From: Sasha Levin Date: Thu, 7 Sep 2023 00:08:04 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.53~159 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=392f4adb691b1f8d6ba0a8502b3b7cb03c8485ae;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch b/queue-6.1/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch new file mode 100644 index 00000000000..c2114456364 --- /dev/null +++ b/queue-6.1/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch @@ -0,0 +1,46 @@ +From d153d20933164c8de07529ca195a35c543248392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 16:49:26 +0900 +Subject: 9p: virtio: fix unlikely null pointer deref in handle_rerror + +From: Dominique Martinet + +[ Upstream commit 13ade4ac5c28e8a014fa85278f5a4270b215f906 ] + +handle_rerror can dereference the pages pointer, but it is not +necessarily set for small payloads. +In practice these should be filtered out by the size check, but +might as well double-check explicitly. + +This fixes the following scan-build warnings: +net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer [core.NullDereference] + memcpy_from_page(to, *pages++, offs, n); + ^~~~~~~~ +net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded from variable 'pages') [core.NullDereference] + memcpy_from_page(to, *pages, offs, size); + ^~~~~~ + +Reviewed-by: Simon Horman +Signed-off-by: Dominique Martinet +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + net/9p/trans_virtio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 3f3eb03cda7d6..6a4a29a2703de 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -385,7 +385,7 @@ static void handle_rerror(struct p9_req_t *req, int in_hdr_len, + void *to = req->rc.sdata + in_hdr_len; + + // Fits entirely into the static data? Nothing to do. +- if (req->rc.size < in_hdr_len) ++ if (req->rc.size < in_hdr_len || !pages) + return; + + // Really long error message? Tough, truncate the reply. Might get +-- +2.40.1 + diff --git a/queue-6.1/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch b/queue-6.1/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch new file mode 100644 index 00000000000..b88e38ae3a0 --- /dev/null +++ b/queue-6.1/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch @@ -0,0 +1,43 @@ +From a616fcd900ed63dcefc2227d7b581825c9a36865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 16:49:27 +0900 +Subject: 9p: virtio: make sure 'offs' is initialized in zc_request + +From: Dominique Martinet + +[ Upstream commit 4a73edab69d3a6623f03817fe950a2d9585f80e4 ] + +Similarly to the previous patch: offs can be used in handle_rerrors +without initializing on small payloads; in this case handle_rerrors will +not use it because of the size check, but it doesn't hurt to make sure +it is zero to please scan-build. + +This fixes the following warning: +net/9p/trans_virtio.c:539:3: warning: 3rd function call argument is an uninitialized value [core.CallAndMessage] + handle_rerror(req, in_hdr_len, offs, in_pages); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Reviewed-by: Simon Horman +Signed-off-by: Dominique Martinet +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + net/9p/trans_virtio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 6a4a29a2703de..3cf660d8a0a7b 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -429,7 +429,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, + struct page **in_pages = NULL, **out_pages = NULL; + struct virtio_chan *chan = client->trans; + struct scatterlist *sgs[4]; +- size_t offs; ++ size_t offs = 0; + int need_drop = 0; + int kicked = 0; + +-- +2.40.1 + diff --git a/queue-6.1/alsa-hda-realtek-enable-4-amplifiers-instead-of-2-on.patch b/queue-6.1/alsa-hda-realtek-enable-4-amplifiers-instead-of-2-on.patch new file mode 100644 index 00000000000..982c26dc5d9 --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-enable-4-amplifiers-instead-of-2-on.patch @@ -0,0 +1,40 @@ +From 5ef93b0d574374a2777a7307c946811f266a8837 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 22:57:47 +0800 +Subject: ALSA: hda/realtek: Enable 4 amplifiers instead of 2 on a HP platform + +From: Chris Chiu + +[ Upstream commit b752a385b584d385683c65cb76a1298f1379a88c ] + +In the commit 7bb62340951a ("ALSA: hda/realtek: fix speaker, mute/micmute +LEDs not work on a HP platform"), speakers and LEDs are fixed but only 2 +CS35L41 amplifiers on SPI bus connected to Realtek codec are enabled. Need +the ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED to get all amplifiers working. + +Signed-off-by: Chris Chiu +Fixes: 7bb62340951a ("ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform") +Cc: +Link: https://lore.kernel.org/r/20230606145747.135966-1-chris.chiu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index aa475154c582f..f70e0ad81607e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9591,7 +9591,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8b8a, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b8b, "HP", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b8d, "HP", ALC236_FIXUP_HP_GPIO_LED), +- SND_PCI_QUIRK(0x103c, 0x8b8f, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8b8f, "HP", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b92, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b97, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), +-- +2.40.1 + diff --git a/queue-6.1/alsa-seq-oss-fix-racy-open-close-of-midi-devices.patch b/queue-6.1/alsa-seq-oss-fix-racy-open-close-of-midi-devices.patch new file mode 100644 index 00000000000..90680ca9148 --- /dev/null +++ b/queue-6.1/alsa-seq-oss-fix-racy-open-close-of-midi-devices.patch @@ -0,0 +1,129 @@ +From eaa448f12a40f3dce1ede06a2ab1b7bd11d9941e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 14:55:33 +0200 +Subject: ALSA: seq: oss: Fix racy open/close of MIDI devices + +From: Takashi Iwai + +[ Upstream commit 297224fc0922e7385573a30c29ffdabb67f27b7d ] + +Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be +called concurrently from different code paths, we have no proper data +protection against races. Introduce open_mutex to each seq_oss_midi +object for avoiding the races. + +Reported-by: "Gong, Sishuai" +Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu +Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/oss/seq_oss_midi.c | 35 +++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 13 deletions(-) + +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index 07efb38f58ac1..f2940b29595f0 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -37,6 +37,7 @@ struct seq_oss_midi { + struct snd_midi_event *coder; /* MIDI event coder */ + struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */ + snd_use_lock_t use_lock; ++ struct mutex open_mutex; + }; + + +@@ -172,6 +173,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo) + mdev->flags = pinfo->capability; + mdev->opened = 0; + snd_use_lock_init(&mdev->use_lock); ++ mutex_init(&mdev->open_mutex); + + /* copy and truncate the name of synth device */ + strscpy(mdev->name, pinfo->name, sizeof(mdev->name)); +@@ -322,15 +324,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + int perm; + struct seq_oss_midi *mdev; + struct snd_seq_port_subscribe subs; ++ int err; + + mdev = get_mididev(dp, dev); + if (!mdev) + return -ENODEV; + ++ mutex_lock(&mdev->open_mutex); + /* already used? */ + if (mdev->opened && mdev->devinfo != dp) { +- snd_use_lock_free(&mdev->use_lock); +- return -EBUSY; ++ err = -EBUSY; ++ goto unlock; + } + + perm = 0; +@@ -340,14 +344,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + perm |= PERM_READ; + perm &= mdev->flags; + if (perm == 0) { +- snd_use_lock_free(&mdev->use_lock); +- return -ENXIO; ++ err = -ENXIO; ++ goto unlock; + } + + /* already opened? */ + if ((mdev->opened & perm) == perm) { +- snd_use_lock_free(&mdev->use_lock); +- return 0; ++ err = 0; ++ goto unlock; + } + + perm &= ~mdev->opened; +@@ -372,13 +376,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode) + } + + if (! mdev->opened) { +- snd_use_lock_free(&mdev->use_lock); +- return -ENXIO; ++ err = -ENXIO; ++ goto unlock; + } + + mdev->devinfo = dp; ++ err = 0; ++ ++ unlock: ++ mutex_unlock(&mdev->open_mutex); + snd_use_lock_free(&mdev->use_lock); +- return 0; ++ return err; + } + + /* +@@ -393,10 +401,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev) + mdev = get_mididev(dp, dev); + if (!mdev) + return -ENODEV; +- if (! mdev->opened || mdev->devinfo != dp) { +- snd_use_lock_free(&mdev->use_lock); +- return 0; +- } ++ mutex_lock(&mdev->open_mutex); ++ if (!mdev->opened || mdev->devinfo != dp) ++ goto unlock; + + memset(&subs, 0, sizeof(subs)); + if (mdev->opened & PERM_WRITE) { +@@ -415,6 +422,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev) + mdev->opened = 0; + mdev->devinfo = NULL; + ++ unlock: ++ mutex_unlock(&mdev->open_mutex); + snd_use_lock_free(&mdev->use_lock); + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch b/queue-6.1/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch new file mode 100644 index 00000000000..9c8bc458384 --- /dev/null +++ b/queue-6.1/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch @@ -0,0 +1,85 @@ +From 059df0025c84fc188abd7d84c05b325983a7e386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 11:20:57 +0200 +Subject: ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset + +From: Takashi Iwai + +[ Upstream commit 3da435063777f8d861ba5a165344e3f75f839357 ] + +Microsoft Modern Wireless Headset (appearing on the host as "Microsoft +USB Link") has a playback and a capture mixer volume/switch, but they +are fairly broken. The descriptor reports wrong dB ranges for +playback, and the capture volume/switch don't influence on the actual +recording at all. Moreover, there seem instabilities in the +connection, and at best, we should disable the runtime PM. + +So this ended up with a quirk entry for: +- Correct the playback dB range; + I picked up some reasonable values but it's a guess work +- Disable the capture mixer; + it's completely useless and confuses PA/PW +- Suppress get-sample-rate, apply the delay for message handling, + and suppress the auto-suspend + +The behavior of the wheel control on the headset is somehow flaky, +too, but it's an issue of HID. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1207129 +Link: https://lore.kernel.org/r/20230725092057.15115-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_maps.c | 14 ++++++++++++++ + sound/usb/quirks.c | 3 +++ + 2 files changed, 17 insertions(+) + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index f4bd1e8ae4b6c..23260aa1919d3 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -374,6 +374,15 @@ static const struct usbmix_name_map corsair_virtuoso_map[] = { + { 0 } + }; + ++/* Microsoft USB Link headset */ ++/* a guess work: raw playback volume values are from 2 to 129 */ ++static const struct usbmix_dB_map ms_usb_link_dB = { -3225, 0, true }; ++static const struct usbmix_name_map ms_usb_link_map[] = { ++ { 9, NULL, .dB = &ms_usb_link_dB }, ++ { 10, NULL }, /* Headset Capture volume; seems non-working, disabled */ ++ { 0 } /* terminator */ ++}; ++ + /* ASUS ROG Zenith II with Realtek ALC1220-VB */ + static const struct usbmix_name_map asus_zenith_ii_map[] = { + { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */ +@@ -668,6 +677,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x1395, 0x0025), + .map = sennheiser_pc8_map, + }, ++ { ++ /* Microsoft USB Link headset */ ++ .id = USB_ID(0x045e, 0x083c), ++ .map = ms_usb_link_map, ++ }, + { 0 } /* terminator */ + }; + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 6cf55b7f7a041..d4a7ffef82194 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2011,6 +2011,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */ ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY | ++ QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x046d, 0x084c, /* Logitech ConferenceCam Connect */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x046d, 0x0991, /* Logitech QuickCam Pro */ +-- +2.40.1 + diff --git a/queue-6.1/alsa-usb-audio-update-for-native-dsd-support-quirks.patch b/queue-6.1/alsa-usb-audio-update-for-native-dsd-support-quirks.patch new file mode 100644 index 00000000000..4a8d6f70eea --- /dev/null +++ b/queue-6.1/alsa-usb-audio-update-for-native-dsd-support-quirks.patch @@ -0,0 +1,136 @@ +From 1adfc6ffa6481da4eebafd12b432b9215fee0a13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 19:56:45 +0300 +Subject: ALSA: usb-audio: Update for native DSD support quirks + +From: Jussi Laako + +[ Upstream commit f7fea075edfa085c25eb34c44ceacf3602537f98 ] + +Maintenance patch for native DSD support. + +Remove incorrect T+A device quirks. Move set of device quirks to vendor +quirks. Add set of missing device and vendor quirks. + +Signed-off-by: Jussi Laako +Link: https://lore.kernel.org/r/20230726165645.404311-1-jussi@sonarnerd.net +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index d4a7ffef82194..4667d543f7481 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1874,8 +1874,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + + /* XMOS based USB DACs */ + switch (chip->usb_id) { +- case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */ +- case USB_ID(0x21ed, 0xd75a): /* Accuphase DAC-60 option card */ ++ case USB_ID(0x139f, 0x5504): /* Nagra DAC */ ++ case USB_ID(0x20b1, 0x3089): /* Mola-Mola DAC */ ++ case USB_ID(0x2522, 0x0007): /* LH Labs Geek Out 1V5 */ ++ case USB_ID(0x2522, 0x0009): /* LH Labs Geek Pulse X Inifinity 2V0 */ + case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */ + case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ + if (fp->altsetting == 2) +@@ -1885,14 +1887,18 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */ + case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */ + case USB_ID(0x16d0, 0x06b2): /* NuPrime DAC-10 */ +- case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x06b4): /* NuPrime Audio HD-AVP/AVA */ + case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */ ++ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ ++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ ++ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ + case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */ + case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */ + case USB_ID(0x2622, 0x0041): /* Audiolab M-DAC+ */ ++ case USB_ID(0x278b, 0x5100): /* Rotel RC-1590 */ + case USB_ID(0x27f7, 0x3002): /* W4S DAC-2v2SE */ + case USB_ID(0x29a2, 0x0086): /* Mutec MC3+ USB */ + case USB_ID(0x6b42, 0x0042): /* MSB Technology */ +@@ -1902,9 +1908,6 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + + /* Amanero Combo384 USB based DACs with native DSD support */ + case USB_ID(0x16d0, 0x071a): /* Amanero - Combo384 */ +- case USB_ID(0x2ab6, 0x0004): /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */ +- case USB_ID(0x2ab6, 0x0005): /* T+A USB HD Audio 1 */ +- case USB_ID(0x2ab6, 0x0006): /* T+A USB HD Audio 2 */ + if (fp->altsetting == 2) { + switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) { + case 0x199: +@@ -2049,6 +2052,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x0644, 0x805f, /* TEAC Model 12 */ + QUIRK_FLAG_FORCE_IFACE_RESET), ++ DEVICE_FLG(0x0644, 0x806b, /* TEAC UD-701 */ ++ QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY | ++ QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */ +@@ -2087,6 +2093,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), + DEVICE_FLG(0x154e, 0x3006, /* Marantz SA-14S1 */ + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), ++ DEVICE_FLG(0x154e, 0x300b, /* Marantz SA-KI RUBY / SA-12 */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x154e, 0x500e, /* Denon DN-X1600 */ + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ +@@ -2131,6 +2139,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x21b4, 0x0230, /* Ayre QB-9 Twenty */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x21b4, 0x0232, /* Ayre QX-5 Twenty */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */ + QUIRK_FLAG_SET_IFACE_FIRST), + DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */ +@@ -2173,12 +2185,18 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_VALIDATE_RATES), + VENDOR_FLG(0x1235, /* Focusrite Novation */ + QUIRK_FLAG_VALIDATE_RATES), ++ VENDOR_FLG(0x1511, /* AURALiC */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x152a, /* Thesycon devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x18d1, /* iBasso devices */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x1de7, /* Phoenix Audio */ + QUIRK_FLAG_GET_SAMPLE_RATE), + VENDOR_FLG(0x20b1, /* XMOS based devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x21ed, /* Accuphase Laboratory */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x22d9, /* Oppo */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x23ba, /* Playback Design */ +@@ -2194,10 +2212,14 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x2ab6, /* T+A devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x2d87, /* Cayin device */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3336, /* HEM devices */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3353, /* Khadas devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x35f4, /* MSB Technology */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3842, /* EVGA */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0xc502, /* HiBy devices */ +-- +2.40.1 + diff --git a/queue-6.1/arm-dts-imx-set-default-tuning-step-for-imx7d-usdhc.patch b/queue-6.1/arm-dts-imx-set-default-tuning-step-for-imx7d-usdhc.patch new file mode 100644 index 00000000000..b03e437262b --- /dev/null +++ b/queue-6.1/arm-dts-imx-set-default-tuning-step-for-imx7d-usdhc.patch @@ -0,0 +1,64 @@ +From e545ad6a45226c27610e9ec60058bf29339c7e4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 23:45:10 +0800 +Subject: ARM: dts: imx: Set default tuning step for imx7d usdhc + +From: Xiaolei Wang + +[ Upstream commit be18293e47cbca7c6acee9231fc851601d69563a ] + +If the tuning step is not set, the tuning step is set to 1. +For some sd cards, the following Tuning timeout will occur. + +Tuning failed, falling back to fixed sampling clock +mmc0: Tuning failed, falling back to fixed sampling clock + +So set the default tuning step. This refers to the NXP vendor's +commit below: + +https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/ +arch/arm/boot/dts/imx7s.dtsi#L1216-L1217 + +Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting") +Signed-off-by: Xiaolei Wang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7s.