off-by: Vijendar Mukunda +Link: https://patch.msgid.link/20240813105944.3126903-2-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp-dsp-offset.h | 6 ++++-- + sound/soc/sof/amd/acp.c | 11 +++++++---- + sound/soc/sof/amd/acp.h | 2 ++ + sound/soc/sof/amd/pci-acp63.c | 2 ++ + sound/soc/sof/amd/pci-rmb.c | 2 ++ + sound/soc/sof/amd/pci-rn.c | 2 ++ + 6 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sof/amd/acp-dsp-offset.h b/sound/soc/sof/amd/acp-dsp-offset.h +index 59afbe2e0f420..072b703f9b3f3 100644 +--- a/sound/soc/sof/amd/acp-dsp-offset.h ++++ b/sound/soc/sof/amd/acp-dsp-offset.h +@@ -76,13 +76,15 @@ + #define DSP_SW_INTR_CNTL_OFFSET 0x0 + #define DSP_SW_INTR_STAT_OFFSET 0x4 + #define DSP_SW_INTR_TRIG_OFFSET 0x8 +-#define ACP_ERROR_STATUS 0x18C4 ++#define ACP3X_ERROR_STATUS 0x18C4 ++#define ACP6X_ERROR_STATUS 0x1A4C + #define ACP3X_AXI2DAGB_SEM_0 0x1880 + #define ACP5X_AXI2DAGB_SEM_0 0x1884 + #define ACP6X_AXI2DAGB_SEM_0 0x1874 + + /* ACP common registers to report errors related to I2S & SoundWire interfaces */ +-#define ACP_SW0_I2S_ERROR_REASON 0x18B4 ++#define ACP3X_SW_I2S_ERROR_REASON 0x18C8 ++#define ACP6X_SW0_I2S_ERROR_REASON 0x18B4 + #define ACP_SW1_I2S_ERROR_REASON 0x1A50 + + /* Registers from ACP_SHA block */ +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 9123427fab4e3..d95f865669a69 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -92,6 +92,7 @@ static int config_dma_channel(struct acp_dev_data *adata, unsigned int ch, + unsigned int idx, unsigned int dscr_count) + { + struct snd_sof_dev *sdev = adata->dev; ++ const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata); + unsigned int val, status; + int ret; + +@@ -102,7 +103,7 @@ static int config_dma_channel(struct acp_dev_data *adata, unsigned int ch, + val & (1 << ch), ACP_REG_POLL_INTERVAL, + ACP_REG_POLL_TIMEOUT_US); + if (ret < 0) { +- status = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_ERROR_STATUS); ++ status = snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->acp_error_stat); + val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, ACP_DMA_ERR_STS_0 + ch * sizeof(u32)); + + dev_err(sdev->dev, "ACP_DMA_ERR_STS :0x%x ACP_ERROR_STATUS :0x%x\n", val, status); +@@ -402,9 +403,11 @@ static irqreturn_t acp_irq_handler(int irq, void *dev_id) + + if (val & ACP_ERROR_IRQ_MASK) { + snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->ext_intr_stat, ACP_ERROR_IRQ_MASK); +- snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + ACP_SW0_I2S_ERROR_REASON, 0); +- snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + ACP_SW1_I2S_ERROR_REASON, 0); +- snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + ACP_ERROR_STATUS, 0); ++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->acp_sw0_i2s_err_reason, 0); ++ /* ACP_SW1_I2S_ERROR_REASON is newly added register from rmb platform onwards */ ++ if (desc->rev >= 6) ++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SW1_I2S_ERROR_REASON, 0); ++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->acp_error_stat, 0); + irq_flag = 1; + } + +diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h +index 87e79d500865a..1af86b5b28db8 100644 +--- a/sound/soc/sof/amd/acp.h ++++ b/sound/soc/sof/amd/acp.h +@@ -203,6 +203,8 @@ struct sof_amd_acp_desc { + u32 probe_reg_offset; + u32 reg_start_addr; + u32 reg_end_addr; ++ u32 acp_error_stat; ++ u32 acp_sw0_i2s_err_reason; + u32 sdw_max_link_count; + u64 sdw_acpi_dev_addr; + }; +diff --git a/sound/soc/sof/amd/pci-acp63.c b/sound/soc/sof/amd/pci-acp63.c +index fc89844473657..986f5928caedd 100644 +--- a/sound/soc/sof/amd/pci-acp63.c ++++ b/sound/soc/sof/amd/pci-acp63.c +@@ -35,6 +35,8 @@ static const struct sof_amd_acp_desc acp63_chip_info = { + .ext_intr_cntl = ACP6X_EXTERNAL_INTR_CNTL, + .ext_intr_stat = ACP6X_EXT_INTR_STAT, + .ext_intr_stat1 = ACP6X_EXT_INTR_STAT1, ++ .acp_error_stat = ACP6X_ERROR_STATUS, ++ .acp_sw0_i2s_err_reason = ACP6X_SW0_I2S_ERROR_REASON, + .dsp_intr_base = ACP6X_DSP_SW_INTR_BASE, + .sram_pte_offset = ACP6X_SRAM_PTE_OFFSET, + .hw_semaphore_offset = ACP6X_AXI2DAGB_SEM_0, +diff --git a/sound/soc/sof/amd/pci-rmb.c b/sound/soc/sof/amd/pci-rmb.c +index 4bc30951f8b0d..a366f904e6f31 100644 +--- a/sound/soc/sof/amd/pci-rmb.c ++++ b/sound/soc/sof/amd/pci-rmb.c +@@ -33,6 +33,8 @@ static const struct sof_amd_acp_desc rembrandt_chip_info = { + .pgfsm_base = ACP6X_PGFSM_BASE, + .ext_intr_stat = ACP6X_EXT_INTR_STAT, + .dsp_intr_base = ACP6X_DSP_SW_INTR_BASE, ++ .acp_error_stat = ACP6X_ERROR_STATUS, ++ .acp_sw0_i2s_err_reason = ACP6X_SW0_I2S_ERROR_REASON, + .sram_pte_offset = ACP6X_SRAM_PTE_OFFSET, + .hw_semaphore_offset = ACP6X_AXI2DAGB_SEM_0, + .fusion_dsp_offset = ACP6X_DSP_FUSION_RUNSTALL, +diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c +index e08875bdfa8b1..2b7c53470ce82 100644 +--- a/sound/soc/sof/amd/pci-rn.c ++++ b/sound/soc/sof/amd/pci-rn.c +@@ -33,6 +33,8 @@ static const struct sof_amd_acp_desc renoir_chip_info = { + .pgfsm_base = ACP3X_PGFSM_BASE, + .ext_intr_stat = ACP3X_EXT_INTR_STAT, + .dsp_intr_base = ACP3X_DSP_SW_INTR_BASE, ++ .acp_error_stat = ACP3X_ERROR_STATUS, ++ .acp_sw0_i2s_err_reason = ACP3X_SW_I2S_ERROR_REASON, + .sram_pte_offset = ACP3X_SRAM_PTE_OFFSET, + .hw_semaphore_offset = ACP3X_AXI2DAGB_SEM_0, + .acp_clkmux_sel = ACP3X_CLKMUX_SEL, +-- +2.43.0 + diff --git a/queue-6.10/asoc-sof-amd-move-iram-dram-fence-register-programmi.patch b/queue-6.10/asoc-sof-amd-move-iram-dram-fence-register-programmi.patch new file mode 100644 index 00000000000..083137af971 --- /dev/null +++ b/queue-6.10/asoc-sof-amd-move-iram-dram-fence-register-programmi.patch @@ -0,0 +1,67 @@ +From 694def8cc8d8bd52aa8cdd1b1665ded7fba60559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 16:29:43 +0530 +Subject: ASoC: SOF: amd: move iram-dram fence register programming sequence + +From: Vijendar Mukunda + +[ Upstream commit c56ba3e44784527fd6efe5eb7a4fa6c9f6969a58 ] + +The existing code modifies IRAM and DRAM size after sha dma start for +vangogh platform. The problem with this sequence is that it might cause +sha dma failure when firmware code binary size is greater than the default +IRAM size. To fix this issue, Move the iram-dram fence register sequence +prior to sha dma start. + +Fixes: 094d11768f74 ("ASoC: SOF: amd: Skip IRAM/DRAM size modification for Steam Deck OLED") +Signed-off-by: Vijendar Mukunda +Link: https://patch.msgid.link/20240813105944.3126903-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c +index 74fd5f2b148b8..9123427fab4e3 100644 +--- a/sound/soc/sof/amd/acp.c ++++ b/sound/soc/sof/amd/acp.c +@@ -263,6 +263,17 @@ int configure_and_run_sha_dma(struct acp_dev_data *adata, void *image_addr, + snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_STRT_ADDR, start_addr); + snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_DESTINATION_ADDR, dest_addr); + snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_MSG_LENGTH, image_length); ++ ++ /* psp_send_cmd only required for vangogh platform (rev - 5) */ ++ if (desc->rev == 5 && !(adata->quirks && adata->quirks->skip_iram_dram_size_mod)) { ++ /* Modify IRAM and DRAM size */ ++ ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | IRAM_DRAM_FENCE_2); ++ if (ret) ++ return ret; ++ ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | MBOX_ISREADY_FLAG); ++ if (ret) ++ return ret; ++ } + snd_sof_dsp_write(sdev, ACP_DSP_BAR, ACP_SHA_DMA_CMD, ACP_SHA_RUN); + + ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, ACP_SHA_TRANSFER_BYTE_CNT, +@@ -280,17 +291,6 @@ int configure_and_run_sha_dma(struct acp_dev_data *adata, void *image_addr, + return ret; + } + +- /* psp_send_cmd only required for vangogh platform (rev - 5) */ +- if (desc->rev == 5 && !(adata->quirks && adata->quirks->skip_iram_dram_size_mod)) { +- /* Modify IRAM and DRAM size */ +- ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | IRAM_DRAM_FENCE_2); +- if (ret) +- return ret; +- ret = psp_send_cmd(adata, MBOX_ACP_IRAM_DRAM_FENCE_COMMAND | MBOX_ISREADY_FLAG); +- if (ret) +- return ret; +- } +- + ret = snd_sof_dsp_read_poll_timeout(sdev, ACP_DSP_BAR, ACP_SHA_DSP_FW_QUALIFIER, + fw_qualifier, fw_qualifier & DSP_FW_RUN_ENABLE, + ACP_REG_POLL_INTERVAL, ACP_DMA_COMPLETE_TIMEOUT_US); +-- +2.43.0 + diff --git a/queue-6.10/backing-file-convert-to-using-fops-splice_write.patch b/queue-6.10/backing-file-convert-to-using-fops-splice_write.patch new file mode 100644 index 00000000000..7d9609a88a5 --- /dev/null +++ b/queue-6.10/backing-file-convert-to-using-fops-splice_write.patch @@ -0,0 +1,47 @@ +From 511cf885ff52fe6eee75c1825222f042335fce06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 15:22:06 +0800 +Subject: backing-file: convert to using fops->splice_write + +From: Ed Tsai + +[ Upstream commit 996b37da1e0f51314d4186b326742c2a95a9f0dd ] + +Filesystems may define their own splice write. Therefore, use the file +fops instead of invoking iter_file_splice_write() directly. + +Signed-off-by: Ed Tsai +Link: https://lore.kernel.org/r/20240708072208.25244-1-ed.tsai@mediatek.com +Fixes: 5ca73468612d ("fuse: implement splice read/write passthrough") +Reviewed-by: Amir Goldstein +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/backing-file.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/backing-file.c b/fs/backing-file.c +index afb557446c27c..8860dac58c37e 100644 +--- a/fs/backing-file.c ++++ b/fs/backing-file.c +@@ -303,13 +303,16 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe, + if (WARN_ON_ONCE(!