From: Sasha Levin Date: Sat, 4 Nov 2023 03:00:38 +0000 (-0400) Subject: Fixes for 6.5 X-Git-Tag: v4.14.329~48 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=17fae7399b0fc51926b9508df231f842cc9d2703;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.5 Signed-off-by: Sasha Levin --- diff --git a/queue-6.5/arm64-dts-imx93-add-the-flex-can-stop-mode-by-gpr.patch b/queue-6.5/arm64-dts-imx93-add-the-flex-can-stop-mode-by-gpr.patch new file mode 100644 index 00000000000..36af7af213c --- /dev/null +++ b/queue-6.5/arm64-dts-imx93-add-the-flex-can-stop-mode-by-gpr.patch @@ -0,0 +1,62 @@ +From b3434461d66a43b4d4dc013c8e45b7979ead2565 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 19:24:57 +0800 +Subject: arm64: dts: imx93: add the Flex-CAN stop mode by GPR +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haibo Chen + +[ Upstream commit 23ed2be5404da7cee6a519fa69bf22d0f69da4e4 ] + +imx93 A0 chip use the internal q-channel handshake signal in LPCG +and CCM to automatically handle the Flex-CAN stop mode. But this +method meet issue when do the system PM stress test. IC can't fix +it easily. So in the new imx93 A1 chip, IC drop this method, and +involve back the old way，use the GPR method to trigger the Flex-CAN +stop mode signal. Now NXP claim to drop imx93 A0, and only support +imx93 A1. So here add the stop mode through GPR. + +This patch also fix a typo for aonmix_ns_gpr. + +Signed-off-by: Haibo Chen +Link: https://lore.kernel.org/all/20230726112458.3524165-1-haibo.chen@nxp.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi +index 1d8dd14b65cfa..2a9b89bf52698 100644 +--- a/arch/arm64/boot/dts/freescale/imx93.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi +@@ -146,7 +146,7 @@ + #size-cells = <1>; + ranges; + +- anomix_ns_gpr: syscon@44210000 { ++ aonmix_ns_gpr: syscon@44210000 { + compatible = "fsl,imx93-aonmix-ns-syscfg", "syscon"; + reg = <0x44210000 0x1000>; + }; +@@ -280,6 +280,7 @@ + assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>; + assigned-clock-rates = <40000000>; + fsl,clk-source = /bits/ 8 <0>; ++ fsl,stop-mode = <&aonmix_ns_gpr 0x14 0>; + status = "disabled"; + }; + +@@ -532,6 +533,7 @@ + assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>; + assigned-clock-rates = <40000000>; + fsl,clk-source = /bits/ 8 <0>; ++ fsl,stop-mode = <&wakeupmix_gpr 0x0c 2>; + status = "disabled"; + }; + +-- +2.42.0 + diff --git a/queue-6.5/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch b/queue-6.5/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch new file mode 100644 index 00000000000..a16751791f9 --- /dev/null +++ b/queue-6.5/asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch @@ -0,0 +1,35 @@ +From 8103ec3ba5fd4a871d48a95c02604824177de302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 13:02:39 +0200 +Subject: ASoC: codecs: tas2780: Fix log of failed reset via I2C. + +From: Roy Chateau + +[ Upstream commit 4e9a429ae80657bdc502d3f5078e2073656ec5fd ] + +Correctly log failures of reset via I2C. + +Signed-off-by: Roy Chateau +Link: https://lore.kernel.org/r/20231013110239.473123-1-roy.chateau@mep-info.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2780.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c +index 86bd6c18a9440..41076be238542 100644 +--- a/sound/soc/codecs/tas2780.c ++++ b/sound/soc/codecs/tas2780.c +@@ -39,7 +39,7 @@ static void tas2780_reset(struct tas2780_priv *tas2780) + usleep_range(2000, 2050); + } + +- snd_soc_component_write(tas2780->component, TAS2780_SW_RST, ++ ret = snd_soc_component_write(tas2780->component, TAS2780_SW_RST, + TAS2780_RST); + if (ret) + dev_err(tas2780->dev, "%s:errCode:0x%x Reset error!\n", +-- +2.42.0 + diff --git a/queue-6.5/asoc-core-do-not-call-link_exit-on-uninitialized-rtd.patch b/queue-6.5/asoc-core-do-not-call-link_exit-on-uninitialized-rtd.patch new file mode 100644 index 00000000000..a87e89057e4 --- /dev/null +++ b/queue-6.5/asoc-core-do-not-call-link_exit-on-uninitialized-rtd.patch @@ -0,0 +1,114 @@ +From 39dce1f36fb7f7192d7ed17350e41e740a42ed39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Sep 2023 12:32:43 +0200 +Subject: ASoC: core: Do not call link_exit() on uninitialized rtd objects +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit dd9f9cc1e6b9391140afa5cf27bb47c9e2a08d02 ] + +On init we have sequence: + + for_each_card_prelinks(card, i, dai_link) { + ret = snd_soc_add_pcm_runtime(card, dai_link); + + ret = init_some_other_things(...); + if (ret) + goto probe_end: + + for_each_card_rtds(card, rtd) { + ret = soc_init_pcm_runtime(card, rtd); + +probe_end: + +while on exit: + for_each_card_rtds(card, rtd) + snd_soc_link_exit(rtd); + +If init_some_other_things() step fails due to error we end up with +not fully setup rtds and try to call snd_soc_link_exit on them, which +depending on contents on .link_exit handler, can end up dereferencing +NULL pointer. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230929103243.705433-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/soc.h | 2 ++ + sound/soc/soc-core.c | 20 +++++++++++++++----- + 2 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/include/sound/soc.h b/include/sound/soc.h +index b27f84580c5b0..cf34810882347 100644 +--- a/include/sound/soc.h ++++ b/include/sound/soc.h +@@ -1125,6 +1125,8 @@ struct snd_soc_pcm_runtime { + unsigned int pop_wait:1; + unsigned int fe_compr:1; /* for Dynamic PCM */ + ++ bool initialized; ++ + int num_components; + struct snd_soc_component *components[]; /* CPU/Codec/Platform */ + }; +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 1a0bde23f5e6f..2d85164457f73 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1259,7 +1259,7 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card, + snd_soc_runtime_get_dai_fmt(rtd); + ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt); + if (ret) +- return ret; ++ goto err; + + /* add DPCM sysfs entries */ + soc_dpcm_debugfs_add(rtd); +@@ -1284,17 +1284,26 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card, + /* create compress_device if possible */ + ret = snd_soc_dai_compress_new(cpu_dai, rtd, num); + if (ret != -ENOTSUPP) +- return ret; ++ goto err; + + /* create the pcm */ + ret = soc_new_pcm(rtd, num); + if (ret < 0) { + dev_err(card->dev, "ASoC: can't create pcm %s :%d\n", + dai_link->stream_name, ret); +- return ret; ++ goto err; + } + +- return snd_soc_pcm_dai_new(rtd); ++ ret = snd_soc_pcm_dai_new(rtd); ++ if (ret < 0) ++ goto err; ++ ++ rtd->initialized = true; ++ ++ return 0; ++err: ++ snd_soc_link_exit(rtd); ++ return ret; + } + + static void soc_set_name_prefix(struct snd_soc_card *card, +@@ -1892,7 +1901,8 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card) + + /* release machine specific resources */ + for_each_card_rtds(card, rtd) +- snd_soc_link_exit(rtd); ++ if (rtd->initialized) ++ snd_soc_link_exit(rtd); + /* remove and free each DAI */ + soc_remove_link_dais(card); + soc_remove_link_components(card); +-- +2.42.0 + diff --git a/queue-6.5/asoc-da7219-correct-the-process-of-setting-up-gnd-sw.patch b/queue-6.5/asoc-da7219-correct-the-process-of-setting-up-gnd-sw.patch new file mode 100644 index 00000000000..f267e054274 --- /dev/null +++ b/queue-6.5/asoc-da7219-correct-the-process-of-setting-up-gnd-sw.patch @@ -0,0 +1,60 @@ +From 68c5025828ef8487924e379abe0e702ce0ddf54c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Oct 2023 10:12:58 +0800 +Subject: ASoC: da7219: Correct the process of setting up Gnd switch in AAD + +From: David Rau + +[ Upstream commit e8ecffd9962fe051d53a0761921b26d653b3df6b ] + +Enable Gnd switch to improve stability when Jack insert event +occurs, and then disable Gnd switch after Jack type detection +is finished. + +Signed-off-by: David Rau +Link: https://lore.kernel.org/r/20231017021258.5929-1-David.Rau.opensource@dm.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 581b334a6631d..3bbe850916493 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -59,9 +59,6 @@ static void da7219_aad_btn_det_work(struct work_struct *work) + bool micbias_up = false; + int retries = 0; + +- /* Disable ground switch */ +- snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00); +- + /* Drive headphones/lineout */ + snd_soc_component_update_bits(component, DA7219_HP_L_CTRL, + DA7219_HP_L_AMP_OE_MASK, +@@ -155,9 +152,6 @@ static void da7219_aad_hptest_work(struct work_struct *work) + tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ_INT_OSC); + } + +- /* Disable ground switch */ +- snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00); +- + /* Ensure gain ramping at fastest rate */ + gain_ramp_ctrl = snd_soc_component_read(component, DA7219_GAIN_RAMP_CTRL); + snd_soc_component_write(component, DA7219_GAIN_RAMP_CTRL, DA7219_GAIN_RAMP_RATE_X8); +@@ -421,6 +415,11 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data) + * handle a removal, and we can check at the end of + * hptest if we have a valid result or not. + */ ++ ++ cancel_delayed_work_sync(&da7219_aad->jack_det_work); ++ /* Disable ground switch */ ++ snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00); ++ + if (statusa & DA7219_JACK_TYPE_STS_MASK) { + report |= SND_JACK_HEADSET; + mask |= SND_JACK_HEADSET | SND_JACK_LINEOUT; +-- +2.42.0 + diff --git a/queue-6.5/asoc-fsl-asoc-card-use-integer-type-for-fll_id-and-p.patch b/queue-6.5/asoc-fsl-asoc-card-use-integer-type-for-fll_id-and-p.patch new file mode 100644 index 00000000000..8a010359b13 --- /dev/null +++ b/queue-6.5/asoc-fsl-asoc-card-use-integer-type-for-fll_id-and-p.patch @@ -0,0 +1,75 @@ +From 3061dd5006a1f535cd75db15947628e9b592cd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Sep 2023 17:43:12 +0800 +Subject: ASoC: fsl-asoc-card: use integer type for fll_id and pll_id + +From: Shengjiu Wang + +[ Upstream commit 2b21207afd06714986a3d22442ed4860ba4f9ced ] + +As the pll_id and pll_id can be zero (WM8960_SYSCLK_AUTO) +with the commit 2bbc2df46e67 ("ASoC: wm8960: Make automatic the +default clocking mode") + +Then the machine driver will skip to call set_sysclk() and set_pll() +for codec, when the sysclk rate is different with what wm8960 read +at probe, the output sound frequency is wrong. + +So change the fll_id and pll_id initial value, still keep machine +driver's behavior same as before. + +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1695202992-24864-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 76b5bfc288fde..bab7d34cf585b 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -52,8 +52,8 @@ struct codec_priv { + unsigned long mclk_freq; + unsigned long free_freq; + u32 mclk_id; +- u32 fll_id; +- u32 pll_id; ++ int fll_id; ++ int pll_id; + }; + + /** +@@ -206,7 +206,7 @@ static int fsl_asoc_card_hw_params(struct snd_pcm_substream *substream, + } + + /* Specific configuration for PLL */ +- if (codec_priv->pll_id && codec_priv->fll_id) { ++ if (codec_priv->pll_id >= 0 && codec_priv->fll_id >= 0) { + if (priv->sample_format == SNDRV_PCM_FORMAT_S24_LE) + pll_out = priv->sample_rate * 384; + else +@@ -248,7 +248,7 @@ static int fsl_asoc_card_hw_free(struct snd_pcm_substream *substream) + + priv->streams &= ~BIT(substream->stream); + +- if (!priv->streams && codec_priv->pll_id && codec_priv->fll_id) { ++ if (!priv->streams && codec_priv->pll_id >= 0 && codec_priv->fll_id >= 0) { + /* Force freq to be free_freq to avoid error message in codec */ + ret = snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0), + codec_priv->mclk_id, +@@ -621,6 +621,10 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + priv->card.dapm_routes = audio_map; + priv->card.num_dapm_routes = ARRAY_SIZE(audio_map); + priv->card.driver_name = DRIVER_NAME; ++ ++ priv->codec_priv.fll_id = -1; ++ priv->codec_priv.pll_id = -1; ++ + /* Diversify the card configurations */ + if (of_device_is_compatible(np, "fsl,imx-audio-cs42888")) { + codec_dai_name = "cs42888"; +-- +2.42.0 + diff --git a/queue-6.5/asoc-intel-sof_sdw-add-support-for-sku-0b14.patch b/queue-6.5/asoc-intel-sof_sdw-add-support-for-sku-0b14.patch new file mode 100644 index 00000000000..597b26ac185 --- /dev/null +++ b/queue-6.5/asoc-intel-sof_sdw-add-support-for-sku-0b14.patch @@ -0,0 +1,46 @@ +From 23682fd35ee3d94ed6163c37c5144f2fa2d110cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 17:21:25 +0800 +Subject: ASoC: Intel: sof_sdw: add support for SKU 0B14 + +From: Pierre-Louis Bossart + +[ Upstream commit fb0b8d299781be8d46b3612aa96cef28da0d93f4 ] + +One more missing SKU in the list. + +Closes: https://github.com/thesofproject/linux/issues/4543 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Chao Song +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20230919092125.1922468-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 93544eac23ad8..a23a7a1a35815 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -366,6 +366,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + /* No Jack */ + .driver_data = (void *)SOF_SDW_TGL_HDMI, + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0B14"), ++ }, ++ /* No Jack */ ++ .driver_data = (void *)SOF_SDW_TGL_HDMI, ++ }, ++ + { + .callback = sof_sdw_quirk_cb, + .matches = { +-- +2.42.0 + diff --git a/queue-6.5/asoc-rt5650-fix-the-wrong-result-of-key-button.patch b/queue-6.5/asoc-rt5650-fix-the-wrong-result-of-key-button.patch new file mode 100644 index 00000000000..3f975264592 --- /dev/null +++ b/queue-6.5/asoc-rt5650-fix-the-wrong-result-of-key-button.patch @@ -0,0 +1,35 @@ +From 6624ea7402de0174e8061821fde0cf024c4a9041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:45:25 +0800 +Subject: ASoC: rt5650: fix the wrong result of key button + +From: Shuming Fan + +[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ] + +The RT5650 should enable a power setting for button detection to avoid the wrong result. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index a506d940a2ead..fae04e9fae4e7 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3251,6 +3251,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component, + RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ); + regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1, + RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL); ++ regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1, ++ RT5645_HP_CB_MASK, RT5645_HP_CB_PU); + } + rt5645_irq(0, rt5645); + +-- +2.42.0 + diff --git a/queue-6.5/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch b/queue-6.5/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch new file mode 100644 index 00000000000..84a0d207476 --- /dev/null +++ b/queue-6.5/asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch @@ -0,0 +1,85 @@ +From ea21fe04c6aa1d561440eaf93fa2ea7bb46fb52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 05:34:18 +0000 +Subject: ASoC: simple-card: fixup asoc_simple_probe() error handling + +From: Kuninori Morimoto + +[ Upstream commit 41bae58df411f9accf01ea660730649b2fab1dab ] + +asoc_simple_probe() is used for both "DT probe" (A) and "platform probe" +(B). It uses "goto err" when error case, but it is not needed for +"platform probe" case (B). Thus it is using "return" directly there. + + static int asoc_simple_probe(...) + { + ^ if (...) { + | ... +(A) if (ret < 0) + | goto err; + v } else { + ^ ... + | if (ret < 0) +(B) return -Exxx; + v } + + ... + ^ if (ret < 0) +(C) goto err; + v ... + + err: +(D) simple_util_clean_reference(card); + + return ret; + } + +Both case are using (C) part, and it calls (D) when err case. +But (D) will do nothing for (B) case. +Because of these behavior, current code itself is not wrong, +but is confusable, and more, static analyzing tool will warning on +(B) part (should use goto err). + +To avoid static analyzing tool warning, this patch uses "goto err" +on (B) part. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 0745bf6a09aa0..5005d3c9c659a 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -701,10 +701,12 @@ static int asoc_simple_probe(struct platform_device *pdev) + struct snd_soc_dai_link *dai_link = priv->dai_link; + struct simple_dai_props *dai_props = priv->dai_props; + ++ ret = -EINVAL; ++ + cinfo = dev->platform_data; + if (!cinfo) { + dev_err(dev, "no info for asoc-simple-card\n"); +- return -EINVAL; ++ goto err; + } + + if (!cinfo->name || +@@ -713,7 +715,7 @@ static int asoc_simple_probe(struct platform_device *pdev) + !cinfo->platform || + !cinfo->cpu_dai.name) { + dev_err(dev, "insufficient asoc_simple_card_info settings\n"); +- return -EINVAL; ++ goto err; + } + + cpus = dai_link->cpus; +-- +2.42.0 + diff --git a/queue-6.5/asoc-soc-dapm-add-helper-for-comparing-widget-name.patch b/queue-6.5/asoc-soc-dapm-add-helper-for-comparing-widget-name.patch new file mode 100644 index 00000000000..b4a28187421 --- /dev/null +++ b/queue-6.5/asoc-soc-dapm-add-helper-for-comparing-widget-name.patch @@ -0,0 +1,74 @@ +From a301b1d65da72d622a01add8b7faea81d6e7d75a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 17:57:09 +0200 +Subject: ASoC: soc-dapm: Add helper for comparing widget name + +From: Krzysztof Kozlowski + +[ Upstream commit 76aca10ccb7c23a7b7a0d56e0bfde2c8cdddfe24 ] + +Some drivers use one event callback for multiple widgets but still need +to perform a bit different actions based on actual widget. This is done +by comparing widget name, however drivers tend to miss possible name +prefix. Add a helper to solve common mistakes. + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231003155710.821315-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/soc-dapm.h | 1 + + sound/soc/soc-component.c | 1 + + sound/soc/soc-dapm.c | 12 ++++++++++++ + 3 files changed, 14 insertions(+) + +diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h +index 87f8e1793af15..295d63437e4d8 100644 +--- a/include/sound/soc-dapm.h ++++ b/include/sound/soc-dapm.h +@@ -423,6 +423,7 @@ void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card); + + int snd_soc_dapm_update_dai(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params, struct snd_soc_dai *dai); ++int snd_soc_dapm_widget_name_cmp(struct snd_soc_dapm_widget *widget, const char *s); + + /* dapm path setup */ + int snd_soc_dapm_new_widgets(struct snd_soc_card *card); +diff --git a/sound/soc/soc-component.c b/sound/soc/soc-component.c +index 4356cc320fea0..10b5fe5a3af85 100644 +--- a/sound/soc/soc-component.c ++++ b/sound/soc/soc-component.c +@@ -242,6 +242,7 @@ int snd_soc_component_notify_control(struct snd_soc_component *component, + char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; + struct snd_kcontrol *kctl; + ++ /* When updating, change also snd_soc_dapm_widget_name_cmp() */ + if (component->name_prefix) + snprintf(name, ARRAY_SIZE(name), "%s %s", component->name_prefix, ctl); + else +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 3091e8160bad7..5fd32185fe63d 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2726,6 +2726,18 @@ int snd_soc_dapm_update_dai(struct snd_pcm_substream *substream, + } + EXPORT_SYMBOL_GPL(snd_soc_dapm_update_dai); + ++int snd_soc_dapm_widget_name_cmp(struct snd_soc_dapm_widget *widget, const char *s) ++{ ++ struct snd_soc_component *component = snd_soc_dapm_to_component(widget->dapm); ++ const char *wname = widget->name; ++ ++ if (component->name_prefix) ++ wname += strlen(component->name_prefix) + 1; /* plus space */ ++ ++ return strcmp(wname, s); ++} ++EXPORT_SYMBOL_GPL(snd_soc_dapm_widget_name_cmp); ++ + /* + * dapm_update_widget_flags() - Re-compute widget sink and source flags + * @w: The widget for which to update the flags +-- +2.42.0 + diff --git a/queue-6.5/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch b/queue-6.5/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch new file mode 100644 index 00000000000..2e531b25abb --- /dev/null +++ b/queue-6.5/asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch @@ -0,0 +1,45 @@ +From 26328dbc0b85a128a5ed9a2764ffab4a59e03a65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Sep 2023 15:01:17 +0200 +Subject: ASoC: tlv320adc3xxx: BUG: Correct micbias setting + +From: Antoine Gennart + +[ Upstream commit e930bea4124b8a4a47ba4092d99da30099b9242d ] + +The micbias setting for tlv320adc can also have the value '3' which +means that the micbias ouput pin is connected to the input pin AVDD. + +Signed-off-by: Antoine Gennart +Link: https://lore.kernel.org/r/20230929130117.77661-1-gennartan@disroot.