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 11b9321badc51..667568aa4326a 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -1184,6 +1184,8 @@ + <&clks IMX7D_USDHC1_ROOT_CLK>; + clock-names = "ipg", "ahb", "per"; + bus-width = <4>; ++ fsl,tuning-step = <2>; ++ fsl,tuning-start-tap = <20>; + status = "disabled"; + }; + +@@ -1196,6 +1198,8 @@ + <&clks IMX7D_USDHC2_ROOT_CLK>; + clock-names = "ipg", "ahb", "per"; + bus-width = <4>; ++ fsl,tuning-step = <2>; ++ fsl,tuning-start-tap = <20>; + status = "disabled"; + }; + +@@ -1208,6 +1212,8 @@ + <&clks IMX7D_USDHC3_ROOT_CLK>; + clock-names = "ipg", "ahb", "per"; + bus-width = <4>; ++ fsl,tuning-step = <2>; ++ fsl,tuning-start-tap = <20>; + status = "disabled"; + }; + +-- +2.40.1 + diff --git a/queue-6.1/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch b/queue-6.1/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch new file mode 100644 index 00000000000..6462741d1e6 --- /dev/null +++ b/queue-6.1/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch @@ -0,0 +1,46 @@ +From 785347532517e1a9a3b53b8d71ca4580e3f10448 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 11:06:20 +0800 +Subject: ASoC: atmel: Fix the 8K sample parameter in I2SC master + +From: Guiting Shen + +[ Upstream commit f85739c0b2b0d98a32f5ca4fcc5501d2b76df4f6 ] + +The 8K sample parameter of 12.288Mhz main system bus clock doesn't work +because the I2SC_MR.IMCKDIV must not be 0 according to the sama5d2 +series datasheet(I2SC Mode Register of Register Summary). + +So use the 6.144Mhz instead of 12.288Mhz to support 8K sample. + +Signed-off-by: Guiting Shen +Link: https://lore.kernel.org/r/20230715030620.62328-1-aarongt.shen@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-i2s.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index 425d66edbf867..5e43ff0b537a3 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -163,11 +163,14 @@ struct atmel_i2s_gck_param { + + #define I2S_MCK_12M288 12288000UL + #define I2S_MCK_11M2896 11289600UL ++#define I2S_MCK_6M144 6144000UL + + /* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */ + static const struct atmel_i2s_gck_param gck_params[] = { ++ /* mck = 6.144Mhz */ ++ { 8000, I2S_MCK_6M144, 1, 47}, /* mck = 768 fs */ ++ + /* mck = 12.288MHz */ +- { 8000, I2S_MCK_12M288, 0, 47}, /* mck = 1536 fs */ + { 16000, I2S_MCK_12M288, 1, 47}, /* mck = 768 fs */ + { 24000, I2S_MCK_12M288, 3, 63}, /* mck = 512 fs */ + { 32000, I2S_MCK_12M288, 3, 47}, /* mck = 384 fs */ +-- +2.40.1 + diff --git a/queue-6.1/asoc-codecs-es8316-fix-dmic-config.patch b/queue-6.1/asoc-codecs-es8316-fix-dmic-config.patch new file mode 100644 index 00000000000..eaf4e2df94d --- /dev/null +++ b/queue-6.1/asoc-codecs-es8316-fix-dmic-config.patch @@ -0,0 +1,36 @@ +From 936943dd603c46f48e28753197ce1bc7b843a5fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 13:47:22 +0800 +Subject: ASoc: codecs: ES8316: Fix DMIC config + +From: Edgar + +[ Upstream commit d20d35d1ad62c6cca36368c1e8f29335a068659e ] + +According to the datasheet, the DMIC config should +be changed to { 0, 2 ,3 } + +Signed-off-by: Edgar +Link: https://lore.kernel.org/r/20230719054722.401954-1-ljijcj@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 87775378362e7..c4e4ab93fdb6d 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -153,7 +153,7 @@ static const char * const es8316_dmic_txt[] = { + "dmic data at high level", + "dmic data at low level", + }; +-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 }; ++static const unsigned int es8316_dmic_values[] = { 0, 2, 3 }; + static const struct soc_enum es8316_dmic_src_enum = + SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3, + ARRAY_SIZE(es8316_dmic_txt), +-- +2.40.1 + diff --git a/queue-6.1/asoc-da7219-check-for-failure-reading-aad-irq-events.patch b/queue-6.1/asoc-da7219-check-for-failure-reading-aad-irq-events.patch new file mode 100644 index 00000000000..4ac6fc0af5f --- /dev/null +++ b/queue-6.1/asoc-da7219-check-for-failure-reading-aad-irq-events.patch @@ -0,0 +1,51 @@ +From f8a8d1ccf7bd7209543edf49b61c97f101d6030e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 21:37:37 +0200 +Subject: ASoC: da7219: Check for failure reading AAD IRQ events + +From: Dmytro Maluka + +[ Upstream commit f0691dc16206f21b13c464434366e2cd632b8ed7 ] + +When handling an AAD interrupt, if IRQ events read failed (for example, +due to i2c "Transfer while suspended" failure, i.e. when attempting to +read it while DA7219 is suspended, which may happen due to a spurious +AAD interrupt), the events array contains garbage uninitialized values. +So instead of trying to interprete those values and doing any actions +based on them (potentially resulting in misbehavior, e.g. reporting +bogus events), refuse to handle the interrupt. + +Signed-off-by: Dmytro Maluka +Link: https://lore.kernel.org/r/20230717193737.161784-3-dmy@semihalf.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 49b1622e7bada..9251490548e8c 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -353,11 +353,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data) + struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component); + u8 events[DA7219_AAD_IRQ_REG_MAX]; + u8 statusa; +- int i, report = 0, mask = 0; ++ int i, ret, report = 0, mask = 0; + + /* Read current IRQ events */ +- regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, +- events, DA7219_AAD_IRQ_REG_MAX); ++ ret = regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, ++ events, DA7219_AAD_IRQ_REG_MAX); ++ if (ret) { ++ dev_warn_ratelimited(component->dev, "Failed to read IRQ events: %d\n", ret); ++ return IRQ_NONE; ++ } + + if (!events[DA7219_AAD_IRQ_REG_A] && !events[DA7219_AAD_IRQ_REG_B]) + return IRQ_NONE; +-- +2.40.1 + diff --git a/queue-6.1/asoc-da7219-flush-pending-aad-irq-when-suspending.patch b/queue-6.1/asoc-da7219-flush-pending-aad-irq-when-suspending.patch new file mode 100644 index 00000000000..d9ad73875f3 --- /dev/null +++ b/queue-6.1/asoc-da7219-flush-pending-aad-irq-when-suspending.patch @@ -0,0 +1,77 @@ +From 56b7f917a0adf8927e95033cfd06403efa4aa47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 21:37:36 +0200 +Subject: ASoC: da7219: Flush pending AAD IRQ when suspending + +From: Dmytro Maluka + +[ Upstream commit 91e292917dad64ab8d1d5ca2ab3069ad9dac6f72 ] + +da7219_aad_suspend() disables jack detection, which should prevent +generating new interrupts by DA7219 while suspended. However, there is a +theoretical possibility that there is a pending interrupt generated just +before suspending DA7219 and not handled yet, so the IRQ handler may +still run after DA7219 is suspended. To prevent that, wait until the +pending IRQ handling is done. + +This patch arose as an attempt to fix the following I2C failure +occurring sometimes during system suspend or resume: + +[ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended +[ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440 +... +[ 355.876462] Call Trace: +[ 355.876468] +[ 355.876475] ? update_load_avg+0x1b3/0x615 +[ 355.876484] __i2c_transfer+0x101/0x1d8 +[ 355.876494] i2c_transfer+0x74/0x10d +[ 355.876504] regmap_i2c_read+0x6a/0x9c +[ 355.876513] _regmap_raw_read+0x179/0x223 +[ 355.876521] regmap_raw_read+0x1e1/0x28e +[ 355.876527] regmap_bulk_read+0x17d/0x1ba +[ 355.876532] ? __wake_up+0xed/0x1bb +[ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184] +[ 355.876556] irq_thread+0x13c/0x231 +[ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f +[ 355.876570] ? irq_thread_fn+0x4d/0x4d +[ 355.876576] kthread+0x13a/0x152 +[ 355.876581] ? synchronize_irq+0xc3/0xc3 +[ 355.876587] ? kthread_blkcg+0x31/0x31 +[ 355.876592] ret_from_fork+0x1f/0x30 +[ 355.876601] + +which indicates that the AAD IRQ handler is unexpectedly running when +DA7219 is suspended, and as a result, is trying to read data from DA7219 +over I2C and is hitting the I2C driver "Transfer while suspended" +failure. + +However, with this patch the above failure is still reproducible. So +this patch does not fix any real observed issue so far, but at least is +useful for confirming that the above issue is not caused by a pending +IRQ but rather looks like a DA7219 hardware issue with an IRQ +unexpectedly generated after jack detection is already disabled. + +Signed-off-by: Dmytro Maluka +Link: https://lore.kernel.org/r/20230717193737.161784-2-dmy@semihalf.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index bba73c44c219f..49b1622e7bada 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -863,6 +863,8 @@ void da7219_aad_suspend(struct snd_soc_component *component) + } + } + } ++ ++ synchronize_irq(da7219_aad->irq); + } + + void da7219_aad_resume(struct snd_soc_component *component) +-- +2.40.1 + diff --git a/queue-6.1/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch b/queue-6.1/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch new file mode 100644 index 00000000000..3c7a03431b0 --- /dev/null +++ b/queue-6.1/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch @@ -0,0 +1,99 @@ +From 5004da6d4cd3adcbe6d6cd6efcae7ab172440a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 17:02:41 -0300 +Subject: ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect + +From: Edson Juliano Drosdeck + +[ Upstream commit 1bc40efdaf4a0ccfdb10a1c8e4b458f4764e8e5f ] + +Add a quirk mechanism to allow specifying that active-high jack-detection +should be used on platforms where this info is not available in devicetree. + +And add an entry for the Positivo CW14Q01P-V2 to the DMI table, so that +jack-detection will work properly on this laptop. + +Signed-off-by: Edson Juliano Drosdeck +Link: https://lore.kernel.org/r/20230719200241.4865-1-edson.drosdeck@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 41 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index 4a72b94e84104..efd92656a060d 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -25,6 +26,13 @@ + #include + #include "nau8821.h" + ++#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++ ++static int nau8821_quirk; ++static int quirk_override = -1; ++module_param_named(quirk, quirk_override, uint, 0444); ++MODULE_PARM_DESC(quirk, "Board-specific quirk override"); ++ + #define NAU_FREF_MAX 13500000 + #define NAU_FVCO_MAX 100000000 + #define NAU_FVCO_MIN 90000000 +@@ -1696,6 +1704,33 @@ static int nau8821_setup_irq(struct nau8821 *nau8821) + return 0; + } + ++/* Please keep this list alphabetically sorted */ ++static const struct dmi_system_id nau8821_quirk_table[] = { ++ { ++ /* Positivo CW14Q01P-V2 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), ++ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), ++ }, ++ .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ }, ++ {} ++}; ++ ++static void nau8821_check_quirks(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ if (quirk_override != -1) { ++ nau8821_quirk = quirk_override; ++ return; ++ } ++ ++ dmi_id = dmi_first_match(nau8821_quirk_table); ++ if (dmi_id) ++ nau8821_quirk = (unsigned long)dmi_id->driver_data; ++} ++ + static int nau8821_i2c_probe(struct i2c_client *i2c) + { + struct device *dev = &i2c->dev; +@@ -1716,6 +1751,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821->dev = dev; + nau8821->irq = i2c->irq; ++ ++ nau8821_check_quirks(); ++ ++ if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ nau8821->jkdet_polarity = 0; ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.40.1 + diff --git a/queue-6.1/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch b/queue-6.1/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch new file mode 100644 index 00000000000..3c5e909af9b --- /dev/null +++ b/queue-6.1/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch @@ -0,0 +1,46 @@ +From 16d7a975884baae45adc98c3cbf10d4f19861ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:06:43 +0800 +Subject: ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit 02fb23d72720df2b6be3f29fc5787ca018eb92c3 ] + +When the system suspends, peripheral Imp-defined interrupt is disabled. +When system level resume is invoked, the peripheral Imp-defined interrupts +should be enabled to handle JD events. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090643.128213-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index c1a94229dc7e3..868a61c8b0608 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -786,8 +786,15 @@ static int __maybe_unused rt5682_dev_resume(struct device *dev) + if (!rt5682->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt5682->disable_irq == true) { ++ mutex_lock(&rt5682->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); ++ rt5682->disable_irq = false; ++ mutex_unlock(&rt5682->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT5682_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.1/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch b/queue-6.1/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch new file mode 100644 index 00000000000..93e34d78ef6 --- /dev/null +++ b/queue-6.1/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch @@ -0,0 +1,46 @@ +From d416394439e855f539cbf6c6654c7c509447dc05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:06:54 +0800 +Subject: ASoC: rt711: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit b69de265bd0e877015a00fbba453ef72af162e0f ] + +When the system suspends, peripheral Imp-defined interrupt is disabled. +When system level resume is invoked, the peripheral Imp-defined interrupts +should be enabled to handle JD events. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090654.128230-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdw.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdw.c b/sound/soc/codecs/rt711-sdw.c +index 4fe68bcf2a7c2..9545b8a7eb192 100644 +--- a/sound/soc/codecs/rt711-sdw.c ++++ b/sound/soc/codecs/rt711-sdw.c +@@ -541,8 +541,15 @@ static int __maybe_unused rt711_dev_resume(struct device *dev) + if (!rt711->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt711->disable_irq == true) { ++ mutex_lock(&rt711->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); ++ rt711->disable_irq = false; ++ mutex_unlock(&rt711->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT711_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.1/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch b/queue-6.1/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch new file mode 100644 index 00000000000..dd53634472a --- /dev/null +++ b/queue-6.1/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch @@ -0,0 +1,48 @@ +From c7121788b5f27cbaf23f047ac9700713f4eb4b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:07:11 +0800 +Subject: ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit 23adeb7056acd4fd866969f4afb91441776cc4f5 ] + +When the system suspends, peripheral SDCA interrupts are disabled. +When system level resume is invoked, the peripheral SDCA interrupts +should be enabled to handle JD events. +Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090711.128247-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdca-sdw.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdca-sdw.c b/sound/soc/codecs/rt711-sdca-sdw.c +index e23cec4c457de..487d3010ddc19 100644 +--- a/sound/soc/codecs/rt711-sdca-sdw.c ++++ b/sound/soc/codecs/rt711-sdca-sdw.c +@@ -442,8 +442,16 @@ static int __maybe_unused rt711_sdca_dev_resume(struct device *dev) + if (!rt711->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt711->disable_irq == true) { ++ mutex_lock(&rt711->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); ++ rt711->disable_irq = false; ++ mutex_unlock(&rt711->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT711_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.1/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch b/queue-6.1/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch new file mode 100644 index 00000000000..d5d31b51b72 --- /dev/null +++ b/queue-6.1/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch @@ -0,0 +1,40 @@ +From ac99f08d0c126aebdfa855ccf3228a33439ae815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 11:06:25 +0800 +Subject: ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in + data_xfer() + +From: Minjie Du + +[ Upstream commit 4139f992c49356391fb086c0c8ce51f66c26d623 ] + +It is possible for dma_request_chan() to return EPROBE_DEFER, which +means acdev->host->dev is not ready yet. At this point dev_err() will +have no output. Use dev_err_probe() instead. + +Signed-off-by: Minjie Du +Acked-by: Viresh Kumar +Reviewed-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_arasan_cf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index e89617ed9175b..46588fc829432 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -529,7 +529,8 @@ static void data_xfer(struct work_struct *work) + /* dma_request_channel may sleep, so calling from process context */ + acdev->dma_chan = dma_request_chan(acdev->host->dev, "data"); + if (IS_ERR(acdev->dma_chan)) { +- dev_err(acdev->host->dev, "Unable to get dma_chan\n"); ++ dev_err_probe(acdev->host->dev, PTR_ERR(acdev->dma_chan), ++ "Unable to get dma_chan\n"); + acdev->dma_chan = NULL; + goto chan_request_fail; + } +-- +2.40.1 + diff --git a/queue-6.1/bnx2x-fix-page-fault-following-eeh-recovery.patch b/queue-6.1/bnx2x-fix-page-fault-following-eeh-recovery.patch new file mode 100644 index 00000000000..075201f88ed --- /dev/null +++ b/queue-6.1/bnx2x-fix-page-fault-following-eeh-recovery.patch @@ -0,0 +1,55 @@ +From 83479a189633caba6b55a47d8f26aa5127a51774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 16:01:43 -0400 +Subject: bnx2x: fix page fault following EEH recovery + +From: David Christensen + +[ Upstream commit 7ebe4eda4265642859507d1b3ca330d8c196cfe5 ] + +In the last step of the EEH recovery process, the EEH driver calls into +bnx2x_io_resume() to re-initialize the NIC hardware via the function +bnx2x_nic_load(). If an error occurs during bnx2x_nic_load(), OS and +hardware resources are released and an error code is returned to the +caller. When called from bnx2x_io_resume(), the return code is ignored +and the network interface is brought up unconditionally. Later attempts +to send a packet via this interface result in a page fault due to a null +pointer reference. + +This patch checks the return code of bnx2x_nic_load(), prints an error +message if necessary, and does not enable the interface. + +Signed-off-by: David Christensen +Reviewed-by: Sridhar Samudrala +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 51b1690fd0459..a1783faf4fe99 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -14312,11 +14312,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev) + bp->fw_seq = SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) & + DRV_MSG_SEQ_NUMBER_MASK; + +- if (netif_running(dev)) +- bnx2x_nic_load(bp, LOAD_NORMAL); ++ if (netif_running(dev)) { ++ if (bnx2x_nic_load(bp, LOAD_NORMAL)) { ++ netdev_err(bp->dev, "Error during driver initialization, try unloading/reloading the driver\n"); ++ goto done; ++ } ++ } + + netif_device_attach(dev); + ++done: + rtnl_unlock(); + } + +-- +2.40.1 + diff --git a/queue-6.1/cifs-fix-max_credits-implementation.patch b/queue-6.1/cifs-fix-max_credits-implementation.patch new file mode 100644 index 00000000000..5d00bbc7ebc --- /dev/null +++ b/queue-6.1/cifs-fix-max_credits-implementation.patch @@ -0,0 +1,119 @@ +From 8bff5fe7813474f9e115375f580b0547bda60c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:46:58 +0000 +Subject: cifs: fix max_credits implementation + +From: Shyam Prasad N + +[ Upstream commit 5e90aa21eb1372736e08cee0c0bf47735c5c4b95 ] + +The current implementation of max_credits on the client does +not work because the CreditRequest logic for several commands +does not take max_credits into account. + +Still, we can end up asking the server for more credits, depending +on the number of credits in flight. For this, we need to +limit the credits while parsing the responses too. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2ops.c | 2 ++ + fs/smb/client/smb2pdu.c | 32 ++++++++++++++++++++++++++++---- + 2 files changed, 30 insertions(+), 4 deletions(-) + +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index bcd4c3a507601..6b020d80bb949 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -34,6 +34,8 @@ static int + change_conf(struct TCP_Server_Info *server) + { + server->credits += server->echo_credits + server->oplock_credits; ++ if (server->credits > server->max_credits) ++ server->credits = server->max_credits; + server->oplock_credits = server->echo_credits = 0; + switch (server->credits) { + case 0: +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index ba46156e32680..ae17d78f6ba17 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -1312,7 +1312,12 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data) + } + + /* enough to enable echos and oplocks and one max size write */ +- req->hdr.CreditRequest = cpu_to_le16(130); ++ if (server->credits >= server->max_credits) ++ req->hdr.CreditRequest = cpu_to_le16(0); ++ else ++ req->hdr.CreditRequest = cpu_to_le16( ++ min_t(int, server->max_credits - ++ server->credits, 130)); + + /* only one of SMB2 signing flags may be set in SMB2 request */ + if (server->sign) +@@ -1907,7 +1912,12 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, + rqst.rq_nvec = 2; + + /* Need 64 for max size write so ask for more in case not there yet */ +- req->hdr.CreditRequest = cpu_to_le16(64); ++ if (server->credits >= server->max_credits) ++ req->hdr.CreditRequest = cpu_to_le16(0); ++ else ++ req->hdr.CreditRequest = cpu_to_le16( ++ min_t(int, server->max_credits - ++ server->credits, 64)); + + rc = cifs_send_recv(xid, ses, server, + &rqst, &resp_buftype, flags, &rsp_iov); +@@ -4291,6 +4301,7 @@ smb2_async_readv(struct cifs_readdata *rdata) + struct TCP_Server_Info *server; + struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink); + unsigned int total_len; ++ int credit_request; + + cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n", + __func__, rdata->offset, rdata->bytes); +@@ -4322,7 +4333,13 @@ smb2_async_readv(struct cifs_readdata *rdata) + if (rdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); ++ credit_request = le16_to_cpu(shdr->CreditCharge) + 8; ++ if (server->credits >= server->max_credits) ++ shdr->CreditRequest = cpu_to_le16(0); ++ else ++ shdr->CreditRequest = cpu_to_le16( ++ min_t(int, server->max_credits - ++ server->credits, credit_request)); + + rc = adjust_credits(server, &rdata->credits, rdata->bytes); + if (rc) +@@ -4532,6 +4549,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + unsigned int total_len; + struct cifs_io_parms _io_parms; + struct cifs_io_parms *io_parms = NULL; ++ int credit_request; + + if (!wdata->server) + server = wdata->server = cifs_pick_channel(tcon->ses); +@@ -4649,7 +4667,13 @@ smb2_async_writev(struct cifs_writedata *wdata, + if (wdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); ++ credit_request = le16_to_cpu(shdr->CreditCharge) + 8; ++ if (server->credits >= server->max_credits) ++ shdr->CreditRequest = cpu_to_le16(0); ++ else ++ shdr->CreditRequest = cpu_to_le16( ++ min_t(int, server->max_credits - ++ server->credits, credit_request)); + + rc = adjust_credits(server, &wdata->credits, io_parms->length); + if (rc) +-- +2.40.1 + diff --git a/queue-6.1/cifs-fix-sockaddr-comparison-in-iface_cmp.patch b/queue-6.1/cifs-fix-sockaddr-comparison-in-iface_cmp.patch new file mode 100644 index 00000000000..dc8461440eb --- /dev/null +++ b/queue-6.1/cifs-fix-sockaddr-comparison-in-iface_cmp.patch @@ -0,0 +1,198 @@ +From 96200029802d8f9c73a927ddc7fda6e0bcdf162b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:46:59 +0000 +Subject: cifs: fix sockaddr comparison in iface_cmp + +From: Shyam Prasad N + +[ Upstream commit 2991b77409891e14a10b96899755c004b0c07edb ] + +iface_cmp used to simply do a memcmp of the two +provided struct sockaddrs. The comparison needs to do more +based on the address family. Similar logic was already +present in cifs_match_ipaddr. Doing something similar now. + +Signed-off-by: Shyam Prasad N +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 37 ----------------------------- + fs/smb/client/cifsproto.h | 1 + + fs/smb/client/connect.c | 50 +++++++++++++++++++++++++++++++++++++++ + fs/smb/client/smb2ops.c | 37 +++++++++++++++++++++++++++++ + 4 files changed, 88 insertions(+), 37 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index a37afbb7e399f..4a092cc5a3936 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -970,43 +970,6 @@ release_iface(struct kref *ref) + kfree(iface); + } + +-/* +- * compare two interfaces a and b +- * return 0 if everything matches. +- * return 1 if a has higher link speed, or rdma capable, or rss capable +- * return -1 otherwise. +- */ +-static inline int +-iface_cmp(struct cifs_server_iface *a, struct cifs_server_iface *b) +-{ +- int cmp_ret = 0; +- +- WARN_ON(!a || !b); +- if (a->speed == b->speed) { +- if (a->rdma_capable == b->rdma_capable) { +- if (a->rss_capable == b->rss_capable) { +- cmp_ret = memcmp(&a->sockaddr, &b->sockaddr, +- sizeof(a->sockaddr)); +- if (!cmp_ret) +- return 0; +- else if (cmp_ret > 0) +- return 1; +- else +- return -1; +- } else if (a->rss_capable > b->rss_capable) +- return 1; +- else +- return -1; +- } else if (a->rdma_capable > b->rdma_capable) +- return 1; +- else +- return -1; +- } else if (a->speed > b->speed) +- return 1; +- else +- return -1; +-} +- + struct cifs_chan { + unsigned int in_reconnect : 1; /* if session setup in progress for this channel */ + struct TCP_Server_Info *server; +diff --git a/fs/smb/client/cifsproto.h b/fs/smb/client/cifsproto.h +index 98513f5af3f96..a914b88ca51a1 100644 +--- a/fs/smb/client/cifsproto.h ++++ b/fs/smb/client/cifsproto.h +@@ -85,6 +85,7 @@ extern int cifs_handle_standard(struct TCP_Server_Info *server, + struct mid_q_entry *mid); + extern int smb3_parse_devname(const char *devname, struct smb3_fs_context *ctx); + extern int smb3_parse_opt(const char *options, const char *key, char **val); ++extern int cifs_ipaddr_cmp(struct sockaddr *srcaddr, struct sockaddr *rhs); + extern bool cifs_match_ipaddr(struct sockaddr *srcaddr, struct sockaddr *rhs); + extern int cifs_discard_remaining_data(struct TCP_Server_Info *server); + extern int cifs_call_async(struct TCP_Server_Info *server, +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index cbe08948baf4a..9cd282960c0bb 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1343,6 +1343,56 @@ cifs_demultiplex_thread(void *p) + module_put_and_kthread_exit(0); + } + ++int ++cifs_ipaddr_cmp(struct sockaddr *srcaddr, struct sockaddr *rhs) ++{ ++ struct sockaddr_in *saddr4 = (struct sockaddr_in *)srcaddr; ++ struct sockaddr_in *vaddr4 = (struct sockaddr_in *)rhs; ++ struct sockaddr_in6 *saddr6 = (struct sockaddr_in6 *)srcaddr; ++ struct sockaddr_in6 *vaddr6 = (struct sockaddr_in6 *)rhs; ++ ++ switch (srcaddr->sa_family) { ++ case AF_UNSPEC: ++ switch (rhs->sa_family) { ++ case AF_UNSPEC: ++ return 0; ++ case AF_INET: ++ case AF_INET6: ++ return 1; ++ default: ++ return -1; ++ } ++ case AF_INET: { ++ switch (rhs->sa_family) { ++ case AF_UNSPEC: ++ return -1; ++ case AF_INET: ++ return memcmp(saddr4, vaddr4, ++ sizeof(struct sockaddr_in)); ++ case AF_INET6: ++ return 1; ++ default: ++ return -1; ++ } ++ } ++ case AF_INET6: { ++ switch (rhs->sa_family) { ++ case AF_UNSPEC: ++ case AF_INET: ++ return -1; ++ case AF_INET6: ++ return memcmp(saddr6, ++ vaddr6, ++ sizeof(struct sockaddr_in6)); ++ default: ++ return -1; ++ } ++ } ++ default: ++ return -1; /* don't expect to be here */ ++ } ++} ++ + /* + * Returns true if srcaddr isn't specified and rhs isn't specified, or + * if srcaddr is specified and matches the IP address of the rhs argument +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index e6a191a7499e8..bcd4c3a507601 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -511,6 +511,43 @@ smb3_negotiate_rsize(struct cifs_tcon *tcon, struct smb3_fs_context *ctx) + return rsize; + } + ++/* ++ * compare two interfaces a and b ++ * return 0 if everything matches. ++ * return 1 if a is rdma capable, or rss capable, or has higher link speed ++ * return -1 otherwise. ++ */ ++static int ++iface_cmp(struct cifs_server_iface *a, struct cifs_server_iface *b) ++{ ++ int cmp_ret = 0; ++ ++ WARN_ON(!a || !b); ++ if (a->rdma_capable == b->rdma_capable) { ++ if (a->rss_capable == b->rss_capable) { ++ if (a->speed == b->speed) { ++ cmp_ret = cifs_ipaddr_cmp((struct sockaddr *) &a->sockaddr, ++ (struct sockaddr *) &b->sockaddr); ++ if (!cmp_ret) ++ return 0; ++ else if (cmp_ret > 0) ++ return 1; ++ else ++ return -1; ++ } else if (a->speed > b->speed) ++ return 1; ++ else ++ return -1; ++ } else if (a->rss_capable > b->rss_capable) ++ return 1; ++ else ++ return -1; ++ } else if (a->rdma_capable > b->rdma_capable) ++ return 1; ++ else ++ return -1; ++} ++ + static int + parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + size_t buf_len, struct cifs_ses *ses, bool in_mount) +-- +2.40.1 + diff --git a/queue-6.1/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch b/queue-6.1/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch new file mode 100644 index 00000000000..b6b4cac3b0c --- /dev/null +++ b/queue-6.1/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch @@ -0,0 +1,52 @@ +From 89a3a3cceca4899fcaf9d9278e43d0a26ebb8e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 21:58:51 +0800 +Subject: clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM + +From: Baoquan He + +[ Upstream commit e7dd44f4f3166db45248414f5df8f615392de47a ] + +On s390 systems (aka mainframes), it has classic channel devices for +networking and permanent storage that are currently even more common +than PCI devices. Hence it could have a fully functional s390 kernel +with CONFIG_PCI=n, then the relevant iomem mapping functions +[including ioremap(), devm_ioremap(), etc.] are not available. + +Here let COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM so that it won't +be built to cause below compiling error if PCI is unset: + +------ +ld: drivers/clk/clk-fixed-mmio.o: in function `fixed_mmio_clk_setup': +clk-fixed-mmio.c:(.text+0x5e): undefined reference to `of_iomap' +ld: clk-fixed-mmio.c:(.text+0xba): undefined reference to `iounmap' +------ + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ +Signed-off-by: Baoquan He +Cc: Michael Turquette +Cc: Stephen Boyd +Cc: linux-clk@vger.kernel.org +Link: https://lore.kernel.org/r/20230707135852.24292-8-bhe@redhat.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig +index 5da82f2bdd211..a5dcc7293a836 100644 +--- a/drivers/clk/Kconfig ++++ b/drivers/clk/Kconfig +@@ -427,6 +427,7 @@ config COMMON_CLK_BD718XX + config COMMON_CLK_FIXED_MMIO + bool "Clock driver for Memory Mapped Fixed values" + depends on COMMON_CLK && OF ++ depends on HAS_IOMEM + help + Support for Memory Mapped IO Fixed clocks + +-- +2.40.1 + diff --git a/queue-6.1/drm-amd-display-exit-idle-optimizations-before-attem.patch b/queue-6.1/drm-amd-display-exit-idle-optimizations-before-attem.patch new file mode 100644 index 00000000000..f4c33d93bf0 --- /dev/null +++ b/queue-6.1/drm-amd-display-exit-idle-optimizations-before-attem.patch @@ -0,0 +1,45 @@ +From 9afcdd0f51b0b67a7cca58cb0e7612355596f47e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 16:50:15 -0400 +Subject: drm/amd/display: Exit idle optimizations before attempt to access PHY + +From: Leo Chen + +[ Upstream commit de612738e9771bd66aeb20044486c457c512f684 ] + +[Why & How] +DMUB may hang when powering down pixel clocks due to no dprefclk. + +It is fixed by exiting idle optimization before the attempt to access PHY. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Alex Hung +Signed-off-by: Leo Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index d260eaa1509ed..9378c98d02cfe 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1813,10 +1813,13 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context) + hws->funcs.edp_backlight_control(edp_link_with_sink, false); + } + /*resume from S3, no vbios posting, no need to power down again*/ ++ clk_mgr_exit_optimized_pwr_state(dc, dc->clk_mgr); ++ + power_down_all_hw_blocks(dc); + disable_vga_and_power_gate_all_controllers(dc); + if (edp_link_with_sink && !keep_edp_vdd_on) + dc->hwss.edp_power_control(edp_link_with_sink, false); ++ clk_mgr_optimize_pwr_state(dc, dc->clk_mgr); + } + bios_set_scratch_acc_mode_change(dc->ctx->dc_bios, 1); + } +-- +2.40.1 + diff --git a/queue-6.1/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch b/queue-6.1/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch new file mode 100644 index 00000000000..1d45c796437 --- /dev/null +++ b/queue-6.1/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch @@ -0,0 +1,43 @@ +From cbf7bf870d7cbf1466eeb5e95cfacd0d3d55674c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 13:22:36 -0400 +Subject: drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family + +From: George Shen + +[ Upstream commit 25b054c3c89cb6a7106a7982f0f70e83d0797dab ] + +[Why] +Current yellow carp B0 PHYD32CLK logic is incorrectly applied to other +ASICs. + +[How] +Add guard to check chip family is yellow carp before applying logic. + +Reviewed-by: Hansen Dsouza +Acked-by: Alex Hung +Signed-off-by: George Shen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +index cef32a1f91cdc..b735e548e26dc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +@@ -84,7 +84,8 @@ static enum phyd32clk_clock_source get_phy_mux_symclk( + struct dcn_dccg *dccg_dcn, + enum phyd32clk_clock_source src) + { +- if (dccg_dcn->base.ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0) { ++ if (dccg_dcn->base.ctx->asic_id.chip_family == FAMILY_YELLOW_CARP && ++ dccg_dcn->base.ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0) { + if (src == PHYD32CLKC) + src = PHYD32CLKF; + if (src == PHYD32CLKD) +-- +2.40.1 + diff --git a/queue-6.1/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch b/queue-6.1/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch new file mode 100644 index 00000000000..9f6485cf212 --- /dev/null +++ b/queue-6.1/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch @@ -0,0 +1,37 @@ +From 3d71f0b465bc75a57a9899045200a3097eb67b06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 18:08:07 +0800 +Subject: drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr + Clock + +From: Jane Jian + +[ Upstream commit 4a37c55b859a69f429bfa7fab4fc43ee470b60ed ] + +Report current GFX clock also from average clock value as the original +CurrClock data is not valid/accurate any more as per FW team + +Signed-off-by: Jane Jian +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +index f7ac488a3da20..503e844baede2 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -1305,7 +1305,7 @@ static ssize_t smu_v13_0_0_get_gpu_metrics(struct smu_context *smu, + gpu_metrics->average_vclk1_frequency = metrics->AverageVclk1Frequency; + gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency; + +- gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK]; ++ gpu_metrics->current_gfxclk = gpu_metrics->average_gfxclk_frequency; + gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK]; + gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK]; + gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0]; +-- +2.40.1 + diff --git a/queue-6.1/drm-amdgpu-match-against-exact-bootloader-status.patch b/queue-6.1/drm-amdgpu-match-against-exact-bootloader-status.patch new file mode 100644 index 00000000000..eef74a001a1 --- /dev/null +++ b/queue-6.1/drm-amdgpu-match-against-exact-bootloader-status.patch @@ -0,0 +1,53 @@ +From 024efad7f72bce9fb3f6729d9c3ce0d744eb853c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 19:11:54 +0530 +Subject: drm/amdgpu: Match against exact bootloader status + +From: Lijo Lazar + +[ Upstream commit d3de41ee5febe5c2d9989fe9810bce2bb54a3a8e ] + +On PSP v13.x ASICs, boot loader will set only the MSB to 1 and clear the +least significant bits for any command submission. Hence match against +the exact register value, otherwise a register value of all 0xFFs also +could falsely indicate that boot loader is ready. Also, from PSP v13.0.6 +and newer, bits[7:0] will be used to indicate command error status. + +Signed-off-by: Lijo Lazar +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +index 8c5fa4b7b68a2..c7cb30efe43de 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +@@ -147,14 +147,15 @@ static int psp_v13_0_wait_for_bootloader(struct psp_context *psp) + int ret; + int retry_loop; + ++ /* Wait for bootloader to signify that it is ready having bit 31 of ++ * C2PMSG_35 set to 1. All other bits are expected to be cleared. ++ * If there is an error in processing command, bits[7:0] will be set. ++ * This is applicable for PSP v13.0.6 and newer. ++ */ + for (retry_loop = 0; retry_loop < 10; retry_loop++) { +- /* Wait for bootloader to signify that is +- ready having bit 31 of C2PMSG_35 set to 1 */ +- ret = psp_wait_for(psp, +- SOC15_REG_OFFSET(MP0, 0, regMP0_SMN_C2PMSG_35), +- 0x80000000, +- 0x80000000, +- false); ++ ret = psp_wait_for( ++ psp, SOC15_REG_OFFSET(MP0, 0, regMP0_SMN_C2PMSG_35), ++ 0x80000000, 0xffffffff, false); + + if (ret == 0) + return 0; +-- +2.40.1 + diff --git a/queue-6.1/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch b/queue-6.1/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch new file mode 100644 index 00000000000..37bfc6ed1c2 --- /dev/null +++ b/queue-6.1/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch @@ -0,0 +1,42 @@ +From f856bd40a3b4cfbb61a4058ae11d31b4340d9faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 22:42:08 +0800 +Subject: ethernet: atheros: fix return value check in atl1c_tso_csum() + +From: Yuanjun Gong + +[ Upstream commit 8d01da0a1db237c44c92859ce3612df7af8d3a53 ] + +in atl1c_tso_csum, it should check the return value of pskb_trim(), +and return an error code if an unexpected value is returned +by pskb_trim(). + +Signed-off-by: Yuanjun Gong +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +index 40c781695d581..7762e532c6a4f 100644 +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -2104,8 +2104,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter, + real_len = (((unsigned char *)ip_hdr(skb) - skb->data) + + ntohs(ip_hdr(skb)->tot_len)); + +- if (real_len < skb->len) +- pskb_trim(skb, real_len); ++ if (real_len < skb->len) { ++ err = pskb_trim(skb, real_len); ++ if (err) ++ return err; ++ } + + hdr_len = skb_tcp_all_headers(skb); + if (unlikely(skb->len == hdr_len)) { +-- +2.40.1 + diff --git a/queue-6.1/fs-nls-make-load_nls-take-a-const-parameter.patch b/queue-6.1/fs-nls-make-load_nls-take-a-const-parameter.patch new file mode 100644 index 00000000000..461965d48dc --- /dev/null +++ b/queue-6.1/fs-nls-make-load_nls-take-a-const-parameter.patch @@ -0,0 +1,66 @@ +From 01a2fe211f6adcc1bc49ee8df22e8e3560132b99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 10:10:56 +0800 +Subject: fs/nls: make load_nls() take a const parameter + +From: Winston Wen + +[ Upstream commit c1ed39ec116272935528ca9b348b8ee79b0791da ] + +load_nls() take a char * parameter, use it to find nls module in list or +construct the module name to load it. + +This change make load_nls() take a const parameter, so we don't need do +some cast like this: + + ses->local_nls = load_nls((char *)ctx->local_nls->charset); + +Suggested-by: Stephen Rothwell +Signed-off-by: Winston Wen +Reviewed-by: Paulo Alcantara +Reviewed-by: Christian Brauner +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/nls/nls_base.c | 4 ++-- + include/linux/nls.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c +index 52ccd34b1e792..a026dbd3593f6 100644 +--- a/fs/nls/nls_base.c ++++ b/fs/nls/nls_base.c +@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls) + return -EINVAL; + } + +-static struct nls_table *find_nls(char *charset) ++static struct nls_table *find_nls(const char *charset) + { + struct nls_table *nls; + spin_lock(&nls_lock); +@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset) + return nls; + } + +-struct nls_table *load_nls(char *charset) ++struct nls_table *load_nls(const char *charset) + { + return try_then_request_module(find_nls(charset), "nls_%s", charset); + } +diff --git a/include/linux/nls.h b/include/linux/nls.h +index 499e486b3722d..e0bf8367b274a 100644 +--- a/include/linux/nls.h ++++ b/include/linux/nls.h +@@ -47,7 +47,7 @@ enum utf16_endian { + /* nls_base.c */ + extern int __register_nls(struct nls_table *, struct module *); + extern int unregister_nls(struct nls_table *); +-extern struct nls_table *load_nls(char *); ++extern struct nls_table *load_nls(const char *charset); + extern void unload_nls(struct nls_table *); + extern struct nls_table *load_nls_default(void); + #define register_nls(nls) __register_nls((nls), THIS_MODULE) +-- +2.40.1 + diff --git a/queue-6.1/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch b/queue-6.1/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch new file mode 100644 index 00000000000..a4184f2179a --- /dev/null +++ b/queue-6.1/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch @@ -0,0 +1,58 @@ +From 07835297c01c7c8840976ae7fa9ced0f466b7606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 21:58:45 +0800 +Subject: idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM + +From: Baoquan He + +[ Upstream commit b1e213a9e31c20206f111ec664afcf31cbfe0dbb ] + +On s390 systems (aka mainframes), it has classic channel devices for +networking and permanent storage that are currently even more common +than PCI devices. Hence it could have a fully functional s390 kernel +with CONFIG_PCI=n, then the relevant iomem mapping functions +[including ioremap(), devm_ioremap(), etc.] are not available. + +Here let FSL_EDMA and INTEL_IDMA64 depend on HAS_IOMEM so that it +won't be built to cause below compiling error if PCI is unset. + +-------- +ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/fsl-edma.ko] undefined! +ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/idma64.ko] undefined! +-------- + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ +Signed-off-by: Baoquan He +Cc: Vinod Koul +Cc: dmaengine@vger.kernel.org +Link: https://lore.kernel.org/r/20230707135852.24292-2-bhe@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index b64ae02c26f8c..81de833ccd041 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -210,6 +210,7 @@ config FSL_DMA + config FSL_EDMA + tristate "Freescale eDMA engine support" + depends on OF ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +@@ -279,6 +280,7 @@ config IMX_SDMA + + config INTEL_IDMA64 + tristate "Intel integrated DMA 64-bit support" ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +-- +2.40.1 + diff --git a/queue-6.1/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch b/queue-6.1/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch new file mode 100644 index 00000000000..0c6978433b4 --- /dev/null +++ b/queue-6.1/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch @@ -0,0 +1,56 @@ +From aeb4127e00ce48f80207efa24c83cb7fbf677a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 10:50:47 +0900 +Subject: kprobes: Prohibit probing on CFI preamble symbol + +From: Masami Hiramatsu (Google) + +[ Upstream commit de02f2ac5d8cfb311f44f2bf144cc20002f1fbbd ] + +Do not allow to probe on "__cfi_" or "__pfx_" started symbol, because those +are used for CFI and not executed. Probing it will break the CFI. + +Link: https://lore.kernel.org/all/168904024679.116016.18089228029322008512.stgit@devnote2/ + +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/kprobes.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 00e177de91ccd..3da9726232ff9 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1545,6 +1545,17 @@ static int check_ftrace_location(struct kprobe *p) + return 0; + } + ++static bool is_cfi_preamble_symbol(unsigned long addr) ++{ ++ char symbuf[KSYM_NAME_LEN]; ++ ++ if (lookup_symbol_name(addr, symbuf)) ++ return false; ++ ++ return str_has_prefix("__cfi_", symbuf) || ++ str_has_prefix("__pfx_", symbuf); ++} ++ + static int check_kprobe_address_safe(struct kprobe *p, + struct module **probed_mod) + { +@@ -1563,7 +1574,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + within_kprobe_blacklist((unsigned long) p->addr) || + jump_label_text_reserved(p->addr, p->addr) || + static_call_text_reserved(p->addr, p->addr) || +- find_bug((unsigned long)p->addr)) { ++ find_bug((unsigned long)p->addr) || ++ is_cfi_preamble_symbol((unsigned long)p->addr)) { + ret = -EINVAL; + goto out; + } +-- +2.40.1 + diff --git a/queue-6.1/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch b/queue-6.1/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch new file mode 100644 index 00000000000..167636ae2d7 --- /dev/null +++ b/queue-6.1/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch @@ -0,0 +1,107 @@ +From d53bbf15f4ccf3b8ead498d3078c9f84ed49b3be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:27:37 +0900 +Subject: ksmbd: fix out of bounds in init_smb2_rsp_hdr() + +From: Namjae Jeon + +[ Upstream commit 536bb492d39bb6c080c92f31e8a55fe9934f452b ] + +If client send smb2 negotiate request and then send smb1 negotiate +request, init_smb2_rsp_hdr is called for smb1 negotiate request since +need_neg is set to false. This patch ignore smb1 packets after ->need_neg +is set to false. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/server.c | 7 ++++++- + fs/smb/server/smb_common.c | 19 +++++++++++-------- + fs/smb/server/smb_common.h | 2 +- + 3 files changed, 18 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c +index 847ee62afb8a1..9804cabe72a84 100644 +--- a/fs/smb/server/server.c ++++ b/fs/smb/server/server.c +@@ -286,6 +286,7 @@ static void handle_ksmbd_work(struct work_struct *wk) + static int queue_ksmbd_work(struct ksmbd_conn *conn) + { + struct ksmbd_work *work; ++ int err; + + work = ksmbd_alloc_work_struct(); + if (!work) { +@@ -297,7 +298,11 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) + work->request_buf = conn->request_buf; + conn->request_buf = NULL; + +- ksmbd_init_smb_server(work); ++ err = ksmbd_init_smb_server(work); ++ if (err) { ++ ksmbd_free_work_struct(work); ++ return 0; ++ } + + ksmbd_conn_enqueue_request(work); + atomic_inc(&conn->r_count); +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index d937e2f45c829..a4421d9458d90 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -388,26 +388,29 @@ static struct smb_version_cmds smb1_server_cmds[1] = { + [SMB_COM_NEGOTIATE_EX] = { .proc = smb1_negotiate, }, + }; + +-static void init_smb1_server(struct ksmbd_conn *conn) ++static int init_smb1_server(struct ksmbd_conn *conn) + { + conn->ops = &smb1_server_ops; + conn->cmds = smb1_server_cmds; + conn->max_cmds = ARRAY_SIZE(smb1_server_cmds); ++ return 0; + } + +-void ksmbd_init_smb_server(struct ksmbd_work *work) ++int ksmbd_init_smb_server(struct ksmbd_work *work) + { + struct ksmbd_conn *conn = work->conn; + __le32 proto; + +- if (conn->need_neg == false) +- return; +- + proto = *(__le32 *)((struct smb_hdr *)work->request_buf)->Protocol; ++ if (conn->need_neg == false) { ++ if (proto == SMB1_PROTO_NUMBER) ++ return -EINVAL; ++ return 0; ++ } ++ + if (proto == SMB1_PROTO_NUMBER) +- init_smb1_server(conn); +- else +- init_smb3_11_server(conn); ++ return init_smb1_server(conn); ++ return init_smb3_11_server(conn); + } + + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, +diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h +index e63d2a4f466b5..1cbb492cdefec 100644 +--- a/fs/smb/server/smb_common.h ++++ b/fs/smb/server/smb_common.h +@@ -427,7 +427,7 @@ bool ksmbd_smb_request(struct ksmbd_conn *conn); + + int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count); + +-void ksmbd_init_smb_server(struct ksmbd_work *work); ++int ksmbd_init_smb_server(struct ksmbd_work *work); + + struct ksmbd_kstat; + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, +-- +2.40.1 + diff --git a/queue-6.1/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch b/queue-6.1/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch new file mode 100644 index 00000000000..515a3568727 --- /dev/null +++ b/queue-6.1/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch @@ -0,0 +1,37 @@ +From 6a686cdf67e2209b1ee3c836fc1de32a71d6f041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 00:09:28 +0900 +Subject: ksmbd: fix out of bounds in smb3_decrypt_req() + +From: Namjae Jeon + +[ Upstream commit dc318846f3dd54574a36ae97fc8d8b75dd7cdb1e ] + +smb3_decrypt_req() validate if pdu_length is smaller than +smb2_transform_hdr size. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21589 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 9b621fd993bb7..ee954c5ab9c2b 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -8713,7 +8713,8 @@ int smb3_decrypt_req(struct ksmbd_work *work) + struct smb2_transform_hdr *tr_hdr = smb2_get_msg(buf); + int rc = 0; + +- if (buf_data_size < sizeof(struct smb2_hdr)) { ++ if (pdu_length < sizeof(struct smb2_transform_hdr) || ++ buf_data_size < sizeof(struct smb2_hdr)) { + pr_err("Transform message is too small (%u)\n", + pdu_length); + return -ECONNABORTED; +-- +2.40.1 + diff --git a/queue-6.1/ksmbd-no-response-from-compound-read.patch b/queue-6.1/ksmbd-no-response-from-compound-read.patch new file mode 100644 index 00000000000..772ca212def --- /dev/null +++ b/queue-6.1/ksmbd-no-response-from-compound-read.patch @@ -0,0 +1,41 @@ +From 8c3f432a304c9304a0cca8da09ae90600ac83c28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:22:33 +0900 +Subject: ksmbd: no response from compound read + +From: Namjae Jeon + +[ Upstream commit e202a1e8634b186da38cbbff85382ea2b9e297cf ] + +ksmbd doesn't support compound read. If client send read-read in +compound to ksmbd, there can be memory leak from read buffer. +Windows and linux clients doesn't send it to server yet. For now, +No response from compound read. compound read will be supported soon. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 74c245809772e..f6fd5cf976a50 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6314,6 +6314,11 @@ int smb2_read(struct ksmbd_work *work) + unsigned int max_read_size = conn->vals->max_read_size; + + WORK_BUFFERS(work, req, rsp); ++ if (work->next_smb2_rcv_hdr_off) { ++ work->send_no_response = 1; ++ err = -EOPNOTSUPP; ++ goto out; ++ } + + if (test_share_config_flag(work->tcon->share_conf, + KSMBD_SHARE_FLAG_PIPE)) { +-- +2.40.1 + diff --git a/queue-6.1/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch b/queue-6.1/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch new file mode 100644 index 00000000000..e0f7f8392b8 --- /dev/null +++ b/queue-6.1/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch @@ -0,0 +1,72 @@ +From b729a111d6ea504729fe077c52cdaaf4417fcf69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:21:11 +0900 +Subject: ksmbd: validate session id and tree id in compound request + +From: Namjae Jeon + +[ Upstream commit 3df0411e132ee74a87aa13142dfd2b190275332e ] + +`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() +will always return the first request smb2 header in a compound request. +if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will +return 0, i.e. The tree id check is skipped. +This patch use ksmbd_req_buf_next() to get current command in compound. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21506 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index ee954c5ab9c2b..74c245809772e 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -86,9 +86,9 @@ struct channel *lookup_chann_list(struct ksmbd_session *sess, struct ksmbd_conn + */ + int smb2_get_ksmbd_tcon(struct ksmbd_work *work) + { +- struct smb2_hdr *req_hdr = smb2_get_msg(work->request_buf); ++ struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); + unsigned int cmd = le16_to_cpu(req_hdr->Command); +- int tree_id; ++ unsigned int tree_id; + + if (cmd == SMB2_TREE_CONNECT_HE || + cmd == SMB2_CANCEL_HE || +@@ -113,7 +113,7 @@ int smb2_get_ksmbd_tcon(struct ksmbd_work *work) + pr_err("The first operation in the compound does not have tcon\n"); + return -EINVAL; + } +- if (work->tcon->id != tree_id) { ++ if (tree_id != UINT_MAX && work->tcon->id != tree_id) { + pr_err("tree id(%u) is different with id(%u) in first operation\n", + tree_id, work->tcon->id); + return -EINVAL; +@@ -565,9 +565,9 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) + */ + int smb2_check_user_session(struct ksmbd_work *work) + { +- struct smb2_hdr *req_hdr = smb2_get_msg(work->request_buf); ++ struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); + struct ksmbd_conn *conn = work->conn; +- unsigned int cmd = conn->ops->get_cmd_val(work); ++ unsigned int cmd = le16_to_cpu(req_hdr->Command); + unsigned long long sess_id; + + /* +@@ -593,7 +593,7 @@ int smb2_check_user_session(struct ksmbd_work *work) + pr_err("The first operation in the compound does not have sess\n"); + return -EINVAL; + } +- if (work->sess->id != sess_id) { ++ if (sess_id != ULLONG_MAX && work->sess->id != sess_id) { + pr_err("session id(%llu) is different with the first operation(%lld)\n", + sess_id, work->sess->id); + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.1/loongarch-fix-the-write_fcsr-macro.patch b/queue-6.1/loongarch-fix-the-write_fcsr-macro.patch new file mode 100644 index 00000000000..24517d1e795 --- /dev/null +++ b/queue-6.1/loongarch-fix-the-write_fcsr-macro.patch @@ -0,0 +1,36 @@ +From ebc44db80d471cb788c9ec1554d29a4b30eec740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 14:35:52 +0800 +Subject: LoongArch: Fix the write_fcsr() macro + +From: Qi Hu + +[ Upstream commit 346dc929623cef70ff7832a4fa0ffd1b696e312a ] + +The "write_fcsr()" macro uses wrong the positions for val and dest in +asm. Fix it! + +Reported-by: Miao HAO +Signed-off-by: Qi Hu +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/loongarch.