(out->f_mode & FMODE_BACKING))) + return -EIO; + ++ if (!out->f_op->splice_write) ++ return -EINVAL; ++ + ret = file_remove_privs(ctx->user_file); + if (ret) + return ret; + + old_cred = override_creds(ctx->cred); + file_start_write(out); +- ret = iter_file_splice_write(pipe, out, ppos, len, flags); ++ ret = out->f_op->splice_write(pipe, out, ppos, len, flags); + file_end_write(out); + revert_creds(old_cred); + +-- +2.43.0 + diff --git a/queue-6.10/cifs-fix-falloc_fl_punch_hole-support.patch b/queue-6.10/cifs-fix-falloc_fl_punch_hole-support.patch new file mode 100644 index 00000000000..d832c2f57d7 --- /dev/null +++ b/queue-6.10/cifs-fix-falloc_fl_punch_hole-support.patch @@ -0,0 +1,105 @@ +From 39e90a452b70063ee3136d8e86a78985e081b9b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 14:22:42 +0100 +Subject: cifs: Fix FALLOC_FL_PUNCH_HOLE support + +From: David Howells + +[ Upstream commit 416871f4fb84bc96822562e654941d5625a25bf8 ] + +The cifs filesystem doesn't quite emulate FALLOC_FL_PUNCH_HOLE correctly +(note that due to lack of protocol support, it can't actually implement it +directly). Whilst it will (partially) invalidate dirty folios in the +pagecache, it doesn't write them back first, and so the EOF marker on the +server may be lower than inode->i_size. + +This presents a problem, however, as if the punched hole invalidates the +tail of the locally cached dirty data, writeback won't know it needs to +move the EOF over to account for the hole punch (which isn't supposed to +move the EOF). We could just write zeroes over the punched out region of +the pagecache and write that back - but this is supposed to be a +deallocatory operation. + +Fix this by manually moving the EOF over on the server after the operation +if the hole punched would corrupt it. + +Note that the FSCTL_SET_ZERO_DATA RPC and the setting of the EOF should +probably be compounded to stop a third party interfering (or, at least, +massively reduce the chance). + +This was reproducible occasionally by using fsx with the following script: + + truncate 0x0 0x375e2 0x0 + punch_hole 0x2f6d3 0x6ab5 0x375e2 + truncate 0x0 0x3a71f 0x375e2 + mapread 0xee05 0xcf12 0x3a71f + write 0x2078e 0x5604 0x3a71f + write 0x3ebdf 0x1421 0x3a71f * + punch_hole 0x379d0 0x8630 0x40000 * + mapread 0x2aaa2 0x85b 0x40000 + fallocate 0x1b401 0x9ada 0x40000 + read 0x15f2 0x7d32 0x40000 + read 0x32f37 0x7a3b 0x40000 * + +The second "write" should extend the EOF to 0x40000, and the "punch_hole" +should operate inside of that - but that depends on whether the VM gets in +and writes back the data first. If it doesn't, the file ends up 0x3a71f in +size, not 0x40000. + +Fixes: 31742c5a3317 ("enable fallocate punch hole ("fallocate -p") for SMB3") +Signed-off-by: David Howells +cc: Steve French +cc: Paulo Alcantara +cc: Shyam Prasad N +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index cfbca3489ece1..f44f5f2494006 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -3287,6 +3287,7 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + struct inode *inode = file_inode(file); + struct cifsFileInfo *cfile = file->private_data; + struct file_zero_data_information fsctl_buf; ++ unsigned long long end = offset + len, i_size, remote_i_size; + long rc; + unsigned int xid; + __u8 set_sparse = 1; +@@ -3318,6 +3319,27 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + (char *)&fsctl_buf, + sizeof(struct file_zero_data_information), + CIFSMaxBufSize, NULL, NULL); ++ ++ if (rc) ++ goto unlock; ++ ++ /* If there's dirty data in the buffer that would extend the EOF if it ++ * were written, then we need to move the EOF marker over to the lower ++ * of the high end of the hole and the proposed EOF. The problem is ++ * that we locally hole-punch the tail of the dirty data, the proposed ++ * EOF update will end up in the wrong place. ++ */ ++ i_size = i_size_read(inode); ++ remote_i_size = netfs_inode(inode)->remote_i_size; ++ if (end > remote_i_size && i_size > remote_i_size) { ++ unsigned long long extend_to = umin(end, i_size); ++ rc = SMB2_set_eof(xid, tcon, cfile->fid.persistent_fid, ++ cfile->fid.volatile_fid, cfile->pid, extend_to); ++ if (rc >= 0) ++ netfs_inode(inode)->remote_i_size = extend_to; ++ } ++ ++unlock: + filemap_invalidate_unlock(inode->i_mapping); + out: + inode_unlock(inode); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-do-not-wait-for-mp0_c2pmsg_33-ifwi-init-i.patch b/queue-6.10/drm-amdgpu-do-not-wait-for-mp0_c2pmsg_33-ifwi-init-i.patch new file mode 100644 index 00000000000..25551a7369e --- /dev/null +++ b/queue-6.10/drm-amdgpu-do-not-wait-for-mp0_c2pmsg_33-ifwi-init-i.patch @@ -0,0 +1,62 @@ +From d63b924d950659ec84e21fbc25c8ab3f985a3a7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 14:59:22 -0400 +Subject: drm/amdgpu: Do not wait for MP0_C2PMSG_33 IFWI init in SRIOV + +From: Victor Lu + +[ Upstream commit b32563859d6f61265222ec0f27d394964a8f7669 ] + +SRIOV does not need to wait for IFWI init, and MP0_C2PMSG_33 is blocked +for VF access. + +Signed-off-by: Victor Lu +Reviewed-by: Vignesh Chander +Signed-off-by: Alex Deucher +Stable-dep-of: 9cead81eff63 ("drm/amdgpu: fix eGPU hotplug regression") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 26 ++++++++++--------- + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index 0e31bdb4b7cb6..ea5223388cff2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -256,19 +256,21 @@ static int amdgpu_discovery_read_binary_from_mem(struct amdgpu_device *adev, + u32 msg; + int i, ret = 0; + +- /* It can take up to a second for IFWI init to complete on some dGPUs, +- * but generally it should be in the 60-100ms range. Normally this starts +- * as soon as the device gets power so by the time the OS loads this has long +- * completed. However, when a card is hotplugged via e.g., USB4, we need to +- * wait for this to complete. Once the C2PMSG is updated, we can +- * continue. +- */ ++ if (!amdgpu_sriov_vf(adev)) { ++ /* It can take up to a second for IFWI init to complete on some dGPUs, ++ * but generally it should be in the 60-100ms range. Normally this starts ++ * as soon as the device gets power so by the time the OS loads this has long ++ * completed. However, when a card is hotplugged via e.g., USB4, we need to ++ * wait for this to complete. Once the C2PMSG is updated, we can ++ * continue. ++ */ + +- for (i = 0; i < 1000; i++) { +- msg = RREG32(mmMP0_SMN_C2PMSG_33); +- if (msg & 0x80000000) +- break; +- usleep_range(1000, 1100); ++ for (i = 0; i < 1000; i++) { ++ msg = RREG32(mmMP0_SMN_C2PMSG_33); ++ if (msg & 0x80000000) ++ break; ++ usleep_range(1000, 1100); ++ } + } + + vram_size = (uint64_t)RREG32(mmRCC_CONFIG_MEMSIZE) << 20; +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-egpu-hotplug-regression.patch b/queue-6.10/drm-amdgpu-fix-egpu-hotplug-regression.patch new file mode 100644 index 00000000000..d1618a99fee --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-egpu-hotplug-regression.patch @@ -0,0 +1,45 @@ +From a0c88d216551d83f589ae844233745d85b0f506e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2024 11:14:29 -0400 +Subject: drm/amdgpu: fix eGPU hotplug regression + +From: Alex Deucher + +[ Upstream commit 9cead81eff635e3b3cbce51b40228f3bdc6f2b8c ] + +The driver needs to wait for the on board firmware +to finish its initialization before probing the card. +Commit 959056982a9b ("drm/amdgpu: Fix discovery initialization failure during pci rescan") +switched from using msleep() to using usleep_range() which +seems to have caused init failures on some navi1x boards. Switch +back to msleep(). + +Fixes: 959056982a9b ("drm/amdgpu: Fix discovery initialization failure during pci rescan") +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3559 +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3500 +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Cc: Ma Jun +(cherry picked from commit c69b07f7bbc905022491c45097923d3487479529) +Cc: stable@vger.kernel.org # 6.10.x +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +index ea5223388cff2..f1b08893765cf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c +@@ -269,7 +269,7 @@ static int amdgpu_discovery_read_binary_from_mem(struct amdgpu_device *adev, + msg = RREG32(mmMP0_SMN_C2PMSG_33); + if (msg & 0x80000000) + break; +- usleep_range(1000, 1100); ++ msleep(1); + } + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-display-make-display-suspend-resume-work-on-d.patch b/queue-6.10/drm-xe-display-make-display-suspend-resume-work-on-d.patch new file mode 100644 index 00000000000..7c149361b9a --- /dev/null +++ b/queue-6.10/drm-xe-display-make-display-suspend-resume-work-on-d.patch @@ -0,0 +1,118 @@ +From 22fcfc713e2d8dda5ed50360e33049487f3b5451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 12:50:44 +0200 +Subject: drm/xe/display: Make display suspend/resume work on discrete + +From: Maarten Lankhorst + +[ Upstream commit ddf6492e0e508b7c2b42c8d5a4ac82bd38ef0dd5 ] + +We should unpin before evicting all memory, and repin after GT resume. +This way, we preserve the contents of the framebuffers, and won't hang +on resume due to migration engine not being restored yet. + +Signed-off-by: Maarten Lankhorst +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Cc: stable@vger.kernel.org # v6.8+ +Reviewed-by: Uma Shankar +Link: https://patchwork.freedesktop.org/patch/msgid/20240806105044.596842-3-maarten.lankhorst@linux.intel.com +Signed-off-by: Maarten Lankhorst,,, +(cherry picked from commit cb8f81c1753187995b7a43e79c12959f14eb32d3) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/display/xe_display.c | 23 +++++++++++++++++++++++ + drivers/gpu/drm/xe/xe_pm.c | 11 ++++++----- + 2 files changed, 29 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/xe/display/xe_display.c b/drivers/gpu/drm/xe/display/xe_display.c +index 79d33d592093c..96835ffa5734e 100644 +--- a/drivers/gpu/drm/xe/display/xe_display.c ++++ b/drivers/gpu/drm/xe/display/xe_display.c +@@ -302,6 +302,27 @@ static bool suspend_to_idle(void) + return false; + } + ++static void xe_display_flush_cleanup_work(struct xe_device *xe) ++{ ++ struct intel_crtc *crtc; ++ ++ for_each_intel_crtc(&xe->drm, crtc) { ++ struct drm_crtc_commit *commit; ++ ++ spin_lock(&crtc->base.commit_lock); ++ commit = list_first_entry_or_null(&crtc->base.commit_list, ++ struct drm_crtc_commit, commit_entry); ++ if (commit) ++ drm_crtc_commit_get(commit); ++ spin_unlock(&crtc->base.commit_lock); ++ ++ if (commit) { ++ wait_for_completion(&commit->cleanup_done); ++ drm_crtc_commit_put(commit); ++ } ++ } ++} ++ + void xe_display_pm_suspend(struct xe_device *xe, bool runtime) + { + bool s2idle = suspend_to_idle(); +@@ -319,6 +340,8 @@ void xe_display_pm_suspend(struct xe_device *xe, bool runtime) + if (!runtime) + intel_display_driver_suspend(xe); + ++ xe_display_flush_cleanup_work(xe); ++ + intel_dp_mst_suspend(xe); + + intel_hpd_cancel_work(xe); +diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c +index 07615acd2c299..cf80679ceb701 100644 +--- a/drivers/gpu/drm/xe/xe_pm.c ++++ b/drivers/gpu/drm/xe/xe_pm.c +@@ -91,13 +91,13 @@ int xe_pm_suspend(struct xe_device *xe) + for_each_gt(gt, xe, id) + xe_gt_suspend_prepare(gt); + ++ xe_display_pm_suspend(xe, false); ++ + /* FIXME: Super racey... */ + err = xe_bo_evict_all(xe); + if (err) + goto err; + +- xe_display_pm_suspend(xe, false); +- + for_each_gt(gt, xe, id) { + err = xe_gt_suspend(gt); + if (err) { +@@ -151,11 +151,11 @@ int xe_pm_resume(struct xe_device *xe) + + xe_irq_resume(xe); + +- xe_display_pm_resume(xe, false); +- + for_each_gt(gt, xe, id) + xe_gt_resume(gt); + ++ xe_display_pm_resume(xe, false); ++ + err = xe_bo_restore_user(xe); + if (err) + goto err; +@@ -363,10 +363,11 @@ int xe_pm_runtime_suspend(struct xe_device *xe) + mutex_unlock(&xe->mem_access.vram_userfault.lock); + + if (xe->d3cold.allowed) { ++ xe_display_pm_suspend(xe, true); ++ + err = xe_bo_evict_all(xe); + if (err) + goto out; +- xe_display_pm_suspend(xe, true); + } + + for_each_gt(gt, xe, id) { +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-exec_queue-rename-xe_exec_queue-compute-to-xe.patch b/queue-6.10/drm-xe-exec_queue-rename-xe_exec_queue-compute-to-xe.patch new file mode 100644 index 00000000000..70b019cfccf --- /dev/null +++ b/queue-6.10/drm-xe-exec_queue-rename-xe_exec_queue-compute-to-xe.patch @@ -0,0 +1,243 @@ +From