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adc3xxx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c +index b976c1946286a..420bbf588efea 100644 +--- a/sound/soc/codecs/tlv320adc3xxx.c ++++ b/sound/soc/codecs/tlv320adc3xxx.c +@@ -293,7 +293,7 @@ + #define ADC3XXX_BYPASS_RPGA 0x80 + + /* MICBIAS control bits */ +-#define ADC3XXX_MICBIAS_MASK 0x2 ++#define ADC3XXX_MICBIAS_MASK 0x3 + #define ADC3XXX_MICBIAS1_SHIFT 5 + #define ADC3XXX_MICBIAS2_SHIFT 3 + +@@ -1099,7 +1099,7 @@ static int adc3xxx_parse_dt_micbias(struct adc3xxx *adc3xxx, + unsigned int val; + + if (!of_property_read_u32(np, propname, &val)) { +- if (val >= ADC3XXX_MICBIAS_AVDD) { ++ if (val > ADC3XXX_MICBIAS_AVDD) { + dev_err(dev, "Invalid property value for '%s'\n", propname); + return -EINVAL; + } +-- +2.42.0 + diff --git a/queue-6.5/ata-pata_parport-add-custom-version-of-wait_after_re.patch b/queue-6.5/ata-pata_parport-add-custom-version-of-wait_after_re.patch new file mode 100644 index 00000000000..69a44837319 --- /dev/null +++ b/queue-6.5/ata-pata_parport-add-custom-version-of-wait_after_re.patch @@ -0,0 +1,116 @@ +From c80c03f958f4425cb838f330ecf7daf6f4e67fc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 22:55:58 +0200 +Subject: ata: pata_parport: add custom version of wait_after_reset + +From: Ondrej Zary + +[ Upstream commit f343e578fef99a69b3322aca38b94a6d8ded2ce7 ] + +Some parallel adapters (e.g. EXP Computer MC-1285B EPP Cable) return +bogus values when there's no master device present. This can cause +reset to fail, preventing the lone slave device (such as EXP Computer +CD-865) from working. + +Add custom version of wait_after_reset that ignores master failure when +a slave device is present. The custom version is also needed because +the generic ata_sff_wait_after_reset uses direct port I/O for slave +device detection. + +Signed-off-by: Ondrej Zary +Reviewed-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_parport/pata_parport.c | 68 ++++++++++++++++++++++++- + 1 file changed, 67 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_parport/pata_parport.c b/drivers/ata/pata_parport/pata_parport.c +index cf87bbb52f1ff..a7adfdcb5e27c 100644 +--- a/drivers/ata/pata_parport/pata_parport.c ++++ b/drivers/ata/pata_parport/pata_parport.c +@@ -80,6 +80,72 @@ static bool pata_parport_devchk(struct ata_port *ap, unsigned int device) + return (nsect == 0x55) && (lbal == 0xaa); + } + ++static int pata_parport_wait_after_reset(struct ata_link *link, ++ unsigned int devmask, ++ unsigned long deadline) ++{ ++ struct ata_port *ap = link->ap; ++ struct pi_adapter *pi = ap->host->private_data; ++ unsigned int dev0 = devmask & (1 << 0); ++ unsigned int dev1 = devmask & (1 << 1); ++ int rc, ret = 0; ++ ++ ata_msleep(ap, ATA_WAIT_AFTER_RESET); ++ ++ /* always check readiness of the master device */ ++ rc = ata_sff_wait_ready(link, deadline); ++ if (rc) { ++ /* ++ * some adapters return bogus values if master device is not ++ * present, so don't abort now if a slave device is present ++ */ ++ if (!dev1) ++ return rc; ++ ret = -ENODEV; ++ } ++ ++ /* ++ * if device 1 was found in ata_devchk, wait for register ++ * access briefly, then wait for BSY to clear. ++ */ ++ if (dev1) { ++ int i; ++ ++ pata_parport_dev_select(ap, 1); ++ ++ /* ++ * Wait for register access. Some ATAPI devices fail ++ * to set nsect/lbal after reset, so don't waste too ++ * much time on it. We're gonna wait for !BSY anyway. ++ */ ++ for (i = 0; i < 2; i++) { ++ u8 nsect, lbal; ++ ++ nsect = pi->proto->read_regr(pi, 0, ATA_REG_NSECT); ++ lbal = pi->proto->read_regr(pi, 0, ATA_REG_LBAL); ++ if (nsect == 1 && lbal == 1) ++ break; ++ /* give drive a breather */ ++ ata_msleep(ap, 50); ++ } ++ ++ rc = ata_sff_wait_ready(link, deadline); ++ if (rc) { ++ if (rc != -ENODEV) ++ return rc; ++ ret = rc; ++ } ++ } ++ ++ pata_parport_dev_select(ap, 0); ++ if (dev1) ++ pata_parport_dev_select(ap, 1); ++ if (dev0) ++ pata_parport_dev_select(ap, 0); ++ ++ return ret; ++} ++ + static int pata_parport_bus_softreset(struct ata_port *ap, unsigned int devmask, + unsigned long deadline) + { +@@ -94,7 +160,7 @@ static int pata_parport_bus_softreset(struct ata_port *ap, unsigned int devmask, + ap->last_ctl = ap->ctl; + + /* wait the port to become ready */ +- return ata_sff_wait_after_reset(&ap->link, devmask, deadline); ++ return pata_parport_wait_after_reset(&ap->link, devmask, deadline); + } + + static int pata_parport_softreset(struct ata_link *link, unsigned int *classes, +-- +2.42.0 + diff --git a/queue-6.5/ata-pata_parport-fit3-implement-ide-command-set-regi.patch b/queue-6.5/ata-pata_parport-fit3-implement-ide-command-set-regi.patch new file mode 100644 index 00000000000..c278ace3fcc --- /dev/null +++ b/queue-6.5/ata-pata_parport-fit3-implement-ide-command-set-regi.patch @@ -0,0 +1,70 @@ +From d64cb4e7b6d5a15a48a2737d1427736de467c4aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 22:55:59 +0200 +Subject: ata: pata_parport: fit3: implement IDE command set registers + +From: Ondrej Zary + +[ Upstream commit 0c1e81d0b5ebd5813536dd5fcf5966ad043f37dc ] + +fit3 protocol driver does not support accessing IDE control registers +(device control/altstatus). The DOS driver does not use these registers +either (as observed from DOSEMU trace). But the HW seems to be capable +of accessing these registers - I simply tried bit 3 and it works! + +The control register is required to properly reset ATAPI devices or +they will be detected only once (after a power cycle). + +Tested with EXP Computer CD-865 with MC-1285B EPP cable and +TransDisk 3000. + +Signed-off-by: Ondrej Zary +Reviewed-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_parport/fit3.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/ata/pata_parport/fit3.c b/drivers/ata/pata_parport/fit3.c +index bad7aa920cdca..d2b81cf2e16d2 100644 +--- a/drivers/ata/pata_parport/fit3.c ++++ b/drivers/ata/pata_parport/fit3.c +@@ -9,11 +9,6 @@ + * + * The TD-2000 and certain older devices use a different protocol. + * Try the fit2 protocol module with them. +- * +- * NB: The FIT adapters do not appear to support the control +- * registers. So, we map ALT_STATUS to STATUS and NO-OP writes +- * to the device control register - this means that IDE reset +- * will not work on these devices. + */ + + #include +@@ -37,8 +32,7 @@ + + static void fit3_write_regr(struct pi_adapter *pi, int cont, int regr, int val) + { +- if (cont == 1) +- return; ++ regr += cont << 3; + + switch (pi->mode) { + case 0: +@@ -59,11 +53,7 @@ static int fit3_read_regr(struct pi_adapter *pi, int cont, int regr) + { + int a, b; + +- if (cont) { +- if (regr != 6) +- return 0xff; +- regr = 7; +- } ++ regr += cont << 3; + + switch (pi->mode) { + case 0: +-- +2.42.0 + diff --git a/queue-6.5/can-flexcan-remove-the-auto-stop-mode-for-imx93.patch b/queue-6.5/can-flexcan-remove-the-auto-stop-mode-for-imx93.patch new file mode 100644 index 00000000000..48d4824d657 --- /dev/null +++ b/queue-6.5/can-flexcan-remove-the-auto-stop-mode-for-imx93.patch @@ -0,0 +1,148 @@ +From cb94b7a07daea7500b80262ca4798e12182ad8b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 19:24:58 +0800 +Subject: can: flexcan: remove the auto stop mode for IMX93 + +From: Haibo Chen + +[ Upstream commit 63ead535570f13d0e06fda3f2d020c8f5394e998 ] + +IMX93 A0 chip involve the internal q-channel handshake in LPCG and +CCM to automatically handle the Flex-CAN IPG STOP signal. Only after +FLEX-CAN enter stop mode then can support the self-wakeup feature. +But meet issue when do the continue system PM stress test. When config +the CAN as wakeup source, the first time after system suspend, any data +on CAN bus can wakeup the system, this is as expect. But the second time +when system suspend, data on CAN bus can't wakeup the system. If continue +this test, we find in odd time system enter suspend, CAN can wakeup the +system, but in even number system enter suspend, CAN can't wakeup the +system. IC find a bug in the auto stop mode logic, and can't fix it easily. +So for the new imx93 A1, IC drop the auto stop mode and involve the +GPR to support stop mode (used before). IC define a bit in GPR which can +trigger the IPG STOP signal to Flex-CAN, let it go into stop mode. +And NXP claim to drop IMX93 A0, and only support IMX93 A1. So this patch +remove the auto stop mode, and add flag FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR +to imx93. + +Signed-off-by: Haibo Chen +Link: https://lore.kernel.org/all/20230726112458.3524165-2-haibo.chen@nxp.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan/flexcan-core.c | 46 ++++++++------------------ + drivers/net/can/flexcan/flexcan.h | 2 -- + 2 files changed, 13 insertions(+), 35 deletions(-) + +diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c +index ff0fc18baf133..d8be69f4a0c3f 100644 +--- a/drivers/net/can/flexcan/flexcan-core.c ++++ b/drivers/net/can/flexcan/flexcan-core.c +@@ -348,7 +348,7 @@ static struct flexcan_devtype_data fsl_imx8mp_devtype_data = { + static struct flexcan_devtype_data fsl_imx93_devtype_data = { + .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS | + FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_RX_MAILBOX | +- FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_AUTO_STOP_MODE | ++ FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR | + FLEXCAN_QUIRK_SUPPORT_FD | FLEXCAN_QUIRK_SUPPORT_ECC | + FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX | + FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX_RTR, +@@ -544,11 +544,6 @@ static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv) + } else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) { + regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr, + 1 << priv->stm.req_bit, 1 << priv->stm.req_bit); +- } else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) { +- /* For the auto stop mode, software do nothing, hardware will cover +- * all the operation automatically after system go into low power mode. +- */ +- return 0; + } + + return flexcan_low_power_enter_ack(priv); +@@ -574,12 +569,6 @@ static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv) + reg_mcr &= ~FLEXCAN_MCR_SLF_WAK; + priv->write(reg_mcr, ®s->mcr); + +- /* For the auto stop mode, hardware will exist stop mode +- * automatically after system go out of low power mode. +- */ +- if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) +- return 0; +- + return flexcan_low_power_exit_ack(priv); + } + +@@ -1994,13 +1983,18 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev) + ret = flexcan_setup_stop_mode_scfw(pdev); + else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) + ret = flexcan_setup_stop_mode_gpr(pdev); +- else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) +- ret = 0; + else + /* return 0 directly if doesn't support stop mode feature */ + return 0; + +- if (ret) ++ /* If ret is -EINVAL, this means SoC claim to support stop mode, but ++ * dts file lack the stop mode property definition. For this case, ++ * directly return 0, this will skip the wakeup capable setting and ++ * will not block the driver probe. ++ */ ++ if (ret == -EINVAL) ++ return 0; ++ else if (ret) + return ret; + + device_set_wakeup_capable(&pdev->dev, true); +@@ -2320,16 +2314,8 @@ static int __maybe_unused flexcan_noirq_suspend(struct device *device) + if (netif_running(dev)) { + int err; + +- if (device_may_wakeup(device)) { ++ if (device_may_wakeup(device)) + flexcan_enable_wakeup_irq(priv, true); +- /* For auto stop mode, need to keep the clock on before +- * system go into low power mode. After system go into +- * low power mode, hardware will config the flexcan into +- * stop mode, and gate off the clock automatically. +- */ +- if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) +- return 0; +- } + + err = pm_runtime_force_suspend(device); + if (err) +@@ -2347,15 +2333,9 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device) + if (netif_running(dev)) { + int err; + +- /* For the wakeup in auto stop mode, no need to gate on the +- * clock here, hardware will do this automatically. +- */ +- if (!(device_may_wakeup(device) && +- priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)) { +- err = pm_runtime_force_resume(device); +- if (err) +- return err; +- } ++ err = pm_runtime_force_resume(device); ++ if (err) ++ return err; + + if (device_may_wakeup(device)) + flexcan_enable_wakeup_irq(priv, false); +diff --git a/drivers/net/can/flexcan/flexcan.h b/drivers/net/can/flexcan/flexcan.h +index 91402977780b2..025c3417031f4 100644 +--- a/drivers/net/can/flexcan/flexcan.h ++++ b/drivers/net/can/flexcan/flexcan.h +@@ -68,8 +68,6 @@ + #define FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX_RTR BIT(15) + /* Device supports RX via FIFO */ + #define FLEXCAN_QUIRK_SUPPORT_RX_FIFO BIT(16) +-/* auto enter stop mode to support wakeup */ +-#define FLEXCAN_QUIRK_AUTO_STOP_MODE BIT(17) + + struct flexcan_devtype_data { + u32 quirks; /* quirks needed for different IP cores */ +-- +2.42.0 + diff --git a/queue-6.5/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch b/queue-6.5/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch new file mode 100644 index 00000000000..f226c2379e1 --- /dev/null +++ b/queue-6.5/ceph_wait_on_conflict_unlink-grab-reference-before-d.patch @@ -0,0 +1,37 @@ +From fc414d2438746e88eb7b261438b008eb0b1d4547 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Sep 2023 21:55:29 -0400 +Subject: ceph_wait_on_conflict_unlink(): grab reference before dropping + ->d_lock + +From: Al Viro + +[ Upstream commit dc32464a5fe4946fe1a4d8f8e29961dc411933c5 ] + +Use of dget() after we'd dropped ->d_lock is too late - dentry might +be gone by that point. + +Reviewed-by: Jeff Layton +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/ceph/mds_client.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index 4b0ba067e9c93..e40aafbfa7b9f 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -709,8 +709,8 @@ int ceph_wait_on_conflict_unlink(struct dentry *dentry) + if (!d_same_name(udentry, pdentry, &dname)) + goto next; + ++ found = dget_dlock(udentry); + spin_unlock(&udentry->d_lock); +- found = dget(udentry); + break; + next: + spin_unlock(&udentry->d_lock); +-- +2.42.0 + diff --git a/queue-6.5/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch b/queue-6.5/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch new file mode 100644 index 00000000000..31661e7a4ab --- /dev/null +++ b/queue-6.5/coresight-tmc-etr-disable-warnings-for-allocation-fa.patch @@ -0,0 +1,82 @@ +From ed9003b5d1f85089dcfb76495c97f960f1ccf5fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 17:19:51 +0100 +Subject: coresight: tmc-etr: Disable warnings for allocation failures + +From: Suzuki K Poulose + +[ Upstream commit e5028011885a85032aa3c1b7e3e493bcdacb4a0a ] + +Running the following command on Juno triggers the warning: + + $ perf record -e cs_etm// -m ,128M ... + + ------------[ cut here ]------------ + WARNING: CPU: 1 PID: 412 at mm/page_alloc.c:4453 __alloc_pages+0x334/0x1420 + CPU: 1 PID: 412 Comm: perf Not tainted 6.5.0-rc3+ #181 + Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 + pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __alloc_pages+0x334/0x1420 + lr : dma_common_alloc_pages+0x108/0x138 + sp : ffffffc087fb7440 + x29: ffffffc087fb7440 x28: 0000000000000000 x27: ffffffc07e48fba0 + x26: 0000000000000001 x25: 000000000000000f x24: ffffffc081f24880 + x23: 0000000000000cc0 x22: ffffff88012b6f08 x21: 0000000008000000 + x20: ffffff8801433000 x19: 0000000000000000 x18: 0000000000000000 + x17: ffffffc080316e5c x16: ffffffc07e46406c x15: ffffffc0803af580 + x14: ffffffc08036b460 x13: ffffffc080025cbc x12: ffffffb8108c3fc4 + x11: 1ffffff8108c3fc3 x10: 1ffffff810ff6eac x9 : 00000000f204f204 + x8 : 000000000000f204 x7 : 00000000f2f2f2f2 x6 : 00000000f3f3f3f3 + x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000 + x2 : 0000000000000cc0 x1 : 0000000000000000 x0 : ffffffc085333000 + Call trace: + __alloc_pages+0x334/0x1420 + dma_common_alloc_pages+0x108/0x138 + __dma_alloc_pages+0xf4/0x108 + dma_alloc_pages+0x18/0x30 + tmc_etr_alloc_flat_buf+0xa0/0x190 [coresight_tmc] + tmc_alloc_etr_buf.constprop.0+0x124/0x298 [coresight_tmc] + alloc_etr_buf.constprop.0.isra.0+0x88/0xc8 [coresight_tmc] + tmc_alloc_etr_buffer+0x164/0x2f0 [coresight_tmc] + etm_setup_aux+0x32c/0x520 [coresight] + rb_alloc_aux+0x29c/0x3f8 + perf_mmap+0x59c/0xce0 + mmap_region+0x340/0x10e0 + do_mmap+0x48c/0x580 + vm_mmap_pgoff+0x160/0x248 + ksys_mmap_pgoff+0x1e8/0x278 + __arm64_sys_mmap+0x8c/0xb8 + +With the flat mode, we only attempt to allocate large memory if there is an IOMMU +connected to the ETR. If the allocation fails, we always have a fallback path +and return an error if nothing else worked. So, suppress the warning for flat +mode allocations. + +Cc: Mike Leach +Cc: James Clark +Cc: Anshuman Khandual +Signed-off-by: Suzuki K Poulose +Reviewed-by: James Clark +Link: https://lore.kernel.org/r/20230817161951.658534-1-suzuki.poulose@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c +index 6132c5b3db9c7..8311e1028ddb0 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c +@@ -610,7 +610,8 @@ static int tmc_etr_alloc_flat_buf(struct tmc_drvdata *drvdata, + + flat_buf->vaddr = dma_alloc_noncoherent(real_dev, etr_buf->size, + &flat_buf->daddr, +- DMA_FROM_DEVICE, GFP_KERNEL); ++ DMA_FROM_DEVICE, ++ GFP_KERNEL | __GFP_NOWARN); + if (!flat_buf->vaddr) { + kfree(flat_buf); + return -ENOMEM; +-- +2.42.0 + diff --git a/queue-6.5/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch b/queue-6.5/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch new file mode 100644 index 00000000000..741cdf86a12 --- /dev/null +++ b/queue-6.5/dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch @@ -0,0 +1,38 @@ +From 56fc96a24de70a8b9547d37c37b05f5a536ecffc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 22:28:35 +0800 +Subject: dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe + +From: Zhang Shurong + +[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. +We fix it by calling pm_runtime_disable when error returns. + +Signed-off-by: Zhang Shurong +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ste_dma40.