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h +index 62835d84a647d..3d15fa5bef37d 100644 +--- a/arch/loongarch/include/asm/loongarch.h ++++ b/arch/loongarch/include/asm/loongarch.h +@@ -1488,7 +1488,7 @@ __BUILD_CSR_OP(tlbidx) + #define write_fcsr(dest, val) \ + do { \ + __asm__ __volatile__( \ +- " movgr2fcsr %0, "__stringify(dest)" \n" \ ++ " movgr2fcsr "__stringify(dest)", %0 \n" \ + : : "r" (val)); \ + } while (0) + +-- +2.40.1 + diff --git a/queue-6.1/loongarch-let-pmd_present-return-true-when-splitting.patch b/queue-6.1/loongarch-let-pmd_present-return-true-when-splitting.patch new file mode 100644 index 00000000000..e39274b074e --- /dev/null +++ b/queue-6.1/loongarch-let-pmd_present-return-true-when-splitting.patch @@ -0,0 +1,67 @@ +From fee3af9621911912246c0e1936017e94fe985697 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 14:35:52 +0800 +Subject: LoongArch: Let pmd_present() return true when splitting pmd + +From: Hongchen Zhang + +[ Upstream commit ddc1729b07cc84bb29f577698b8d2e74a4004a6e ] + +When we split a pmd into ptes, pmd_present() and pmd_trans_huge() should +return true, otherwise it would be treated as a swap pmd. + +This is the same as arm64 does in commit b65399f6111b ("arm64/mm: Change +THP helpers to comply with generic MM semantics"), we also add a new bit +named _PAGE_PRESENT_INVALID for LoongArch. + +Signed-off-by: Hongchen Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/pgtable-bits.h | 2 ++ + arch/loongarch/include/asm/pgtable.h | 3 ++- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/loongarch/include/asm/pgtable-bits.h b/arch/loongarch/include/asm/pgtable-bits.h +index 3d1e0a69975a5..5f2ebcea509cd 100644 +--- a/arch/loongarch/include/asm/pgtable-bits.h ++++ b/arch/loongarch/include/asm/pgtable-bits.h +@@ -21,12 +21,14 @@ + #define _PAGE_HGLOBAL_SHIFT 12 /* HGlobal is a PMD bit */ + #define _PAGE_PFN_SHIFT 12 + #define _PAGE_PFN_END_SHIFT 48 ++#define _PAGE_PRESENT_INVALID_SHIFT 60 + #define _PAGE_NO_READ_SHIFT 61 + #define _PAGE_NO_EXEC_SHIFT 62 + #define _PAGE_RPLV_SHIFT 63 + + /* Used by software */ + #define _PAGE_PRESENT (_ULCAST_(1) << _PAGE_PRESENT_SHIFT) ++#define _PAGE_PRESENT_INVALID (_ULCAST_(1) << _PAGE_PRESENT_INVALID_SHIFT) + #define _PAGE_WRITE (_ULCAST_(1) << _PAGE_WRITE_SHIFT) + #define _PAGE_ACCESSED (_ULCAST_(1) << _PAGE_ACCESSED_SHIFT) + #define _PAGE_MODIFIED (_ULCAST_(1) << _PAGE_MODIFIED_SHIFT) +diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h +index 79d5bfd913e0f..e748fad82f13e 100644 +--- a/arch/loongarch/include/asm/pgtable.h ++++ b/arch/loongarch/include/asm/pgtable.h +@@ -208,7 +208,7 @@ static inline int pmd_bad(pmd_t pmd) + static inline int pmd_present(pmd_t pmd) + { + if (unlikely(pmd_val(pmd) & _PAGE_HUGE)) +- return !!(pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROTNONE)); ++ return !!(pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROTNONE | _PAGE_PRESENT_INVALID)); + + return pmd_val(pmd) != (unsigned long)invalid_pte_table; + } +@@ -525,6 +525,7 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) + + static inline pmd_t pmd_mkinvalid(pmd_t pmd) + { ++ pmd_val(pmd) |= _PAGE_PRESENT_INVALID; + pmd_val(pmd) &= ~(_PAGE_PRESENT | _PAGE_VALID | _PAGE_DIRTY | _PAGE_PROTNONE); + + return pmd; +-- +2.40.1 + diff --git a/queue-6.1/m68k-fix-invalid-.section-syntax.patch b/queue-6.1/m68k-fix-invalid-.section-syntax.patch new file mode 100644 index 00000000000..2bd67afcf0c --- /dev/null +++ b/queue-6.1/m68k-fix-invalid-.section-syntax.patch @@ -0,0 +1,100 @@ +From 9de3e794eca636524d20394672ab12662dce3ca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 17:36:10 +0200 +Subject: m68k: Fix invalid .section syntax + +From: Ben Hutchings + +[ Upstream commit 922a9bd138101e3e5718f0f4d40dba68ef89bb43 ] + +gas supports several different forms for .section for ELF targets, +including: + .section NAME [, "FLAGS"[, @TYPE[,FLAG_SPECIFIC_ARGUMENTS]]] +and: + .section "NAME"[, #FLAGS...] + +In several places we use a mix of these two forms: + .section NAME, #FLAGS... + +A current development snapshot of binutils (2.40.50.20230611) treats +this mixed syntax as an error. + +Change to consistently use: + .section NAME, "FLAGS" +as is used elsewhere in the kernel. + +Link: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=m68k&ver=6.4%7Erc6-1%7Eexp1&stamp=1686907300&raw=1 +Signed-off-by: Ben Hutchings +Tested-by: Jan-Benedict Glaw +Link: https://lore.kernel.org/r/ZIyBaueWT9jnTwRC@decadent.org.uk +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/fpsp040/skeleton.S | 4 ++-- + arch/m68k/ifpsp060/os.S | 4 ++-- + arch/m68k/kernel/relocate_kernel.S | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S +index 439395aa6fb42..081922c72daaa 100644 +--- a/arch/m68k/fpsp040/skeleton.S ++++ b/arch/m68k/fpsp040/skeleton.S +@@ -499,13 +499,13 @@ in_ea: + dbf %d0,morein + rts + +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: + jbsr fpsp040_die + jbra .Lnotkern + +- .section __ex_table,#alloc ++ .section __ex_table,"a" + .align 4 + + .long in_ea,1b +diff --git a/arch/m68k/ifpsp060/os.S b/arch/m68k/ifpsp060/os.S +index 7a0d6e4280665..89e2ec224ab6c 100644 +--- a/arch/m68k/ifpsp060/os.S ++++ b/arch/m68k/ifpsp060/os.S +@@ -379,11 +379,11 @@ _060_real_access: + + + | Execption handling for movs access to illegal memory +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: moveq #-1,%d1 + rts +-.section __ex_table,#alloc ++.section __ex_table,"a" + .align 4 + .long dmrbuae,1b + .long dmrwuae,1b +diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S +index ab0f1e7d46535..f7667079e08e9 100644 +--- a/arch/m68k/kernel/relocate_kernel.S ++++ b/arch/m68k/kernel/relocate_kernel.S +@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcopy),%a4 + 2: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 2b+2 + .previous + +@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcont040),%a4 + 5: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 5b+2 + .previous + +-- +2.40.1 + diff --git a/queue-6.1/media-amphion-use-dev_err_probe.patch b/queue-6.1/media-amphion-use-dev_err_probe.patch new file mode 100644 index 00000000000..108d4f4ecef --- /dev/null +++ b/queue-6.1/media-amphion-use-dev_err_probe.patch @@ -0,0 +1,44 @@ +From 08b947e16a79398c241ea61a03aaebfde1128810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 11:32:44 +0100 +Subject: media: amphion: use dev_err_probe + +From: Alexander Stein + +[ Upstream commit 517f088385e1b8015606143e6212cb30f8714070 ] + +This simplifies the code and silences -517 error messages. Also +the reason is listed in /sys/kernel/debug/devices_deferred. + +Signed-off-by: Alexander Stein +Reviewed-by: ming_qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_mbox.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/amphion/vpu_mbox.c b/drivers/media/platform/amphion/vpu_mbox.c +index bf759eb2fd46d..b6d5b4844f672 100644 +--- a/drivers/media/platform/amphion/vpu_mbox.c ++++ b/drivers/media/platform/amphion/vpu_mbox.c +@@ -46,11 +46,10 @@ static int vpu_mbox_request_channel(struct device *dev, struct vpu_mbox *mbox) + cl->rx_callback = vpu_mbox_rx_callback; + + ch = mbox_request_channel_byname(cl, mbox->name); +- if (IS_ERR(ch)) { +- dev_err(dev, "Failed to request mbox chan %s, ret : %ld\n", +- mbox->name, PTR_ERR(ch)); +- return PTR_ERR(ch); +- } ++ if (IS_ERR(ch)) ++ return dev_err_probe(dev, PTR_ERR(ch), ++ "Failed to request mbox chan %s\n", ++ mbox->name); + + mbox->ch = ch; + return 0; +-- +2.40.1 + diff --git a/queue-6.1/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch b/queue-6.1/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch new file mode 100644 index 00000000000..da23c2640d4 --- /dev/null +++ b/queue-6.1/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch @@ -0,0 +1,63 @@ +From b160114a1e298670a1686b1be6c50ffbf0f84701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 10:09:00 +0100 +Subject: media: pci: cx23885: fix error handling for cx23885 ATSC boards + +From: Nikolay Burykin + +[ Upstream commit 4aaa96b59df5fac41ba891969df6b092061ea9d7 ] + +After having been assigned to NULL value at cx23885-dvb.c:1202, +pointer '0' is dereferenced at cx23885-dvb.c:2469. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Nikolay Burykin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx23885/cx23885-dvb.c | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c +index 8fd5b6ef24282..7551ca4a322a4 100644 +--- a/drivers/media/pci/cx23885/cx23885-dvb.c ++++ b/drivers/media/pci/cx23885/cx23885-dvb.c +@@ -2459,16 +2459,10 @@ static int dvb_register(struct cx23885_tsport *port) + request_module("%s", info.type); + client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); + if (!i2c_client_has_driver(client_tuner)) { +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + if (!try_module_get(client_tuner->dev.driver->owner)) { + i2c_unregister_device(client_tuner); +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + port->i2c_client_tuner = client_tuner; +@@ -2505,16 +2499,10 @@ static int dvb_register(struct cx23885_tsport *port) + request_module("%s", info.type); + client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); + if (!i2c_client_has_driver(client_tuner)) { +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + if (!try_module_get(client_tuner->dev.driver->owner)) { + i2c_unregister_device(client_tuner); +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + port->i2c_client_tuner = client_tuner; +-- +2.40.1 + diff --git a/queue-6.1/media-pulse8-cec-handle-possible-ping-error.patch b/queue-6.1/media-pulse8-cec-handle-possible-ping-error.patch new file mode 100644 index 00000000000..2b22e3fbff7 --- /dev/null +++ b/queue-6.1/media-pulse8-cec-handle-possible-ping-error.patch @@ -0,0 +1,42 @@ +From fdddfb4826b0c4992a845bccf540f8fd25182e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 06:38:15 +0200 +Subject: media: pulse8-cec: handle possible ping error + +From: Dmitry Antipov + +[ Upstream commit 92cbf865ea2e0f2997ff97815c6db182eb23df1b ] + +Handle (and warn about) possible error waiting for MSGCODE_PING result. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Antipov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/usb/pulse8/pulse8-cec.c +index 04b13cdc38d2c..ba67587bd43ec 100644 +--- a/drivers/media/cec/usb/pulse8/pulse8-cec.c ++++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c +@@ -809,8 +809,11 @@ static void pulse8_ping_eeprom_work_handler(struct work_struct *work) + + mutex_lock(&pulse8->lock); + cmd = MSGCODE_PING; +- pulse8_send_and_wait(pulse8, &cmd, 1, +- MSGCODE_COMMAND_ACCEPTED, 0); ++ if (pulse8_send_and_wait(pulse8, &cmd, 1, ++ MSGCODE_COMMAND_ACCEPTED, 0)) { ++ dev_warn(pulse8->dev, "failed to ping EEPROM\n"); ++ goto unlock; ++ } + + if (pulse8->vers < 2) + goto unlock; +-- +2.40.1 + diff --git a/queue-6.1/media-uapi-hevc-add-num_delta_pocs_of_ref_rps_idx-fi.patch b/queue-6.1/media-uapi-hevc-add-num_delta_pocs_of_ref_rps_idx-fi.patch new file mode 100644 index 00000000000..6184719b091 --- /dev/null +++ b/queue-6.1/media-uapi-hevc-add-num_delta_pocs_of_ref_rps_idx-fi.patch @@ -0,0 +1,74 @@ +From cb33dc845831196d60abb659351734eee628e87e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 16:07:38 +0800 +Subject: media: uapi: HEVC: Add num_delta_pocs_of_ref_rps_idx field + +From: Benjamin Gaignard + +[ Upstream commit ae440c5da33cdb90a109f2df2a0360c67b3fab7e ] + +Some drivers firmwares parse by themselves slice header and need +num_delta_pocs_of_ref_rps_idx value to parse slice header +short_term_ref_pic_set(). +Use one of the 4 reserved bytes to store this value without +changing the v4l2_ctrl_hevc_decode_params structure size and padding. + +This value also exist in DXVA API. + +Signed-off-by: Benjamin Gaignard +Signed-off-by: Yunfei Dong +Reviewed-by: Nicolas Dufresne +Signed-off-by: Hans Verkuil +[hverkuil: fix typo in num_delta_pocs_of_ref_rps_idx doc] +Stable-dep-of: 297160d411e3 ("media: mediatek: vcodec: move core context from device to each instance") +Signed-off-by: Sasha Levin +--- + .../userspace-api/media/v4l/ext-ctrls-codec-stateless.rst | 7 +++++++ + include/uapi/linux/v4l2-controls.h | 6 +++++- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/Documentation/userspace-api/media/v4l/ext-ctrls-codec-stateless.rst b/Documentation/userspace-api/media/v4l/ext-ctrls-codec-stateless.rst +index cd33857d947d3..0ef49647c90bd 100644 +--- a/Documentation/userspace-api/media/v4l/ext-ctrls-codec-stateless.rst ++++ b/Documentation/userspace-api/media/v4l/ext-ctrls-codec-stateless.rst +@@ -2923,6 +2923,13 @@ This structure contains all loop filter related parameters. See sections + - ``poc_lt_curr[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]`` + - PocLtCurr as described in section 8.3.2 "Decoding process for reference + picture set": provides the index of the long term references in DPB array. ++ * - __u8 ++ - ``num_delta_pocs_of_ref_rps_idx`` ++ - When the short_term_ref_pic_set_sps_flag in the slice header is equal to 0, ++ it is the same as the derived value NumDeltaPocs[RefRpsIdx]. It can be used to parse ++ the RPS data in slice headers instead of skipping it with @short_term_ref_pic_set_size. ++ When the value of short_term_ref_pic_set_sps_flag in the slice header is ++ equal to 1, num_delta_pocs_of_ref_rps_idx shall be set to 0. + * - struct :c:type:`v4l2_hevc_dpb_entry` + - ``dpb[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]`` + - The decoded picture buffer, for meta-data about reference frames. +diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h +index b5e7d082b8adf..d4a4e3cab3c2a 100644 +--- a/include/uapi/linux/v4l2-controls.h ++++ b/include/uapi/linux/v4l2-controls.h +@@ -2411,6 +2411,9 @@ struct v4l2_ctrl_hevc_slice_params { + * @poc_st_curr_after: provides the index of the short term after references + * in DPB array + * @poc_lt_curr: provides the index of the long term references in DPB array ++ * @num_delta_pocs_of_ref_rps_idx: same as the derived value NumDeltaPocs[RefRpsIdx], ++ * can be used to parse the RPS data in slice headers ++ * instead of skipping it with @short_term_ref_pic_set_size. + * @reserved: padding field. Should be zeroed by applications. + * @dpb: the decoded picture buffer, for meta-data about reference frames + * @flags: see V4L2_HEVC_DECODE_PARAM_FLAG_{} +@@ -2426,7 +2429,8 @@ struct v4l2_ctrl_hevc_decode_params { + __u8 poc_st_curr_before[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]; + __u8 poc_st_curr_after[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]; + __u8 poc_lt_curr[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]; +- __u8 reserved[4]; ++ __u8 num_delta_pocs_of_ref_rps_idx; ++ __u8 reserved[3]; + struct v4l2_hevc_dpb_entry dpb[V4L2_HEVC_DPB_ENTRIES_NUM_MAX]; + __u64 flags; + }; +-- +2.40.1 + diff --git a/queue-6.1/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch b/queue-6.1/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch new file mode 100644 index 00000000000..13020fcc77d --- /dev/null +++ b/queue-6.1/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch @@ -0,0 +1,116 @@ +From d7e8bfbf7682625f1686ba5eec2ba4ca6a3d1a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 15:03:12 +0000 +Subject: net: annotate data-races around sk->sk_{rcv|snd}timeo + +From: Eric Dumazet + +[ Upstream commit 285975dd674258ccb33e77a1803e8f2015e67105 ] + +sk_getsockopt() runs without locks, we must add annotations +to sk->sk_rcvtimeo and sk->sk_sndtimeo. + +In the future we might allow fetching these fields before +we lock the socket in TCP fast path. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 24 ++++++++++++++---------- + net/sched/em_meta.c | 4 ++-- + 2 files changed, 16 insertions(+), 12 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 509773919d302..8b91d9f911336 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -425,6 +425,7 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + { + struct __kernel_sock_timeval tv; + int err = sock_copy_user_timeval(&tv, optval, optlen, old_timeval); ++ long val; + + if (err) + return err; +@@ -435,7 +436,7 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + if (tv.tv_sec < 0) { + static int warned __read_mostly; + +- *timeo_p = 0; ++ WRITE_ONCE(*timeo_p, 0); + if (warned < 10 && net_ratelimit()) { + warned++; + pr_info("%s: `%s' (pid %d) tries to set negative timeout\n", +@@ -443,11 +444,12 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + } + return 0; + } +- *timeo_p = MAX_SCHEDULE_TIMEOUT; +- if (tv.tv_sec == 0 && tv.tv_usec == 0) +- return 0; +- if (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) +- *timeo_p = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec, USEC_PER_SEC / HZ); ++ val = MAX_SCHEDULE_TIMEOUT; ++ if ((tv.tv_sec || tv.tv_usec) && ++ (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1))) ++ val = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec, ++ USEC_PER_SEC / HZ); ++ WRITE_ONCE(*timeo_p, val); + return 0; + } + +@@ -809,9 +811,9 @@ void sock_set_sndtimeo(struct sock *sk, s64 secs) + { + lock_sock(sk); + if (secs && secs < MAX_SCHEDULE_TIMEOUT / HZ - 1) +- sk->sk_sndtimeo = secs * HZ; ++ WRITE_ONCE(sk->sk_sndtimeo, secs * HZ); + else +- sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; ++ WRITE_ONCE(sk->sk_sndtimeo, MAX_SCHEDULE_TIMEOUT); + release_sock(sk); + } + EXPORT_SYMBOL(sock_set_sndtimeo); +@@ -1708,12 +1710,14 @@ int sk_getsockopt(struct sock *sk, int level, int optname, + + case SO_RCVTIMEO_OLD: + case SO_RCVTIMEO_NEW: +- lv = sock_get_timeout(sk->sk_rcvtimeo, &v, SO_RCVTIMEO_OLD == optname); ++ lv = sock_get_timeout(READ_ONCE(sk->sk_rcvtimeo), &v, ++ SO_RCVTIMEO_OLD == optname); + break; + + case SO_SNDTIMEO_OLD: + case SO_SNDTIMEO_NEW: +- lv = sock_get_timeout(sk->sk_sndtimeo, &v, SO_SNDTIMEO_OLD == optname); ++ lv = sock_get_timeout(READ_ONCE(sk->sk_sndtimeo), &v, ++ SO_SNDTIMEO_OLD == optname); + break; + + case SO_RCVLOWAT: +diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c +index 49bae3d5006b0..b1f1b49d35edf 100644 +--- a/net/sched/em_meta.c ++++ b/net/sched/em_meta.c +@@ -568,7 +568,7 @@ META_COLLECTOR(int_sk_rcvtimeo) + *err = -1; + return; + } +- dst->value = sk->sk_rcvtimeo / HZ; ++ dst->value = READ_ONCE(sk->sk_rcvtimeo) / HZ; + } + + META_COLLECTOR(int_sk_sndtimeo) +@@ -579,7 +579,7 @@ META_COLLECTOR(int_sk_sndtimeo) + *err = -1; + return; + } +- dst->value = sk->sk_sndtimeo / HZ; ++ dst->value = READ_ONCE(sk->sk_sndtimeo) / HZ; + } + + META_COLLECTOR(int_sk_sendmsg_off) +-- +2.40.1 + diff --git a/queue-6.1/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch b/queue-6.1/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch new file mode 100644 index 00000000000..c27666d8161 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch @@ -0,0 +1,117 @@ +From e21f7e52af50bc8254cd692d160797ae7faa7de9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 10:13:42 +0200 +Subject: net: dsa: microchip: KSZ9477 register regmap alignment to 32 bit + boundaries + +From: Lukasz Majewski + +[ Upstream