d223aefbe0dbbd9758523a44ed575d187a338dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 19:03:48 +0200 +Subject: drm/xe/exec_queue: Rename xe_exec_queue::compute to xe_exec_queue::lr + +From: Francois Dugast + +[ Upstream commit 731e46c032281601756f08cfa7d8505fe41166a9 ] + +The properties of this struct are used in long running context so +make that clear by renaming it to lr, in alignment with the rest +of the code. + +Cc: Matthew Brost +Signed-off-by: Francois Dugast +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20240613170348.723245-1-francois.dugast@intel.com +Signed-off-by: Rodrigo Vivi +Stable-dep-of: 730b72480e29 ("drm/xe: prevent UAF around preempt fence") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_exec_queue.c | 6 +-- + drivers/gpu/drm/xe/xe_exec_queue_types.h | 14 +++--- + drivers/gpu/drm/xe/xe_preempt_fence.c | 2 +- + drivers/gpu/drm/xe/xe_vm.c | 58 ++++++++++++------------ + 4 files changed, 40 insertions(+), 40 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index 2ae4420e29353..316731c5cce6d 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -67,7 +67,7 @@ static struct xe_exec_queue *__xe_exec_queue_alloc(struct xe_device *xe, + q->fence_irq = >->fence_irq[hwe->class]; + q->ring_ops = gt->ring_ops[hwe->class]; + q->ops = gt->exec_queue_ops; +- INIT_LIST_HEAD(&q->compute.link); ++ INIT_LIST_HEAD(&q->lr.link); + INIT_LIST_HEAD(&q->multi_gt_link); + + q->sched_props.timeslice_us = hwe->eclass->sched_props.timeslice_us; +@@ -631,8 +631,8 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, + return PTR_ERR(q); + + if (xe_vm_in_preempt_fence_mode(vm)) { +- q->compute.context = dma_fence_context_alloc(1); +- spin_lock_init(&q->compute.lock); ++ q->lr.context = dma_fence_context_alloc(1); ++ spin_lock_init(&q->lr.lock); + + err = xe_vm_add_compute_exec_queue(vm, q); + if (XE_IOCTL_DBG(xe, err)) +diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h +index f0c40e8ad80a1..52a1965d91375 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h ++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h +@@ -115,19 +115,19 @@ struct xe_exec_queue { + enum xe_exec_queue_priority priority; + } sched_props; + +- /** @compute: compute exec queue state */ ++ /** @lr: long-running exec queue state */ + struct { +- /** @compute.pfence: preemption fence */ ++ /** @lr.pfence: preemption fence */ + struct dma_fence *pfence; +- /** @compute.context: preemption fence context */ ++ /** @lr.context: preemption fence context */ + u64 context; +- /** @compute.seqno: preemption fence seqno */ ++ /** @lr.seqno: preemption fence seqno */ + u32 seqno; +- /** @compute.link: link into VM's list of exec queues */ ++ /** @lr.link: link into VM's list of exec queues */ + struct list_head link; +- /** @compute.lock: preemption fences lock */ ++ /** @lr.lock: preemption fences lock */ + spinlock_t lock; +- } compute; ++ } lr; + + /** @ops: submission backend exec queue operations */ + const struct xe_exec_queue_ops *ops; +diff --git a/drivers/gpu/drm/xe/xe_preempt_fence.c b/drivers/gpu/drm/xe/xe_preempt_fence.c +index 5b243b7feb59d..e8b8ae5c6485e 100644 +--- a/drivers/gpu/drm/xe/xe_preempt_fence.c ++++ b/drivers/gpu/drm/xe/xe_preempt_fence.c +@@ -129,7 +129,7 @@ xe_preempt_fence_arm(struct xe_preempt_fence *pfence, struct xe_exec_queue *q, + list_del_init(&pfence->link); + pfence->q = xe_exec_queue_get(q); + dma_fence_init(&pfence->base, &preempt_fence_ops, +- &q->compute.lock, context, seqno); ++ &q->lr.lock, context, seqno); + + return &pfence->base; + } +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 3137cbbaabde0..fd5612cc6f19b 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -83,10 +83,10 @@ static bool preempt_fences_waiting(struct xe_vm *vm) + lockdep_assert_held(&vm->lock); + xe_vm_assert_held(vm); + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { +- if (!q->compute.pfence || ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) { ++ if (!q->lr.pfence || + test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, +- &q->compute.pfence->flags)) { ++ &q->lr.pfence->flags)) { + return true; + } + } +@@ -129,14 +129,14 @@ static int wait_for_existing_preempt_fences(struct xe_vm *vm) + + xe_vm_assert_held(vm); + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { +- if (q->compute.pfence) { +- long timeout = dma_fence_wait(q->compute.pfence, false); ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) { ++ if (q->lr.pfence) { ++ long timeout = dma_fence_wait(q->lr.pfence, false); + + if (timeout < 0) + return -ETIME; +- dma_fence_put(q->compute.pfence); +- q->compute.pfence = NULL; ++ dma_fence_put(q->lr.pfence); ++ q->lr.pfence = NULL; + } + } + +@@ -148,7 +148,7 @@ static bool xe_vm_is_idle(struct xe_vm *vm) + struct xe_exec_queue *q; + + xe_vm_assert_held(vm); +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) { + if (!xe_exec_queue_is_idle(q)) + return false; + } +@@ -161,17 +161,17 @@ static void arm_preempt_fences(struct xe_vm *vm, struct list_head *list) + struct list_head *link; + struct xe_exec_queue *q; + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) { + struct dma_fence *fence; + + link = list->next; + xe_assert(vm->xe, link != list); + + fence = xe_preempt_fence_arm(to_preempt_fence_from_link(link), +- q, q->compute.context, +- ++q->compute.seqno); +- dma_fence_put(q->compute.pfence); +- q->compute.pfence = fence; ++ q, q->lr.context, ++ ++q->lr.seqno); ++ dma_fence_put(q->lr.pfence); ++ q->lr.pfence = fence; + } + } + +@@ -191,10 +191,10 @@ static int add_preempt_fences(struct xe_vm *vm, struct xe_bo *bo) + if (err) + goto out_unlock; + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) +- if (q->compute.pfence) { ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) ++ if (q->lr.pfence) { + dma_resv_add_fence(bo->ttm.base.resv, +- q->compute.pfence, ++ q->lr.pfence, + DMA_RESV_USAGE_BOOKKEEP); + } + +@@ -211,10 +211,10 @@ static void resume_and_reinstall_preempt_fences(struct xe_vm *vm, + lockdep_assert_held(&vm->lock); + xe_vm_assert_held(vm); + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) { + q->ops->resume(q); + +- drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, q->compute.pfence, ++ drm_gpuvm_resv_add_fence(&vm->gpuvm, exec, q->lr.pfence, + DMA_RESV_USAGE_BOOKKEEP, DMA_RESV_USAGE_BOOKKEEP); + } + } +@@ -238,16 +238,16 @@ int xe_vm_add_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q) + if (err) + goto out_up_write; + +- pfence = xe_preempt_fence_create(q, q->compute.context, +- ++q->compute.seqno); ++ pfence = xe_preempt_fence_create(q, q->lr.context, ++ ++q->lr.seqno); + if (!pfence) { + err = -ENOMEM; + goto out_fini; + } + +- list_add(&q->compute.link, &vm->preempt.exec_queues); ++ list_add(&q->lr.link, &vm->preempt.exec_queues); + ++vm->preempt.num_exec_queues; +- q->compute.pfence = pfence; ++ q->lr.pfence = pfence; + + down_read(&vm->userptr.notifier_lock); + +@@ -284,12 +284,12 @@ void xe_vm_remove_compute_exec_queue(struct xe_vm *vm, struct xe_exec_queue *q) + return; + + down_write(&vm->lock); +- list_del(&q->compute.link); ++ list_del(&q->lr.link); + --vm->preempt.num_exec_queues; +- if (q->compute.pfence) { +- dma_fence_enable_sw_signaling(q->compute.pfence); +- dma_fence_put(q->compute.pfence); +- q->compute.pfence = NULL; ++ if (q->lr.pfence) { ++ dma_fence_enable_sw_signaling(q->lr.pfence); ++ dma_fence_put(q->lr.pfence); ++ q->lr.pfence = NULL; + } + up_write(&vm->lock); + } +@@ -325,7 +325,7 @@ static void xe_vm_kill(struct xe_vm *vm) + vm->flags |= XE_VM_FLAG_BANNED; + trace_xe_vm_kill(vm); + +- list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) ++ list_for_each_entry(q, &vm->preempt.exec_queues, lr.link) + q->ops->kill(q); + xe_vm_unlock(vm); + +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-prepare-display-for-d3cold.patch b/queue-6.10/drm-xe-prepare-display-for-d3cold.patch new file mode 100644 index 00000000000..7661099dd13 --- /dev/null +++ b/queue-6.10/drm-xe-prepare-display-for-d3cold.patch @@ -0,0 +1,183 @@ +From d928c88dd2cfa5a9a92d01340d996d62e6f0b81e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 13:01:03 -0400 +Subject: drm/xe: Prepare display for D3Cold + +From: Rodrigo Vivi + +[ Upstream commit e7b180b22022f52e3f5fca695cc75d63bddc5a1c ] + +Prepare power-well and DC handling for a full power +lost during D3Cold, then sanitize it upon D3->D0. +Otherwise we get a bunch of state mismatch. + +Ideally we could leave DC9 enabled and wouldn't need +to move DC9->DC0 on every runtime resume, however, +the disable_DC is part of the power-well checks and +intrinsic to the dc_off power well. In the future that +can be detangled so we can have even bigger power savings. +But for now, let's focus on getting a D3Cold, which saves +much more power by itself. + +v2: create new functions to avoid full-suspend-resume path, +which would result in a deadlock between xe_gem_fault and the +modeset-ioctl. + +v3: Only avoid the full modeset to avoid the race, for a more +robust suspend-resume. + +Cc: Anshuman Gupta +Cc: Uma Shankar +Tested-by: Francois Dugast +Reviewed-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20240522170105.327472-5-rodrigo.vivi@intel.com +Signed-off-by: Rodrigo Vivi +Stable-dep-of: ddf6492e0e50 ("drm/xe/display: Make display suspend/resume work on discrete") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/display/xe_display.c | 10 ++++++---- + drivers/gpu/drm/xe/display/xe_display.h | 8 ++++---- + drivers/gpu/drm/xe/xe_pm.c | 15 ++++++++++++--- + 3 files changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/xe/display/xe_display.c b/drivers/gpu/drm/xe/display/xe_display.c +index 7cdc03dc40ed9..79d33d592093c 100644 +--- a/drivers/gpu/drm/xe/display/xe_display.c ++++ b/drivers/gpu/drm/xe/display/xe_display.c +@@ -302,7 +302,7 @@ static bool suspend_to_idle(void) + return false; + } + +-void xe_display_pm_suspend(struct xe_device *xe) ++void xe_display_pm_suspend(struct xe_device *xe, bool runtime) + { + bool s2idle = suspend_to_idle(); + if (!xe->info.enable_display) +@@ -316,7 +316,8 @@ void xe_display_pm_suspend(struct xe_device *xe) + if (has_display(xe)) + drm_kms_helper_poll_disable(&xe->drm); + +- intel_display_driver_suspend(xe); ++ if (!runtime) ++ intel_display_driver_suspend(xe); + + intel_dp_mst_suspend(xe); + +@@ -352,7 +353,7 @@ void xe_display_pm_resume_early(struct xe_device *xe) + intel_power_domains_resume(xe); + } + +-void xe_display_pm_resume(struct xe_device *xe) ++void xe_display_pm_resume(struct xe_device *xe, bool runtime) + { + if (!xe->info.enable_display) + return; +@@ -367,7 +368,8 @@ void xe_display_pm_resume(struct xe_device *xe) + + /* MST sideband requires HPD interrupts enabled */ + intel_dp_mst_resume(xe); +- intel_display_driver_resume(xe); ++ if (!runtime) ++ intel_display_driver_resume(xe); + + intel_hpd_poll_disable(xe); + if (has_display(xe)) +diff --git a/drivers/gpu/drm/xe/display/xe_display.h