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c +index 89e82508c1339..002833fb1fa04 100644 +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -3668,6 +3668,7 @@ static int __init d40_probe(struct platform_device *pdev) + regulator_disable(base->lcpa_regulator); + regulator_put(base->lcpa_regulator); + } ++ pm_runtime_disable(base->dev); + + report_failure: + d40_err(dev, "probe failed\n"); +-- +2.42.0 + diff --git a/queue-6.5/drm-amdgpu-reserve-fences-for-vm-update.patch b/queue-6.5/drm-amdgpu-reserve-fences-for-vm-update.patch new file mode 100644 index 00000000000..9731bdb84ce --- /dev/null +++ b/queue-6.5/drm-amdgpu-reserve-fences-for-vm-update.patch @@ -0,0 +1,43 @@ +From 161079adb724f8c0f7ed8eccc4c8cef79ada073d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 15:28:52 -0400 +Subject: drm/amdgpu: Reserve fences for VM update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Felix Kuehling + +[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ] + +In amdgpu_dma_buf_move_notify reserve fences for the page table updates +in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON +in dma_resv_add_fence when using SDMA for page table updates. + +Signed-off-by: Felix Kuehling +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +index 12210598e5b8e..ba3a87cb88ccc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +@@ -403,7 +403,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) + continue; + } + +- r = amdgpu_vm_clear_freed(adev, vm, NULL); ++ /* Reserve fences for two SDMA page table updates */ ++ r = dma_resv_reserve_fences(resv, 2); ++ if (!r) ++ r = amdgpu_vm_clear_freed(adev, vm, NULL); + if (!r) + r = amdgpu_vm_handle_moved(adev, vm); + +-- +2.42.0 + diff --git a/queue-6.5/drm-amdgpu-unset-context-priority-is-now-invalid.patch b/queue-6.5/drm-amdgpu-unset-context-priority-is-now-invalid.patch new file mode 100644 index 00000000000..32986f30832 --- /dev/null +++ b/queue-6.5/drm-amdgpu-unset-context-priority-is-now-invalid.patch @@ -0,0 +1,50 @@ +From a19d91fcd68f2d002bd23d269aeaa48f31671133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 22:24:39 -0400 +Subject: drm/amdgpu: Unset context priority is now invalid +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luben Tuikov + +[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ] + +A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of +carrying it around and passing it to the Direct Rendering Manager--and it +becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context +creation. + +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Luben Tuikov +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tuikov@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index 0dc9c655c4fbd..092962b93064f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] = { + bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio) + { + switch (ctx_prio) { +- case AMDGPU_CTX_PRIORITY_UNSET: + case AMDGPU_CTX_PRIORITY_VERY_LOW: + case AMDGPU_CTX_PRIORITY_LOW: + case AMDGPU_CTX_PRIORITY_NORMAL: +@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio) + case AMDGPU_CTX_PRIORITY_VERY_HIGH: + return true; + default: ++ case AMDGPU_CTX_PRIORITY_UNSET: + return false; + } + } +-- +2.42.0 + diff --git a/queue-6.5/drm-ttm-reorder-sys-manager-cleanup-step.patch b/queue-6.5/drm-ttm-reorder-sys-manager-cleanup-step.patch new file mode 100644 index 00000000000..8f21d66a07c --- /dev/null +++ b/queue-6.5/drm-ttm-reorder-sys-manager-cleanup-step.patch @@ -0,0 +1,59 @@ +From 47ce6d6686107472d6a36ab1ae35e9468a2e04f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 14:15:25 +0200 +Subject: drm/ttm: Reorder sys manager cleanup step +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Karolina Stolarek + +[ Upstream commit 3b401e30c249849d803de6c332dad2a595a58658 ] + +With the current cleanup flow, we could trigger a NULL pointer +dereference if there is a delayed destruction of a BO with a +system resource that gets executed on drain_workqueue() call, +as we attempt to free a resource using an already released +resource manager. + +Remove the device from the device list and drain its workqueue +before releasing the system domain manager in ttm_device_fini(). + +Signed-off-by: Karolina Stolarek +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_device.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c +index 7726a72befc54..d48b39132b324 100644 +--- a/drivers/gpu/drm/ttm/ttm_device.c ++++ b/drivers/gpu/drm/ttm/ttm_device.c +@@ -232,10 +232,6 @@ void ttm_device_fini(struct ttm_device *bdev) + struct ttm_resource_manager *man; + unsigned i; + +- man = ttm_manager_type(bdev, TTM_PL_SYSTEM); +- ttm_resource_manager_set_used(man, false); +- ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); +- + mutex_lock(&ttm_global_mutex); + list_del(&bdev->device_list); + mutex_unlock(&ttm_global_mutex); +@@ -243,6 +239,10 @@ void ttm_device_fini(struct ttm_device *bdev) + drain_workqueue(bdev->wq); + destroy_workqueue(bdev->wq); + ++ man = ttm_manager_type(bdev, TTM_PL_SYSTEM); ++ ttm_resource_manager_set_used(man, false); ++ ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL); ++ + spin_lock(&bdev->lru_lock); + for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i) + if (list_empty(&man->lru[0])) +-- +2.42.0 + diff --git a/queue-6.5/efi-fix-memory-leak-in-krealloc-failure-handling.patch b/queue-6.5/efi-fix-memory-leak-in-krealloc-failure-handling.patch new file mode 100644 index 00000000000..0888f62e7e2 --- /dev/null +++ b/queue-6.5/efi-fix-memory-leak-in-krealloc-failure-handling.patch @@ -0,0 +1,46 @@ +From b03703eb68a6e37c412c75f46be7b6500b310b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Sep 2023 22:26:33 +0800 +Subject: efi: fix memory leak in krealloc failure handling + +From: Kuan-Wei Chiu + +[ Upstream commit 0d3ad1917996839a5042d18f04e41915cfa1b74a ] + +In the previous code, there was a memory leak issue where the +previously allocated memory was not freed upon a failed krealloc +operation. This patch addresses the problem by releasing the old memory +before setting the pointer to NULL in case of a krealloc failure. This +ensures that memory is properly managed and avoids potential memory +leaks. + +Signed-off-by: Kuan-Wei Chiu +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 1599f11768426..9cfac61812f68 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -273,9 +273,13 @@ static __init int efivar_ssdt_load(void) + if (status == EFI_NOT_FOUND) { + break; + } else if (status == EFI_BUFFER_TOO_SMALL) { +- name = krealloc(name, name_size, GFP_KERNEL); +- if (!name) ++ efi_char16_t *name_tmp = ++ krealloc(name, name_size, GFP_KERNEL); ++ if (!name_tmp) { ++ kfree(name); + return -ENOMEM; ++ } ++ name = name_tmp; + continue; + } + +-- +2.42.0 + diff --git a/queue-6.5/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch b/queue-6.5/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch new file mode 100644 index 00000000000..ead126f399b --- /dev/null +++ b/queue-6.5/fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch @@ -0,0 +1,58 @@ +From a9eba8873f1fb9ea9fe899002389cb3f061e8fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Sep 2023 19:04:21 +0800 +Subject: fbdev: atyfb: only use ioremap_uc() on i386 and ia64 + +From: Arnd Bergmann + +[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ] + +ioremap_uc() is only meaningful on old x86-32 systems with the PAT +extension, and on ia64 with its slightly unconventional ioremap() +behavior, everywhere else this is the same as ioremap() anyway. + +Change the only driver that still references ioremap_uc() to only do so +on x86-32/ia64 in order to allow removing that interface at some +point in the future for the other architectures. + +On some architectures, ioremap_uc() just returns NULL, changing +the driver to call ioremap() means that they now have a chance +of working correctly. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Baoquan He +Reviewed-by: Luis Chamberlain +Cc: Helge Deller +Cc: Thomas Zimmermann +Cc: Christophe Leroy +Cc: linux-fbdev@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/aty/atyfb_base.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c +index cba2b113b28b0..a73114c1c6918 100644 +--- a/drivers/video/fbdev/aty/atyfb_base.c ++++ b/drivers/video/fbdev/aty/atyfb_base.c +@@ -3440,11 +3440,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info, + } + + info->fix.mmio_start = raddr; ++#if defined(__i386__) || defined(__ia64__) + /* + * By using strong UC we force the MTRR to never have an + * effect on the MMIO region on both non-PAT and PAT systems. + */ + par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000); ++#else ++ par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000); ++#endif + if (par->ati_regbase == NULL) + return -ENOMEM; + +-- +2.42.0 + diff --git a/queue-6.5/fbdev-omapfb-fix-some-error-codes.patch b/queue-6.5/fbdev-omapfb-fix-some-error-codes.patch new file mode 100644 index 00000000000..c0ebf10be39 --- /dev/null +++ b/queue-6.5/fbdev-omapfb-fix-some-error-codes.patch @@ -0,0 +1,41 @@ +From 83b68ce4e8910173563c1dac7ecfaa7b791ebca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 14:19:52 +0300 +Subject: fbdev: omapfb: fix some error codes + +From: Dan Carpenter + +[ Upstream commit dc608db793731426938baa2f0e75a4a3cce5f5cf ] + +Return negative -ENXIO instead of positive ENXIO. + +Signed-off-by: Dan Carpenter +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap/omapfb_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index ad65554b33c35..0be95b4e14fdb 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -1648,13 +1648,13 @@ static int omapfb_do_probe(struct platform_device *pdev, + } + fbdev->int_irq = platform_get_irq(pdev, 0); + if (fbdev->int_irq < 0) { +- r = ENXIO; ++ r = -ENXIO; + goto cleanup; + } + + fbdev->ext_irq = platform_get_irq(pdev, 1); + if (fbdev->ext_irq < 0) { +- r = ENXIO; ++ r = -ENXIO; + goto cleanup; + } + +-- +2.42.0 + diff --git a/queue-6.5/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch b/queue-6.5/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch new file mode 100644 index 00000000000..7f0fa4b8647 --- /dev/null +++ b/queue-6.5/fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch @@ -0,0 +1,41 @@ +From f9beb6a7a9e9c794e15554fd8633fca3b0d31951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 17:43:47 -0300 +Subject: fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() + +From: Jorge Maidana + +[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ] + +Delete the v86d netlink only after all the VBE tasks have been +completed. + +Fixes initial state restore on module unload: +uvesafb: VBE state restore call failed (eax=0x4f04, err=-19) + +Signed-off-by: Jorge Maidana +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/uvesafb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c +index 78d85dae8ec80..c4559768f00f6 100644 +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1931,10 +1931,10 @@ static void uvesafb_exit(void) + } + } + +- cn_del_callback(&uvesafb_cn_id); + driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d); + platform_device_unregister(uvesafb_device); + platform_driver_unregister(&uvesafb_driver); ++ cn_del_callback(&uvesafb_cn_id); + } + + module_exit(uvesafb_exit); +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-add-ckeck-in-ni_update_parent.patch b/queue-6.5/fs-ntfs3-add-ckeck-in-ni_update_parent.patch new file mode 100644 index 00000000000..e3c150ef5ec --- /dev/null +++ b/queue-6.5/fs-ntfs3-add-ckeck-in-ni_update_parent.patch @@ -0,0 +1,37 @@ +From 6035640d6bdf6e8f5914961b0ca102f30d4ede2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:52:19 +0400 +Subject: fs/ntfs3: Add ckeck in ni_update_parent() + +From: Konstantin Komarov + +[ Upstream commit 87d1888aa40f25773fa0b948bcb2545f97e2cb15 ] + +Check simple case when parent inode equals current inode. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 16bd9faa2d28b..8f34d6472ddbd 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -3208,6 +3208,12 @@ static bool ni_update_parent(struct ntfs_inode *ni, struct NTFS_DUP_INFO *dup, + if (!fname || !memcmp(&fname->dup, dup, sizeof(fname->dup))) + continue; + ++ /* Check simple case when parent inode equals current inode. */ ++ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) { ++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); ++ continue; ++ } ++ + /* ntfs_iget5 may sleep. */ + dir = ntfs_iget5(sb, &fname->home, NULL); + if (IS_ERR(dir)) { +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-add-more-attributes-checks-in-mi_enum_attr.patch b/queue-6.5/fs-ntfs3-add-more-attributes-checks-in-mi_enum_attr.patch new file mode 100644 index 00000000000..1696043fd80 --- /dev/null +++ b/queue-6.5/fs-ntfs3-add-more-attributes-checks-in-mi_enum_attr.patch @@ -0,0 +1,149 @@ +From 6a08e600137d172981a5b7f22eef96e3bf4defb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 16:17:02 +0400 +Subject: fs/ntfs3: Add more attributes checks in mi_enum_attr() + +From: Konstantin Komarov + +[ Upstream commit 013ff63b649475f0ee134e2c8d0c8e65284ede50 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/record.c | 68 ++++++++++++++++++++++++++++++++++++----------- + 1 file changed, 52 insertions(+), 16 deletions(-) + +diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c +index c12ebffc94da4..02cc91ed88357 100644 +--- a/fs/ntfs3/record.c ++++ b/fs/ntfs3/record.c +@@ -193,8 +193,9 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + { + const struct MFT_REC *rec = mi->mrec; + u32 used = le32_to_cpu(rec->used); +- u32 t32, off, asize; ++ u32 t32, off, asize, prev_type; + u16 t16; ++ u64 data_size, alloc_size, tot_size; + + if (!attr) { + u32 total = le32_to_cpu(rec->total); +@@ -213,6 +214,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + if (!is_rec_inuse(rec)) + return NULL; + ++ prev_type = 0; + attr = Add2Ptr(rec, off); + } else { + /* Check if input attr inside record. */ +@@ -226,11 +228,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + return NULL; + } + +- if (off + asize < off) { +- /* Overflow check. */ ++ /* Overflow check. */ ++ if (off + asize < off) + return NULL; +- } + ++ prev_type = le32_to_cpu(attr->type); + attr = Add2Ptr(attr, asize); + off += asize; + } +@@ -250,7 +252,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + + /* 0x100 is last known attribute for now. */ + t32 = le32_to_cpu(attr->type); +- if ((t32 & 0xf) || (t32 > 0x100)) ++ if (!t32 || (t32 & 0xf) || (t32 > 0x100)) ++ return NULL; ++ ++ /* attributes in record must be ordered by type */ ++ if (t32 < prev_type) + return NULL; + + /* Check overflow and boundary. */ +@@ -259,16 +265,15 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + + /* Check size of attribute. */ + if (!attr->non_res) { ++ /* Check resident fields. */ + if (asize < SIZEOF_RESIDENT) + return NULL; + + t16 = le16_to_cpu(attr->res.data_off); +- + if (t16 > asize) + return NULL; + +- t32 = le32_to_cpu(attr->res.data_size); +- if (t16 + t32 > asize) ++ if (t16 + le32_to_cpu(attr->res.data_size) > asize) + return NULL; + + t32 = sizeof(short) * attr->name_len; +@@ -278,21 +283,52 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) + return attr; + } + +- /* Check some nonresident fields. */ +- if (attr->name_len && +- le16_to_cpu(attr->name_off) + sizeof(short) * attr->name_len > +- le16_to_cpu(attr->nres.run_off)) { ++ /* Check nonresident fields. */ ++ if (attr->non_res != 1) ++ return NULL; ++ ++ t16 = le16_to_cpu(attr->nres.run_off); ++ if (t16 > asize) ++ return NULL; ++ ++ t32 = sizeof(short) * attr->name_len; ++ if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) ++ return NULL; ++ ++ /* Check start/end vcn. */ ++ if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1) ++ return NULL; ++ ++ data_size = le64_to_cpu(attr->nres.data_size); ++ if (le64_to_cpu(attr->nres.valid_size) > data_size) + return NULL; +- } + +- if (attr->nres.svcn || !is_attr_ext(attr)) { ++ alloc_size = le64_to_cpu(attr->nres.alloc_size); ++ if (data_size > alloc_size) ++ return NULL; ++ ++ t32 = mi->sbi->cluster_mask; ++ if (alloc_size & t32) ++ return NULL; ++ ++ if (!attr->nres.svcn && is_attr_ext(attr)) { ++ /* First segment of sparse/compressed attribute */ ++ if (asize + 8 < SIZEOF_NONRESIDENT_EX) ++ return NULL; ++ ++ tot_size = le64_to_cpu(attr->nres.total_size); ++ if (tot_size & t32) ++ return NULL; ++ ++ if (tot_size > alloc_size) ++ return NULL; ++ } else { + if (asize + 8 < SIZEOF_NONRESIDENT) + return NULL; + + if (attr->nres.c_unit) + return NULL; +- } else if (asize + 8 < SIZEOF_NONRESIDENT_EX) +- return NULL; ++ } + + return attr; + } +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-add-more-info-into-proc-fs-ntfs3-dev-volinf.patch b/queue-6.5/fs-ntfs3-add-more-info-into-proc-fs-ntfs3-dev-volinf.patch new file mode 100644 index 00000000000..b6fc68cac98 --- /dev/null +++ b/queue-6.5/fs-ntfs3-add-more-info-into-proc-fs-ntfs3-dev-volinf.patch @@ -0,0 +1,49 @@ +From ded7ca210b52a536338a974f843504a2bfb109ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 10:54:07 +0300 +Subject: fs/ntfs3: Add more info into /proc/fs/ntfs3//volinfo + +From: Konstantin Komarov + +[ Upstream commit d27e202b9ac416e52093edf8789614d93dbd6231 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 9124d74ea676b..d699819c70a14 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -453,15 +453,23 @@ static struct proc_dir_entry *proc_info_root; + * ntfs3.1 + * cluster size + * number of clusters ++ * total number of mft records ++ * number of used mft records ~= number of files + folders ++ * real state of ntfs "dirty"/"clean" ++ * current state of ntfs "dirty"/"clean" + */ + static int ntfs3_volinfo(struct seq_file *m, void *o) + { + struct super_block *sb = m->private; + struct ntfs_sb_info *sbi = sb->s_fs_info; + +- seq_printf(m, "ntfs%d.%d\n%u\n%zu\n", sbi->volume.major_ver, +- sbi->volume.minor_ver, sbi->cluster_size, +- sbi->used.bitmap.nbits); ++ seq_printf(m, "ntfs%d.%d\n%u\n%zu\n\%zu\n%zu\n%s\n%s\n", ++ sbi->volume.major_ver, sbi->volume.minor_ver, ++ sbi->cluster_size, sbi->used.bitmap.nbits, ++ sbi->mft.bitmap.nbits, ++ sbi->mft.bitmap.nbits - wnd_zeroes(&sbi->mft.bitmap), ++ sbi->volume.real_dirty ? "dirty" : "clean", ++ (sbi->volume.flags & VOLUME_FLAG_DIRTY) ? "dirty" : "clean"); + + return 0; + } +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-avoid-possible-memory-leak.patch b/queue-6.5/fs-ntfs3-avoid-possible-memory-leak.patch new file mode 100644 index 00000000000..472f5ca8ec9 --- /dev/null +++ b/queue-6.5/fs-ntfs3-avoid-possible-memory-leak.patch @@ -0,0 +1,41 @@ +From a182ef4f1b9d3c41917dc7ea5488a83f1e70812e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 12:48:07 +0800 +Subject: fs/ntfs3: Avoid possible memory leak + +From: Su Hui + +[ Upstream commit e4494770a5cad3c9d1d2a65ed15d07656c0d9b82 ] + +smatch warn: +fs/ntfs3/fslog.c:2172 last_log_lsn() warn: possible memory leak of 'page_bufs' +Jump to label 'out' to free 'page_bufs' and is more consistent with +other code. + +Signed-off-by: Su Hui +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fslog.