commit 8d7ae22ae9f8c8a4407f8e993df64440bdbd0cee ] + +The commit (SHA1: 5c844d57aa7894154e49cf2fc648bfe2f1aefc1c) provided code +to apply "Module 6: Certain PHY registers must be written as pairs instead +of singly" errata for KSZ9477 as this chip for certain PHY registers +(0xN120 to 0xN13F, N=1,2,3,4,5) must be accesses as 32 bit words instead +of 16 or 8 bit access. +Otherwise, adjacent registers (no matter if reserved or not) are +overwritten with 0x0. + +Without this patch some registers (e.g. 0x113c or 0x1134) required for 32 +bit access are out of valid regmap ranges. + +As a result, following error is observed and KSZ9477 is not properly +configured: + +ksz-switch spi1.0: can't rmw 32bit reg 0x113c: -EIO +ksz-switch spi1.0: can't rmw 32bit reg 0x1134: -EIO +ksz-switch spi1.0 lan1 (uninitialized): failed to connect to PHY: -EIO +ksz-switch spi1.0 lan1 (uninitialized): error -5 setting up PHY for tree 0, switch 0, port 0 + +The solution is to modify regmap_reg_range to allow accesses with 4 bytes +boundaries. + +Signed-off-by: Lukasz Majewski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 35 +++++++++++--------------- + 1 file changed, 15 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 8c492d56d2c36..dc9eea3c8ab16 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -590,10 +590,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x1030, 0x1030), + regmap_reg_range(0x1100, 0x1115), + regmap_reg_range(0x111a, 0x111f), +- regmap_reg_range(0x1122, 0x1127), +- regmap_reg_range(0x112a, 0x112b), +- regmap_reg_range(0x1136, 0x1139), +- regmap_reg_range(0x113e, 0x113f), ++ regmap_reg_range(0x1120, 0x112b), ++ regmap_reg_range(0x1134, 0x113b), ++ regmap_reg_range(0x113c, 0x113f), + regmap_reg_range(0x1400, 0x1401), + regmap_reg_range(0x1403, 0x1403), + regmap_reg_range(0x1410, 0x1417), +@@ -624,10 +623,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x2030, 0x2030), + regmap_reg_range(0x2100, 0x2115), + regmap_reg_range(0x211a, 0x211f), +- regmap_reg_range(0x2122, 0x2127), +- regmap_reg_range(0x212a, 0x212b), +- regmap_reg_range(0x2136, 0x2139), +- regmap_reg_range(0x213e, 0x213f), ++ regmap_reg_range(0x2120, 0x212b), ++ regmap_reg_range(0x2134, 0x213b), ++ regmap_reg_range(0x213c, 0x213f), + regmap_reg_range(0x2400, 0x2401), + regmap_reg_range(0x2403, 0x2403), + regmap_reg_range(0x2410, 0x2417), +@@ -658,10 +656,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x3030, 0x3030), + regmap_reg_range(0x3100, 0x3115), + regmap_reg_range(0x311a, 0x311f), +- regmap_reg_range(0x3122, 0x3127), +- regmap_reg_range(0x312a, 0x312b), +- regmap_reg_range(0x3136, 0x3139), +- regmap_reg_range(0x313e, 0x313f), ++ regmap_reg_range(0x3120, 0x312b), ++ regmap_reg_range(0x3134, 0x313b), ++ regmap_reg_range(0x313c, 0x313f), + regmap_reg_range(0x3400, 0x3401), + regmap_reg_range(0x3403, 0x3403), + regmap_reg_range(0x3410, 0x3417), +@@ -692,10 +689,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x4030, 0x4030), + regmap_reg_range(0x4100, 0x4115), + regmap_reg_range(0x411a, 0x411f), +- regmap_reg_range(0x4122, 0x4127), +- regmap_reg_range(0x412a, 0x412b), +- regmap_reg_range(0x4136, 0x4139), +- regmap_reg_range(0x413e, 0x413f), ++ regmap_reg_range(0x4120, 0x412b), ++ regmap_reg_range(0x4134, 0x413b), ++ regmap_reg_range(0x413c, 0x413f), + regmap_reg_range(0x4400, 0x4401), + regmap_reg_range(0x4403, 0x4403), + regmap_reg_range(0x4410, 0x4417), +@@ -726,10 +722,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x5030, 0x5030), + regmap_reg_range(0x5100, 0x5115), + regmap_reg_range(0x511a, 0x511f), +- regmap_reg_range(0x5122, 0x5127), +- regmap_reg_range(0x512a, 0x512b), +- regmap_reg_range(0x5136, 0x5139), +- regmap_reg_range(0x513e, 0x513f), ++ regmap_reg_range(0x5120, 0x512b), ++ regmap_reg_range(0x5134, 0x513b), ++ regmap_reg_range(0x513c, 0x513f), + regmap_reg_range(0x5400, 0x5401), + regmap_reg_range(0x5403, 0x5403), + regmap_reg_range(0x5410, 0x5417), +-- +2.40.1 + diff --git a/queue-6.1/net-hns3-restore-user-pause-configure-when-disable-a.patch b/queue-6.1/net-hns3-restore-user-pause-configure-when-disable-a.patch new file mode 100644 index 00000000000..10f012235fd --- /dev/null +++ b/queue-6.1/net-hns3-restore-user-pause-configure-when-disable-a.patch @@ -0,0 +1,70 @@ +From ac5e72e5f7d8421dfdafce4245bbdbd218fc5fe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 19:34:49 +0800 +Subject: net: hns3: restore user pause configure when disable autoneg + +From: Jian Shen + +[ Upstream commit 15159ec0c831b565820c2de05114ea1b4cf07681 ] + +Restore the mac pause state to user configuration when autoneg is disabled + +Signed-off-by: Jian Shen +Signed-off-by: Peiyang Wang +Signed-off-by: Jijie Shao +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230807113452.474224-2-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 1 + + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 6af2273f227c2..84ecd8b9be48c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -10936,9 +10936,12 @@ int hclge_cfg_flowctrl(struct hclge_dev *hdev) + u32 rx_pause, tx_pause; + u8 flowctl; + +- if (!phydev->link || !phydev->autoneg) ++ if (!phydev->link) + return 0; + ++ if (!phydev->autoneg) ++ return hclge_mac_pause_setup_hw(hdev); ++ + local_advertising = linkmode_adv_to_lcl_adv_t(phydev->advertising); + + if (phydev->pause) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 150f146fa24fb..8b40c6b4ee53e 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -1549,7 +1549,7 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + return 0; + } + +-static int hclge_mac_pause_setup_hw(struct hclge_dev *hdev) ++int hclge_mac_pause_setup_hw(struct hclge_dev *hdev) + { + bool tx_en, rx_en; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +index dd6f1fd486cf2..251e808456208 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +@@ -242,6 +242,7 @@ int hclge_pfc_pause_en_cfg(struct hclge_dev *hdev, u8 tx_rx_bitmap, + u8 pfc_bitmap); + int hclge_mac_pause_en_cfg(struct hclge_dev *hdev, bool tx, bool rx); + int hclge_pause_addr_cfg(struct hclge_dev *hdev, const u8 *mac_addr); ++int hclge_mac_pause_setup_hw(struct hclge_dev *hdev); + void hclge_pfc_rx_stats_get(struct hclge_dev *hdev, u64 *stats); + void hclge_pfc_tx_stats_get(struct hclge_dev *hdev, u64 *stats); + int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate); +-- +2.40.1 + diff --git a/queue-6.1/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch b/queue-6.1/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch new file mode 100644 index 00000000000..b04e6c035b2 --- /dev/null +++ b/queue-6.1/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch @@ -0,0 +1,65 @@ +From 59ce41fd0b89b4473410de10bea2054f5c5643ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 13:05:56 +0200 +Subject: net: sfp: handle 100G/25G active optical cables in sfp_parse_support + +From: Josua Mayer + +[ Upstream commit db1a6ad77c180efc7242d7204b9a0c72c8a5a1bb ] + +Handle extended compliance code 0x1 (SFF8024_ECC_100G_25GAUI_C2M_AOC) +for active optical cables supporting 25G and 100G speeds. + +Since the specification makes no statement about transmitter range, and +as the specific sfp module that had been tested features only 2m fiber - +short-range (SR) modes are selected. + +The 100G speed is irrelevant because it would require multiple fibers / +multiple SFP28 modules combined under one netdev. +sfp-bus.c only handles a single module per netdev, so only 25Gbps modes +are selected. + +sfp_parse_support already handles SFF8024_ECC_100GBASE_SR4_25GBASE_SR +with compatible properties, however that entry is a contradiction in +itself since with SFP(28) 100GBASE_SR4 is impossible - that would likely +be a mode for qsfp modules only. + +Add a case for SFF8024_ECC_100G_25GAUI_C2M_AOC selecting 25gbase-r +interface mode and 25000baseSR link mode. +Also enforce SFP28 bitrate limits on the values read from sfp eeprom as +requested by Russell King. + +Tested with fs.com S28-AO02 AOC SFP28 module. + +Signed-off-by: Josua Mayer +Reviewed-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp-bus.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index daac293e8edec..1865e3dbdfad0 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -254,6 +254,16 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id, + switch (id->base.extended_cc) { + case SFF8024_ECC_UNSPEC: + break; ++ case SFF8024_ECC_100G_25GAUI_C2M_AOC: ++ if (br_min <= 28000 && br_max >= 25000) { ++ /* 25GBASE-R, possibly with FEC */ ++ __set_bit(PHY_INTERFACE_MODE_25GBASER, interfaces); ++ /* There is currently no link mode for 25000base ++ * with unspecified range, reuse SR. ++ */ ++ phylink_set(modes, 25000baseSR_Full); ++ } ++ break; + case SFF8024_ECC_100GBASE_SR4_25GBASE_SR: + phylink_set(modes, 100000baseSR4_Full); + phylink_set(modes, 25000baseSR_Full); +-- +2.40.1 + diff --git a/queue-6.1/net-usb-qmi_wwan-add-quectel-em05gv2.patch b/queue-6.1/net-usb-qmi_wwan-add-quectel-em05gv2.patch new file mode 100644 index 00000000000..fbbc8868c00 --- /dev/null +++ b/queue-6.1/net-usb-qmi_wwan-add-quectel-em05gv2.patch @@ -0,0 +1,64 @@ +From c578a7d1cdb2a0e71233581399a577b5ca8b43b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 20:00:43 +0000 +Subject: net: usb: qmi_wwan: add Quectel EM05GV2 + +From: Martin Kohn + +[ Upstream commit d4480c9bb9258db9ddf2e632f6ef81e96b41089c ] + +Add support for Quectel EM05GV2 (G=global) with vendor ID +0x2c7c and product ID 0x030e + +Enabling DTR on this modem was necessary to ensure stable operation. +Patch for usb: serial: option: is also in progress. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=030e Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Martin Kohn +Link: https://lore.kernel.org/r/AM0PR04MB57648219DE893EE04FA6CC759701A@AM0PR04MB5764.eurprd04.prod.outlook.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 68829a5a93d3e..4fb981b8732ef 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1422,6 +1422,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ ++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ +-- +2.40.1 + diff --git a/queue-6.1/netlabel-fix-shift-wrapping-bug-in-netlbl_catmap_set.patch b/queue-6.1/netlabel-fix-shift-wrapping-bug-in-netlbl_catmap_set.patch new file mode 100644 index 00000000000..0ec07066a41 --- /dev/null +++ b/queue-6.1/netlabel-fix-shift-wrapping-bug-in-netlbl_catmap_set.patch @@ -0,0 +1,38 @@ +From 0b49afdfbc1fe21abf0131fb6416c58b5ac106e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 16:57:54 +0300 +Subject: netlabel: fix shift wrapping bug in netlbl_catmap_setlong() + +From: Dmitry Mastykin + +[ Upstream commit b403643d154d15176b060b82f7fc605210033edd ] + +There is a shift wrapping bug in this code on 32-bit architectures. +NETLBL_CATMAP_MAPTYPE is u64, bitmap is unsigned long. +Every second 32-bit word of catmap becomes corrupted. + +Signed-off-by: Dmitry Mastykin +Acked-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlabel/netlabel_kapi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 54c0830039470..27511c90a26f4 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -857,7 +857,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, + + offset -= iter->startbit; + idx = offset / NETLBL_CATMAP_MAPSIZE; +- iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE); ++ iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE)bitmap ++ << (offset % NETLBL_CATMAP_MAPSIZE); + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.1/ovl-always-reevaluate-the-file-signature-for-ima.patch b/queue-6.1/ovl-always-reevaluate-the-file-signature-for-ima.patch new file mode 100644 index 00000000000..29e478ebef9 --- /dev/null +++ b/queue-6.1/ovl-always-reevaluate-the-file-signature-for-ima.patch @@ -0,0 +1,44 @@ +From a2a58b897fb3b1bbb7c8b7d1b224d070d8ff26e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 17:56:46 -0400 +Subject: ovl: Always reevaluate the file signature for IMA + +From: Eric Snowberg + +[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ] + +Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") +partially closed an IMA integrity issue when directly modifying a file +on the lower filesystem. If the overlay file is first opened by a user +and later the lower backing file is modified by root, but the extended +attribute is NOT updated, the signature validation succeeds with the old +original signature. + +Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to +force signature reevaluation on every file access until a fine grained +solution can be found. + +Signed-off-by: Eric Snowberg +Signed-off-by: Mimi Zohar +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/overlayfs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 51eec4a8e82b2..08d3a1f34ac6c 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -2155,7 +2155,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) + ovl_trusted_xattr_handlers; + sb->s_fs_info = ofs; + sb->s_flags |= SB_POSIXACL; +- sb->s_iflags |= SB_I_SKIP_SYNC; ++ sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE; + + err = -ENOMEM; + root_dentry = ovl_get_root(sb, upperpath.dentry, oe); +-- +2.40.1 + diff --git a/queue-6.1/partially-revert-drm-amd-display-fix-possible-underf.patch b/queue-6.1/partially-revert-drm-amd-display-fix-possible-underf.patch new file mode 100644 index 00000000000..2dd5e596295 --- /dev/null +++ b/queue-6.1/partially-revert-drm-amd-display-fix-possible-underf.patch @@ -0,0 +1,46 @@ +From 69b25007f6d982eef88e58f026c15ca445f6fe69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:47:35 -0400 +Subject: Partially revert "drm/amd/display: Fix possible underflow for + displays with large vblank" + +From: Daniel Miess + +[ Upstream commit a99a4ff6ef205d125002fc7e0857074e4e6597b6 ] + +This partially reverts commit de231189e7bf ("drm/amd/display: Fix +possible underflow for displays with large vblank"). + +[Why] +The increased value of VBlankNomDefaultUS causes underflow at the +desktop of an IP KVM setup + +[How] +Change the value from 800 back to 668 + +Reviewed-by: Nicholas Kazlauskas +Reviewed-by: Jun Lei +Acked-by: Hamza Mahfooz +Signed-off-by: Daniel Miess +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c +index 8a88605827a84..551a63f7064bb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c +@@ -32,7 +32,7 @@ + #include "dml/display_mode_vba.h" + + struct _vcs_dpi_ip_params_st dcn3_14_ip = { +- .VBlankNomDefaultUS = 800, ++ .VBlankNomDefaultUS = 668, + .gpuvm_enable = 1, + .gpuvm_max_page_table_levels = 1, + .hostvm_enable = 1, +-- +2.40.1 + diff --git a/queue-6.1/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch b/queue-6.1/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch new file mode 100644 index 00000000000..1538ee96993 --- /dev/null +++ b/queue-6.1/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch @@ -0,0 +1,48 @@ +From ecd82780cd5fdedf35dedf723d656f434ec1e81d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 10:45:40 -0400 +Subject: phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error + code + +From: Adrien Thierry + +[ Upstream commit 8932089b566c24ea19b57e37704c492678de1420 ] + +The return value from qcom_snps_hsphy_suspend/resume is not used. Make +sure qcom_snps_hsphy_runtime_suspend/resume return this value as well. + +Signed-off-by: Adrien Thierry +Link: https://lore.kernel.org/r/20230629144542.14906-4-athierry@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index 6170f8fd118e2..d0319bee01c0f 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -214,8 +214,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_suspend(struct device *dev) + if (!hsphy->phy_initialized) + return 0; + +- qcom_snps_hsphy_suspend(hsphy); +- return 0; ++ return qcom_snps_hsphy_suspend(hsphy); + } + + static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev) +@@ -225,8 +224,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev) + if (!hsphy->phy_initialized) + return 0; + +- qcom_snps_hsphy_resume(hsphy); +- return 0; ++ return qcom_snps_hsphy_resume(hsphy); + } + + static int qcom_snps_hsphy_set_mode(struct phy *phy, enum phy_mode mode, +-- +2.40.1 + diff --git a/queue-6.1/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch b/queue-6.1/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch new file mode 100644 index 00000000000..27df471b934 --- /dev/null +++ b/queue-6.1/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch @@ -0,0 +1,40 @@ +From f08b6c91123aef242076989b9bee49de12cec6c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 11:06:27 -0400 +Subject: platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE + notifications + +From: Shih-Yi Chen + +[ Upstream commit 0848cab765c634597636810bf76d0934003cce28 ] + +rshim console does not show all entries of dmesg. + +Fixed by setting MLXBF_TM_TX_LWM_IRQ for every CONSOLE notification. + +Signed-off-by: Shih-Yi Chen +Reviewed-by: Liming Sung +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/20230821150627.26075-1-shihyic@nvidia.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index b2e19f30a928b..d31fe7eed38df 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -868,6 +868,7 @@ static bool mlxbf_tmfifo_virtio_notify(struct virtqueue *vq) + tm_vdev = fifo->vdev[VIRTIO_ID_CONSOLE]; + mlxbf_tmfifo_console_output(tm_vdev, vring); + spin_unlock_irqrestore(&fifo->spin_lock[0], flags); ++ set_bit(MLXBF_TM_TX_LWM_IRQ, &fifo->pend_events); + } else if (test_and_set_bit(MLXBF_TM_TX_LWM_IRQ, + &fifo->pend_events)) { + return true; +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch b/queue-6.1/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch new file mode 100644 index 00000000000..9f5aa7ed4c0 --- /dev/null +++ b/queue-6.1/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch @@ -0,0 +1,44 @@ +From 702fb33e1552ec09438afef2406f91cb6b8a6620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 09:43:15 +0800 +Subject: platform/x86/amd/pmf: Fix unsigned comparison with less than zero + +From: Yang Li + +[ Upstream commit 785c00993dc4c4bb2f7b0f3a3f29c03a6f7aab2e ] + +The return value from the call to amd_pmf_get_pprof_modes() is int. +However, the return value is being assigned to an unsigned char +variable 'mode', so making 'mode' an int. + +silence the warning: +./drivers/platform/x86/amd/pmf/sps.c:183:5-9: WARNING: Unsigned expression compared with zero: mode < 0 + +Reported-by: Abaci Robot +Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5995 +Signed-off-by: Yang Li +Link: https://lore.kernel.org/r/20230727014315.51375-1-yang.lee@linux.alibaba.