b/drivers/gpu/drm/xe/display/xe_display.h +index 710e56180b52d..93d1f779b9788 100644 +--- a/drivers/gpu/drm/xe/display/xe_display.h ++++ b/drivers/gpu/drm/xe/display/xe_display.h +@@ -34,10 +34,10 @@ void xe_display_irq_enable(struct xe_device *xe, u32 gu_misc_iir); + void xe_display_irq_reset(struct xe_device *xe); + void xe_display_irq_postinstall(struct xe_device *xe, struct xe_gt *gt); + +-void xe_display_pm_suspend(struct xe_device *xe); ++void xe_display_pm_suspend(struct xe_device *xe, bool runtime); + void xe_display_pm_suspend_late(struct xe_device *xe); + void xe_display_pm_resume_early(struct xe_device *xe); +-void xe_display_pm_resume(struct xe_device *xe); ++void xe_display_pm_resume(struct xe_device *xe, bool runtime); + + #else + +@@ -63,10 +63,10 @@ static inline void xe_display_irq_enable(struct xe_device *xe, u32 gu_misc_iir) + static inline void xe_display_irq_reset(struct xe_device *xe) {} + static inline void xe_display_irq_postinstall(struct xe_device *xe, struct xe_gt *gt) {} + +-static inline void xe_display_pm_suspend(struct xe_device *xe) {} ++static inline void xe_display_pm_suspend(struct xe_device *xe, bool runtime) {} + static inline void xe_display_pm_suspend_late(struct xe_device *xe) {} + static inline void xe_display_pm_resume_early(struct xe_device *xe) {} +-static inline void xe_display_pm_resume(struct xe_device *xe) {} ++static inline void xe_display_pm_resume(struct xe_device *xe, bool runtime) {} + + #endif /* CONFIG_DRM_XE_DISPLAY */ + #endif /* _XE_DISPLAY_H_ */ +diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c +index 37fbeda12d3bd..07615acd2c299 100644 +--- a/drivers/gpu/drm/xe/xe_pm.c ++++ b/drivers/gpu/drm/xe/xe_pm.c +@@ -96,12 +96,12 @@ int xe_pm_suspend(struct xe_device *xe) + if (err) + goto err; + +- xe_display_pm_suspend(xe); ++ xe_display_pm_suspend(xe, false); + + for_each_gt(gt, xe, id) { + err = xe_gt_suspend(gt); + if (err) { +- xe_display_pm_resume(xe); ++ xe_display_pm_resume(xe, false); + goto err; + } + } +@@ -151,7 +151,7 @@ int xe_pm_resume(struct xe_device *xe) + + xe_irq_resume(xe); + +- xe_display_pm_resume(xe); ++ xe_display_pm_resume(xe, false); + + for_each_gt(gt, xe, id) + xe_gt_resume(gt); +@@ -366,6 +366,7 @@ int xe_pm_runtime_suspend(struct xe_device *xe) + err = xe_bo_evict_all(xe); + if (err) + goto out; ++ xe_display_pm_suspend(xe, true); + } + + for_each_gt(gt, xe, id) { +@@ -375,7 +376,12 @@ int xe_pm_runtime_suspend(struct xe_device *xe) + } + + xe_irq_suspend(xe); ++ ++ if (xe->d3cold.allowed) ++ xe_display_pm_suspend_late(xe); + out: ++ if (err) ++ xe_display_pm_resume(xe, true); + lock_map_release(&xe_pm_runtime_lockdep_map); + xe_pm_write_callback_task(xe, NULL); + return err; +@@ -411,6 +417,8 @@ int xe_pm_runtime_resume(struct xe_device *xe) + if (err) + goto out; + ++ xe_display_pm_resume_early(xe); ++ + /* + * This only restores pinned memory which is the memory + * required for the GT(s) to resume. +@@ -426,6 +434,7 @@ int xe_pm_runtime_resume(struct xe_device *xe) + xe_gt_resume(gt); + + if (xe->d3cold.allowed && xe->d3cold.power_lost) { ++ xe_display_pm_resume(xe, true); + err = xe_bo_restore_user(xe); + if (err) + goto out; +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-prevent-uaf-around-preempt-fence.patch b/queue-6.10/drm-xe-prevent-uaf-around-preempt-fence.patch new file mode 100644 index 00000000000..3752f429627 --- /dev/null +++ b/queue-6.10/drm-xe-prevent-uaf-around-preempt-fence.patch @@ -0,0 +1,100 @@ +From e59cf8c139edce087792a08b37ec50bc5da56e47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2024 12:01:30 +0100 +Subject: drm/xe: prevent UAF around preempt fence + +From: Matthew Auld + +[ Upstream commit 730b72480e29f63fd644f5fa57c9d46109428953 ] + +The fence lock is part of the queue, therefore in the current design +anything locking the fence should then also hold a ref to the queue to +prevent the queue from being freed. + +However, currently it looks like we signal the fence and then drop the +queue ref, but if something is waiting on the fence, the waiter is +kicked to wake up at some later point, where upon waking up it first +grabs the lock before checking the fence state. But if we have already +dropped the queue ref, then the lock might already be freed as part of +the queue, leading to uaf. + +To prevent this, move the fence lock into the fence itself so we don't +run into lifetime issues. Alternative might be to have device level +lock, or only release the queue in the fence release callback, however +that might require pushing to another worker to avoid locking issues. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2454 +References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2342 +References: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2020 +Signed-off-by: Matthew Auld +Cc: Matthew Brost +Cc: # v6.8+ +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20240814110129.825847-2-matthew.auld@intel.com +(cherry picked from commit 7116c35aacedc38be6d15bd21b2fc936eed0008b) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_exec_queue.c | 1 - + drivers/gpu/drm/xe/xe_exec_queue_types.h | 2 -- + drivers/gpu/drm/xe/xe_preempt_fence.c | 3 ++- + drivers/gpu/drm/xe/xe_preempt_fence_types.h | 2 ++ + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c +index 316731c5cce6d..ba7013f82c8b6 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue.c ++++ b/drivers/gpu/drm/xe/xe_exec_queue.c +@@ -632,7 +632,6 @@ int xe_exec_queue_create_ioctl(struct drm_device *dev, void *data, + + if (xe_vm_in_preempt_fence_mode(vm)) { + q->lr.context = dma_fence_context_alloc(1); +- spin_lock_init(&q->lr.lock); + + err = xe_vm_add_compute_exec_queue(vm, q); + if (XE_IOCTL_DBG(xe, err)) +diff --git a/drivers/gpu/drm/xe/xe_exec_queue_types.h b/drivers/gpu/drm/xe/xe_exec_queue_types.h +index 52a1965d91375..a5aa43942d8cf 100644 +--- a/drivers/gpu/drm/xe/xe_exec_queue_types.h ++++ b/drivers/gpu/drm/xe/xe_exec_queue_types.h +@@ -125,8 +125,6 @@ struct xe_exec_queue { + u32 seqno; + /** @lr.link: link into VM's list of exec queues */ + struct list_head link; +- /** @lr.lock: preemption fences lock */ +- spinlock_t lock; + } lr; + + /** @ops: submission backend exec queue operations */ +diff --git a/drivers/gpu/drm/xe/xe_preempt_fence.c b/drivers/gpu/drm/xe/xe_preempt_fence.c +index e8b8ae5c6485e..c453f45328b1c 100644 +--- a/drivers/gpu/drm/xe/xe_preempt_fence.c ++++ b/drivers/gpu/drm/xe/xe_preempt_fence.c +@@ -128,8 +128,9 @@ xe_preempt_fence_arm(struct xe_preempt_fence *pfence, struct xe_exec_queue *q, + { + list_del_init(&pfence->link); + pfence->q = xe_exec_queue_get(q); ++ spin_lock_init(&pfence->lock); + dma_fence_init(&pfence->base, &preempt_fence_ops, +- &q->lr.lock, context, seqno); ++ &pfence->lock, context, seqno); + + return &pfence->base; + } +diff --git a/drivers/gpu/drm/xe/xe_preempt_fence_types.h b/drivers/gpu/drm/xe/xe_preempt_fence_types.h +index b54b5c29b5331..312c3372a49f9 100644 +--- a/drivers/gpu/drm/xe/xe_preempt_fence_types.h ++++ b/drivers/gpu/drm/xe/xe_preempt_fence_types.h +@@ -25,6 +25,8 @@ struct xe_preempt_fence { + struct xe_exec_queue *q; + /** @preempt_work: work struct which issues preemption */ + struct work_struct preempt_work; ++ /** @lock: dma-fence fence lock */ ++ spinlock_t lock; + /** @error: preempt fence is in error state */ + int error; + }; +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-vm-simplify-if-condition.patch b/queue-6.10/drm-xe-vm-simplify-if-condition.patch new file mode 100644 index 00000000000..2001f60a821 --- /dev/null +++ b/queue-6.10/drm-xe-vm-simplify-if-condition.patch @@ -0,0 +1,46 @@ +From 4aaa541cdedc4167bac05041f861548abb8ed253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:00:07 +0200 +Subject: drm/xe/vm: Simplify if condition + +From: Thorsten Blum + +[ Upstream commit b3181f433206a1432bc7093d1896fe36026f7fff ] + +The if condition !A || A && B can be simplified to !A || B. + +Fixes the following Coccinelle/coccicheck warning reported by +excluded_middle.cocci: + + WARNING !A || A && B is equivalent to !A || B + +Compile-tested only. + +Signed-off-by: Thorsten Blum +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20240603180005.191578-1-thorsten.blum@toblux.com +Stable-dep-of: 730b72480e29 ("drm/xe: prevent UAF around preempt fence") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_vm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c +index 4aa3943e6f292..3137cbbaabde0 100644 +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -85,8 +85,8 @@ static bool preempt_fences_waiting(struct xe_vm *vm) + + list_for_each_entry(q, &vm->preempt.exec_queues, compute.link) { + if (!q->compute.pfence || +- (q->compute.pfence && test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, +- &q->compute.pfence->flags))) { ++ test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, ++ &q->compute.pfence->flags)) { + return true; + } + } +-- +2.43.0 + diff --git a/queue-6.10/fs-nfsd-fix-update-of-inode-attrs-in-cb_getattr.patch b/queue-6.10/fs-nfsd-fix-update-of-inode-attrs-in-cb_getattr.patch new file mode 100644 index 00000000000..91f0afdf4e5 --- /dev/null +++ b/queue-6.10/fs-nfsd-fix-update-of-inode-attrs-in-cb_getattr.patch @@ -0,0 +1,155 @@ +From 32d05e614a783ba3a2bb199e619e4ef728b45b83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2024 10:32:34 -0400 +Subject: fs/nfsd: fix update of inode attrs in CB_GETATTR + +From: Jeff Layton + +[ Upstream commit 7e8ae8486e4471513e2111aba6ac29f2357bed2a ] + +Currently, we copy the mtime and ctime to the in-core inode and then +mark the inode dirty. This is fine for certain types of filesystems, but +not all. Some require a real setattr to properly change these values +(e.g. ceph or reexported NFS). + +Fix this code to call notify_change() instead, which is the proper way +to effect a setattr. There is one problem though: + +In this case, the client is holding a write delegation and has sent us +attributes to update our cache. We don't want to break the delegation +for this since that would defeat the purpose. Add a new ATTR_DELEG flag +that makes notify_change bypass the try_break_deleg call. + +Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") +Reviewed-by: Christian Brauner +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/attr.c | 14 +++++++++++--- + fs/nfsd/nfs4state.c | 18 +++++++++++++----- + fs/nfsd/nfs4xdr.c | 2 +- + fs/nfsd/state.h | 2 +- + include/linux/fs.h | 1 + + 5 files changed, 27 insertions(+), 10 deletions(-) + +diff --git a/fs/attr.c b/fs/attr.c +index 960a310581ebb..0dbf43b6555c8 100644 +--- a/fs/attr.c ++++ b/fs/attr.c +@@ -489,9 +489,17 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry, + error = security_inode_setattr(idmap, dentry, attr); + if (error) + return error; +- error = try_break_deleg(inode, delegated_inode); +- if (error) +- return error; ++ ++ /* ++ * If ATTR_DELEG is set, then these attributes are being set on ++ * behalf of the holder of a write delegation. We want to avoid ++ * breaking the delegation in this case. ++ */ ++ if (!