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 12f28cdf5c838..98ccb66508583 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2168,8 +2168,10 @@ static int last_log_lsn(struct ntfs_log *log) + + if (!page) { + page = kmalloc(log->page_size, GFP_NOFS); +- if (!page) +- return -ENOMEM; ++ if (!page) { ++ err = -ENOMEM; ++ goto out; ++ } + } + + /* +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-do-not-allow-to-change-label-if-volume-is-r.patch b/queue-6.5/fs-ntfs3-do-not-allow-to-change-label-if-volume-is-r.patch new file mode 100644 index 00000000000..84d7e79e81e --- /dev/null +++ b/queue-6.5/fs-ntfs3-do-not-allow-to-change-label-if-volume-is-r.patch @@ -0,0 +1,36 @@ +From 1fa262012ef0df005e1082fbd81e7104432ed736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 10:56:15 +0300 +Subject: fs/ntfs3: Do not allow to change label if volume is read-only + +From: Konstantin Komarov + +[ Upstream commit e52dce610a2d53bf2b5e94a8843c71cb73a91ea5 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index d699819c70a14..32c5de5699929 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -498,7 +498,12 @@ static ssize_t ntfs3_label_write(struct file *file, const char __user *buffer, + struct super_block *sb = pde_data(file_inode(file)); + struct ntfs_sb_info *sbi = sb->s_fs_info; + ssize_t ret = count; +- u8 *label = kmalloc(count, GFP_NOFS); ++ u8 *label; ++ ++ if (sb_rdonly(sb)) ++ return -EROFS; ++ ++ label = kmalloc(count, GFP_NOFS); + + if (!label) + return -ENOMEM; +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-fix-alternative-boot-searching.patch b/queue-6.5/fs-ntfs3-fix-alternative-boot-searching.patch new file mode 100644 index 00000000000..b20bd6dcf81 --- /dev/null +++ b/queue-6.5/fs-ntfs3-fix-alternative-boot-searching.patch @@ -0,0 +1,61 @@ +From a8afe472f0ef5529982eed5769902cad08830409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 13:12:11 +0300 +Subject: fs/ntfs3: Fix alternative boot searching + +From: Konstantin Komarov + +[ Upstream commit dcc852e509a4cba0ac6ac734077cef260e4e0fe6 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index bcb17a1723465..9124d74ea676b 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -838,7 +838,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + struct ntfs_sb_info *sbi = sb->s_fs_info; + int err; + u32 mb, gb, boot_sector_size, sct_per_clst, record_size; +- u64 sectors, clusters, mlcn, mlcn2; ++ u64 sectors, clusters, mlcn, mlcn2, dev_size0; + struct NTFS_BOOT *boot; + struct buffer_head *bh; + struct MFT_REC *rec; +@@ -847,6 +847,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + u32 boot_off = 0; + const char *hint = "Primary boot"; + ++ /* Save original dev_size. Used with alternative boot. */ ++ dev_size0 = dev_size; ++ + sbi->volume.blocks = dev_size >> PAGE_SHIFT; + + bh = ntfs_bread(sb, 0); +@@ -1084,9 +1087,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + } + + out: +- if (err == -EINVAL && !bh->b_blocknr && dev_size > PAGE_SHIFT) { ++ if (err == -EINVAL && !bh->b_blocknr && dev_size0 > PAGE_SHIFT) { + u32 block_size = min_t(u32, sector_size, PAGE_SIZE); +- u64 lbo = dev_size - sizeof(*boot); ++ u64 lbo = dev_size0 - sizeof(*boot); + + /* + * Try alternative boot (last sector) +@@ -1100,6 +1103,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + boot_off = lbo & (block_size - 1); + hint = "Alternative boot"; ++ dev_size = dev_size0; /* restore original size. */ + goto check_boot; + } + brelse(bh); +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-fix-directory-element-type-detection.patch b/queue-6.5/fs-ntfs3-fix-directory-element-type-detection.patch new file mode 100644 index 00000000000..25bde073429 --- /dev/null +++ b/queue-6.5/fs-ntfs3-fix-directory-element-type-detection.patch @@ -0,0 +1,44 @@ +From cef686905c1307b6d0193ba2bc11d251e82032eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Sep 2023 21:50:32 -0700 +Subject: fs/ntfs3: Fix directory element type detection + +From: Gabriel Marcano + +[ Upstream commit 85a4780dc96ed9dd643bbadf236552b3320fae26 ] + +Calling stat() from userspace correctly identified junctions in an NTFS +partition as symlinks, but using readdir() and iterating through the +directory containing the same junction did not identify the junction +as a symlink. + +When emitting directory contents, check FILE_ATTRIBUTE_REPARSE_POINT +attribute to detect junctions and report them as links. + +Signed-off-by: Gabriel Marcano +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 063a6654199bc..ec0566b322d5d 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -309,7 +309,11 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + return 0; + } + +- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; ++ /* NTFS: symlinks are "dir + reparse" or "file + reparse" */ ++ if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) ++ dt_type = DT_LNK; ++ else ++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG; + + return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type); + } +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch b/queue-6.5/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch new file mode 100644 index 00000000000..a3f3c066337 --- /dev/null +++ b/queue-6.5/fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch @@ -0,0 +1,36 @@ +From 754890c5d464d686722c051cbbd70c849a93b425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:28:11 +0300 +Subject: fs/ntfs3: Fix NULL pointer dereference on error in + attr_allocate_frame() + +From: Konstantin Komarov + +[ Upstream commit 9c689c8dc86f8ca99bf91c05f24c8bab38fe7d5f ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index a9d82bbb4729e..0b52bc9681085 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1736,10 +1736,8 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + le_b = NULL; + attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL, + 0, NULL, &mi_b); +- if (!attr_b) { +- err = -ENOENT; +- goto out; +- } ++ if (!attr_b) ++ return -ENOENT; + + attr = attr_b; + le = le_b; +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch b/queue-6.5/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch new file mode 100644 index 00000000000..1af34cba3b2 --- /dev/null +++ b/queue-6.5/fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch @@ -0,0 +1,31 @@ +From 252fc9734eb77947243a701d441831f3522df159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Sep 2023 11:19:08 +0300 +Subject: fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr() + +From: Konstantin Komarov + +[ Upstream commit 32e9212256b88f35466642f9c939bb40cfb2c2de ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 8f34d6472ddbd..05fb3dbe39076 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -2148,7 +2148,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) + + for (i = 0; i < pages_per_frame; i++) { + pg = pages[i]; +- if (i == idx) ++ if (i == idx || !pg) + continue; + unlock_page(pg); + put_page(pg); +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch b/queue-6.5/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch new file mode 100644 index 00000000000..92059fea7f9 --- /dev/null +++ b/queue-6.5/fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch @@ -0,0 +1,80 @@ +From 313e441f5949eecea6f9e69a4b2c6845ccaaee38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 16:12:58 +0400 +Subject: fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) + +From: Konstantin Komarov + +[ Upstream commit fc471e39e38fea6677017cbdd6d928088a59fc67 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrlist.c | 15 +++++++++++++-- + fs/ntfs3/bitmap.c | 3 ++- + fs/ntfs3/super.c | 2 +- + 3 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c +index 42631b31adf17..7c01735d1219d 100644 +--- a/fs/ntfs3/attrlist.c ++++ b/fs/ntfs3/attrlist.c +@@ -52,7 +52,8 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + + if (!attr->non_res) { + lsize = le32_to_cpu(attr->res.data_size); +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is resident: lsize < record_size (1K or 4K) */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +@@ -80,7 +81,17 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr) + if (err < 0) + goto out; + +- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN); ++ /* attr is nonresident. ++ * The worst case: ++ * 1T (2^40) extremely fragmented file. ++ * cluster = 4K (2^12) => 2^28 fragments ++ * 2^9 fragments per one record => 2^19 records ++ * 2^5 bytes of ATTR_LIST_ENTRY per one record => 2^24 bytes. ++ * ++ * the result is 16M bytes per attribute list. ++ * Use kvmalloc to allocate in range [several Kbytes - dozen Mbytes] ++ */ ++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL); + if (!le) { + err = -ENOMEM; + goto out; +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index 107e808e06eae..d66055e30aff9 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -659,7 +659,8 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits) + wnd->bits_last = wbits; + + wnd->free_bits = +- kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN); ++ kvmalloc_array(wnd->nwnd, sizeof(u16), GFP_KERNEL | __GFP_ZERO); ++ + if (!wnd->free_bits) + return -ENOMEM; + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index d6b5170253a69..bcb17a1723465 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -1388,7 +1388,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + } + + bytes = inode->i_size; +- sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN); ++ sbi->def_table = t = kvmalloc(bytes, GFP_KERNEL); + if (!t) { + err = -ENOMEM; + goto put_inode_out; +-- +2.42.0 + diff --git a/queue-6.5/fs-ntfs3-write-immediately-updated-ntfs-state.patch b/queue-6.5/fs-ntfs3-write-immediately-updated-ntfs-state.patch new file mode 100644 index 00000000000..4b532258ae5 --- /dev/null +++ b/queue-6.5/fs-ntfs3-write-immediately-updated-ntfs-state.patch @@ -0,0 +1,44 @@ +From 68176d4f8b6c21174e0cab5f3c7e3c707a4dbb4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 15:57:19 +0400 +Subject: fs/ntfs3: Write immediately updated ntfs state + +From: Konstantin Komarov + +[ Upstream commit 06ccfb00645990a9fcc14249e6d1c25921ecb836 ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 9ddb2ab23b954..fbfe21dbb4259 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -983,18 +983,11 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty) + if (err) + return err; + +- mark_inode_dirty(&ni->vfs_inode); ++ mark_inode_dirty_sync(&ni->vfs_inode); + /* verify(!ntfs_update_mftmirr()); */ + +- /* +- * If we used wait=1, sync_inode_metadata waits for the io for the +- * inode to finish. It hangs when media is removed. +- * So wait=0 is sent down to sync_inode_metadata +- * and filemap_fdatawrite is used for the data blocks. +- */ +- err = sync_inode_metadata(&ni->vfs_inode, 0); +- if (!err) +- err = filemap_fdatawrite(ni->vfs_inode.i_mapping); ++ /* write mft record on disk. */ ++ err = _ni_write_inode(&ni->vfs_inode, 1); + + return err; + } +-- +2.42.0 + diff --git a/queue-6.5/gpu-drm-eliminate-drm_sched_priority_unset.patch b/queue-6.5/gpu-drm-eliminate-drm_sched_priority_unset.patch new file mode 100644 index 00000000000..7bdcf9cd44b --- /dev/null +++ b/queue-6.5/gpu-drm-eliminate-drm_sched_priority_unset.patch @@ -0,0 +1,59 @@ +From d9bcf22d72c63cd767cd6013a55225b58f971546 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Oct 2023 22:48:56 -0400 +Subject: gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luben Tuikov + +[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ] + +Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was +amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it +calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to +index sched->sched_rq[]. + +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Luben Tuikov +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tuikov@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++- + include/drm/gpu_scheduler.h | 3 +-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index 092962b93064f..aac52d9754e6d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio) + { + switch (ctx_prio) { + case AMDGPU_CTX_PRIORITY_UNSET: +- return DRM_SCHED_PRIORITY_UNSET; ++ pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL"); ++ return DRM_SCHED_PRIORITY_NORMAL; + + case AMDGPU_CTX_PRIORITY_VERY_LOW: + return DRM_SCHED_PRIORITY_MIN; +diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h +index f9544d9b670d3..ac65f0626cfc9 100644 +--- a/include/drm/gpu_scheduler.h ++++ b/include/drm/gpu_scheduler.h +@@ -68,8 +68,7 @@ enum drm_sched_priority { + DRM_SCHED_PRIORITY_HIGH, + DRM_SCHED_PRIORITY_KERNEL, + +- DRM_SCHED_PRIORITY_COUNT, +- DRM_SCHED_PRIORITY_UNSET = -2 ++ DRM_SCHED_PRIORITY_COUNT + }; + + /* Used to chose between FIFO and RR jobs scheduling */ +-- +2.42.0 + diff --git a/queue-6.5/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch b/queue-6.5/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch new file mode 100644 index 00000000000..504cc76c399 --- /dev/null +++ b/queue-6.5/input-synaptics-rmi4-handle-reset-delay-when-using-s.patch @@ -0,0 +1,135 @@ +From ec817059f9ec49000f74b8fd217120ca8b86757f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 17:29:57 -0700 +Subject: Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport + +From: Dmitry Torokhov + +[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ] + +Touch controllers need some time after receiving reset command for the +firmware to finish re-initializing and be ready to respond to commands +from the host. The driver already had handling for the post-reset delay +for I2C and SPI transports, this change adds the handling to +SMBus-connected devices. + +SMBus devices are peculiar because they implement legacy PS/2 +compatibility mode, so reset is actually issued by psmouse driver on the +associated serio port, after which the control is passed to the RMI4 +driver with SMBus companion device. + +Note that originally the delay was added to psmouse driver in +92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus +mode"), but that resulted in an unwanted delay in "fast" reconnect +handler for the serio port, so it was decided to revert the patch and +have the delay being handled in the RMI4 driver, similar to the other +transports. + +Tested-by: Jeffery Miller +Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + drivers/input/rmi4/rmi_smbus.c | 50 ++++++++++++++++++--------------- + 2 files changed, 29 insertions(+), 22 deletions(-) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index cefc74b3b34b1..22d16d80efb93 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1753,6 +1753,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse, + psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) && + !SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10); + const struct rmi_device_platform_data pdata = { ++ .reset_delay_ms = 30, + .sensor_pdata = { + .sensor_type = rmi_sensor_touchpad, + .axis_align.flip_y = true, +diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c +index 7059a2762aebc..b0b099b5528a8 100644 +--- a/drivers/input/rmi4/rmi_smbus.c ++++ b/drivers/input/rmi4/rmi_smbus.c +@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb) + + static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb) + { +- int retval; ++ struct i2c_client *client = rmi_smb->client; ++ int smbus_version; ++ ++ /* ++ * psmouse driver resets the controller, we only need to wait ++ * to give the firmware chance to fully reinitialize. ++ */ ++ if (rmi_smb->xport.pdata.reset_delay_ms) ++ msleep(rmi_smb->xport.pdata.reset_delay_ms); + + /* we need to get the smbus version to activate the touchpad */ +- retval = rmi_smb_get_version(rmi_smb); +- if (retval < 0) +- return retval; ++ smbus_version = rmi_smb_get_version(rmi_smb); ++ if (smbus_version < 0) ++ return smbus_version; ++ ++ rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", ++ smbus_version); ++ ++ if (smbus_version != 2 && smbus_version != 3) { ++ dev_err(&client->dev, "Unrecognized SMB version %d\n", ++ smbus_version); ++ return -ENODEV; ++ } + + return 0; + } +@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr) + rmi_smb_clear_state(rmi_smb); + + /* +- * we do not call the actual reset command, it has to be handled in +- * PS/2 or there will be races between PS/2 and SMBus. +- * PS/2 should ensure that a psmouse_reset is called before +- * intializing the device and after it has been removed to be in a known +- * state. ++ * We do not call the actual reset command, it has to be handled in ++ * PS/2 or there will be races between PS/2 and SMBus. PS/2 should ++ * ensure that a psmouse_reset is called before initializing the ++ * device and after it has been removed to be in a known state. + */ + return rmi_smb_enable_smbus_mode(rmi_smb); + } +@@ -272,7 +288,6 @@ static int rmi_smb_probe(struct i2c_client *client) + { + struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev); + struct rmi_smb_xport *rmi_smb; +- int smbus_version; + int error; + + if (!pdata) { +@@ -311,18 +326,9 @@ static int rmi_smb_probe(struct i2c_client *client) + rmi_smb->xport.proto_name = "smb"; + rmi_smb->xport.ops = &rmi_smb_ops; + +- smbus_version = rmi_smb_get_version(rmi_smb); +- if (smbus_version < 0) +- return smbus_version; +- +- rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d", +- smbus_version); +- +- if (smbus_version != 2 && smbus_version != 3) { +- dev_err(&client->dev, "Unrecognized SMB version %d\n", +- smbus_version); +- return -ENODEV; +- } ++ error = rmi_smb_enable_smbus_mode(rmi_smb); ++ if (error) ++ return error; + + i2c_set_clientdata(client, rmi_smb); + +-- +2.42.0 + diff --git a/queue-6.5/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch b/queue-6.5/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch new file mode 100644 index 00000000000..646a6fdc50a --- /dev/null +++ b/queue-6.5/io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch @@ -0,0 +1,42 @@ +From 3deefa3702639c3bd717ca56fc79b93391e1ca77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Aug 2023 18:47:31 -0400 +Subject: io_uring: kiocb_done() should *not* trust ->ki_pos if + ->{read,write}_iter() failed + +From: Al Viro + +[ Upstream commit 1939316bf988f3e49a07d9c4dd6f660bf4daa53d ] + +->ki_pos value is unreliable in such cases. For an obvious example, +consider O_DSYNC write - we feed the data to page cache and start IO, +then we make sure it's completed. Update of ->ki_pos is dealt with +by the first part; failure in the second ends up with negative value +returned _and_ ->ki_pos left advanced as if sync had been successful. +In the same situation write(2) does not advance the file position +at all. + +Reviewed-by: Christian Brauner +Reviewed-by: Jens Axboe +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + io_uring/rw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/io_uring/rw.c b/io_uring/rw.c +index 1bce2208b65c4..d61620e080d10 100644 +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -332,7 +332,7 @@ static int kiocb_done(struct io_kiocb *req, ssize_t ret, + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + unsigned final_ret = io_fixup_rw_res(req, ret); + +- if (req->flags & REQ_F_CUR_POS) ++ if (ret >= 0 && req->flags & REQ_F_CUR_POS) + req->file->f_pos = rw->kiocb.ki_pos; + if (ret >= 0 && (rw->kiocb.ki_complete == io_complete_rw)) { + if (!__io_complete_rw_common(req, ret)) { +-- +2.42.0 + diff --git a/queue-6.5/irqchip-gic-v3-enable-non-coherent-redistributors-it.patch b/queue-6.5/irqchip-gic-v3-enable-non-coherent-redistributors-it.patch new file mode 100644 index 00000000000..b35c05eea45 --- /dev/null +++ b/queue-6.5/irqchip-gic-v3-enable-non-coherent-redistributors-it.patch @@ -0,0 +1,155 @@ +From 5c1c46b9ed23f469499b21a5cf1619bade02b4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 14:59:26 +0200 +Subject: irqchip/gic-v3: Enable non-coherent redistributors/ITSes DT probing + +From: Lorenzo Pieralisi + +[ Upstream commit 3a0fff0fb6a3861fa05416f21858cf0c75cbf944 ] + +The GIC architecture specification defines a set of registers +for redistributors and ITSes that control the sharebility and +cacheability attributes of redistributors/ITSes initiator ports +on the interconnect (GICR_[V]PROPBASER, GICR_[V]PENDBASER, +GITS_BASER). + +Architecturally the GIC provides a means to drive shareability +and cacheability attributes signals and related IWB/OWB/ISH barriers +but it is not mandatory for designs to wire up the corresponding +interconnect signals that control the cacheability/shareability +of transactions. + +Redistributors and ITSes interconnect ports can be connected to +non-coherent interconnects that are not able to manage the +shareability/cacheability attributes; this implicitly makes +the redistributors and ITSes non-coherent observers. + +So far, the GIC driver on probe executes a write to "probe" for +the redistributors and ITSes registers shareability bitfields +by writing a value (ie InnerShareable - the shareability domain the +CPUs are in) and check it back to detect whether the value sticks or +not; this hinges on a GIC programming model behaviour that predates the +current specifications, that just define shareability bits as writeable +but do not guarantee that writing certain shareability values +enable the expected behaviour for the redistributors/ITSes +memory interconnect ports. + +To enable non-coherent GIC designs, introduce the "dma-noncoherent" +device tree property to allow firmware to describe redistributors and +ITSes as non-coherent observers on the memory interconnect and use the +property to force the shareability attributes to be programmed into the +redistributors and ITSes registers through the GIC quirks mechanism. + +Signed-off-by: Lorenzo Pieralisi +Cc: Robin Murphy +Cc: Mark Rutland +Cc: Marc Zyngier +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231006125929.48591-3-lpieralisi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-common.h | 4 ++++ + drivers/irqchip/irq-gic-v3-its.c | 21 +++++++++++++++++---- + drivers/irqchip/irq-gic-v3.c | 13 +++++++++++++ + 3 files changed, 34 insertions(+), 4 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-common.h b/drivers/irqchip/irq-gic-common.h +index 3db4592cda1c0..f407cce9ecaaa 100644 +--- a/drivers/irqchip/irq-gic-common.h ++++ b/drivers/irqchip/irq-gic-common.h +@@ -29,4 +29,8 @@ void gic_enable_quirks(u32 iidr, const struct gic_quirk *quirks, + void gic_enable_of_quirks(const struct device_node *np, + const struct gic_quirk *quirks, void *data); + ++#define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) ++#define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) ++#define RDIST_FLAGS_FORCE_NON_SHAREABLE (1 << 2) ++ + #endif /* _IRQ_GIC_COMMON_H */ +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 5e57b605b7c61..75a2dd550625b 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -44,10 +44,6 @@ + #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) + #define ITS_FLAGS_FORCE_NON_SHAREABLE (1ULL << 3) + +-#define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) +-#define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) +-#define RDIST_FLAGS_FORCE_NON_SHAREABLE (1 << 2) +- + #define RD_LOCAL_LPI_ENABLED BIT(0) + #define RD_LOCAL_PENDTABLE_PREALLOCATED BIT(1) + #define RD_LOCAL_MEMRESERVE_DONE BIT(2) +@@ -4754,6 +4750,14 @@ static bool __maybe_unused its_enable_rk3588001(void *data) + return true; + } + ++static bool its_set_non_coherent(void *data) ++{ ++ struct its_node *its = data; ++ ++ its->flags |= ITS_FLAGS_FORCE_NON_SHAREABLE; ++ return true; ++} ++ + static const struct gic_quirk its_quirks[] = { + #ifdef CONFIG_CAVIUM_ERRATUM_22375 + { +@@ -4808,6 +4812,11 @@ static const struct gic_quirk its_quirks[] = { + .init = its_enable_rk3588001, + }, + #endif ++ { ++ .desc = "ITS: non-coherent attribute", ++ .property = "dma-noncoherent", ++ .init = its_set_non_coherent, ++ }, + { + } + }; +@@ -4817,6 +4826,10 @@ static void its_enable_quirks(struct its_node *its) + u32 iidr = readl_relaxed(its->base + GITS_IIDR); + + gic_enable_quirks(iidr, its_quirks, its); ++ ++ if (is_of_node(its->fwnode_handle)) ++ gic_enable_of_quirks(to_of_node(its->fwnode_handle), ++ its_quirks, its); + } + + static int its_save_disable(void) +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index eedfa8e9f0772..f59ac9586b7b1 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -1857,6 +1857,14 @@ static bool gic_enable_quirk_arm64_2941627(void *data) + return true; + } + ++static bool rd_set_non_coherent(void *data) ++{ ++ struct gic_chip_data *d = data; ++ ++ d->rdists.flags |= RDIST_FLAGS_FORCE_NON_SHAREABLE; ++ return true; ++} ++ + static const struct gic_quirk gic_quirks[] = { + { + .desc = "GICv3: Qualcomm MSM8996 broken firmware", +@@ -1923,6 +1931,11 @@ static const struct gic_quirk gic_quirks[] = { + .mask = 0xff0f0fff, + .init = gic_enable_quirk_arm64_2941627, + }, ++ { ++ .desc = "GICv3: non-coherent attribute", ++ .property = "dma-noncoherent", ++ .init = rd_set_non_coherent, ++ }, + { + } + }; +-- +2.42.0 + diff --git a/queue-6.5/irqchip-gic-v3-its-split-allocation-from-initialisat.patch b/queue-6.5/irqchip-gic-v3-its-split-allocation-from-initialisat.patch new file mode 100644 index 00000000000..a0fc87c66b3 --- /dev/null +++ b/queue-6.5/irqchip-gic-v3-its-split-allocation-from-initialisat.patch @@ -0,0 +1,325 @@ +From ee23f0cc29b3721d4b3540d792be83ae1e71031e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 14:59:27 +0200 +Subject: irqchip/gic-v3-its: Split allocation from initialisation of its_node + +From: Marc Zyngier + +[ Upstream commit 9585a495ac936049dba141e8f9d99159ca06d46a ] + +In order to pave the way for more fancy quirk handling without making +more of a mess of this terrible driver, split the allocation of the +ITS descriptor (its_node) from the actual probing. + +This will allow firmware-specific hooks to be added between these +two points. + +Signed-off-by: Marc Zyngier +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231006125929.48591-4-lpieralisi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-its.c | 149 ++++++++++++++++++------------- + 1 file changed, 89 insertions(+), 60 deletions(-) + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index e0c2b10d154d6..5e57b605b7c61 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -4952,7 +4952,7 @@ static void __init __iomem *its_map_one(struct resource *res, int *err) + return NULL; + } + +-static int its_init_domain(struct fwnode_handle *handle, struct its_node *its) ++static int its_init_domain(struct its_node *its) + { + struct irq_domain *inner_domain; + struct msi_domain_info *info; +@@ -4966,7 +4966,7 @@ static int its_init_domain(struct fwnode_handle *handle, struct its_node *its) + + inner_domain = irq_domain_create_hierarchy(its_parent, + its->msi_domain_flags, 0, +- handle, &its_domain_ops, ++ its->fwnode_handle, &its_domain_ops, + info); + if (!inner_domain) { + kfree(info); +@@ -5017,8 +5017,7 @@ static int its_init_vpe_domain(void) + return 0; + } + +-static int __init its_compute_its_list_map(struct resource *res, +- void __iomem *its_base) ++static int __init its_compute_its_list_map(struct its_node *its) + { + int its_number; + u32 ctlr; +@@ -5032,15 +5031,15 @@ static int __init its_compute_its_list_map(struct resource *res, + its_number = find_first_zero_bit(&its_list_map, GICv4_ITS_LIST_MAX); + if (its_number >= GICv4_ITS_LIST_MAX) { + pr_err("ITS@%pa: No ITSList entry available!\n", +- &res->start); ++ &its->phys_base); + return -EINVAL; + } + +- ctlr = readl_relaxed(its_base + GITS_CTLR); ++ ctlr = readl_relaxed(its->base + GITS_CTLR); + ctlr &= ~GITS_CTLR_ITS_NUMBER; + ctlr |= its_number << GITS_CTLR_ITS_NUMBER_SHIFT; +- writel_relaxed(ctlr, its_base + GITS_CTLR); +- ctlr = readl_relaxed(its_base + GITS_CTLR); ++ writel_relaxed(ctlr, its->base + GITS_CTLR); ++ ctlr = readl_relaxed(its->base + GITS_CTLR); + if ((ctlr & GITS_CTLR_ITS_NUMBER) != (its_number << GITS_CTLR_ITS_NUMBER_SHIFT)) { + its_number = ctlr & GITS_CTLR_ITS_NUMBER; + its_number >>= GITS_CTLR_ITS_NUMBER_SHIFT; +@@ -5048,75 +5047,50 @@ static int __init its_compute_its_list_map(struct resource *res, + + if (test_and_set_bit(its_number, &its_list_map)) { + pr_err("ITS@%pa: Duplicate ITSList entry %d\n", +- &res->start, its_number); ++ &its->phys_base, its_number); + return -EINVAL; + } + + return its_number; + } + +-static int __init its_probe_one(struct resource *res, +- struct fwnode_handle *handle, int numa_node) ++static int __init its_probe_one(struct its_node *its) + { +- struct its_node *its; +- void __iomem *its_base; +- u64 baser, tmp, typer; ++ u64 baser, tmp; + struct page *page; + u32 ctlr; + int err; + +- its_base = its_map_one(res, &err); +- if (!its_base) +- return err; +- +- pr_info("ITS %pR\n", res); +- +- its = kzalloc(sizeof(*its), GFP_KERNEL); +- if (!its) { +- err = -ENOMEM; +- goto out_unmap; +- } +- +- raw_spin_lock_init(&its->lock); +- mutex_init(&its->dev_alloc_lock); +- INIT_LIST_HEAD(&its->entry); +- INIT_LIST_HEAD(&its->its_device_list); +- typer = gic_read_typer(its_base + GITS_TYPER); +- its->typer = typer; +- its->base = its_base; +- its->phys_base = res->start; + if (is_v4(its)) { +- if (!(typer & GITS_TYPER_VMOVP)) { +- err = its_compute_its_list_map(res, its_base); ++ if (!(its->typer & GITS_TYPER_VMOVP)) { ++ err = its_compute_its_list_map(its); + if (err < 0) +- goto out_free_its; ++ goto out; + + its->list_nr = err; + + pr_info("ITS@%pa: Using ITS number %d\n", +- &res->start, err); ++ &its->phys_base, err); + } else { +- pr_info("ITS@%pa: Single VMOVP capable\n", &res->start); ++ pr_info("ITS@%pa: Single VMOVP capable\n", &its->phys_base); + } + + if (is_v4_1(its)) { +- u32 svpet = FIELD_GET(GITS_TYPER_SVPET, typer); ++ u32 svpet = FIELD_GET(GITS_TYPER_SVPET, its->typer); + +- its->sgir_base = ioremap(res->start + SZ_128K, SZ_64K); ++ its->sgir_base = ioremap(its->phys_base + SZ_128K, SZ_64K); + if (!its->sgir_base) { + err = -ENOMEM; +- goto out_free_its; ++ goto out; + } + +- its->mpidr = readl_relaxed(its_base + GITS_MPIDR); ++ its->mpidr = readl_relaxed(its->base + GITS_MPIDR); + + pr_info("ITS@%pa: Using GICv4.1 mode %08x %08x\n", +- &res->start, its->mpidr, svpet); ++ &its->phys_base, its->mpidr, svpet); + } + } + +- its->numa_node = numa_node; +- + page = alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO, + get_order(ITS_CMD_QUEUE_SZ)); + if (!page) { +@@ -5125,12 +5099,9 @@ static int __init its_probe_one(struct resource *res, + } + its->cmd_base = (void *)page_address(page); + its->cmd_write = its->cmd_base; +- its->fwnode_handle = handle; + its->get_msi_base = its_irq_get_msi_base; + its->msi_domain_flags = IRQ_DOMAIN_FLAG_ISOLATED_MSI; + +- its_enable_quirks(its); +- + err = its_alloc_tables(its); + if (err) + goto out_free_cmd; +@@ -5174,7 +5145,7 @@ static int __init its_probe_one(struct resource *res, + ctlr |= GITS_CTLR_ImDe; + writel_relaxed(ctlr, its->base + GITS_CTLR); + +- err = its_init_domain(handle, its); ++ err = its_init_domain(its); + if (err) + goto out_free_tables; + +@@ -5191,11 +5162,8 @@ static int __init its_probe_one(struct resource *res, + out_unmap_sgir: + if (its->sgir_base) + iounmap(its->sgir_base); +-out_free_its: +- kfree(its); +-out_unmap: +- iounmap(its_base); +- pr_err("ITS@%pa: failed probing (%d)\n", &res->start, err); ++out: ++ pr_err("ITS@%pa: failed probing (%d)\n", &its->phys_base, err); + return err; + } + +@@ -5356,10 +5324,53 @@ static const struct of_device_id its_device_id[] = { + {}, + }; + ++static struct its_node __init *its_node_init(struct resource *res, ++ struct fwnode_handle *handle, int numa_node) ++{ ++ void __iomem *its_base; ++ struct its_node *its; ++ int err; ++ ++ its_base = its_map_one(res, &err); ++ if (!its_base) ++ return NULL; ++ ++ pr_info("ITS %pR\n", res); ++ ++ its = kzalloc(sizeof(*its), GFP_KERNEL); ++ if (!its) ++ goto out_unmap; ++ ++ raw_spin_lock_init(&its->lock); ++ mutex_init(&its->dev_alloc_lock); ++ INIT_LIST_HEAD(&its->entry); ++ INIT_LIST_HEAD(&its->its_device_list); ++ ++ its->typer = gic_read_typer(its_base + GITS_TYPER); ++ its->base = its_base; ++ its->phys_base = res->start; ++ ++ its->numa_node = numa_node; ++ its->fwnode_handle = handle; ++ ++ return its; ++ ++out_unmap: ++ iounmap(its_base); ++ return NULL; ++} ++ ++static void its_node_destroy(struct its_node *its) ++{ ++ iounmap(its->base); ++ kfree(its); ++} ++ + static int __init its_of_probe(struct device_node *node) + { + struct device_node *np; + struct resource res; ++ int err; + + /* + * Make sure *all* the ITS are reset before we probe any, as +@@ -5369,8 +5380,6 @@ static int __init its_of_probe(struct device_node *node) + */ + for (np = of_find_matching_node(node, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { +- int err; +- + if (!of_device_is_available(np) || + !of_property_read_bool(np, "msi-controller") || + of_address_to_resource(np, 0, &res)) +@@ -5383,6 +5392,8 @@ static int __init its_of_probe(struct device_node *node) + + for (np = of_find_matching_node(node, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ struct its_node *its; ++ + if (!of_device_is_available(np)) + continue; + if (!of_property_read_bool(np, "msi-controller")) { +@@ -5396,7 +5407,17 @@ static int __init its_of_probe(struct device_node *node) + continue; + } + +- its_probe_one(&res, &np->fwnode, of_node_to_nid(np)); ++ ++ its = its_node_init(&res, &np->fwnode, of_node_to_nid(np)); ++ if (!its) ++ return -ENOMEM; ++ ++ its_enable_quirks(its); ++ err = its_probe_one(its); ++ if (err) { ++ its_node_destroy(its); ++ return err; ++ } + } + return 0; + } +@@ -5508,6 +5529,7 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header, + { + struct acpi_madt_generic_translator *its_entry; + struct fwnode_handle *dom_handle; ++ struct its_node *its; + struct resource res; + int err; + +@@ -5532,11 +5554,18 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header, + goto dom_err; + } + +- err = its_probe_one(&res, dom_handle, +- acpi_get_its_numa_node(its_entry->translation_id)); ++ its = its_node_init(&res, dom_handle, ++ acpi_get_its_numa_node(its_entry->translation_id)); ++ if (!its) { ++ err = -ENOMEM; ++ goto node_err; ++ } ++ ++ err = its_probe_one(its); + if (!err) + return 0; + ++node_err: + iort_deregister_domain_token(its_entry->translation_id); + dom_err: + irq_domain_free_fwnode(dom_handle); +-- +2.42.0 + diff --git a/queue-6.5/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch b/queue-6.5/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch new file mode 100644 index 00000000000..d78bd0ee82e --- /dev/null +++ b/queue-6.5/irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch @@ -0,0 +1,54 @@ +From 5688956cfeb9ecd6385b32c1c3c5fcb9386634ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 10:13:51 +0530 +Subject: irqchip/riscv-intc: Mark all INTC nodes as initialized + +From: Anup Patel + +[ Upstream commit e13cd66bd821be417c498a34928652db4ac6b436 ] + +The RISC-V INTC local interrupts are per-HART (or per-CPU) so we +create INTC IRQ domain only for the INTC node belonging to the boot +HART. This means only the boot HART INTC node will be marked as +initialized and other INTC nodes won't be marked which results +downstream interrupt controllers (such as PLIC, IMSIC and APLIC +direct-mode) not being probed due to missing device suppliers. + +To address this issue, we mark all INTC node for which we don't +create IRQ domain as initialized. + +Reported-by: Dmitry Dunaev +Signed-off-by: Anup Patel +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru +Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-riscv-intc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c +index 4adeee1bc391f..e8d01b14ccdde 100644 +--- a/drivers/irqchip/irq-riscv-intc.c ++++ b/drivers/irqchip/irq-riscv-intc.c +@@ -155,8 +155,16 @@ static int __init riscv_intc_init(struct device_node *node, + * for each INTC DT node. We only need to do INTC initialization + * for the INTC DT node belonging to boot CPU (or boot HART). + */ +- if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) ++ if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) { ++ /* ++ * The INTC nodes of each CPU are suppliers for downstream ++ * interrupt controllers (such as PLIC, IMSIC and APLIC ++ * direct-mode) so we should mark an INTC node as initialized ++ * if we are not creating IRQ domain for it. ++ */ ++ fwnode_dev_initialized(of_fwnode_handle(node), true); + return 0; ++ } + + return riscv_intc_init_common(of_node_to_fwnode(node)); + } +-- +2.42.0 + diff --git a/queue-6.5/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch b/queue-6.5/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch new file mode 100644 index 00000000000..674024c7aa5 --- /dev/null +++ b/queue-6.5/irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch @@ -0,0 +1,37 @@ +From c01328adaaa06153bec88a54ebe3a519b5b7aded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Oct 2023 12:20:03 -0400 +Subject: irqchip/stm32-exti: add missing DT IRQ flag translation + +From: Ben Wolsieffer + +[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ] + +The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger +flags specified in the device tree were being ignored. This was +preventing the RTC alarm interrupt from working, because it must be set +to trigger on the rising edge to function correctly. + +Signed-off-by: Ben Wolsieffer +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-stm32-exti.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c +index b5fa76ce5046a..cb4b195bc849a 100644 +--- a/drivers/irqchip/irq-stm32-exti.c ++++ b/drivers/irqchip/irq-stm32-exti.c +@@ -459,6 +459,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = { + .map = irq_map_generic_chip, + .alloc = stm32_exti_alloc, + .free = stm32_exti_free, ++ .xlate = irq_domain_xlate_twocell, + }; + + static void stm32_irq_ack(struct irq_data *d) +-- +2.42.0 + diff --git a/queue-6.5/loongarch-disable-wuc-for-pgprot_writecombine-like-i.patch b/queue-6.5/loongarch-disable-wuc-for-pgprot_writecombine-like-i.patch new file mode 100644 index 00000000000..96f3bcc6b09 --- /dev/null +++ b/queue-6.5/loongarch-disable-wuc-for-pgprot_writecombine-like-i.patch @@ -0,0 +1,100 @@ +From 21b95a718282aa37d187e77b07cb9b409b45202f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Disable WUC for pgprot_writecombine() like ioremap_wc() + +From: Icenowy Zheng + +[ Upstream commit 278be83601dd1725d4732241f066d528e160a39d ] + +Currently the code disables WUC only disables it for ioremap_wc(), which +is only used when mapping writecombine pages like ioremap() (mapped to +the kernel space). But for VRAM mapped in TTM/GEM, it is mapped with a +crafted pgprot by the pgprot_writecombine() function, in which case WUC +isn't disabled now. + +Disable WUC for pgprot_writecombine() (fallback to SUC) if needed, like +ioremap_wc(). + +This improves the AMDGPU driver's stability (solves some misrendering) +on Loongson-3A5000/3A6000 machines. + +Signed-off-by: Icenowy Zheng +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/io.h | 5 ++--- + arch/loongarch/include/asm/pgtable-bits.h | 4 +++- + arch/loongarch/kernel/setup.c | 10 +++++----- + 3 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/arch/loongarch/include/asm/io.h b/arch/loongarch/include/asm/io.h +index 1c94102200407..0355b64e90ed0 100644 +--- a/arch/loongarch/include/asm/io.h ++++ b/arch/loongarch/include/asm/io.h +@@ -54,10 +54,9 @@ static inline void __iomem *ioremap_prot(phys_addr_t offset, unsigned long size, + * @offset: bus address of the memory + * @size: size of the resource to map + */ +-extern pgprot_t pgprot_wc; +- + #define ioremap_wc(offset, size) \ +- ioremap_prot((offset), (size), pgprot_val(pgprot_wc)) ++ ioremap_prot((offset), (size), \ ++ pgprot_val(wc_enabled ? PAGE_KERNEL_WUC : PAGE_KERNEL_SUC)) + + #define ioremap_cache(offset, size) \ + ioremap_prot((offset), (size), pgprot_val(PAGE_KERNEL)) +diff --git a/arch/loongarch/include/asm/pgtable-bits.h b/arch/loongarch/include/asm/pgtable-bits.h +index de46a6b1e9f11..7b9ac012cd090 100644 +--- a/arch/loongarch/include/asm/pgtable-bits.h ++++ b/arch/loongarch/include/asm/pgtable-bits.h +@@ -105,13 +105,15 @@ static inline pgprot_t pgprot_noncached(pgprot_t _prot) + return __pgprot(prot); + } + ++extern bool wc_enabled; ++ + #define pgprot_writecombine pgprot_writecombine + + static inline pgprot_t pgprot_writecombine(pgprot_t _prot) + { + unsigned long prot = pgprot_val(_prot); + +- prot = (prot & ~_CACHE_MASK) | _CACHE_WUC; ++ prot = (prot & ~_CACHE_MASK) | (wc_enabled ? _CACHE_WUC : _CACHE_SUC); + + return __pgprot(prot); + } +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 9d830ab4e3025..1351614042d4e 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -161,19 +161,19 @@ static void __init smbios_parse(void) + } + + #ifdef CONFIG_ARCH_WRITECOMBINE +-pgprot_t pgprot_wc = PAGE_KERNEL_WUC; ++bool wc_enabled = true; + #else +-pgprot_t pgprot_wc = PAGE_KERNEL_SUC; ++bool wc_enabled = false; + #endif + +-EXPORT_SYMBOL(pgprot_wc); ++EXPORT_SYMBOL(wc_enabled); + + static int __init setup_writecombine(char *p) + { + if (!strcmp(p, "on")) +- pgprot_wc = PAGE_KERNEL_WUC; ++ wc_enabled = true; + else if (!strcmp(p, "off")) +- pgprot_wc = PAGE_KERNEL_SUC; ++ wc_enabled = false; + else + pr_warn("Unknown writecombine setting \"%s\".\n", p); + +-- +2.42.0 + diff --git a/queue-6.5/loongarch-export-symbol-invalid_pud_table-for-module.patch b/queue-6.5/loongarch-export-symbol-invalid_pud_table-for-module.patch new file mode 100644 index 00000000000..0fadda61b73 --- /dev/null +++ b/queue-6.5/loongarch-export-symbol-invalid_pud_table-for-module.patch @@ -0,0 +1,39 @@ +From 4fcc251faea5e9d0e37d7d5c3dbb5d10f15f3699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Export symbol invalid_pud_table for modules building + +From: Huacai Chen + +[ Upstream commit 449c2756c2323c9e32b2a2fa9c8b59ce91b5819d ] + +Export symbol invalid_pud_table for modules building (such as the KVM +module) if 4-level page tables enabled. Otherwise we get: + +ERROR: modpost: "invalid_pud_table" [arch/loongarch/kvm/kvm.ko] undefined! + +Reported-by: Randy Dunlap +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Tianrui Zhao +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/mm/init.