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/sps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c +index fd448844de206..b2cf62937227c 100644 +--- a/drivers/platform/x86/amd/pmf/sps.c ++++ b/drivers/platform/x86/amd/pmf/sps.c +@@ -121,7 +121,8 @@ int amd_pmf_get_pprof_modes(struct amd_pmf_dev *pmf) + + int amd_pmf_power_slider_update_event(struct amd_pmf_dev *dev) + { +- u8 mode, flag = 0; ++ u8 flag = 0; ++ int mode; + int src; + + mode = amd_pmf_get_pprof_modes(dev); +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch b/queue-6.1/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch new file mode 100644 index 00000000000..5c325bec420 --- /dev/null +++ b/queue-6.1/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch @@ -0,0 +1,56 @@ +From d4ab79729247fa3c1630597aaf7288498f7b25eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 18:29:50 +0300 +Subject: platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops + +From: Kristian Angelov + +[ Upstream commit 6a758a3e831ce1a84c9c209ac6dc755f4c8ce77a ] + +This patch fixes setting the cmd values to 0xb3 and 0xb4. +This is necessary on some TUF laptops in order to set the RGB mode. + +Closes: https://lore.kernel.org/platform-driver-x86/443078148.491022.1677576298133@nm83.abv.bg +Signed-off-by: Kristian Angelov +Reviewed-by: Luke D. Jones +Link: https://lore.kernel.org/r/ZLlS7o6UdTUBkyqa@wyvern.localdomain +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 02bf286924183..36effe04c6f33 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -738,13 +738,23 @@ static ssize_t kbd_rgb_mode_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) + { +- u32 cmd, mode, r, g, b, speed; ++ u32 cmd, mode, r, g, b, speed; + int err; + + if (sscanf(buf, "%d %d %d %d %d %d", &cmd, &mode, &r, &g, &b, &speed) != 6) + return -EINVAL; + +- cmd = !!cmd; ++ /* B3 is set and B4 is save to BIOS */ ++ switch (cmd) { ++ case 0: ++ cmd = 0xb3; ++ break; ++ case 1: ++ cmd = 0xb4; ++ break; ++ default: ++ return -EINVAL; ++ } + + /* These are the known usable modes across all TUF/ROG */ + if (mode >= 12 || mode == 9) +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch b/queue-6.1/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch new file mode 100644 index 00000000000..de55b8281aa --- /dev/null +++ b/queue-6.1/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch @@ -0,0 +1,55 @@ +From 72a444dd50d02810c7910d8e10b5f516a8650b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 18:59:20 +0300 +Subject: platform/x86: huawei-wmi: Silence ambient light sensor + +From: Konstantin Shelekhin + +[ Upstream commit c21733754cd6ecbca346f2adf9b17d4cfa50504f ] + +Currently huawei-wmi causes a lot of spam in dmesg on my +Huawei MateBook X Pro 2022: + + ... + [36409.328463] input input9: Unknown key pressed, code: 0x02c1 + [36411.335104] input input9: Unknown key pressed, code: 0x02c1 + [36412.338674] input input9: Unknown key pressed, code: 0x02c1 + [36414.848564] input input9: Unknown key pressed, code: 0x02c1 + [36416.858706] input input9: Unknown key pressed, code: 0x02c1 + ... + +Fix that by ignoring events generated by ambient light sensor. + +This issue was reported on GitHub and resolved with the following merge +request: + + https://github.com/aymanbagabas/Huawei-WMI/pull/70 + +I've contacted the mainter of this repo and he gave me the "go ahead" to +send this patch to the maling list. + +Signed-off-by: Konstantin Shelekhin +Link: https://lore.kernel.org/r/20230722155922.173856-1-k.shelekhin@ftml.net +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index b85050e4a0d65..ae5daecff1771 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -86,6 +86,8 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, + { KE_IGNORE, 0x295, { KEY_KBDILLUMUP } }, ++ // Ignore Ambient Light Sensoring ++ { KE_KEY, 0x2c1, { KEY_RESERVED } }, + { KE_END, 0 } + }; + +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch b/queue-6.1/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch new file mode 100644 index 00000000000..1eb1639fb0b --- /dev/null +++ b/queue-6.1/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch @@ -0,0 +1,51 @@ +From a6b8e1ef34cb98a368849428a5a3fa65a2d96959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jul 2023 21:32:13 +0300 +Subject: platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks + +From: Maxim Mikityanskiy + +[ Upstream commit 7783e97f8558ad7a4d1748922461bc88483fbcdf ] + +HP Elite Dragonfly G2 (a convertible laptop/tablet) has a reliable VGBS +method. If VGBS is not called on boot, the firmware sends an initial +0xcd event shortly after calling the BTNL method, but only if the device +is booted in the laptop mode. However, if the device is booted in the +tablet mode and VGBS is not called, there is no initial 0xcc event, and +the input device for SW_TABLET_MODE is not registered up until the user +turns the device into the laptop mode. + +Call VGBS on boot on this device to get the initial state of +SW_TABLET_MODE in a reliable way. + +Tested with BIOS 1.13.1. + +Signed-off-by: Maxim Mikityanskiy +Link: https://lore.kernel.org/r/20230716183213.64173-1-maxtram95@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index df533b277b999..b96ef0eb82aff 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -131,6 +131,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), ++ }, ++ }, + { } + }; + +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-intel-hid-always-call-btnl-acpi-method.patch b/queue-6.1/platform-x86-intel-hid-always-call-btnl-acpi-method.patch new file mode 100644 index 00000000000..df504ce7069 --- /dev/null +++ b/queue-6.1/platform-x86-intel-hid-always-call-btnl-acpi-method.patch @@ -0,0 +1,73 @@ +From b1e7648f6768a4a9fbfaa0c279f28de9147563f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 20:15:16 +0200 +Subject: platform/x86: intel: hid: Always call BTNL ACPI method + +From: Hans de Goede + +[ Upstream commit e3ab18de2b09361d6f0e4aafb9cfd6d002ce43a1 ] + +On a HP Elite Dragonfly G2 the 0xcc and 0xcd events for SW_TABLET_MODE +are only send after the BTNL ACPI method has been called. + +Likely more devices need this, so make the BTNL ACPI method unconditional +instead of only doing it on devices with a 5 button array. + +Note this also makes the intel_button_array_enable() call in probe() +unconditional, that function does its own priv->array check. This makes +the intel_button_array_enable() call in probe() consistent with the calls +done on suspend/resume which also rely on the priv->array check inside +the function. + +Reported-by: Maxim Mikityanskiy +Closes: https://lore.kernel.org/platform-driver-x86/20230712175023.31651-1-maxtram95@gmail.com/ +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230715181516.5173-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index b6313ecd190c0..df533b277b999 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -601,7 +601,7 @@ static bool button_array_present(struct platform_device *device) + static int intel_hid_probe(struct platform_device *device) + { + acpi_handle handle = ACPI_HANDLE(&device->dev); +- unsigned long long mode; ++ unsigned long long mode, dummy; + struct intel_hid_priv *priv; + acpi_status status; + int err; +@@ -666,18 +666,15 @@ static int intel_hid_probe(struct platform_device *device) + if (err) + goto err_remove_notify; + +- if (priv->array) { +- unsigned long long dummy; ++ intel_button_array_enable(&device->dev, true); + +- intel_button_array_enable(&device->dev, true); +- +- /* Call button load method to enable HID power button */ +- if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, +- &dummy)) { +- dev_warn(&device->dev, +- "failed to enable HID power button\n"); +- } +- } ++ /* ++ * Call button load method to enable HID power button ++ * Always do this since it activates events on some devices without ++ * a button array too. ++ */ ++ if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, &dummy)) ++ dev_warn(&device->dev, "failed to enable HID power button\n"); + + device_init_wakeup(&device->dev, true); + /* +-- +2.40.1 + diff --git a/queue-6.1/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch b/queue-6.1/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch new file mode 100644 index 00000000000..854f5bfe6d1 --- /dev/null +++ b/queue-6.1/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch @@ -0,0 +1,43 @@ +From 64f7b244e9a6f9ded2194f96f04e5773b05d1494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 18:11:02 +0800 +Subject: platform/x86: think-lmi: Use kfree_sensitive instead of kfree + +From: Wang Ming + +[ Upstream commit 1da0893aed2e48e2bdf37c29b029f2e060d25927 ] + +key might contain private part of the key, so better use +kfree_sensitive to free it. + +Signed-off-by: Wang Ming +Link: https://lore.kernel.org/r/20230717101114.18966-1-machel@vivo.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 3cbb92b6c5215..f6290221d139d 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -719,12 +719,12 @@ static ssize_t cert_to_password_store(struct kobject *kobj, + /* Format: 'Password,Signature' */ + auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature); + if (!auth_str) { +- kfree(passwd); ++ kfree_sensitive(passwd); + return -ENOMEM; + } + ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str); + kfree(auth_str); +- kfree(passwd); ++ kfree_sensitive(passwd); + + return ret ?: count; + } +-- +2.40.1 + diff --git a/queue-6.1/powerpc-boot-disable-power10-features-after-bootafla.patch b/queue-6.1/powerpc-boot-disable-power10-features-after-bootafla.patch new file mode 100644 index 00000000000..61d23857ee9 --- /dev/null +++ b/queue-6.1/powerpc-boot-disable-power10-features-after-bootafla.patch @@ -0,0 +1,63 @@ +From fa0b0c14fb493558c232c76be59a2168e5117ef7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 12:34:53 -0700 +Subject: powerpc/boot: Disable power10 features after BOOTAFLAGS assignment + +From: Nathan Chancellor + +[ Upstream commit 2b694fc96fe33a7c042e3a142d27d945c8c668b0 ] + +When building the boot wrapper assembly files with clang after +commit 648a1783fe25 ("powerpc/boot: Fix boot wrapper code generation +with CONFIG_POWER10_CPU"), the following warnings appear for each file +built: + + '-prefixed' is not a recognized feature for this target (ignoring feature) + '-pcrel' is not a recognized feature for this target (ignoring feature) + +While it is questionable whether or not LLVM should be emitting a +warning when passed negative versions of code generation flags when +building assembly files (since it does not emit a warning for the +altivec and vsx flags), it is easy enough to work around this by just +moving the disabled flags to BOOTCFLAGS after the assignment of +BOOTAFLAGS, so that they are not added when building assembly files. +Do so to silence the warnings. + +Fixes: 648a1783fe25 ("powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU") +Link: https://github.com/ClangBuiltLinux/linux/issues/1839 +Reviewed-by: Nicholas Piggin +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230427-remove-power10-args-from-boot-aflags-clang-v1-1-9107f7c943bc@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/Makefile | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile +index 13fad4f0a6d8f..b13324b1a1696 100644 +--- a/arch/powerpc/boot/Makefile ++++ b/arch/powerpc/boot/Makefile +@@ -34,8 +34,6 @@ endif + + BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \ +- $(call cc-option,-mno-prefixed) $(call cc-option,-mno-pcrel) \ +- $(call cc-option,-mno-mma) \ + $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \ + -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \ + $(LINUXINCLUDE) +@@ -71,6 +69,10 @@ BOOTAFLAGS := -D__ASSEMBLY__ $(BOOTCFLAGS) -nostdinc + + BOOTARFLAGS := -crD + ++BOOTCFLAGS += $(call cc-option,-mno-prefixed) \ ++ $(call cc-option,-mno-pcrel) \ ++ $(call cc-option,-mno-mma) ++ + ifdef CONFIG_CC_IS_CLANG + BOOTCFLAGS += $(CLANG_FLAGS) + BOOTAFLAGS += $(CLANG_FLAGS) +-- +2.40.1 + diff --git a/queue-6.1/powerpc-powermac-use-early_-io-variants-in-via_calib.patch b/queue-6.1/powerpc-powermac-use-early_-io-variants-in-via_calib.patch new file mode 100644 index 00000000000..db45b6c0c51 --- /dev/null +++ b/queue-6.1/powerpc-powermac-use-early_-io-variants-in-via_calib.patch @@ -0,0 +1,69 @@ +From 616d0d79b914307addb7fc5c0581bed80b920282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 11:08:16 +1000 +Subject: powerpc/powermac: Use early_* IO variants in via_calibrate_decr() + +From: Benjamin Gray + +[ Upstream commit 86582e6189dd8f9f52c25d46c70fe5d111da6345 ] + +On a powermac platform, via the call path: + + start_kernel() + time_init() + ppc_md.calibrate_decr() (pmac_calibrate_decr) + via_calibrate_decr() + +ioremap() and iounmap() are called. The unmap can enable interrupts +unexpectedly (cond_resched() in vunmap_pmd_range()), which causes a +warning later in the boot sequence in start_kernel(). + +Use the early_* variants of these IO functions to prevent this. + +The issue is pre-existing, but is surfaced by commit 721255b9826b +("genirq: Use a maple tree for interrupt descriptor management"). + +Signed-off-by: Benjamin Gray +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230706010816.72682-1-bgray@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powermac/time.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/powermac/time.c b/arch/powerpc/platforms/powermac/time.c +index 4c5790aff1b54..8633891b7aa58 100644 +--- a/arch/powerpc/platforms/powermac/time.c ++++ b/arch/powerpc/platforms/powermac/time.c +@@ -26,8 +26,8 @@ + #include + #include + ++#include + #include +-#include + #include + #include + #include +@@ -182,7 +182,7 @@ static int __init via_calibrate_decr(void) + return 0; + } + of_node_put(vias); +- via = ioremap(rsrc.start, resource_size(&rsrc)); ++ via = early_ioremap(rsrc.start, resource_size(&rsrc)); + if (via == NULL) { + printk(KERN_ERR "Failed to map VIA for timer calibration !\n"); + return 0; +@@ -207,7 +207,7 @@ static int __init via_calibrate_decr(void) + + ppc_tb_freq = (dstart - dend) * 100 / 6; + +- iounmap(via); ++ early_iounmap((void *)via, resource_size(&rsrc)); + + return 1; + } +-- +2.40.1 + diff --git a/queue-6.1/revert-bridge-add-extack-warning-when-enabling-stp-i.patch b/queue-6.1/revert-bridge-add-extack-warning-when-enabling-stp-i.patch new file mode 100644 index 00000000000..1eefc650f2a --- /dev/null +++ b/queue-6.1/revert-bridge-add-extack-warning-when-enabling-stp-i.patch @@ -0,0 +1,67 @@ +From db66da205bcd403d2d50de934e0d5048c2477cb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 10:41:52 -0700 +Subject: Revert "bridge: Add extack warning when enabling STP in netns." + +From: Kuniyuki Iwashima + +[ Upstream commit 7ebd00a5a20c48e6020d49a3b2afb3cdfd2da8b7 ] + +This reverts commit 56a16035bb6effb37177867cea94c13a8382f745. + +Since the previous commit, STP works on bridge in netns. + + # unshare -n + # ip link add br0 type bridge + # ip link add veth0 type veth peer name veth1 + + # ip link set veth0 master br0 up + [ 50.558135] br0: port 1(veth0) entered blocking state + [ 50.558366] br0: port 1(veth0) entered disabled state + [ 50.558798] veth0: entered allmulticast mode + [ 50.564401] veth0: entered promiscuous mode + + # ip link set veth1 master br0 up + [ 54.215487] br0: port 2(veth1) entered blocking state + [ 54.215657] br0: port 2(veth1) entered disabled state + [ 54.215848] veth1: entered allmulticast mode + [ 54.219577] veth1: entered promiscuous mode + + # ip link set br0 type bridge stp_state 1 + # ip link set br0 up + [ 61.960726] br0: port 2(veth1) entered blocking state + [ 61.961097] br0: port 2(veth1) entered listening state + [ 61.961495] br0: port 1(veth0) entered blocking state + [ 61.961653] br0: port 1(veth0) entered listening state + [ 63.998835] br0: port 2(veth1) entered blocking state + [ 77.437113] br0: port 1(veth0) entered learning state + [ 86.653501] br0: received packet on veth0 with own address as source address (addr:6e:0f:e7:6f:5f:5f, vlan:0) + [ 92.797095] br0: port 1(veth0) entered forwarding state + [ 92.797398] br0: topology change detected, propagating + +Let's remove the warning. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/bridge/br_stp_if.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index b65962682771f..75204d36d7f90 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -201,9 +201,6 @@ int br_stp_set_enabled(struct net_bridge *br, unsigned long val, + { + ASSERT_RTNL(); + +- if (!net_eq(dev_net(br->dev), &init_net)) +- NL_SET_ERR_MSG_MOD(extack, "STP does not work in non-root netns"); +- + if (br_mrp_enabled(br)) { + NL_SET_ERR_MSG_MOD(extack, + "STP can't be enabled if MRP is already enabled"); +-- +2.40.1 + diff --git a/queue-6.1/revert-mips-unhide-pata_platform.patch b/queue-6.1/revert-mips-unhide-pata_platform.patch new file mode 100644 index 00000000000..07d3b98d183 --- /dev/null +++ b/queue-6.1/revert-mips-unhide-pata_platform.patch @@ -0,0 +1,38 @@ +From 516c21f8b552d51bc2805781a9f39b4215a83356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 13:56:36 +0100 +Subject: Revert "MIPS: unhide PATA_PLATFORM" + +From: Maciej W. Rozycki + +[ Upstream commit 1e13da548fbffb807633df85a244b70caa90bdf7 ] + +Revert commit 75b18aac6fa3 ("MIPS: unhide PATA_PLATFORM") now that +HAVE_PATA_PLATFORM is set selectively for all the relevant platforms. + +Verified with `db1xxx_defconfig' and `sb1250_swarm_defconfig' by making +sure PATA_PLATFORM is still there in `.config' with this change applied, +and with `malta_defconfig' by making sure it's now gone. + +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index cf1fbf4eaa8a0..0e62f5edaee2e 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -83,7 +83,6 @@ config MIPS + select HAVE_LD_DEAD_CODE_DATA_ELIMINATION + select HAVE_MOD_ARCH_SPECIFIC + select HAVE_NMI +- select HAVE_PATA_PLATFORM + select HAVE_PERF_EVENTS + select HAVE_PERF_REGS + select HAVE_PERF_USER_STACK_DUMP +-- +2.40.1 + diff --git a/queue-6.1/revert-revert-drm-amd-display-enable-freesync-video-.patch b/queue-6.1/revert-revert-drm-amd-display-enable-freesync-video-.patch new file mode 100644 index 00000000000..3f5e997ac30 --- /dev/null +++ b/queue-6.1/revert-revert-drm-amd-display-enable-freesync-video-.patch @@ -0,0 +1,79 @@ +From 231ac1f4dcb8d0d8782be11971fae1a9601d97f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 14:29:26 -0400 +Subject: Revert "Revert drm/amd/display: Enable Freesync Video Mode by + default" + +From: Aurabindo Pillai + +[ Upstream commit 11b92df8a2f7f4605ccc764ce6ae4a72760674df ] + +This reverts commit 4243c84aa082d8fba70c45f48eb2bb5c19799060. + +Enables freesync video by default, since the hang and corruption issue +on eDP panels are now fixed. + +Acked-by: Stylon Wang +Signed-off-by: Aurabindo Pillai +Reviewed-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 249b269e2cc53..9beb326a9528e 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5921,8 +5921,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector, + */ + DRM_DEBUG_DRIVER("No preferred mode found\n"); + } else { +- recalculate_timing = amdgpu_freesync_vid_mode && +- is_freesync_video_mode(&mode, aconnector); ++ recalculate_timing = is_freesync_video_mode(&mode, aconnector); + if (recalculate_timing) { + freesync_mode = get_highest_refresh_rate_mode(aconnector, false); + drm_mode_copy(&saved_mode, &mode); +@@ -7016,7 +7015,7 @@ static void amdgpu_dm_connector_add_freesync_modes(struct drm_connector *connect + struct amdgpu_dm_connector *amdgpu_dm_connector = + to_amdgpu_dm_connector(connector); + +- if (!