(ia_valid & ATTR_DELEG)) { ++ error = try_break_deleg(inode, delegated_inode); ++ if (error) ++ return error; ++ } + + if (inode->i_op->setattr) + error = inode->i_op->setattr(idmap, dentry, attr); +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 02d43f95146ee..07f2496850c4c 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -8815,7 +8815,7 @@ nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, + /** + * nfsd4_deleg_getattr_conflict - Recall if GETATTR causes conflict + * @rqstp: RPC transaction context +- * @inode: file to be checked for a conflict ++ * @dentry: dentry of inode to be checked for a conflict + * @modified: return true if file was modified + * @size: new size of file if modified is true + * +@@ -8830,7 +8830,7 @@ nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, + * code is returned. + */ + __be32 +-nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, ++nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct dentry *dentry, + bool *modified, u64 *size) + { + __be32 status; +@@ -8839,6 +8839,7 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + struct file_lease *fl; + struct iattr attrs; + struct nfs4_cb_fattr *ncf; ++ struct inode *inode = d_inode(dentry); + + *modified = false; + ctx = locks_inode_context(inode); +@@ -8890,15 +8891,22 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + ncf->ncf_cur_fsize != ncf->ncf_cb_fsize)) + ncf->ncf_file_modified = true; + if (ncf->ncf_file_modified) { ++ int err; ++ + /* + * Per section 10.4.3 of RFC 8881, the server would + * not update the file's metadata with the client's + * modified size + */ + attrs.ia_mtime = attrs.ia_ctime = current_time(inode); +- attrs.ia_valid = ATTR_MTIME | ATTR_CTIME; +- setattr_copy(&nop_mnt_idmap, inode, &attrs); +- mark_inode_dirty(inode); ++ attrs.ia_valid = ATTR_MTIME | ATTR_CTIME | ATTR_DELEG; ++ inode_lock(inode); ++ err = notify_change(&nop_mnt_idmap, dentry, &attrs, NULL); ++ inode_unlock(inode); ++ if (err) { ++ nfs4_put_stid(&dp->dl_stid); ++ return nfserrno(err); ++ } + ncf->ncf_cur_fsize = ncf->ncf_cb_fsize; + *size = ncf->ncf_cur_fsize; + *modified = true; +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 8a7bc2b58e721..0869062280ccc 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -3565,7 +3565,7 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, + } + args.size = 0; + if (attrmask[0] & (FATTR4_WORD0_CHANGE | FATTR4_WORD0_SIZE)) { +- status = nfsd4_deleg_getattr_conflict(rqstp, d_inode(dentry), ++ status = nfsd4_deleg_getattr_conflict(rqstp, dentry, + &file_modified, &size); + if (status) + goto out; +diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h +index ffc217099d191..ec4559ecd193b 100644 +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -781,5 +781,5 @@ static inline bool try_to_expire_client(struct nfs4_client *clp) + } + + extern __be32 nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, +- struct inode *inode, bool *file_modified, u64 *size); ++ struct dentry *dentry, bool *file_modified, u64 *size); + #endif /* NFSD4_STATE_H */ +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 36b9e87439221..5f07c1c377df6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -208,6 +208,7 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, + #define ATTR_OPEN (1 << 15) /* Truncating from open(O_TRUNC) */ + #define ATTR_TIMES_SET (1 << 16) + #define ATTR_TOUCH (1 << 17) ++#define ATTR_DELEG (1 << 18) /* Delegated attrs. Don't break write delegations */ + + /* + * Whiteout is represented by a char device. The following constants define the +-- +2.43.0 + diff --git a/queue-6.10/mm-fix-missing-folio-invalidation-calls-during-trunc.patch b/queue-6.10/mm-fix-missing-folio-invalidation-calls-during-trunc.patch new file mode 100644 index 00000000000..dfcd91e2cae --- /dev/null +++ b/queue-6.10/mm-fix-missing-folio-invalidation-calls-during-trunc.patch @@ -0,0 +1,66 @@ +From a7d676f7da1fe58b50e470c67a984caf36b7416b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 21:08:09 +0100 +Subject: mm: Fix missing folio invalidation calls during truncation + +From: David Howells + +[ Upstream commit 0aa2e1b2fb7a75aa4b5b4347055ccfea6f091769 ] + +When AS_RELEASE_ALWAYS is set on a mapping, the ->release_folio() and +->invalidate_folio() calls should be invoked even if PG_private and +PG_private_2 aren't set. This is used by netfslib to keep track of the +point above which reads can be skipped in favour of just zeroing pagecache +locally. + +There are a couple of places in truncation in which invalidation is only +called when folio_has_private() is true. Fix these to check +folio_needs_release() instead. + +Without this, the generic/075 and generic/112 xfstests (both fsx-based +tests) fail with minimum folio size patches applied[1]. + +Fixes: b4fa966f03b7 ("mm, netfs, fscache: stop read optimisation when folio removed from pagecache") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240815090849.972355-1-kernel@pankajraghav.com/ [1] +Link: https://lore.kernel.org/r/20240823200819.532106-2-dhowells@redhat.com +Reviewed-by: Matthew Wilcox (Oracle) +cc: Matthew Wilcox (Oracle) +cc: Pankaj Raghav +cc: Jeff Layton +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: netfs@lists.linux.dev +cc: linux-mm@kvack.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + mm/truncate.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/truncate.c b/mm/truncate.c +index e99085bf3d34d..a2af7f088407f 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -174,7 +174,7 @@ static void truncate_cleanup_folio(struct folio *folio) + if (folio_mapped(folio)) + unmap_mapping_folio(folio); + +- if (folio_has_private(folio)) ++ if (folio_needs_release(folio)) + folio_invalidate(folio, 0, folio_size(folio)); + + /* +@@ -235,7 +235,7 @@ bool truncate_inode_partial_folio(struct folio *folio, loff_t start, loff_t end) + */ + folio_zero_range(folio, offset, length); + +- if (folio_has_private(folio)) ++ if (folio_needs_release(folio)) + folio_invalidate(folio, offset, length); + if (!folio_test_large(folio)) + return true; +-- +2.43.0 + diff --git a/queue-6.10/netfs-fix-interaction-of-streaming-writes-with-zero-.patch b/queue-6.10/netfs-fix-interaction-of-streaming-writes-with-zero-.patch new file mode 100644 index 00000000000..96ed9da5c16 --- /dev/null +++ b/queue-6.10/netfs-fix-interaction-of-streaming-writes-with-zero-.patch @@ -0,0 +1,70 @@ +From 4fa4adae73f68de2b6d02daf30b7c9a39aefa77e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Aug 2024 12:56:53 +0100 +Subject: netfs: Fix interaction of streaming writes with zero-point tracker + +From: David Howells + +[ Upstream commit e00e99ba6c6b8e5239e75cd6684a6827d93c39a2 ] + +When a folio that is marked for streaming write (dirty, but not uptodate, +with partial content specified in the private data) is written back, the +folio is effectively switched to the blank state upon completion of the +write. This means that if we want to read it in future, we need to reread +the whole folio. + +However, if the folio is above the zero_point position, when it is read +back, it will just be cleared and the read skipped, leading to apparent +local corruption. + +Fix this by increasing the zero_point to the end of the dirty data in the +folio when clearing the folio state after writeback. This is analogous to +the folio having ->release_folio() called upon it. + +This was causing the config.log generated by configuring a cpython tree on +a cifs share to get corrupted because the scripts involved were appending +text to the file in small pieces. + +Fixes: 288ace2f57c9 ("netfs: New writeback implementation") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/563286.1724500613@warthog.procyon.org.uk +cc: Steve French +cc: Paulo Alcantara +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/write_collect.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/netfs/write_collect.c b/fs/netfs/write_collect.c +index 488147439fe0f..a2b697b4aa401 100644 +--- a/fs/netfs/write_collect.c ++++ b/fs/netfs/write_collect.c +@@ -33,6 +33,7 @@ + int netfs_folio_written_back(struct folio *folio) + { + enum netfs_folio_trace why = netfs_folio_trace_clear; ++ struct netfs_inode *ictx = netfs_inode(folio->mapping->host); + struct netfs_folio *finfo; + struct netfs_group *group = NULL; + int gcount = 0; +@@ -41,6 +42,12 @@ int netfs_folio_written_back(struct folio *folio) + /* Streaming writes cannot be redirtied whilst under writeback, + * so discard the streaming record. + */ ++ unsigned long long fend; ++ ++ fend = folio_pos(folio) + finfo->dirty_offset + finfo->dirty_len; ++ if (fend > ictx->zero_point) ++ ictx->zero_point = fend; ++ + folio_detach_private(folio); + group = finfo->netfs_group; + gcount++; +-- +2.43.0 + diff --git a/queue-6.10/netfs-fix-missing-iterator-reset-on-retry-of-short-r.patch b/queue-6.10/netfs-fix-missing-iterator-reset-on-retry-of-short-r.patch new file mode 100644 index 00000000000..2217346afe2 --- /dev/null +++ b/queue-6.10/netfs-fix-missing-iterator-reset-on-retry-of-short-r.patch @@ -0,0 +1,42 @@ +From 77681897a29d831ff65d669b665518b0f3a888da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 21:08:13 +0100 +Subject: netfs: Fix missing iterator reset on retry of short read + +From: David Howells + +[ Upstream commit 950b03d0f664a54389a555d79215348ed413161f ] + +Fix netfs_rreq_perform_resubmissions() to reset before retrying a short +read, otherwise the wrong part of the output buffer will be used. + +Fixes: 92b6cc5d1e7c ("netfs: Add iov_iters to (sub)requests to describe various buffers") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240823200819.532106-6-dhowells@redhat.com +cc: Steve French +cc: Paulo Alcantara +cc: Jeff Layton +cc: linux-cifs@vger.kernel.org +cc: netfs@lists.linux.dev +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/netfs/io.c b/fs/netfs/io.c +index f3abc5dfdbc0c..c96431d3da6d8 100644 +--- a/fs/netfs/io.c ++++ b/fs/netfs/io.c +@@ -313,6 +313,7 @@ static bool netfs_rreq_perform_resubmissions(struct netfs_io_request *rreq) + netfs_reset_subreq_iter(rreq, subreq); + netfs_read_from_server(rreq, subreq); + } else if (test_bit(NETFS_SREQ_SHORT_IO, &subreq->flags)) { ++ netfs_reset_subreq_iter(rreq, subreq); + netfs_rreq_short_read(rreq, subreq); + } + } +-- +2.43.0 + diff --git a/queue-6.10/netfs-fix-netfs_release_folio-to-say-no-if-folio-dir.patch b/queue-6.10/netfs-fix-netfs_release_folio-to-say-no-if-folio-dir.patch new file mode 100644 index 00000000000..4effcb6334a --- /dev/null +++ b/queue-6.10/netfs-fix-netfs_release_folio-to-say-no-if-folio-dir.patch @@ -0,0 +1,52 @@ +From 2733849992b8c3aa2eba07eee1ab3a43d794ad4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 21:08:11 +0100 +Subject: netfs: Fix netfs_release_folio() to say no if folio dirty + +From: David Howells + +[ Upstream commit 7dfc8f0c6144c290dbeb01835a67e81b34dda8cd ] + +Fix netfs_release_folio() to say no (ie. return false) if the folio is +dirty (analogous with iomap's behaviour). Without this, it will say yes to +the release of a dirty page by split_huge_page_to_list_to_order(), which +will result in the loss of untruncated data in the folio. + +Without this, the generic/075 and generic/112 xfstests (both fsx-based +tests) fail with minimum folio size patches applied[1]. + +Fixes: c1ec4d7c2e13 ("netfs: Provide invalidate_folio and release_folio calls") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240815090849.972355-1-kernel@pankajraghav.com/ [1] +Link: https://lore.kernel.org/r/20240823200819.532106-4-dhowells@redhat.com +cc: Matthew Wilcox (Oracle) +cc: Pankaj Raghav +cc: Jeff Layton +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: netfs@lists.linux.dev +cc: linux-mm@kvack.