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c +index 3b7d8129570b8..51c9a6c90a169 100644 +--- a/arch/loongarch/mm/init.c ++++ b/arch/loongarch/mm/init.c +@@ -267,6 +267,7 @@ pgd_t swapper_pg_dir[_PTRS_PER_PGD] __section(".bss..swapper_pg_dir"); + pgd_t invalid_pg_dir[_PTRS_PER_PGD] __page_aligned_bss; + #ifndef __PAGETABLE_PUD_FOLDED + pud_t invalid_pud_table[PTRS_PER_PUD] __page_aligned_bss; ++EXPORT_SYMBOL(invalid_pud_table); + #endif + #ifndef __PAGETABLE_PMD_FOLDED + pmd_t invalid_pmd_table[PTRS_PER_PMD] __page_aligned_bss; +-- +2.42.0 + diff --git a/queue-6.5/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch b/queue-6.5/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch new file mode 100644 index 00000000000..e959cf3d700 --- /dev/null +++ b/queue-6.5/loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch @@ -0,0 +1,46 @@ +From e9d7677426e5504aa74eda40592ef6c90a6dce84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Replace kmap_atomic() with kmap_local_page() in + copy_user_highpage() + +From: Huacai Chen + +[ Upstream commit 477a0ebec101359f49d92796e3b609857d564b52 ] + +Replace kmap_atomic()/kunmap_atomic() calls with kmap_local_page()/ +kunmap_local() in copy_user_highpage() which can be invoked from both +preemptible and atomic context [1]. + +[1] https://lore.kernel.org/all/20201029222652.302358281@linutronix.de/ + +Suggested-by: Deepak R Varma +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/mm/init.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c +index 51c9a6c90a169..d967d881c3fef 100644 +--- a/arch/loongarch/mm/init.c ++++ b/arch/loongarch/mm/init.c +@@ -68,11 +68,11 @@ void copy_user_highpage(struct page *to, struct page *from, + { + void *vfrom, *vto; + +- vto = kmap_atomic(to); +- vfrom = kmap_atomic(from); ++ vfrom = kmap_local_page(from); ++ vto = kmap_local_page(to); + copy_page(vto, vfrom); +- kunmap_atomic(vfrom); +- kunmap_atomic(vto); ++ kunmap_local(vfrom); ++ kunmap_local(vto); + /* Make sure this page is cleared on other CPU's too before using it */ + smp_wmb(); + } +-- +2.42.0 + diff --git a/queue-6.5/loongarch-use-sym_code_-to-annotate-exception-handle.patch b/queue-6.5/loongarch-use-sym_code_-to-annotate-exception-handle.patch new file mode 100644 index 00000000000..99d77cbee51 --- /dev/null +++ b/queue-6.5/loongarch-use-sym_code_-to-annotate-exception-handle.patch @@ -0,0 +1,237 @@ +From 021faca6a5a990f7706cb37a3402f9b5c5a0e7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 08:42:52 +0800 +Subject: LoongArch: Use SYM_CODE_* to annotate exception handlers + +From: Tiezhu Yang + +[ Upstream commit 00c2ca84c680f64b79b5e10a482ca435fd7d98ce ] + +As described in include/linux/linkage.h, + + FUNC -- C-like functions (proper stack frame etc.) + CODE -- non-C code (e.g. irq handlers with different, special stack etc.) + + SYM_FUNC_{START, END} -- use for global functions + SYM_CODE_{START, END} -- use for non-C (special) functions + +So use SYM_CODE_* to annotate exception handlers. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/linkage.h | 8 +++++++ + arch/loongarch/kernel/entry.S | 4 ++-- + arch/loongarch/kernel/genex.S | 16 ++++++------- + arch/loongarch/mm/tlbex.S | 36 ++++++++++++++-------------- + 4 files changed, 36 insertions(+), 28 deletions(-) + +diff --git a/arch/loongarch/include/asm/linkage.h b/arch/loongarch/include/asm/linkage.h +index 81b0c4cfbf4f2..e2eca1a25b4ef 100644 +--- a/arch/loongarch/include/asm/linkage.h ++++ b/arch/loongarch/include/asm/linkage.h +@@ -33,4 +33,12 @@ + .cfi_endproc; \ + SYM_END(name, SYM_T_FUNC) + ++#define SYM_CODE_START(name) \ ++ SYM_START(name, SYM_L_GLOBAL, SYM_A_ALIGN) \ ++ .cfi_startproc; ++ ++#define SYM_CODE_END(name) \ ++ .cfi_endproc; \ ++ SYM_END(name, SYM_T_NONE) ++ + #endif +diff --git a/arch/loongarch/kernel/entry.S b/arch/loongarch/kernel/entry.S +index d737e3cf42d3f..1781c6a5befa2 100644 +--- a/arch/loongarch/kernel/entry.S ++++ b/arch/loongarch/kernel/entry.S +@@ -18,7 +18,7 @@ + .text + .cfi_sections .debug_frame + .align 5 +-SYM_FUNC_START(handle_syscall) ++SYM_CODE_START(handle_syscall) + csrrd t0, PERCPU_BASE_KS + la.pcrel t1, kernelsp + add.d t1, t1, t0 +@@ -66,7 +66,7 @@ SYM_FUNC_START(handle_syscall) + bl do_syscall + + RESTORE_ALL_AND_RET +-SYM_FUNC_END(handle_syscall) ++SYM_CODE_END(handle_syscall) + _ASM_NOKPROBE(handle_syscall) + + SYM_CODE_START(ret_from_fork) +diff --git a/arch/loongarch/kernel/genex.S b/arch/loongarch/kernel/genex.S +index 78f0663846575..2bb3aa2dcfcb2 100644 +--- a/arch/loongarch/kernel/genex.S ++++ b/arch/loongarch/kernel/genex.S +@@ -31,7 +31,7 @@ SYM_FUNC_START(__arch_cpu_idle) + 1: jr ra + SYM_FUNC_END(__arch_cpu_idle) + +-SYM_FUNC_START(handle_vint) ++SYM_CODE_START(handle_vint) + BACKUP_T0T1 + SAVE_ALL + la_abs t1, __arch_cpu_idle +@@ -46,11 +46,11 @@ SYM_FUNC_START(handle_vint) + la_abs t0, do_vint + jirl ra, t0, 0 + RESTORE_ALL_AND_RET +-SYM_FUNC_END(handle_vint) ++SYM_CODE_END(handle_vint) + +-SYM_FUNC_START(except_vec_cex) ++SYM_CODE_START(except_vec_cex) + b cache_parity_error +-SYM_FUNC_END(except_vec_cex) ++SYM_CODE_END(except_vec_cex) + + .macro build_prep_badv + csrrd t0, LOONGARCH_CSR_BADV +@@ -66,7 +66,7 @@ SYM_FUNC_END(except_vec_cex) + + .macro BUILD_HANDLER exception handler prep + .align 5 +- SYM_FUNC_START(handle_\exception) ++ SYM_CODE_START(handle_\exception) + 666: + BACKUP_T0T1 + SAVE_ALL +@@ -76,7 +76,7 @@ SYM_FUNC_END(except_vec_cex) + jirl ra, t0, 0 + 668: + RESTORE_ALL_AND_RET +- SYM_FUNC_END(handle_\exception) ++ SYM_CODE_END(handle_\exception) + SYM_DATA(unwind_hint_\exception, .word 668b - 666b) + .endm + +@@ -93,7 +93,7 @@ SYM_FUNC_END(except_vec_cex) + BUILD_HANDLER watch watch none + BUILD_HANDLER reserved reserved none /* others */ + +-SYM_FUNC_START(handle_sys) ++SYM_CODE_START(handle_sys) + la_abs t0, handle_syscall + jr t0 +-SYM_FUNC_END(handle_sys) ++SYM_CODE_END(handle_sys) +diff --git a/arch/loongarch/mm/tlbex.S b/arch/loongarch/mm/tlbex.S +index ca17dd3a19153..d5d682f3d29f3 100644 +--- a/arch/loongarch/mm/tlbex.S ++++ b/arch/loongarch/mm/tlbex.S +@@ -17,7 +17,7 @@ + #define PTRS_PER_PTE_BITS (PAGE_SHIFT - 3) + + .macro tlb_do_page_fault, write +- SYM_FUNC_START(tlb_do_page_fault_\write) ++ SYM_CODE_START(tlb_do_page_fault_\write) + SAVE_ALL + csrrd a2, LOONGARCH_CSR_BADV + move a0, sp +@@ -25,13 +25,13 @@ + li.w a1, \write + bl do_page_fault + RESTORE_ALL_AND_RET +- SYM_FUNC_END(tlb_do_page_fault_\write) ++ SYM_CODE_END(tlb_do_page_fault_\write) + .endm + + tlb_do_page_fault 0 + tlb_do_page_fault 1 + +-SYM_FUNC_START(handle_tlb_protect) ++SYM_CODE_START(handle_tlb_protect) + BACKUP_T0T1 + SAVE_ALL + move a0, sp +@@ -41,9 +41,9 @@ SYM_FUNC_START(handle_tlb_protect) + la_abs t0, do_page_fault + jirl ra, t0, 0 + RESTORE_ALL_AND_RET +-SYM_FUNC_END(handle_tlb_protect) ++SYM_CODE_END(handle_tlb_protect) + +-SYM_FUNC_START(handle_tlb_load) ++SYM_CODE_START(handle_tlb_load) + csrwr t0, EXCEPTION_KS0 + csrwr t1, EXCEPTION_KS1 + csrwr ra, EXCEPTION_KS2 +@@ -187,16 +187,16 @@ nopage_tlb_load: + csrrd ra, EXCEPTION_KS2 + la_abs t0, tlb_do_page_fault_0 + jr t0 +-SYM_FUNC_END(handle_tlb_load) ++SYM_CODE_END(handle_tlb_load) + +-SYM_FUNC_START(handle_tlb_load_ptw) ++SYM_CODE_START(handle_tlb_load_ptw) + csrwr t0, LOONGARCH_CSR_KS0 + csrwr t1, LOONGARCH_CSR_KS1 + la_abs t0, tlb_do_page_fault_0 + jr t0 +-SYM_FUNC_END(handle_tlb_load_ptw) ++SYM_CODE_END(handle_tlb_load_ptw) + +-SYM_FUNC_START(handle_tlb_store) ++SYM_CODE_START(handle_tlb_store) + csrwr t0, EXCEPTION_KS0 + csrwr t1, EXCEPTION_KS1 + csrwr ra, EXCEPTION_KS2 +@@ -343,16 +343,16 @@ nopage_tlb_store: + csrrd ra, EXCEPTION_KS2 + la_abs t0, tlb_do_page_fault_1 + jr t0 +-SYM_FUNC_END(handle_tlb_store) ++SYM_CODE_END(handle_tlb_store) + +-SYM_FUNC_START(handle_tlb_store_ptw) ++SYM_CODE_START(handle_tlb_store_ptw) + csrwr t0, LOONGARCH_CSR_KS0 + csrwr t1, LOONGARCH_CSR_KS1 + la_abs t0, tlb_do_page_fault_1 + jr t0 +-SYM_FUNC_END(handle_tlb_store_ptw) ++SYM_CODE_END(handle_tlb_store_ptw) + +-SYM_FUNC_START(handle_tlb_modify) ++SYM_CODE_START(handle_tlb_modify) + csrwr t0, EXCEPTION_KS0 + csrwr t1, EXCEPTION_KS1 + csrwr ra, EXCEPTION_KS2 +@@ -497,16 +497,16 @@ nopage_tlb_modify: + csrrd ra, EXCEPTION_KS2 + la_abs t0, tlb_do_page_fault_1 + jr t0 +-SYM_FUNC_END(handle_tlb_modify) ++SYM_CODE_END(handle_tlb_modify) + +-SYM_FUNC_START(handle_tlb_modify_ptw) ++SYM_CODE_START(handle_tlb_modify_ptw) + csrwr t0, LOONGARCH_CSR_KS0 + csrwr t1, LOONGARCH_CSR_KS1 + la_abs t0, tlb_do_page_fault_1 + jr t0 +-SYM_FUNC_END(handle_tlb_modify_ptw) ++SYM_CODE_END(handle_tlb_modify_ptw) + +-SYM_FUNC_START(handle_tlb_refill) ++SYM_CODE_START(handle_tlb_refill) + csrwr t0, LOONGARCH_CSR_TLBRSAVE + csrrd t0, LOONGARCH_CSR_PGD + lddir t0, t0, 3 +@@ -521,4 +521,4 @@ SYM_FUNC_START(handle_tlb_refill) + tlbfill + csrrd t0, LOONGARCH_CSR_TLBRSAVE + ertn +-SYM_FUNC_END(handle_tlb_refill) ++SYM_CODE_END(handle_tlb_refill) +-- +2.42.0 + diff --git a/queue-6.5/media-i2c-ov8858-don-t-set-fwnode-in-the-driver.patch b/queue-6.5/media-i2c-ov8858-don-t-set-fwnode-in-the-driver.patch new file mode 100644 index 00000000000..2c219ca1dbe --- /dev/null +++ b/queue-6.5/media-i2c-ov8858-don-t-set-fwnode-in-the-driver.patch @@ -0,0 +1,87 @@ +From a92324dd3e71c9ab45924b9f6fe1776be1c3b4b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 09:07:44 +0200 +Subject: media: i2c: ov8858: Don't set fwnode in the driver + +From: Ondrej Jirman + +[ Upstream commit c46f16f156ac58afcf4addc850bb5dfbca77b9fc ] + +This makes the driver work with the new check in +v4l2_async_register_subdev() that was introduced recently in 6.6-rc1. +Without this change, probe fails with: + +ov8858 1-0036: Detected OV8858 sensor, revision 0xb2 +ov8858 1-0036: sub-device fwnode is an endpoint! +ov8858 1-0036: v4l2 async register subdev failed +ov8858: probe of 1-0036 failed with error -22 + +This also simplifies the driver a bit. + +Signed-off-by: Ondrej Jirman +Reviewed-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov8858.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/i2c/ov8858.c b/drivers/media/i2c/ov8858.c +index 3af6125a2eee8..4d9fd76e2f60f 100644 +--- a/drivers/media/i2c/ov8858.c ++++ b/drivers/media/i2c/ov8858.c +@@ -1850,9 +1850,9 @@ static int ov8858_parse_of(struct ov8858 *ov8858) + } + + ret = v4l2_fwnode_endpoint_parse(endpoint, &vep); ++ fwnode_handle_put(endpoint); + if (ret) { + dev_err(dev, "Failed to parse endpoint: %d\n", ret); +- fwnode_handle_put(endpoint); + return ret; + } + +@@ -1864,12 +1864,9 @@ static int ov8858_parse_of(struct ov8858 *ov8858) + default: + dev_err(dev, "Unsupported number of data lanes %u\n", + ov8858->num_lanes); +- fwnode_handle_put(endpoint); + return -EINVAL; + } + +- ov8858->subdev.fwnode = endpoint; +- + return 0; + } + +@@ -1913,7 +1910,7 @@ static int ov8858_probe(struct i2c_client *client) + + ret = ov8858_init_ctrls(ov8858); + if (ret) +- goto err_put_fwnode; ++ return ret; + + sd = &ov8858->subdev; + sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS; +@@ -1964,8 +1961,6 @@ static int ov8858_probe(struct i2c_client *client) + media_entity_cleanup(&sd->entity); + err_free_handler: + v4l2_ctrl_handler_free(&ov8858->ctrl_handler); +-err_put_fwnode: +- fwnode_handle_put(ov8858->subdev.fwnode); + + return ret; + } +@@ -1978,7 +1973,6 @@ static void ov8858_remove(struct i2c_client *client) + v4l2_async_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + v4l2_ctrl_handler_free(&ov8858->ctrl_handler); +- fwnode_handle_put(ov8858->subdev.fwnode); + + pm_runtime_disable(&client->dev); + if (!pm_runtime_status_suspended(&client->dev)) +-- +2.42.0 + diff --git a/queue-6.5/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch b/queue-6.5/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch new file mode 100644 index 00000000000..50d43d29b3b --- /dev/null +++ b/queue-6.5/net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch @@ -0,0 +1,35 @@ +From 5416a66d3f8d6b3cbe9609c253a6d1585eaa16fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 17:27:59 +0800 +Subject: net: chelsio: cxgb4: add an error code check in t4_load_phy_fw + +From: Su Hui + +[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ] + +t4_set_params_timeout() can return -EINVAL if failed, add check +for this. + +Signed-off-by: Su Hui +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 8d719f82854a9..76de55306c4d0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3816,6 +3816,8 @@ int t4_load_phy_fw(struct adapter *adap, int win, + FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD)); + ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1, + ¶m, &val, 30000); ++ if (ret) ++ return ret; + + /* If we have version number support, then check to see that the new + * firmware got loaded properly. +-- +2.42.0 + diff --git a/queue-6.5/net-mlx5-bridge-fix-peer-entry-ageing-in-lag-mode.patch b/queue-6.5/net-mlx5-bridge-fix-peer-entry-ageing-in-lag-mode.patch new file mode 100644 index 00000000000..22ced992a34 --- /dev/null +++ b/queue-6.5/net-mlx5-bridge-fix-peer-entry-ageing-in-lag-mode.patch @@ -0,0 +1,131 @@ +From 5fcb4295eb48140cffce968caf6fcd754f1696e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 11:10:57 +0200 +Subject: net/mlx5: Bridge, fix peer entry ageing in LAG mode + +From: Vlad Buslov + +[ Upstream commit 7a3ce8074878a68a75ceacec93d9ae05906eec86 ] + +With current implementation in single FDB LAG mode all packets are +processed by eswitch 0 rules. As such, 'peer' FDB entries receive the +packets for rules of other eswitches and are responsible for updating the +main entry by sending SWITCHDEV_FDB_ADD_TO_BRIDGE notification from their +background update wq task. However, this introduces a race condition when +non-zero eswitch instance decides to delete a FDB entry, sends +SWITCHDEV_FDB_DEL_TO_BRIDGE notification, but another eswitch's update task +refreshes the same entry concurrently while its async delete work is still +pending on the workque. In such case another SWITCHDEV_FDB_ADD_TO_BRIDGE +event may be generated and entry will remain stuck in FDB marked as +'offloaded' since no more SWITCHDEV_FDB_DEL_TO_BRIDGE notifications are +sent for deleting the peer entries. + +Fix the issue by synchronously marking deleted entries with +MLX5_ESW_BRIDGE_FLAG_DELETED flag and skipping them in background update +job. + +Signed-off-by: Vlad Buslov +Reviewed-by: Jianbo Liu +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/en/rep/bridge.c | 11 ++++++++ + .../ethernet/mellanox/mlx5/core/esw/bridge.c | 25 ++++++++++++++++++- + .../ethernet/mellanox/mlx5/core/esw/bridge.h | 3 +++ + .../mellanox/mlx5/core/esw/bridge_priv.h | 1 + + 4 files changed, 39 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +index 5608002465734..285c13edc09f0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +@@ -463,6 +463,17 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb, + /* only handle the event on peers */ + if (mlx5_esw_bridge_is_local(dev, rep, esw)) + break; ++ ++ fdb_info = container_of(info, ++ struct switchdev_notifier_fdb_info, ++ info); ++ /* Mark for deletion to prevent the update wq task from ++ * spuriously refreshing the entry which would mark it again as ++ * offloaded in SW bridge. After this fallthrough to regular ++ * async delete code. ++ */ ++ mlx5_esw_bridge_fdb_mark_deleted(dev, vport_num, esw_owner_vhca_id, br_offloads, ++ fdb_info); + fallthrough; + case SWITCHDEV_FDB_ADD_TO_DEVICE: + case SWITCHDEV_FDB_DEL_TO_DEVICE: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +index f4fe1daa4afd5..de1ed59239da8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c +@@ -1748,6 +1748,28 @@ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16 + entry->lastuse = jiffies; + } + ++void mlx5_esw_bridge_fdb_mark_deleted(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id, ++ struct mlx5_esw_bridge_offloads *br_offloads, ++ struct switchdev_notifier_fdb_info *fdb_info) ++{ ++ struct mlx5_esw_bridge_fdb_entry *entry; ++ struct mlx5_esw_bridge *bridge; ++ ++ bridge = mlx5_esw_bridge_from_port_lookup(vport_num, esw_owner_vhca_id, br_offloads); ++ if (!bridge) ++ return; ++ ++ entry = mlx5_esw_bridge_fdb_lookup(bridge, fdb_info->addr, fdb_info->vid); ++ if (!entry) { ++ esw_debug(br_offloads->esw->dev, ++ "FDB mark deleted entry with specified key not found (MAC=%pM,vid=%u,vport=%u)\n", ++ fdb_info->addr, fdb_info->vid, vport_num); ++ return; ++ } ++ ++ entry->flags |= MLX5_ESW_BRIDGE_FLAG_DELETED; ++} ++ + void mlx5_esw_bridge_fdb_create(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id, + struct mlx5_esw_bridge_offloads *br_offloads, + struct switchdev_notifier_fdb_info *fdb_info) +@@ -1810,7 +1832,8 @@ void mlx5_esw_bridge_update(struct mlx5_esw_bridge_offloads *br_offloads) + unsigned long lastuse = + (unsigned long)mlx5_fc_query_lastuse(entry->ingress_counter); + +- if (entry->flags & MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER) ++ if (entry->flags & (MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER | ++ MLX5_ESW_BRIDGE_FLAG_DELETED)) + continue; + + if (time_after(lastuse, entry->lastuse)) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h +index c2c7c70d99eb7..d6f5391619930 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h +@@ -62,6 +62,9 @@ int mlx5_esw_bridge_vport_peer_unlink(struct net_device *br_netdev, u16 vport_nu + void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id, + struct mlx5_esw_bridge_offloads *br_offloads, + struct switchdev_notifier_fdb_info *fdb_info); ++void mlx5_esw_bridge_fdb_mark_deleted(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id, ++ struct mlx5_esw_bridge_offloads *br_offloads, ++ struct switchdev_notifier_fdb_info *fdb_info); + void mlx5_esw_bridge_fdb_create(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id, + struct mlx5_esw_bridge_offloads *br_offloads, + struct switchdev_notifier_fdb_info *fdb_info); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h +index 4911cc32161b4..7c251af566c6f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h +@@ -133,6 +133,7 @@ struct mlx5_esw_bridge_mdb_key { + enum { + MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER = BIT(0), + MLX5_ESW_BRIDGE_FLAG_PEER = BIT(1), ++ MLX5_ESW_BRIDGE_FLAG_DELETED = BIT(2), + }; + + enum { +-- +2.42.0 + diff --git a/queue-6.5/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch b/queue-6.5/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch new file mode 100644 index 00000000000..2cd6c39a1d1 --- /dev/null +++ b/queue-6.5/net-sched-cls_u32-fix-allocation-size-in-u32_init.patch @@ -0,0 +1,105 @@ +From b7694624bbdaac9601b52268b3307eb7d45cc04e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 15:19:37 +0200 +Subject: net: sched: cls_u32: Fix allocation size in u32_init() + +From: Gustavo A. R. Silva + +[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ] + +commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array +with flexible-array member") incorrecly replaced an instance of +`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results +in a an over-allocation of 8 bytes. + +This change is wrong because `hlist` in `struct tc_u_common` is a +pointer: + +net/sched/cls_u32.c: +struct tc_u_common { + struct tc_u_hnode __rcu *hlist; + void *ptr; + int refcnt; + struct idr handle_idr; + struct hlist_node hnode; + long knodes; +}; + +So, the use of `struct_size()` makes no sense: we don't need to allocate +any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine. + +So, `struct_size(tp_c, hlist->ht, 1)` translates to: + +sizeof(*tp_c) + sizeof(tp_c->hlist->ht) == +sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) == + 144 + 8 == 0x98 (byes) + ^^^ + | + unnecessary extra + allocation size + +$ pahole -C tc_u_common net/sched/cls_u32.o +struct tc_u_common { + struct tc_u_hnode * hlist; /* 0 8 */ + void * ptr; /* 8 8 */ + int refcnt; /* 16 4 */ + + /* XXX 4 bytes hole, try to pack */ + + struct idr handle_idr; /* 24 96 */ + /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ + struct hlist_node hnode; /* 120 16 */ + /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */ + long int knodes; /* 136 8 */ + + /* size: 144, cachelines: 3, members: 6 */ + /* sum members: 140, holes: 1, sum holes: 4 */ + /* last cacheline: 16 bytes */ +}; + +And with `sizeof(*tp_c)`, we have: + + sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes) + +which is the correct and original allocation size. + +Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with +`sizeof(*tp_c)`, and avoid allocating 8 too many bytes. + +The following difference in binary output is expected and reflects the +desired change: + +| net/sched/cls_u32.o +| @@ -6148,7 +6148,7 @@ +| include/linux/slab.h:599 +| 2cf5: mov 0x0(%rip),%rdi # 2cfc +| 2cf8: R_X86_64_PC32 kmalloc_caches+0xc +|- 2cfc: mov $0x98,%edx +|+ 2cfc: mov $0x90,%edx + +Reported-by: Alejandro Colomar +Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/ +Signed-off-by: Gustavo A. R. Silva +Acked-by: Jamal Hadi Salim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_u32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index da4c179a4d418..6663e971a13e7 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -366,7 +366,7 @@ static int u32_init(struct tcf_proto *tp) + idr_init(&root_ht->handle_idr); + + if (tp_c == NULL) { +- tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL); ++ tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL); + if (tp_c == NULL) { + kfree(root_ht); + return -ENOBUFS; +-- +2.42.0 + diff --git a/queue-6.5/netfilter-nf_tables-audit-log-object-reset-once-per-.patch b/queue-6.5/netfilter-nf_tables-audit-log-object-reset-once-per-.patch new file mode 100644 index 00000000000..782aa46f555 --- /dev/null +++ b/queue-6.5/netfilter-nf_tables-audit-log-object-reset-once-per-.patch @@ -0,0 +1,198 @@ +From ce0f876d0e24e605844a12834a9ae28b24af6a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Oct 2023 17:06:59 +0200 +Subject: netfilter: nf_tables: audit log object reset once per table + +From: Phil Sutter + +[ Upstream commit 1baf0152f7707c6c7e4ea815dcc1f431c0e603f9 ] + +When resetting multiple objects at once (via dump request), emit a log +message per table (or filled skb) and resurrect the 'entries' parameter +to contain the number of objects being logged for. + +To test the skb exhaustion path, perform some bulk counter and quota +adds in the kselftest. + +Signed-off-by: Phil Sutter +Reviewed-by: Richard Guy Briggs +Acked-by: Paul Moore (Audit) +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 50 +++++++++++-------- + .../testing/selftests/netfilter/nft_audit.sh | 46 +++++++++++++++++ + 2 files changed, 74 insertions(+), 22 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index e43d9508e7a9c..6a05bed3cb46d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -7604,6 +7604,16 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, + return -1; + } + ++static void audit_log_obj_reset(const struct nft_table *table, ++ unsigned int base_seq, unsigned int nentries) ++{ ++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq); ++ ++ audit_log_nfcfg(buf, table->family, nentries, ++ AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); ++ kfree(buf); ++} ++ + struct nft_obj_filter { + char *table; + u32 type; +@@ -7618,8 +7628,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + struct net *net = sock_net(skb->sk); + int family = nfmsg->nfgen_family; + struct nftables_pernet *nft_net; ++ unsigned int entries = 0; + struct nft_object *obj; + bool reset = false; ++ int rc = 0; + + if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) + reset = true; +@@ -7632,6 +7644,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + if (family != NFPROTO_UNSPEC && family != table->family) + continue; + ++ entries = 0; + list_for_each_entry_rcu(obj, &table->objects, list) { + if (!nft_is_active(net, obj)) + goto cont; +@@ -7647,34 +7660,27 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + filter->type != NFT_OBJECT_UNSPEC && + obj->ops->type->type != filter->type) + goto cont; +- if (reset) { +- char *buf = kasprintf(GFP_ATOMIC, +- "%s:%u", +- table->name, +- nft_net->base_seq); +- +- audit_log_nfcfg(buf, +- family, +- obj->handle, +- AUDIT_NFT_OP_OBJ_RESET, +- GFP_ATOMIC); +- kfree(buf); +- } + +- if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid, +- cb->nlh->nlmsg_seq, +- NFT_MSG_NEWOBJ, +- NLM_F_MULTI | NLM_F_APPEND, +- table->family, table, +- obj, reset) < 0) +- goto done; ++ rc = nf_tables_fill_obj_info(skb, net, ++ NETLINK_CB(cb->skb).portid, ++ cb->nlh->nlmsg_seq, ++ NFT_MSG_NEWOBJ, ++ NLM_F_MULTI | NLM_F_APPEND, ++ table->family, table, ++ obj, reset); ++ if (rc < 0) ++ break; + ++ entries++; + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); + cont: + idx++; + } ++ if (reset && entries) ++ audit_log_obj_reset(table, nft_net->base_seq, entries); ++ if (rc < 0) ++ break; + } +-done: + rcu_read_unlock(); + + cb->args[0] = idx; +@@ -7779,7 +7785,7 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, + + audit_log_nfcfg(buf, + family, +- obj->handle, ++ 1, + AUDIT_NFT_OP_OBJ_RESET, + GFP_ATOMIC); + kfree(buf); +diff --git a/tools/testing/selftests/netfilter/nft_audit.sh b/tools/testing/selftests/netfilter/nft_audit.sh +index 5267c88496d51..99ed5bd6e8402 100755 +--- a/tools/testing/selftests/netfilter/nft_audit.sh ++++ b/tools/testing/selftests/netfilter/nft_audit.sh +@@ -99,6 +99,12 @@ do_test 'nft add counter t1 c1' \ + do_test 'nft add counter t2 c1; add counter t2 c2' \ + 'table=t2 family=2 entries=2 op=nft_register_obj' + ++for ((i = 3; i <= 500; i++)); do ++ echo "add counter t2 c$i" ++done >$rulefile ++do_test "nft -f $rulefile" \ ++'table=t2 family=2 entries=498 op=nft_register_obj' ++ + # adding/updating quotas + + do_test 'nft add quota t1 q1 { 10 bytes }' \ +@@ -107,6 +113,12 @@ do_test 'nft add quota t1 q1 { 10 bytes }' \ + do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \ + 'table=t2 family=2 entries=2 op=nft_register_obj' + ++for ((i = 3; i <= 500; i++)); do ++ echo "add quota t2 q$i { 10 bytes }" ++done >$rulefile ++do_test "nft -f $rulefile" \ ++'table=t2 family=2 entries=498 op=nft_register_obj' ++ + # changing the quota value triggers obj update path + do_test 'nft add quota t1 q1 { 20 bytes }' \ + 'table=t1 family=2 entries=1 op=nft_register_obj' +@@ -156,6 +168,40 @@ done + do_test 'nft reset set t1 s' \ + 'table=t1 family=2 entries=3 op=nft_reset_setelem' + ++# resetting counters ++ ++do_test 'nft reset counter t1 c1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset counters t1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset counters t2' \ ++'table=t2 family=2 entries=342 op=nft_reset_obj ++table=t2 family=2 entries=158 op=nft_reset_obj' ++ ++do_test 'nft reset counters' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj ++table=t2 family=2 entries=341 op=nft_reset_obj ++table=t2 family=2 entries=159 op=nft_reset_obj' ++ ++# resetting quotas ++ ++do_test 'nft reset quota t1 q1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset quotas t1' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj' ++ ++do_test 'nft reset quotas t2' \ ++'table=t2 family=2 entries=315 op=nft_reset_obj ++table=t2 family=2 entries=185 op=nft_reset_obj' ++ ++do_test 'nft reset quotas' \ ++'table=t1 family=2 entries=1 op=nft_reset_obj ++table=t2 family=2 entries=314 op=nft_reset_obj ++table=t2 family=2 entries=186 op=nft_reset_obj' ++ + # deleting rules + + readarray -t handles < <(nft -a list chain t1 c1 | \ +-- +2.42.0 + diff --git a/queue-6.5/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch b/queue-6.5/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch new file mode 100644 index 00000000000..d5498738049 --- /dev/null +++ b/queue-6.5/netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch @@ -0,0 +1,39 @@ +From 2b0a3fbd730f25a1ecbb737689783244cc4bda33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Oct 2023 10:53:08 +0200 +Subject: netfilter: nfnetlink_log: silence bogus compiler warning + +From: Florian Westphal + +[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ] + +net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized + +The warning is bogus, the variable is only used if ct is non-NULL and +always initialised in that case. Init to 0 too to silence this. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/ +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nfnetlink_log.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index e57eb168ee130..984f6f106e4ac 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -700,8 +700,8 @@ nfulnl_log_packet(struct net *net, + unsigned int plen = 0; + struct nfnl_log_net *log = nfnl_log_pernet(net); + const struct nfnl_ct_hook *nfnl_ct = NULL; ++ enum ip_conntrack_info ctinfo = 0; + struct nf_conn *ct = NULL; +- enum ip_conntrack_info ctinfo; + + if (li_user && li_user->type == NF_LOG_TYPE_ULOG) + li = li_user; +-- +2.42.0 + diff --git a/queue-6.5/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch b/queue-6.5/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch new file mode 100644 index 00000000000..4ca3d02f893 --- /dev/null +++ b/queue-6.5/platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch @@ -0,0 +1,65 @@ +From 904dcf72db870c2a784fbf49d0037ec316b8ddb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 19:02:35 -0400 +Subject: platform/mellanox: mlxbf-tmfifo: Fix a warning message + +From: Liming Sun + +[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ] + +This commit fixes the smatch static checker warning in function +mlxbf_tmfifo_rxtx_word() which complains data not initialized at +line 634 when IS_VRING_DROP() is TRUE. + +Signed-off-by: Liming Sun +Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index f3696a54a2bd7..d9615ad600123 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -607,24 +607,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring, + + if (vring->cur_len + sizeof(u64) <= len) { + /* The whole word. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + sizeof(u64)); +- else +- memcpy(&data, addr + vring->cur_len, +- sizeof(u64)); ++ } else { ++ memcpy(&data, addr + vring->cur_len, ++ sizeof(u64)); + } + vring->cur_len += sizeof(u64); + } else { + /* Leftover bytes. */ +- if (!IS_VRING_DROP(vring)) { +- if (is_rx) ++ if (is_rx) { ++ if (!IS_VRING_DROP(vring)) + memcpy(addr + vring->cur_len, &data, + len - vring->cur_len); +- else +- memcpy(&data, addr + vring->cur_len, +- len - vring->cur_len); ++ } else { ++ data = 0; ++ memcpy(&data, addr + vring->cur_len, ++ len - vring->cur_len); + } + vring->cur_len = len; + } +-- +2.42.0 + diff --git a/queue-6.5/powerpc-85xx-fix-math-emulation-exception.patch b/queue-6.5/powerpc-85xx-fix-math-emulation-exception.patch new file mode 100644 index 00000000000..0752ee9d1f5 --- /dev/null +++ b/queue-6.5/powerpc-85xx-fix-math-emulation-exception.patch @@ -0,0 +1,47 @@ +From b680e0976d31c9948cf3a7f1c42f0785fb97e744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 17:55:51 +0200 +Subject: powerpc/85xx: Fix math emulation exception + +From: Christophe Leroy + +[ Upstream commit 8e8a12ecbc86700b5e1a3596ce2b3c43dafad336 ] + +Booting mpc85xx_defconfig kernel on QEMU leads to: + +Bad trap at PC: fe9bab0, SR: 2d000, vector=800 +awk[82]: unhandled trap (5) at 0 nip fe9bab0 lr fe9e01c code 5 in libc-2.27.so[fe5a000+17a000] +awk[82]: code: 3aa00000 3a800010 4bffe03c 9421fff0 7ca62b78 38a00000 93c10008 83c10008 +awk[82]: code: 38210010 4bffdec8 9421ffc0 7c0802a6 d8010008 4815190d 93810030 +Trace/breakpoint trap +WARNING: no useful console + +This is because allthough CONFIG_MATH_EMULATION is selected, +Exception 800 calls unknown_exception(). + +Call emulation_assist_interrupt() instead. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/066caa6d9480365da9b8ed83692d7101e10ac5f8.1695657339.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_85xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_85xx.S b/arch/powerpc/kernel/head_85xx.S +index fdbee1093e2ba..f9634111e82ed 100644 +--- a/arch/powerpc/kernel/head_85xx.S ++++ b/arch/powerpc/kernel/head_85xx.S +@@ -396,7 +396,7 @@ interrupt_base: + #ifdef CONFIG_PPC_FPU + FP_UNAVAILABLE_EXCEPTION + #else +- EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, unknown_exception) ++ EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, emulation_assist_interrupt) + #endif + + /* System Call Interrupt */ +-- +2.42.0 + diff --git a/queue-6.5/powerpc-mm-fix-boot-crash-with-flatmem.patch b/queue-6.5/powerpc-mm-fix-boot-crash-with-flatmem.patch new file mode 100644 index 00000000000..bebb5e7e096 --- /dev/null +++ b/queue-6.5/powerpc-mm-fix-boot-crash-with-flatmem.patch @@ -0,0 +1,143 @@ +From dad018c522d82bfb2b080d1c093d01fbb1ebc980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Oct 2023 22:25:00 +1100 +Subject: powerpc/mm: Fix boot crash with FLATMEM + +From: Michael Ellerman + +[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ] + +Erhard reported that his G5 was crashing with v6.6-rc kernels: + + mpic: Setting up HT PICs workarounds for U3/U4 + BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe + Faulting instruction address: 0xc00000000005dc40 + Oops: Kernel access of bad area, sig: 11 [#1] + BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G T 6.6.0-rc3-PMacGS #1 + Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac + NIP: c00000000005dc40 LR: c000000000066660 CTR: c000000000007730 + REGS: c0000000022bf510 TRAP: 0380 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 44004242 XER: 00000000 + IRQMASK: 3 + GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac + GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300 + GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000 + GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8 + GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000 + GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c + GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000 + GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac + NIP hash_page_do_lazy_icache+0x50/0x100 + LR __hash_page_4K+0x420/0x590 + Call Trace: + hash_page_mm+0x364/0x6f0 + do_hash_fault+0x114/0x2b0 + data_access_common_virt+0x198/0x1f0 + --- interrupt: 300 at mpic_init+0x4bc/0x10c4 + NIP: c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000 + REGS: c0000000022bf9f0 TRAP: 0300 Tainted: G T (6.6.0-rc3-PMacGS) + MSR: 9000000000001032 CR: 24004248 XER: 00000000 + DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1 + ... + NIP mpic_init+0x4bc/0x10c4 + LR mpic_init+0x464/0x10c4 + --- interrupt: 300 + pmac_setup_one_mpic+0x258/0x2dc + pmac_pic_init+0x28c/0x3d8 + init_IRQ+0x90/0x140 + start_kernel+0x57c/0x78c + start_here_common+0x1c/0x20 + +A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc: +implement the new page table range API"). + +Analysis of the oops pointed to a struct page with a corrupted +compound_head being loaded via page_folio() -> _compound_head() in +hash_page_do_lazy_icache(). + +The access by the mpic code is to an MMIO address, so the expectation +is that the struct page for that address would be initialised by +init_unavailable_range(), as pointed out by Aneesh. + +Instrumentation showed that was not the case, which eventually lead to +the realisation that pfn_valid() was returning false for that address, +causing the struct page to not be initialised. + +Because the system is using FLATMEM, the version of pfn_valid() in +memory_model.h is used: + +static inline int pfn_valid(unsigned long pfn) +{ + ... + return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr; +} + +Which relies on max_mapnr being initialised. Early in boot max_mapnr is +zero meaning no PFNs are valid. + +max_mapnr is initialised in mem_init() called via: + + start_kernel() + mm_core_init() # init/main.c:928 + mem_init() + +But that is too late for the usage in init_unavailable_range() called via: + + start_kernel() + setup_arch() # init/main.c:893 + paging_init() + free_area_init() + init_unavailable_range() + +Although max_mapnr is currently set in mem_init(), the value is actually +already available much earlier, as soon as mem_topology_setup() has +completed, which is also before paging_init() is called. So move the +initialisation there, which causes paging_init() to correctly initialise +the struct page and fixes the bug. + +This bug seems to have been lurking for years, but went unnoticed +because the pre-folio code was inspecting the uninitialised page->flags +but not dereferencing it. + +Thanks to Erhard and Aneesh for help debugging. + +Reported-by: Erhard Furtner +Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/ +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/setup-common.c | 2 ++ + arch/powerpc/mm/mem.c | 1 - + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index d2a446216444f..d35ba3ac218bf 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -948,6 +948,8 @@ void __init setup_arch(char **cmdline_p) + + /* Parse memory topology */ + mem_topology_setup(); ++ /* Set max_mapnr before paging_init() */ ++ set_max_mapnr(max_pfn); + + /* + * Release secondary cpus out of their spinloops at 0x60 now that +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 8b121df7b08f8..07e8f4f1e07f8 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -288,7 +288,6 @@ void __init mem_init(void) + #endif + + high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); +- set_max_mapnr(max_pfn); + + kasan_late_init(); + +-- +2.42.0 + diff --git a/queue-6.5/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch b/queue-6.5/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch new file mode 100644 index 00000000000..2e2aa57804e --- /dev/null +++ b/queue-6.5/r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch @@ -0,0 +1,47 @@ +From d12099f182165ad170332a15b5c73c2e09707bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:57 -0700 +Subject: r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en() + +From: Douglas Anderson + +[ Upstream commit bc65cc42af737a5a35f83842408ef2c6c79ba025 ] + +If the adapter is unplugged while we're looping in r8153b_ups_en() / +r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500 +loops). Add code similar to what's done in other places in the driver +to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 1a016eafaf126..b64df36fbb115 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3656,6 +3656,8 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +@@ -3696,6 +3698,8 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; +-- +2.42.0 + diff --git a/queue-6.5/r8152-check-for-unplug-in-rtl_phy_patch_request.patch b/queue-6.5/r8152-check-for-unplug-in-rtl_phy_patch_request.patch new file mode 100644 index 00000000000..55a482346c8 --- /dev/null +++ b/queue-6.5/r8152-check-for-unplug-in-rtl_phy_patch_request.patch @@ -0,0 +1,39 @@ +From fbf3f1731547b47526a06da568b5d4797cea3b67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:56 -0700 +Subject: r8152: Check for unplug in rtl_phy_patch_request() + +From: Douglas Anderson + +[ Upstream commit dc90ba37a8c37042407fa6970b9830890cfe6047 ] + +If the adapter is unplugged while we're looping in +rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms * +5000 loops). Add code similar to what's done in other places in the +driver to check for unplug and bail. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 14497e5558bf9..1a016eafaf126 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4059,6 +4059,9 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; ++ + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); + if ((ocp_data & PATCH_READY) ^ check) +-- +2.42.0 + diff --git a/queue-6.5/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch b/queue-6.5/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch new file mode 100644 index 00000000000..d221fbf8e2c --- /dev/null +++ b/queue-6.5/r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch @@ -0,0 +1,457 @@ +From 06754e6088e2a23706931b2142218aa90b409cfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Oct 2023 14:06:58 -0700 +Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE + +From: Douglas Anderson + +[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ] + +Whenever the RTL8152_UNPLUG is set that just tells the driver that all +accesses will fail and we should just immediately bail. A future patch +will use this same concept at a time when the driver hasn't actually +been unplugged but is about to be reset. Rename the flag in +preparation for the future patch. + +This is a no-op change and just a search and replace. + +Signed-off-by: Douglas Anderson +Reviewed-by: Grant Grundler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 96 ++++++++++++++++++++--------------------- + 1 file changed, 48 insertions(+), 48 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index b64df36fbb115..212043db5cbe5 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -764,7 +764,7 @@ enum rtl_register_content { + + /* rtl8152 flags */ + enum rtl8152_flags { +- RTL8152_UNPLUG = 0, ++ RTL8152_INACCESSIBLE = 0, + RTL8152_SET_RX_MODE, + WORK_ENABLE, + RTL8152_LINK_CHG, +@@ -1245,7 +1245,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) + static void rtl_set_unplug(struct r8152 *tp) + { + if (tp->udev->state == USB_STATE_NOTATTACHED) { +- set_bit(RTL8152_UNPLUG, &tp->flags); ++ set_bit(RTL8152_INACCESSIBLE, &tp->flags); + smp_mb__after_atomic(); + } + } +@@ -1256,7 +1256,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, + u16 limit = 64; + int ret = 0; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1300,7 +1300,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen, + u16 byteen_start, byteen_end, byen; + u16 limit = 512; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + /* both size and indix must be 4 bytes align */ +@@ -1530,7 +1530,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg) + struct r8152 *tp = netdev_priv(netdev); + int ret; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + if (phy_id != R8152_PHY_ID) +@@ -1546,7 +1546,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val) + { + struct r8152 *tp = netdev_priv(netdev); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (phy_id != R8152_PHY_ID) +@@ -1751,7 +1751,7 @@ static void read_bulk_callback(struct urb *urb) + if (!tp) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -1843,7 +1843,7 @@ static void write_bulk_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!skb_queue_empty(&tp->tx_queue)) +@@ -1864,7 +1864,7 @@ static void intr_callback(struct urb *urb) + if (!test_bit(WORK_ENABLE, &tp->flags)) + return; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + switch (status) { +@@ -2608,7 +2608,7 @@ static void bottom_half(struct tasklet_struct *t) + { + struct r8152 *tp = from_tasklet(tp, t, tx_tl); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (!test_bit(WORK_ENABLE, &tp->flags)) +@@ -2651,7 +2651,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags) + int ret; + + /* The rx would be stopped, so skip submitting */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || + !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev)) + return 0; + +@@ -3051,7 +3051,7 @@ static int rtl_enable(struct r8152 *tp) + + static int rtl8152_enable(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3138,7 +3138,7 @@ static int rtl8153_enable(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -3170,7 +3170,7 @@ static void rtl_disable(struct r8152 *tp) + u32 ocp_data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -3624,7 +3624,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -3656,7 +3656,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -3698,7 +3698,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable) + int i; + + for (i = 0; i < 500; i++) { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) +@@ -4063,8 +4063,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait) + for (i = 0; wait && i < 5000; i++) { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) +- break; ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) ++ return -ENODEV; + + usleep_range(1000, 2000); + ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT); +@@ -6027,7 +6027,7 @@ static int rtl8156_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + r8156_fc_parameter(tp); +@@ -6085,7 +6085,7 @@ static int rtl8156b_enable(struct r8152 *tp) + u32 ocp_data; + u16 speed; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + set_tx_qlen(tp); +@@ -6271,7 +6271,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex, + + static void rtl8152_up(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8152_aldps_en(tp, false); +@@ -6281,7 +6281,7 @@ static void rtl8152_up(struct r8152 *tp) + + static void rtl8152_down(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6296,7 +6296,7 @@ static void rtl8153_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6336,7 +6336,7 @@ static void rtl8153_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6357,7 +6357,7 @@ static void rtl8153b_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6381,7 +6381,7 @@ static void rtl8153b_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6418,7 +6418,7 @@ static void rtl8153c_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6499,7 +6499,7 @@ static void rtl8156_up(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -6572,7 +6572,7 @@ static void rtl8156_down(struct r8152 *tp) + { + u32 ocp_data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + return; + } +@@ -6710,7 +6710,7 @@ static void rtl_work_func_t(struct work_struct *work) + /* If the device is unplugged or !netif_running(), the workqueue + * doesn't need to wake the device, and could return directly. + */ +- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6749,7 +6749,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work) + { + struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work); + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (usb_autopm_get_interface(tp->intf) < 0) +@@ -6876,7 +6876,7 @@ static int rtl8152_close(struct net_device *netdev) + netif_stop_queue(netdev); + + res = usb_autopm_get_interface(tp->intf); +- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) { ++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) { + rtl_drop_queued_tx(tp); + rtl_stop_rx(tp); + } else { +@@ -6909,7 +6909,7 @@ static void r8152b_init(struct r8152 *tp) + u32 ocp_data; + u16 data; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + data = r8152_mdio_read(tp, MII_BMCR); +@@ -6953,7 +6953,7 @@ static void r8153_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_u1u2en(tp, false); +@@ -6964,7 +6964,7 @@ static void r8153_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7093,7 +7093,7 @@ static void r8153b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7104,7 +7104,7 @@ static void r8153b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + break; + } + +@@ -7175,7 +7175,7 @@ static void r8153c_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_u1u2en(tp, false); +@@ -7195,7 +7195,7 @@ static void r8153c_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8024,7 +8024,7 @@ static void r8156_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8045,7 +8045,7 @@ static void r8156_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -8120,7 +8120,7 @@ static void r8156b_init(struct r8152 *tp) + u16 data; + int i; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP); +@@ -8154,7 +8154,7 @@ static void r8156b_init(struct r8152 *tp) + break; + + msleep(20); +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + } + +@@ -9183,7 +9183,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd) + struct mii_ioctl_data *data = if_mii(rq); + int res; + +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return -ENODEV; + + res = usb_autopm_get_interface(tp->intf); +@@ -9285,7 +9285,7 @@ static const struct net_device_ops rtl8152_netdev_ops = { + + static void rtl8152_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + if (tp->version != RTL_VER_01) +@@ -9294,7 +9294,7 @@ static void rtl8152_unload(struct r8152 *tp) + + static void rtl8153_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153_power_cut_en(tp, false); +@@ -9302,7 +9302,7 @@ static void rtl8153_unload(struct r8152 *tp) + + static void rtl8153b_unload(struct r8152 *tp) + { +- if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) + return; + + r8153b_power_cut_en(tp, false); +-- +2.42.0 + diff --git a/queue-6.5/riscv-dts-thead-set-dma-noncoherent-to-soc-bus.patch b/queue-6.5/riscv-dts-thead-set-dma-noncoherent-to-soc-bus.patch new file mode 100644 index 00000000000..aa9da3fce01 --- /dev/null +++ b/queue-6.5/riscv-dts-thead-set-dma-noncoherent-to-soc-bus.patch @@ -0,0 +1,36 @@ +From ac0b02cd3004f6f56416ccb3a6589d7bb86fe612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Sep 2023 15:22:32 +0800 +Subject: riscv: dts: thead: set dma-noncoherent to soc bus + +From: Jisheng Zhang + +[ Upstream commit 759426c758c7053a941a4c06c7571461439fcff6 ] + +riscv select ARCH_DMA_DEFAULT_COHERENT by default, and th1520 isn't +dma coherent, so set dma-noncoherent to reflect this fact. + +Signed-off-by: Jisheng Zhang +Tested-by: Drew Fustini +Reviewed-by: Guo Ren +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/thead/th1520.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/boot/dts/thead/th1520.dtsi b/arch/riscv/boot/dts/thead/th1520.dtsi +index 56a73134b49e6..58108f0eb3fdc 100644 +--- a/arch/riscv/boot/dts/thead/th1520.dtsi ++++ b/arch/riscv/boot/dts/thead/th1520.dtsi +@@ -139,6 +139,7 @@ + interrupt-parent = <&plic>; + #address-cells = <2>; + #size-cells = <2>; ++ dma-noncoherent; + ranges; + + plic: interrupt-controller@ffd8000000 { +-- +2.42.0 + diff --git a/queue-6.5/s390-kasan-handle-dcss-mapping-in-memory-holes.patch b/queue-6.5/s390-kasan-handle-dcss-mapping-in-memory-holes.patch new file mode 100644 index 00000000000..70971ef648d --- /dev/null +++ b/queue-6.5/s390-kasan-handle-dcss-mapping-in-memory-holes.patch @@ -0,0 +1,57 @@ +From c16d9ee3df1091dc2e0b2c920f4e99429d6b323d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Oct 2023 11:06:21 +0200 +Subject: s390/kasan: handle DCSS mapping in memory holes + +From: Vasily Gorbik + +[ Upstream commit 327899674eef18f96644be87aa5510b7523fe4f6 ] + +When physical memory is defined under z/VM using DEF STOR CONFIG, there +may be memory holes that are not hotpluggable memory. In such cases, +DCSS mapping could be placed in one of these memory holes. Subsequently, +attempting memory access to such DCSS mapping would result in a kasan +failure because there is no shadow memory mapping for it. + +To maintain consistency with cases where DCSS mapping is positioned after +the kernel identity mapping, which is then covered by kasan zero shadow +mapping, handle the scenario above by populating zero shadow mapping +for memory holes where DCSS mapping could potentially be placed. + +Reviewed-by: Heiko Carstens +Reviewed-by: Gerald Schaefer +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/vmem.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c +index c67f59db7a512..f66d642251fe8 100644 +--- a/arch/s390/boot/vmem.c ++++ b/arch/s390/boot/vmem.c +@@ -57,6 +57,7 @@ static void kasan_populate_shadow(void) + pmd_t pmd_z = __pmd(__pa(kasan_early_shadow_pte) | _SEGMENT_ENTRY); + pud_t pud_z = __pud(__pa(kasan_early_shadow_pmd) | _REGION3_ENTRY); + p4d_t p4d_z = __p4d(__pa(kasan_early_shadow_pud) | _REGION2_ENTRY); ++ unsigned long memgap_start = 0; + unsigned long untracked_end; + unsigned long start, end; + int i; +@@ -101,8 +102,12 @@ static void kasan_populate_shadow(void) + * +- shadow end ----+---------+- shadow end ---+ + */ + +- for_each_physmem_usable_range(i, &start, &end) ++ for_each_physmem_usable_range(i, &start, &end) { + kasan_populate(start, end, POPULATE_KASAN_MAP_SHADOW); ++ if (memgap_start && physmem_info.info_source == MEM_DETECT_DIAG260) ++ kasan_populate(memgap_start, start, POPULATE_KASAN_ZERO_SHADOW); ++ memgap_start = end; ++ } + if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) { + untracked_end = VMALLOC_START; + /* shallowly populate kasan shadow for vmalloc and modules */ +-- +2.42.0 + diff --git a/queue-6.5/scsi-mpt3sas-fix-in-error-path.patch b/queue-6.5/scsi-mpt3sas-fix-in-error-path.patch new file mode 100644 index 00000000000..f9976d1c457 --- /dev/null +++ b/queue-6.5/scsi-mpt3sas-fix-in-error-path.patch @@ -0,0 +1,39 @@ +From c039a8921765cec138cce937f6fb5465151fa822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Oct 2023 13:45:29 +0200 +Subject: scsi: mpt3sas: Fix in error path + +From: Tomas Henzl + +[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ] + +The driver should be deregistered as misc driver after PCI registration +failure. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index c3c1f466fe01d..605013d3ee83a 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -12913,8 +12913,10 @@ _mpt3sas_init(void) + mpt3sas_ctl_init(hbas_to_enumerate); + + error = pci_register_driver(&mpt3sas_driver); +- if (error) ++ if (error) { ++ mpt3sas_ctl_exit(hbas_to_enumerate); + scsih_exit(); ++ } + + return error; + } +-- +2.42.0 + diff --git a/queue-6.5/series b/queue-6.5/series new file mode 100644 index 00000000000..a06ea678544 --- /dev/null +++ b/queue-6.5/series @@ -0,0 +1,62 @@ +asoc-intel-sof_sdw-add-support-for-sku-0b14.patch +asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch +coresight-tmc-etr-disable-warnings-for-allocation-fa.patch +asoc-fsl-asoc-card-use-integer-type-for-fll_id-and-p.patch +asoc-core-do-not-call-link_exit-on-uninitialized-rtd.patch +asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch +net-sched-cls_u32-fix-allocation-size-in-u32_init.patch +arm64-dts-imx93-add-the-flex-can-stop-mode-by-gpr.patch +can-flexcan-remove-the-auto-stop-mode-for-imx93.patch +irqchip-gic-v3-its-split-allocation-from-initialisat.patch +irqchip-gic-v3-enable-non-coherent-redistributors-it.patch +irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch +irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch +dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch +ata-pata_parport-add-custom-version-of-wait_after_re.patch +ata-pata_parport-fit3-implement-ide-command-set-regi.patch +powerpc-85xx-fix-math-emulation-exception.patch +media-i2c-ov8858-don-t-set-fwnode-in-the-driver.patch +input-synaptics-rmi4-handle-reset-delay-when-using-s.patch +fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch +fs-ntfs3-add-ckeck-in-ni_update_parent.patch +fs-ntfs3-write-immediately-updated-ntfs-state.patch +fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch +fs-ntfs3-add-more-attributes-checks-in-mi_enum_attr.patch +fs-ntfs3-fix-alternative-boot-searching.patch +fs-ntfs3-add-more-info-into-proc-fs-ntfs3-dev-volinf.patch +fs-ntfs3-do-not-allow-to-change-label-if-volume-is-r.patch +fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch +fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch +fs-ntfs3-fix-directory-element-type-detection.patch +fs-ntfs3-avoid-possible-memory-leak.patch +spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch +asoc-soc-dapm-add-helper-for-comparing-widget-name.patch +netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch +net-mlx5-bridge-fix-peer-entry-ageing-in-lag-mode.patch +x86-efistub-don-t-try-to-print-after-exitbootservice.patch +efi-fix-memory-leak-in-krealloc-failure-handling.patch +asoc-rt5650-fix-the-wrong-result-of-key-button.patch +asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch +s390-kasan-handle-dcss-mapping-in-memory-holes.patch +drm-ttm-reorder-sys-manager-cleanup-step.patch +fbdev-omapfb-fix-some-error-codes.patch +fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch +scsi-mpt3sas-fix-in-error-path.patch +asoc-da7219-correct-the-process-of-setting-up-gnd-sw.patch +drm-amdgpu-unset-context-priority-is-now-invalid.patch +gpu-drm-eliminate-drm_sched_priority_unset.patch +loongarch-use-sym_code_-to-annotate-exception-handle.patch +loongarch-export-symbol-invalid_pud_table-for-module.patch +loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch +loongarch-disable-wuc-for-pgprot_writecombine-like-i.patch +netfilter-nf_tables-audit-log-object-reset-once-per-.patch +platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch +drm-amdgpu-reserve-fences-for-vm-update.patch +riscv-dts-thead-set-dma-noncoherent-to-soc-bus.patch +net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch +r8152-check-for-unplug-in-rtl_phy_patch_request.patch +r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch +r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch +powerpc-mm-fix-boot-crash-with-flatmem.patch +io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch +ceph_wait_on_conflict_unlink-grab-reference-before-d.patch diff --git a/queue-6.5/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch b/queue-6.5/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch new file mode 100644 index 00000000000..0c3b0333a9d --- /dev/null +++ b/queue-6.5/spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch @@ -0,0 +1,40 @@ +From 50fd79e436bfac4ee18e75b49288c3571b9dadbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 11:28:12 -0700 +Subject: spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0 + +From: William A. Kennington III + +[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ] + +We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when +dummy.nbytes is 0. Since we have no dummy bytes, we don't need to +configure the dummy byte bits per clock register value anyway. + +Signed-off-by: "William A. Kennington III" +Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-npcm-fiu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c +index eb353561509a8..01a2b9de18b7f 100644 +--- a/drivers/spi/spi-npcm-fiu.c ++++ b/drivers/spi/spi-npcm-fiu.c +@@ -353,8 +353,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem, + uma_cfg |= ilog2(op->cmd.buswidth); + uma_cfg |= ilog2(op->addr.buswidth) + << NPCM_FIU_UMA_CFG_ADBPCK_SHIFT; +- uma_cfg |= ilog2(op->dummy.buswidth) +- << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; ++ if (op->dummy.nbytes) ++ uma_cfg |= ilog2(op->dummy.buswidth) ++ << NPCM_FIU_UMA_CFG_DBPCK_SHIFT; + uma_cfg |= ilog2(op->data.buswidth) + << NPCM_FIU_UMA_CFG_RDBPCK_SHIFT; + uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT; +-- +2.42.0 + diff --git a/queue-6.5/x86-efistub-don-t-try-to-print-after-exitbootservice.patch b/queue-6.5/x86-efistub-don-t-try-to-print-after-exitbootservice.patch new file mode 100644 index 00000000000..3682bf5a797 --- /dev/null +++ b/queue-6.5/x86-efistub-don-t-try-to-print-after-exitbootservice.patch @@ -0,0 +1,48 @@ +From ec9ab9048622ed295ccf498c5a5b2be4f622b9e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Oct 2023 22:25:28 +0300 +Subject: x86/efistub: Don't try to print after ExitBootService() + +From: Nikolay Borisov + +[ Upstream commit ff07186b4d774ac22a5345d30763045af4569416 ] + +setup_e820() is executed after UEFI's ExitBootService has been called. +This causes the firmware to throw an exception because the Console IO +protocol is supposed to work only during boot service environment. As +per UEFI 2.9, section 12.1: + + "This protocol is used to handle input and output of text-based + information intended for the system user during the operation of code + in the boot services environment." + +So drop the diagnostic warning from this function. We might add back a +warning that is issued later when initializing the kernel itself. + +Signed-off-by: Nikolay Borisov +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/libstub/x86-stub.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c +index 146477da2b98c..a5a856a7639e1 100644 +--- a/drivers/firmware/efi/libstub/x86-stub.c ++++ b/drivers/firmware/efi/libstub/x86-stub.c +@@ -648,11 +648,8 @@ setup_e820(struct boot_params *params, struct setup_data *e820ext, u32 e820ext_s + break; + + case EFI_UNACCEPTED_MEMORY: +- if (!IS_ENABLED(CONFIG_UNACCEPTED_MEMORY)) { +- efi_warn_once( +-"The system has unaccepted memory, but kernel does not support it\nConsider enabling CONFIG_UNACCEPTED_MEMORY\n"); ++ if (!IS_ENABLED(CONFIG_UNACCEPTED_MEMORY)) + continue; +- } + e820_type = E820_TYPE_RAM; + process_unaccepted_memory(d->phys_addr, + d->phys_addr + PAGE_SIZE * d->num_pages); +-- +2.42.0 +