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/misc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c +index 607a1972f4563..21acf4b092a46 100644 +--- a/fs/netfs/misc.c ++++ b/fs/netfs/misc.c +@@ -161,6 +161,9 @@ bool netfs_release_folio(struct folio *folio, gfp_t gfp) + struct netfs_inode *ctx = netfs_inode(folio_inode(folio)); + unsigned long long end; + ++ if (folio_test_dirty(folio)) ++ return false; ++ + end = folio_pos(folio) + folio_size(folio); + if (end > ctx->zero_point) + ctx->zero_point = end; +-- +2.43.0 + diff --git a/queue-6.10/netfs-fix-trimming-of-streaming-write-folios-in-netf.patch b/queue-6.10/netfs-fix-trimming-of-streaming-write-folios-in-netf.patch new file mode 100644 index 00000000000..8a354b58b96 --- /dev/null +++ b/queue-6.10/netfs-fix-trimming-of-streaming-write-folios-in-netf.patch @@ -0,0 +1,135 @@ +From 74e5aa03f1e98a0daeff4dece1f2b6a8a4d3bd45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 21:08:12 +0100 +Subject: netfs: Fix trimming of streaming-write folios in netfs_inval_folio() + +From: David Howells + +[ Upstream commit cce6bfa6ca0e30af9927b0074c97fe6a92f28092 ] + +When netfslib writes to a folio that it doesn't have data for, but that +data exists on the server, it will make a 'streaming write' whereby it +stores data in a folio that is marked dirty, but not uptodate. When it +does this, it attaches a record to folio->private to track the dirty +region. + +When truncate() or fallocate() wants to invalidate part of such a folio, it +will call into ->invalidate_folio(), specifying the part of the folio that +is to be invalidated. netfs_invalidate_folio(), on behalf of the +filesystem, must then determine how to trim the streaming write record. In +a couple of cases, however, it does this incorrectly (the reduce-length and +move-start cases are switched over and don't, in any case, calculate the +value correctly). + +Fix this by making the logic tree more obvious and fixing the cases. + +Fixes: 9ebff83e6481 ("netfs: Prep to use folio->private for write grouping and streaming write") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20240823200819.532106-5-dhowells@redhat.com +cc: Matthew Wilcox (Oracle) +cc: Pankaj Raghav +cc: Jeff Layton +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: netfs@lists.linux.dev +cc: linux-mm@kvack.org +cc: linux-fsdevel@vger.kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/netfs/misc.c | 50 ++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 35 insertions(+), 15 deletions(-) + +diff --git a/fs/netfs/misc.c b/fs/netfs/misc.c +index 21acf4b092a46..a46bf569303fc 100644 +--- a/fs/netfs/misc.c ++++ b/fs/netfs/misc.c +@@ -97,10 +97,20 @@ EXPORT_SYMBOL(netfs_clear_inode_writeback); + void netfs_invalidate_folio(struct folio *folio, size_t offset, size_t length) + { + struct netfs_folio *finfo; ++ struct netfs_inode *ctx = netfs_inode(folio_inode(folio)); + size_t flen = folio_size(folio); + + kenter("{%lx},%zx,%zx", folio->index, offset, length); + ++ if (offset == 0 && length == flen) { ++ unsigned long long i_size = i_size_read(&ctx->inode); ++ unsigned long long fpos = folio_pos(folio), end; ++ ++ end = umin(fpos + flen, i_size); ++ if (fpos < i_size && end > ctx->zero_point) ++ ctx->zero_point = end; ++ } ++ + folio_wait_private_2(folio); /* [DEPRECATED] */ + + if (!folio_test_private(folio)) +@@ -115,18 +125,34 @@ void netfs_invalidate_folio(struct folio *folio, size_t offset, size_t length) + /* We have a partially uptodate page from a streaming write. */ + unsigned int fstart = finfo->dirty_offset; + unsigned int fend = fstart + finfo->dirty_len; +- unsigned int end = offset + length; ++ unsigned int iend = offset + length; + + if (offset >= fend) + return; +- if (end <= fstart) ++ if (iend <= fstart) ++ return; ++ ++ /* The invalidation region overlaps the data. If the region ++ * covers the start of the data, we either move along the start ++ * or just erase the data entirely. ++ */ ++ if (offset <= fstart) { ++ if (iend >= fend) ++ goto erase_completely; ++ /* Move the start of the data. */ ++ finfo->dirty_len = fend - iend; ++ finfo->dirty_offset = offset; ++ return; ++ } ++ ++ /* Reduce the length of the data if the invalidation region ++ * covers the tail part. ++ */ ++ if (iend >= fend) { ++ finfo->dirty_len = offset - fstart; + return; +- if (offset <= fstart && end >= fend) +- goto erase_completely; +- if (offset <= fstart && end > fstart) +- goto reduce_len; +- if (offset > fstart && end >= fend) +- goto move_start; ++ } ++ + /* A partial write was split. The caller has already zeroed + * it, so just absorb the hole. + */ +@@ -139,12 +165,6 @@ void netfs_invalidate_folio(struct folio *folio, size_t offset, size_t length) + folio_clear_uptodate(folio); + kfree(finfo); + return; +-reduce_len: +- finfo->dirty_len = offset + length - finfo->dirty_offset; +- return; +-move_start: +- finfo->dirty_len -= offset - finfo->dirty_offset; +- finfo->dirty_offset = offset; + } + EXPORT_SYMBOL(netfs_invalidate_folio); + +@@ -164,7 +184,7 @@ bool netfs_release_folio(struct folio *folio, gfp_t gfp) + if (folio_test_dirty(folio)) + return false; + +- end = folio_pos(folio) + folio_size(folio); ++ end = umin(folio_pos(folio) + folio_size(folio), i_size_read(&ctx->inode)); + if (end > ctx->zero_point) + ctx->zero_point = end; + +-- +2.43.0 + diff --git a/queue-6.10/nfsd-ensure-that-nfsd4_fattr_args.context-is-zeroed-.patch b/queue-6.10/nfsd-ensure-that-nfsd4_fattr_args.context-is-zeroed-.patch new file mode 100644 index 00000000000..11b290f7e9b --- /dev/null +++ b/queue-6.10/nfsd-ensure-that-nfsd4_fattr_args.context-is-zeroed-.patch @@ -0,0 +1,47 @@ +From b71f66c0a6fbe9bf9d65131fda5e5c26282e476a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 14:47:01 -0400 +Subject: nfsd: ensure that nfsd4_fattr_args.context is zeroed out + +From: Jeff Layton + +[ Upstream commit f58bab6fd4063913bd8321e99874b8239e9ba726 ] + +If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to +checking for the security label, then args.context will be set to +uninitialized junk on the stack, which we'll then try to free. +Initialize it early. + +Fixes: f59388a579c6 ("NFSD: Add nfsd4_encode_fattr4_sec_label()") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4xdr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index c7bfd2180e3f2..8a7bc2b58e721 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -3545,6 +3545,9 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, + args.dentry = dentry; + args.ignore_crossmnt = (ignore_crossmnt != 0); + args.acl = NULL; ++#ifdef CONFIG_NFSD_V4_SECURITY_LABEL ++ args.context = NULL; ++#endif + + /* + * Make a local copy of the attribute bitmap that can be modified. +@@ -3617,7 +3620,6 @@ nfsd4_encode_fattr4(struct svc_rqst *rqstp, struct xdr_stream *xdr, + args.contextsupport = false; + + #ifdef CONFIG_NFSD_V4_SECURITY_LABEL +- args.context = NULL; + if ((attrmask[2] & FATTR4_WORD2_SECURITY_LABEL) || + attrmask[0] & FATTR4_WORD0_SUPPORTED_ATTRS) { + if (exp->ex_flags & NFSEXP_SECURITY_LABEL) +-- +2.43.0 + diff --git a/queue-6.10/nfsd-fix-potential-uaf-in-nfsd4_cb_getattr_release.patch b/queue-6.10/nfsd-fix-potential-uaf-in-nfsd4_cb_getattr_release.patch new file mode 100644 index 00000000000..9ccf8ff43b5 --- /dev/null +++ b/queue-6.10/nfsd-fix-potential-uaf-in-nfsd4_cb_getattr_release.patch @@ -0,0 +1,38 @@ +From 8b0fddc6c3b24f311712855fcbe263f3e3f526de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 18:27:39 -0400 +Subject: nfsd: fix potential UAF in nfsd4_cb_getattr_release + +From: Jeff Layton + +[ Upstream commit 1116e0e372eb16dd907ec571ce5d4af325c55c10 ] + +Once we drop the delegation reference, the fields embedded in it are no +longer safe to access. Do that last. + +Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 19d39872be325..02d43f95146ee 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3078,9 +3078,9 @@ nfsd4_cb_getattr_release(struct nfsd4_callback *cb) + struct nfs4_delegation *dp = + container_of(ncf, struct nfs4_delegation, dl_cb_fattr); + +- nfs4_put_stid(&dp->dl_stid); + clear_bit(CB_GETATTR_BUSY, &ncf->ncf_cb_flags); + wake_up_bit(&ncf->ncf_cb_flags, CB_GETATTR_BUSY); ++ nfs4_put_stid(&dp->dl_stid); + } + + static const struct nfsd4_callback_ops nfsd4_cb_recall_any_ops = { +-- +2.43.0 + diff --git a/queue-6.10/nfsd-hold-reference-to-delegation-when-updating-it-f.patch b/queue-6.10/nfsd-hold-reference-to-delegation-when-updating-it-f.patch new file mode 100644 index 00000000000..4eee9a47a60 --- /dev/null +++ b/queue-6.10/nfsd-hold-reference-to-delegation-when-updating-it-f.patch @@ -0,0 +1,75 @@ +From d5cef521ff861c969186dc5752519d49576691f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 18:27:38 -0400 +Subject: nfsd: hold reference to delegation when updating it for cb_getattr + +From: Jeff Layton + +[ Upstream commit da05ba23d4c8d3e8a45846b952e53dd76c4b5e36 ] + +Once we've dropped the flc_lock, there is nothing that ensures that the +delegation that was found will still be around later. Take a reference +to it while holding the lock and then drop it when we've finished with +the delegation. + +Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index dafff707e23a4..19d39872be325 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -8837,7 +8837,6 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); + struct file_lock_context *ctx; + struct file_lease *fl; +- struct nfs4_delegation *dp; + struct iattr attrs; + struct nfs4_cb_fattr *ncf; + +@@ -8862,7 +8861,8 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + goto break_lease; + } + if (type == F_WRLCK) { +- dp = fl->c.flc_owner; ++ struct nfs4_delegation *dp = fl->c.flc_owner; ++ + if (dp->dl_recall.cb_clp == *(rqstp->rq_lease_breaker)) { + spin_unlock(&ctx->flc_lock); + return 0; +@@ -8870,6 +8870,7 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + break_lease: + nfsd_stats_wdeleg_getattr_inc(nn); + dp = fl->c.flc_owner; ++ refcount_inc(&dp->dl_stid.sc_count); + ncf = &dp->dl_cb_fattr; + nfs4_cb_getattr(&dp->dl_cb_fattr); + spin_unlock(&ctx->flc_lock); +@@ -8879,8 +8880,10 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + /* Recall delegation only if client didn't respond */ + status = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ)); + if (status != nfserr_jukebox || +- !nfsd_wait_for_delegreturn(rqstp, inode)) ++ !nfsd_wait_for_delegreturn(rqstp, inode)) { ++ nfs4_put_stid(&dp->dl_stid); + return status; ++ } + } + if (!ncf->ncf_file_modified && + (ncf->ncf_initial_cinfo != ncf->ncf_cb_change || +@@ -8900,6 +8903,7 @@ nfsd4_deleg_getattr_conflict(struct svc_rqst *rqstp, struct inode *inode, + *size = ncf->ncf_cur_fsize; + *modified = true; + } ++ nfs4_put_stid(&dp->dl_stid); + return 0; + } + break; +-- +2.43.0 + diff --git a/queue-6.10/nfsd-prevent-panic-for-nfsv4.0-closed-files-in-nfs4_.patch b/queue-6.10/nfsd-prevent-panic-for-nfsv4.0-closed-files-in-nfs4_.patch new file mode 100644 index 00000000000..d813edce64f --- /dev/null +++ b/queue-6.10/nfsd-prevent-panic-for-nfsv4.0-closed-files-in-nfs4_.patch @@ -0,0 +1,77 @@ +From 1890e33a315f1f3ed0a3e4591822dfc6f05d7816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Aug 2024 11:51:08 -0400 +Subject: nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open + +From: Olga Kornievskaia + +[ Upstream commit a204501e1743d695ca2930ed25a2be9f8ced96d3 ] + +Prior to commit 3f29cc82a84c ("nfsd: split sc_status out of +sc_type") states_show() relied on sc_type field to be of valid +type before calling into a subfunction to show content of a +particular stateid. From that commit, we split the validity of +the stateid into sc_status and no longer changed sc_type to 0 +while unhashing the stateid. This resulted in kernel oopsing +for nfsv4.0 opens that stay around and in nfs4_show_open() +would derefence sc_file which was NULL. + +Instead, for closed open stateids forgo displaying information +that relies of having a valid sc_file. + +To reproduce: mount the server with 4.0, read and close +a file and then on the server cat /proc/fs/nfsd/clients/2/states + +[ 513.590804] Call trace: +[ 513.590925] _raw_spin_lock+0xcc/0x160 +[ 513.591119] nfs4_show_open+0x78/0x2c0 [nfsd] +[ 513.591412] states_show+0x44c/0x488 [nfsd] +[ 513.591681] seq_read_iter+0x5d8/0x760 +[ 513.591896] seq_read+0x188/0x208 +[ 513.592075] vfs_read+0x148/0x470 +[ 513.592241] ksys_read+0xcc/0x178 + +Fixes: 3f29cc82a84c ("nfsd: split sc_status out of sc_type") +Signed-off-by: Olga Kornievskaia +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index a20c2c9d7d457..dafff707e23a4 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -2789,15 +2789,18 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st) + deny & NFS4_SHARE_ACCESS_READ ? "r" : "-", + deny & NFS4_SHARE_ACCESS_WRITE ? "w" : "-"); + +- spin_lock(&nf->fi_lock); +- file = find_any_file_locked(nf); +- if (file) { +- nfs4_show_superblock(s, file); +- seq_puts(s, ", "); +- nfs4_show_fname(s, file); +- seq_puts(s, ", "); +- } +- spin_unlock(&nf->fi_lock); ++ if (nf) { ++ spin_lock(&nf->fi_lock); ++ file = find_any_file_locked(nf); ++ if (file) { ++ nfs4_show_superblock(s, file); ++ seq_puts(s, ", "); ++ nfs4_show_fname(s, file); ++ seq_puts(s, ", "); ++ } ++ spin_unlock(&nf->fi_lock); ++ } else ++ seq_puts(s, "closed, "); + nfs4_show_owner(s, oo); + if (st->sc_status & SC_STATUS_ADMIN_REVOKED) + seq_puts(s, ", admin-revoked"); +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch b/queue-6.10/pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch new file mode 100644 index 00000000000..c6bd18c8cc6 --- /dev/null +++ b/queue-6.10/pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch @@ -0,0 +1,184 @@ +From cbd75ab8ccb7795edbaa4c09613fec975f4bbf5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 19:27:09 -0400 +Subject: pinctrl: mediatek: common-v2: Fix broken bias-disable for + PULL_PU_PD_RSEL_TYPE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 166bf8af91225576f85208a31eaedbadd182d1ea ] + +Despite its name, commit fed74d75277d ("pinctrl: mediatek: common-v2: +Fix bias-disable for PULL_PU_PD_RSEL_TYPE") actually broke bias-disable +for PULL_PU_PD_RSEL_TYPE. + +mtk_pinconf_bias_set_combo() tries every bias method supported by the +pin until one succeeds. For PULL_PU_PD_RSEL_TYPE pins, before the +breaking commit, mtk_pinconf_bias_set_rsel() would be called first to +try and set the RSEL value (as well as PU and PD), and if that failed, +the only other valid option was that bias-disable was specified, which +would then be handled by calling mtk_pinconf_bias_set_pu_pd() and +disabling both PU and PD. + +The breaking commit misunderstood this logic and added an early "return +0" in mtk_pinconf_bias_set_rsel(). The result was that in the +bias-disable case, the bias was left unchanged, since by returning +success, mtk_pinconf_bias_set_combo() no longer tried calling +mtk_pinconf_bias_set_pu_pd() to disable the bias. + +Since the logic for configuring bias-disable on PULL_PU_PD_RSEL_TYPE +pins required mtk_pinconf_bias_set_rsel() to fail first, in that case, +an error was printed to the log, eg: + + mt8195-pinctrl 10005000.pinctrl: Not support rsel value 0 Ohm for pin = 29 (GPIO29) + +This is what the breaking commit actually got rid of, and likely part of +the reason why that commit was thought to be fixing functionality, while +in reality it was breaking it. + +Instead of simply reverting that commit, restore the functionality but +in a way that avoids the error from being printed and makes the code +less confusing: +* Return 0 explicitly if a bias method was successful +* Introduce an extra function mtk_pinconf_bias_set_pu_pd_rsel() that + calls both mtk_pinconf_bias_set_rsel() (only if needed) and + mtk_pinconf_bias_set_pu_pd() + * And analogously for the corresponding getters + +Fixes: fed74d75277d ("pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/20240808-mtk-rsel-bias-disable-fix-v1-1-1b4e85bf596c@collabora.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + .../pinctrl/mediatek/pinctrl-mtk-common-v2.c | 55 ++++++++++--------- + 1 file changed, 29 insertions(+), 26 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +index b7921b59eb7b1..54301fbba524a 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +@@ -709,32 +709,35 @@ static int mtk_pinconf_bias_set_rsel(struct mtk_pinctrl *hw, + { + int err, rsel_val; + +- if (!pullup && arg == MTK_DISABLE) +- return 0; +- + if (hw->rsel_si_unit) { + /* find pin rsel_index from pin_rsel array*/ + err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val); + if (err) +- goto out; ++ return err; + } else { +- if (arg < MTK_PULL_SET_RSEL_000 || +- arg > MTK_PULL_SET_RSEL_111) { +- err = -EINVAL; +- goto out; +- } ++ if (arg < MTK_PULL_SET_RSEL_000 || arg > MTK_PULL_SET_RSEL_111) ++ return -EINVAL; + + rsel_val = arg - MTK_PULL_SET_RSEL_000; + } + +- err = mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val); +- if (err) +- goto out; ++ return mtk_hw_set_value(hw, desc, PINCTRL_PIN_REG_RSEL, rsel_val); ++} + +- err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, MTK_ENABLE); ++static int mtk_pinconf_bias_set_pu_pd_rsel(struct mtk_pinctrl *hw, ++ const struct mtk_pin_desc *desc, ++ u32 pullup, u32 arg) ++{ ++ u32 enable = arg == MTK_DISABLE ? MTK_DISABLE : MTK_ENABLE; ++ int err; + +-out: +- return err; ++ if (arg != MTK_DISABLE) { ++ err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg); ++ if (err) ++ return err; ++ } ++ ++ return mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, enable); + } + + int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw, +@@ -750,22 +753,22 @@ int mtk_pinconf_bias_set_combo(struct mtk_pinctrl *hw, + try_all_type = MTK_PULL_TYPE_MASK; + + if (try_all_type & MTK_PULL_RSEL_TYPE) { +- err = mtk_pinconf_bias_set_rsel(hw, desc, pullup, arg); ++ err = mtk_pinconf_bias_set_pu_pd_rsel(hw, desc, pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PU_PD_TYPE) { + err = mtk_pinconf_bias_set_pu_pd(hw, desc, pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PULLSEL_TYPE) { + err = mtk_pinconf_bias_set_pullsel_pullen(hw, desc, + pullup, arg); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE) +@@ -803,9 +806,9 @@ static int mtk_rsel_get_si_unit(struct mtk_pinctrl *hw, + return 0; + } + +-static int mtk_pinconf_bias_get_rsel(struct mtk_pinctrl *hw, +- const struct mtk_pin_desc *desc, +- u32 *pullup, u32 *enable) ++static int mtk_pinconf_bias_get_pu_pd_rsel(struct mtk_pinctrl *hw, ++ const struct mtk_pin_desc *desc, ++ u32 *pullup, u32 *enable) + { + int pu, pd, rsel, err; + +@@ -939,22 +942,22 @@ int mtk_pinconf_bias_get_combo(struct mtk_pinctrl *hw, + try_all_type = MTK_PULL_TYPE_MASK; + + if (try_all_type & MTK_PULL_RSEL_TYPE) { +- err = mtk_pinconf_bias_get_rsel(hw, desc, pullup, enable); ++ err = mtk_pinconf_bias_get_pu_pd_rsel(hw, desc, pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PU_PD_TYPE) { + err = mtk_pinconf_bias_get_pu_pd(hw, desc, pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PULLSEL_TYPE) { + err = mtk_pinconf_bias_get_pullsel_pullen(hw, desc, + pullup, enable); + if (!err) +- return err; ++ return 0; + } + + if (try_all_type & MTK_PULL_PUPD_R1R0_TYPE) +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-qcom-x1e80100-fix-special-pin-offsets.patch b/queue-6.10/pinctrl-qcom-x1e80100-fix-special-pin-offsets.patch new file mode 100644 index 00000000000..523a6101555 --- /dev/null +++ b/queue-6.10/pinctrl-qcom-x1e80100-fix-special-pin-offsets.patch @@ -0,0 +1,46 @@ +From a667d1c907b920b7ba592d6561446f96ae282b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 02:22:04 +0200 +Subject: pinctrl: qcom: x1e80100: Fix special pin offsets + +From: Konrad Dybcio + +[ Upstream commit d3692d95cc4d88114b070ee63cffc976f00f207f ] + +Remove the erroneus 0x100000 offset to prevent the boards from crashing +on pin state setting, as well as for the intended state changes to take +effect. + +Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Abel Vesa +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/20240809-topic-h_sdc-v1-1-bb421532c531@quicinc.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-x1e80100.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-x1e80100.c b/drivers/pinctrl/qcom/pinctrl-x1e80100.c +index 6cd4d10e6fd6f..65ed933f05ce1 100644 +--- a/drivers/pinctrl/qcom/pinctrl-x1e80100.c ++++ b/drivers/pinctrl/qcom/pinctrl-x1e80100.c +@@ -1805,10 +1805,10 @@ static const struct msm_pingroup x1e80100_groups[] = { + [235] = PINGROUP(235, aon_cci, qdss_gpio, _, _, _, _, _, _, _), + [236] = PINGROUP(236, aon_cci, qdss_gpio, _, _, _, _, _, _, _), + [237] = PINGROUP(237, _, _, _, _, _, _, _, _, _), +- [238] = UFS_RESET(ufs_reset, 0x1f9000), +- [239] = SDC_QDSD_PINGROUP(sdc2_clk, 0x1f2000, 14, 6), +- [240] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x1f2000, 11, 3), +- [241] = SDC_QDSD_PINGROUP(sdc2_data, 0x1f2000, 9, 0), ++ [238] = UFS_RESET(ufs_reset, 0xf9000), ++ [239] = SDC_QDSD_PINGROUP(sdc2_clk, 0xf2000, 14, 6), ++ [240] = SDC_QDSD_PINGROUP(sdc2_cmd, 0xf2000, 11, 3), ++ [241] = SDC_QDSD_PINGROUP(sdc2_data, 0xf2000, 9, 0), + }; + + static const struct msm_gpio_wakeirq_map x1e80100_pdc_map[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-qcom-x1e80100-update-pdc-hwirq-map.patch b/queue-6.10/pinctrl-qcom-x1e80100-update-pdc-hwirq-map.patch new file mode 100644 index 00000000000..4bc17f6a6bf --- /dev/null +++ b/queue-6.10/pinctrl-qcom-x1e80100-update-pdc-hwirq-map.patch @@ -0,0 +1,69 @@ +From 07eeeb75a8d0bbcb0bebbf702d7178f051cbe63e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 11:37:57 +0200 +Subject: pinctrl: qcom: x1e80100: Update PDC hwirq map + +From: Konrad Dybcio + +[ Upstream commit b7fd10333713e9984cc9b9c04f3681f80efdc809 ] + +The current map seems to be out of sync (and includes a duplicate entry +for GPIO193..). + +Replace it with the map present in shipping devices' ACPI tables. + +This new one seems more complete, as it e.g. contains GPIO145 (PCIE6a +WAKE#) + +Fixes: 05e4941d97ef ("pinctrl: qcom: Add X1E80100 pinctrl driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Abel Vesa +Reviewed-by: Rajendra Nayak +Link: https://lore.kernel.org/20240711-topic-x1e_pdc_tlmm-v1-1-e278b249d793@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-x1e80100.c | 27 ++++++++++++++----------- + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-x1e80100.c b/drivers/pinctrl/qcom/pinctrl-x1e80100.c +index e30e938403574..6cd4d10e6fd6f 100644 +--- a/drivers/pinctrl/qcom/pinctrl-x1e80100.c ++++ b/drivers/pinctrl/qcom/pinctrl-x1e80100.c +@@ -1813,18 +1813,21 @@ static const struct msm_pingroup x1e80100_groups[] = { + + static const struct msm_gpio_wakeirq_map x1e80100_pdc_map[] = { + { 0, 72 }, { 2, 70 }, { 3, 71 }, { 6, 123 }, { 7, 67 }, { 11, 85 }, +- { 15, 68 }, { 18, 122 }, { 19, 69 }, { 21, 158 }, { 23, 143 }, { 26, 129 }, +- { 27, 144 }, { 28, 77 }, { 29, 78 }, { 30, 92 }, { 32, 145 }, { 33, 115 }, +- { 34, 130 }, { 35, 146 }, { 36, 147 }, { 39, 80 }, { 43, 148 }, { 47, 149 }, +- { 51, 79 }, { 53, 89 }, { 59, 87 }, { 64, 90 }, { 65, 106 }, { 66, 142 }, +- { 67, 88 }, { 71, 91 }, { 75, 152 }, { 79, 153 }, { 80, 125 }, { 81, 128 }, +- { 84, 137 }, { 85, 155 }, { 87, 156 }, { 91, 157 }, { 92, 138 }, { 94, 140 }, +- { 95, 141 }, { 113, 84 }, { 121, 73 }, { 123, 74 }, { 129, 76 }, { 131, 82 }, +- { 134, 83 }, { 141, 93 }, { 144, 94 }, { 147, 96 }, { 148, 97 }, { 150, 102 }, +- { 151, 103 }, { 153, 104 }, { 156, 105 }, { 157, 107 }, { 163, 98 }, { 166, 112 }, +- { 172, 99 }, { 181, 101 }, { 184, 116 }, { 193, 40 }, { 193, 117 }, { 196, 108 }, +- { 203, 133 }, { 212, 120 }, { 213, 150 }, { 214, 121 }, { 215, 118 }, { 217, 109 }, +- { 220, 110 }, { 221, 111 }, { 222, 124 }, { 224, 131 }, { 225, 132 }, ++ { 13, 86 }, { 15, 68 }, { 18, 122 }, { 19, 69 }, { 21, 158 }, { 23, 143 }, ++ { 24, 126 }, { 26, 129 }, { 27, 144 }, { 28, 77 }, { 29, 78 }, { 30, 92 }, ++ { 31, 159 }, { 32, 145 }, { 33, 115 }, { 34, 130 }, { 35, 146 }, { 36, 147 }, ++ { 38, 113 }, { 39, 80 }, { 43, 148 }, { 47, 149 }, { 51, 79 }, { 53, 89 }, ++ { 55, 81 }, { 59, 87 }, { 64, 90 }, { 65, 106 }, { 66, 142 }, { 67, 88 }, ++ { 68, 151 }, { 71, 91 }, { 75, 152 }, { 79, 153 }, { 80, 125 }, { 81, 128 }, ++ { 83, 154 }, { 84, 137 }, { 85, 155 }, { 87, 156 }, { 91, 157 }, { 92, 138 }, ++ { 93, 139 }, { 94, 140 }, { 95, 141 }, { 113, 84 }, { 121, 73 }, { 123, 74 }, ++ { 125, 75 }, { 129, 76 }, { 131, 82 }, { 134, 83 }, { 141, 93 }, { 144, 94 }, ++ { 145, 95 }, { 147, 96 }, { 148, 97 }, { 150, 102 }, { 151, 103 }, { 153, 104 }, ++ { 154, 100 }, { 156, 105 }, { 157, 107 }, { 163, 98 }, { 166, 112 }, { 172, 99 }, ++ { 175, 114 }, { 181, 101 }, { 184, 116 }, { 193, 117 }, { 196, 108 }, { 203, 133 }, ++ { 208, 134 }, { 212, 120 }, { 213, 150 }, { 214, 121 }, { 215, 118 }, { 217, 109 }, ++ { 219, 119 }, { 220, 110 }, { 221, 111 }, { 222, 124 }, { 224, 131 }, { 225, 132 }, ++ { 228, 135 }, { 230, 136 }, { 232, 162 }, + }; + + static const struct msm_pinctrl_soc_data x1e80100_pinctrl = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-starfive-jh7110-correct-the-level-trigger-co.patch b/queue-6.10/pinctrl-starfive-jh7110-correct-the-level-trigger-co.patch new file mode 100644 index 00000000000..c3f9dfb9668 --- /dev/null +++ b/queue-6.10/pinctrl-starfive-jh7110-correct-the-level-trigger-co.patch @@ -0,0 +1,43 @@ +From 9b5e5bfbd3d5f8c29c293e535237b9e996d6c785 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 15:01:08 +0800 +Subject: pinctrl: starfive: jh7110: Correct the level trigger configuration of + iev register + +From: Hal Feng + +[ Upstream commit 639766ca10d1e218e257ae7eabe76814bae6ab89 ] + +A mistake was made in level trigger register configuration. Correct it. + +Fixes: 447976ab62c5 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver") +Signed-off-by: Hal Feng +Link: https://lore.kernel.org/20240812070108.100923-1-hal.feng@starfivetech.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +index 9609eb1ecc3d8..7637de7452b91 100644 +--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c ++++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c +@@ -795,12 +795,12 @@ static int jh7110_irq_set_type(struct irq_data *d, unsigned int trigger) + case IRQ_TYPE_LEVEL_HIGH: + irq_type = 0; /* 0: level triggered */ + edge_both = 0; /* 0: ignored */ +- polarity = mask; /* 1: high level */ ++ polarity = 0; /* 0: high level */ + break; + case IRQ_TYPE_LEVEL_LOW: + irq_type = 0; /* 0: level triggered */ + edge_both = 0; /* 0: ignored */ +- polarity = 0; /* 0: low level */ ++ polarity = mask; /* 1: low level */ + break; + default: + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series index 030b22dc5f1..2f6d5204755 100644 --- a/queue-6.10/series +++ b/queue-6.10/series @@ -41,3 +41,35 @@ drm-vmwgfx-prevent-unmapping-active-read-buffers.patch drm-vmwgfx-fix-prime-with-external-buffers.patch drm-vmwgfx-disable-coherent-dumb-buffers-without-3d.patch video-aperture-optionally-match-the-device-in-sysfb_disable.patch +drm-xe-prepare-display-for-d3cold.patch +drm-xe-display-make-display-suspend-resume-work-on-d.patch +drm-xe-vm-simplify-if-condition.patch +drm-xe-exec_queue-rename-xe_exec_queue-compute-to-xe.patch +drm-xe-prevent-uaf-around-preempt-fence.patch +drm-amdgpu-do-not-wait-for-mp0_c2pmsg_33-ifwi-init-i.patch +drm-amdgpu-fix-egpu-hotplug-regression.patch +pinctrl-qcom-x1e80100-update-pdc-hwirq-map.patch +asoc-sof-amd-move-iram-dram-fence-register-programmi.patch +asoc-sof-amd-fix-for-incorrect-acp-error-register-of.patch +asoc-amd-acp-fix-module-autoloading.patch +asoc-sof-amd-fix-for-acp-init-sequence.patch +alsa-hda-cs35l56-don-t-use-the-device-index-as-a-cal.patch +asoc-cs-amp-lib-test-force-test-calibration-blob-ent.patch +asoc-cs-amp-lib-ignore-empty-uefi-calibration-entrie.patch +nfsd-ensure-that-nfsd4_fattr_args.context-is-zeroed-.patch +backing-file-convert-to-using-fops-splice_write.patch +pinctrl-mediatek-common-v2-fix-broken-bias-disable-f.patch +pinctrl-qcom-x1e80100-fix-special-pin-offsets.patch +pinctrl-starfive-jh7110-correct-the-level-trigger-co.patch +nfsd-prevent-panic-for-nfsv4.0-closed-files-in-nfs4_.patch +mm-fix-missing-folio-invalidation-calls-during-trunc.patch +afs-fix-post-setattr-file-edit-to-do-truncation-corr.patch +netfs-fix-netfs_release_folio-to-say-no-if-folio-dir.patch +netfs-fix-trimming-of-streaming-write-folios-in-netf.patch +netfs-fix-missing-iterator-reset-on-retry-of-short-r.patch +netfs-fix-interaction-of-streaming-writes-with-zero-.patch +smb-client-remove-unused-rq_iter_size-from-struct-sm.patch +cifs-fix-falloc_fl_punch_hole-support.patch +nfsd-hold-reference-to-delegation-when-updating-it-f.patch +nfsd-fix-potential-uaf-in-nfsd4_cb_getattr_release.patch +fs-nfsd-fix-update-of-inode-attrs-in-cb_getattr.patch diff --git a/queue-6.10/smb-client-remove-unused-rq_iter_size-from-struct-sm.patch b/queue-6.10/smb-client-remove-unused-rq_iter_size-from-struct-sm.patch new file mode 100644 index 00000000000..f109ff36ce6 --- /dev/null +++ b/queue-6.10/smb-client-remove-unused-rq_iter_size-from-struct-sm.patch @@ -0,0 +1,88 @@ +From 2ee937ce04a0b708d6ed88892adb0c4873511b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 15:59:12 +0200 +Subject: smb/client: remove unused rq_iter_size from struct smb_rqst + +From: Stefan Metzmacher + +[ Upstream commit b608e2c318789aeba49055747166e13bee57df4a ] + +Reviewed-by: David Howells +Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 1 - + fs/smb/client/cifssmb.c | 1 - + fs/smb/client/smb2ops.c | 2 -- + fs/smb/client/smb2pdu.c | 2 -- + 4 files changed, 6 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index 0a271b9fbc622..1e4da268de3b4 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -254,7 +254,6 @@ struct cifs_open_info_data { + struct smb_rqst { + struct kvec *rq_iov; /* array of kvecs */ + unsigned int rq_nvec; /* number of kvecs in array */ +- size_t rq_iter_size; /* Amount of data in ->rq_iter */ + struct iov_iter rq_iter; /* Data iterator */ + struct xarray rq_buffer; /* Page buffer for encryption */ + }; +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index 595c4b673707e..6dce70f172082 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -1713,7 +1713,6 @@ cifs_async_writev(struct cifs_io_subrequest *wdata) + rqst.rq_iov = iov; + rqst.rq_nvec = 2; + rqst.rq_iter = wdata->subreq.io_iter; +- rqst.rq_iter_size = iov_iter_count(&wdata->subreq.io_iter); + + cifs_dbg(FYI, "async write at %llu %zu bytes\n", + wdata->subreq.start, wdata->subreq.len); +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 7fe59235f0901..cfbca3489ece1 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4428,7 +4428,6 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, + } + iov_iter_xarray(&new->rq_iter, ITER_SOURCE, + buffer, 0, size); +- new->rq_iter_size = size; + } + } + +@@ -4474,7 +4473,6 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, + rqst.rq_nvec = 2; + if (iter) { + rqst.rq_iter = *iter; +- rqst.rq_iter_size = iov_iter_count(iter); + iter_size = iov_iter_count(iter); + } + +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 52b95f33db57d..d262e70100c9c 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -4517,7 +4517,6 @@ smb2_readv_callback(struct mid_q_entry *mid) + + if (rdata->got_bytes) { + rqst.rq_iter = rdata->subreq.io_iter; +- rqst.rq_iter_size = iov_iter_count(&rdata->subreq.io_iter); + } + + WARN_ONCE(rdata->server != mid->server, +@@ -4969,7 +4968,6 @@ smb2_async_writev(struct cifs_io_subrequest *wdata) + rqst.rq_iov = iov; + rqst.rq_nvec = 1; + rqst.rq_iter = wdata->subreq.io_iter; +- rqst.rq_iter_size = iov_iter_count(&rqst.rq_iter); + if (test_bit(NETFS_SREQ_RETRYING, &wdata->subreq.flags)) + smb2_set_replay(server, &rqst); + #ifdef CONFIG_CIFS_SMB_DIRECT +-- +2.43.0 +