(amdgpu_freesync_vid_mode && edid)) ++ if (!edid) + return; + + if (amdgpu_dm_connector->max_vfreq - amdgpu_dm_connector->min_vfreq > 10) +@@ -9022,8 +9021,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + * TODO: Refactor this function to allow this check to work + * in all conditions. + */ +- if (amdgpu_freesync_vid_mode && +- dm_new_crtc_state->stream && ++ if (dm_new_crtc_state->stream && + is_timing_unchanged_for_freesync(new_crtc_state, old_crtc_state)) + goto skip_modeset; + +@@ -9063,7 +9061,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + } + + /* Now check if we should set freesync video mode */ +- if (amdgpu_freesync_vid_mode && dm_new_crtc_state->stream && ++ if (dm_new_crtc_state->stream && + dc_is_stream_unchanged(new_stream, dm_old_crtc_state->stream) && + dc_is_stream_scaling_unchanged(new_stream, dm_old_crtc_state->stream) && + is_timing_unchanged_for_freesync(new_crtc_state, +@@ -9076,7 +9074,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm, + set_freesync_fixed_config(dm_new_crtc_state); + + goto skip_modeset; +- } else if (amdgpu_freesync_vid_mode && aconnector && ++ } else if (aconnector && + is_freesync_video_mode(&new_crtc_state->mode, + aconnector)) { + struct drm_display_mode *high_mode; +-- +2.40.1 + diff --git a/queue-6.1/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch b/queue-6.1/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch new file mode 100644 index 00000000000..8517533721f --- /dev/null +++ b/queue-6.1/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch @@ -0,0 +1,42 @@ +From c15710c9c66a629e1578544d46c4a59379533026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 13:08:23 +0300 +Subject: Revert "wifi: ath6k: silence false positive -Wno-dangling-pointer + warning on GCC 12" + +From: Kalle Valo + +[ Upstream commit a1ce186db7f0e449f35d12fb55ae0da2a1b400e2 ] + +This reverts commit bd1d129daa3ede265a880e2c6a7f91eab0f4dc62. + +The dangling-pointer warnings were disabled kernel-wide by commit 49beadbd47c2 +("gcc-12: disable '-Wdangling-pointer' warning for now") for v5.19. So this +hack in ath6kl is not needed anymore. + +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230724100823.2948804-1-kvalo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/Makefile | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/Makefile b/drivers/net/wireless/ath/ath6kl/Makefile +index a75bfa9fd1cfd..dc2b3b46781e1 100644 +--- a/drivers/net/wireless/ath/ath6kl/Makefile ++++ b/drivers/net/wireless/ath/ath6kl/Makefile +@@ -36,11 +36,6 @@ ath6kl_core-y += wmi.o + ath6kl_core-y += core.o + ath6kl_core-y += recovery.o + +-# FIXME: temporarily silence -Wdangling-pointer on non W=1+ builds +-ifndef KBUILD_EXTRA_WARN +-CFLAGS_htc_mbox.o += $(call cc-disable-warning, dangling-pointer) +-endif +- + ath6kl_core-$(CONFIG_NL80211_TESTMODE) += testmode.o + ath6kl_core-$(CONFIG_ATH6KL_TRACING) += trace.o + +-- +2.40.1 + diff --git a/queue-6.1/s390-dasd-fix-hanging-device-after-request-requeue.patch b/queue-6.1/s390-dasd-fix-hanging-device-after-request-requeue.patch new file mode 100644 index 00000000000..ca1ed1e9129 --- /dev/null +++ b/queue-6.1/s390-dasd-fix-hanging-device-after-request-requeue.patch @@ -0,0 +1,222 @@ +From 32798f53bfcb98c081a2b668bfa9846752dc04e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 21:36:46 +0200 +Subject: s390/dasd: fix hanging device after request requeue + +From: Stefan Haberland + +[ Upstream commit 8a2278ce9c25048d999fe1a3561def75d963f471 ] + +The DASD device driver has a function to requeue requests to the +blocklayer. +This function is used in various cases when basic settings for the device +have to be changed like High Performance Ficon related parameters or copy +pair settings. + +The functions iterates over the device->ccw_queue and also removes the +requests from the block->ccw_queue. +In case the device is started on an alias device instead of the base +device it might be removed from the block->ccw_queue without having it +canceled properly before. This might lead to a hanging device since the +request is no longer on a queue and can not be handled properly. + +Fix by iterating over the block->ccw_queue instead of the +device->ccw_queue. This will take care of all blocklayer related requests +and handle them on all associated DASD devices. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20230721193647.3889634-4-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd.c | 125 +++++++++++++++----------------------- + 1 file changed, 48 insertions(+), 77 deletions(-) + +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index bce3422d85640..04d9b1d4b1ba9 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2926,41 +2926,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data) + * Requeue a request back to the block request queue + * only works for block requests + */ +-static int _dasd_requeue_request(struct dasd_ccw_req *cqr) ++static void _dasd_requeue_request(struct dasd_ccw_req *cqr) + { +- struct dasd_block *block = cqr->block; + struct request *req; + +- if (!block) +- return -EINVAL; + /* + * If the request is an ERP request there is nothing to requeue. + * This will be done with the remaining original request. + */ + if (cqr->refers) +- return 0; ++ return; + spin_lock_irq(&cqr->dq->lock); + req = (struct request *) cqr->callback_data; + blk_mq_requeue_request(req, true); + spin_unlock_irq(&cqr->dq->lock); + +- return 0; ++ return; + } + +-/* +- * Go through all request on the dasd_block request queue, cancel them +- * on the respective dasd_device, and return them to the generic +- * block layer. +- */ +-static int dasd_flush_block_queue(struct dasd_block *block) ++static int _dasd_requests_to_flushqueue(struct dasd_block *block, ++ struct list_head *flush_queue) + { + struct dasd_ccw_req *cqr, *n; +- int rc, i; +- struct list_head flush_queue; + unsigned long flags; ++ int rc, i; + +- INIT_LIST_HEAD(&flush_queue); +- spin_lock_bh(&block->queue_lock); ++ spin_lock_irqsave(&block->queue_lock, flags); + rc = 0; + restart: + list_for_each_entry_safe(cqr, n, &block->ccw_queue, blocklist) { +@@ -2975,13 +2966,32 @@ static int dasd_flush_block_queue(struct dasd_block *block) + * is returned from the dasd_device layer. + */ + cqr->callback = _dasd_wake_block_flush_cb; +- for (i = 0; cqr != NULL; cqr = cqr->refers, i++) +- list_move_tail(&cqr->blocklist, &flush_queue); ++ for (i = 0; cqr; cqr = cqr->refers, i++) ++ list_move_tail(&cqr->blocklist, flush_queue); + if (i > 1) + /* moved more than one request - need to restart */ + goto restart; + } +- spin_unlock_bh(&block->queue_lock); ++ spin_unlock_irqrestore(&block->queue_lock, flags); ++ ++ return rc; ++} ++ ++/* ++ * Go through all request on the dasd_block request queue, cancel them ++ * on the respective dasd_device, and return them to the generic ++ * block layer. ++ */ ++static int dasd_flush_block_queue(struct dasd_block *block) ++{ ++ struct dasd_ccw_req *cqr, *n; ++ struct list_head flush_queue; ++ unsigned long flags; ++ int rc; ++ ++ INIT_LIST_HEAD(&flush_queue); ++ rc = _dasd_requests_to_flushqueue(block, &flush_queue); ++ + /* Now call the callback function of flushed requests */ + restart_cb: + list_for_each_entry_safe(cqr, n, &flush_queue, blocklist) { +@@ -3864,75 +3874,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_space_avail); + */ + int dasd_generic_requeue_all_requests(struct dasd_device *device) + { ++ struct dasd_block *block = device->block; + struct list_head requeue_queue; + struct dasd_ccw_req *cqr, *n; +- struct dasd_ccw_req *refers; + int rc; + +- INIT_LIST_HEAD(&requeue_queue); +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- rc = 0; +- list_for_each_entry_safe(cqr, n, &device->ccw_queue, devlist) { +- /* Check status and move request to flush_queue */ +- if (cqr->status == DASD_CQR_IN_IO) { +- rc = device->discipline->term_IO(cqr); +- if (rc) { +- /* unable to terminate requeust */ +- dev_err(&device->cdev->dev, +- "Unable to terminate request %p " +- "on suspend\n", cqr); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- dasd_put_device(device); +- return rc; +- } +- } +- list_move_tail(&cqr->devlist, &requeue_queue); +- } +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- +- list_for_each_entry_safe(cqr, n, &requeue_queue, devlist) { +- wait_event(dasd_flush_wq, +- (cqr->status != DASD_CQR_CLEAR_PENDING)); ++ if (!block) ++ return 0; + +- /* +- * requeue requests to blocklayer will only work +- * for block device requests +- */ +- if (_dasd_requeue_request(cqr)) +- continue; ++ INIT_LIST_HEAD(&requeue_queue); ++ rc = _dasd_requests_to_flushqueue(block, &requeue_queue); + +- /* remove requests from device and block queue */ +- list_del_init(&cqr->devlist); +- while (cqr->refers != NULL) { +- refers = cqr->refers; +- /* remove the request from the block queue */ +- list_del(&cqr->blocklist); +- /* free the finished erp request */ +- dasd_free_erp_request(cqr, cqr->memdev); +- cqr = refers; ++ /* Now call the callback function of flushed requests */ ++restart_cb: ++ list_for_each_entry_safe(cqr, n, &requeue_queue, blocklist) { ++ wait_event(dasd_flush_wq, (cqr->status < DASD_CQR_QUEUED)); ++ /* Process finished ERP request. */ ++ if (cqr->refers) { ++ spin_lock_bh(&block->queue_lock); ++ __dasd_process_erp(block->base, cqr); ++ spin_unlock_bh(&block->queue_lock); ++ /* restart list_for_xx loop since dasd_process_erp ++ * might remove multiple elements ++ */ ++ goto restart_cb; + } +- +- /* +- * _dasd_requeue_request already checked for a valid +- * blockdevice, no need to check again +- * all erp requests (cqr->refers) have a cqr->block +- * pointer copy from the original cqr +- */ ++ _dasd_requeue_request(cqr); + list_del_init(&cqr->blocklist); + cqr->block->base->discipline->free_cp( + cqr, (struct request *) cqr->callback_data); + } +- +- /* +- * if requests remain then they are internal request +- * and go back to the device queue +- */ +- if (!list_empty(&requeue_queue)) { +- /* move freeze_queue to start of the ccw_queue */ +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- list_splice_tail(&requeue_queue, &device->ccw_queue); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- } + dasd_schedule_device_bh(device); + return rc; + } +-- +2.40.1 + diff --git a/queue-6.1/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch b/queue-6.1/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch new file mode 100644 index 00000000000..b262bfbd075 --- /dev/null +++ b/queue-6.1/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch @@ -0,0 +1,45 @@ +From dba2ea87705eea4618599dcb21ae9d318d31bbc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 21:36:45 +0200 +Subject: s390/dasd: use correct number of retries for ERP requests + +From: Stefan Haberland + +[ Upstream commit acea28a6b74f458defda7417d2217b051ba7d444 ] + +If a DASD request fails an error recovery procedure (ERP) request might +be built as a copy of the original request to do error recovery. + +The ERP request gets a number of retries assigned. +This number is always 256 no matter what other value might have been set +for the original request. This is not what is expected when a user +specifies a certain amount of retries for the device via sysfs. + +Correctly use the number of retries of the original request for ERP +requests. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20230721193647.3889634-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_3990_erp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index d030fe2e29643..91cb9d52a4250 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2441,7 +2441,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr) + erp->block = cqr->block; + erp->magic = cqr->magic; + erp->expires = cqr->expires; +- erp->retries = 256; ++ erp->retries = device->default_retries; + erp->buildclk = get_tod_clock(); + erp->status = DASD_CQR_FILLED; + +-- +2.40.1 + diff --git a/queue-6.1/scsi-aacraid-reply-queue-mapping-to-cpus-based-on-ir.patch b/queue-6.1/scsi-aacraid-reply-queue-mapping-to-cpus-based-on-ir.patch new file mode 100644 index 00000000000..030038025ae --- /dev/null +++ b/queue-6.1/scsi-aacraid-reply-queue-mapping-to-cpus-based-on-ir.patch @@ -0,0 +1,158 @@ +From 77db8fd4f4ef94991f50c10ce8ccfd7221f912ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 16:08:34 -0700 +Subject: scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity + +From: Sagar Biradar + +[ Upstream commit 9dc704dcc09eae7d21b5da0615eb2ed79278f63e ] + +Fix the I/O hang that arises because of the MSIx vector not having a mapped +online CPU upon receiving completion. + +SCSI cmds take the blk_mq route, which is setup during init. Reserved cmds +fetch the vector_no from mq_map after init is complete. Before init, they +have to use 0 - as per the norm. + +Reviewed-by: Gilbert Wu +Signed-off-by: Sagar Biradar +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/20230519230834.27436-1-sagar.biradar@microchip.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/aacraid/aacraid.h | 1 + + drivers/scsi/aacraid/commsup.c | 6 +++++- + drivers/scsi/aacraid/linit.c | 14 ++++++++++++++ + drivers/scsi/aacraid/src.c | 25 +++++++++++++++++++++++-- + 4 files changed, 43 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h +index 5e115e8b2ba46..7c6efde75da66 100644 +--- a/drivers/scsi/aacraid/aacraid.h ++++ b/drivers/scsi/aacraid/aacraid.h +@@ -1678,6 +1678,7 @@ struct aac_dev + u32 handle_pci_error; + bool init_reset; + u8 soft_reset_support; ++ u8 use_map_queue; + }; + + #define aac_adapter_interrupt(dev) \ +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index deb32c9f4b3e6..3f062e4013ab6 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -223,8 +223,12 @@ int aac_fib_setup(struct aac_dev * dev) + struct fib *aac_fib_alloc_tag(struct aac_dev *dev, struct scsi_cmnd *scmd) + { + struct fib *fibptr; ++ u32 blk_tag; ++ int i; + +- fibptr = &dev->fibs[scsi_cmd_to_rq(scmd)->tag]; ++ blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); ++ i = blk_mq_unique_tag_to_tag(blk_tag); ++ fibptr = &dev->fibs[i]; + /* + * Null out fields that depend on being zero at the start of + * each I/O +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index 5ba5c18b77b46..bff49b8ab057d 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -19,6 +19,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -505,6 +506,15 @@ static int aac_slave_configure(struct scsi_device *sdev) + return 0; + } + ++static void aac_map_queues(struct Scsi_Host *shost) ++{ ++ struct aac_dev *aac = (struct aac_dev *)shost->hostdata; ++ ++ blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT], ++ aac->pdev, 0); ++ aac->use_map_queue = true; ++} ++ + /** + * aac_change_queue_depth - alter queue depths + * @sdev: SCSI device we are considering +@@ -1489,6 +1499,7 @@ static struct scsi_host_template aac_driver_template = { + .bios_param = aac_biosparm, + .shost_groups = aac_host_groups, + .slave_configure = aac_slave_configure, ++ .map_queues = aac_map_queues, + .change_queue_depth = aac_change_queue_depth, + .sdev_groups = aac_dev_groups, + .eh_abort_handler = aac_eh_abort, +@@ -1776,6 +1787,8 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + shost->max_lun = AAC_MAX_LUN; + + pci_set_drvdata(pdev, shost); ++ shost->nr_hw_queues = aac->max_msix; ++ shost->host_tagset = 1; + + error = scsi_add_host(shost, &pdev->dev); + if (error) +@@ -1908,6 +1921,7 @@ static void aac_remove_one(struct pci_dev *pdev) + struct aac_dev *aac = (struct aac_dev *)shost->hostdata; + + aac_cancel_rescan_worker(aac); ++ aac->use_map_queue = false; + scsi_remove_host(shost); + + __aac_shutdown(aac); +diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c +index 11ef58204e96f..61949f3741886 100644 +--- a/drivers/scsi/aacraid/src.c ++++ b/drivers/scsi/aacraid/src.c +@@ -493,6 +493,10 @@ static int aac_src_deliver_message(struct fib *fib) + #endif + + u16 vector_no; ++ struct scsi_cmnd *scmd; ++ u32 blk_tag; ++ struct Scsi_Host *shost = dev->scsi_host_ptr; ++ struct blk_mq_queue_map *qmap; + + atomic_inc(&q->numpending); + +@@ -505,8 +509,25 @@ static int aac_src_deliver_message(struct fib *fib) + if ((dev->comm_interface == AAC_COMM_MESSAGE_TYPE3) + && dev->sa_firmware) + vector_no = aac_get_vector(dev); +- else +- vector_no = fib->vector_no; ++ else { ++ if (!fib->vector_no || !fib->callback_data) { ++ if (shost && dev->use_map_queue) { ++ qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT]; ++ vector_no = qmap->mq_map[raw_smp_processor_id()]; ++ } ++ /* ++ * We hardcode the vector_no for ++ * reserved commands as a valid shost is ++ * absent during the init ++ */ ++ else ++ vector_no = 0; ++ } else { ++ scmd = (struct scsi_cmnd *)fib->callback_data; ++ blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd)); ++ vector_no = blk_mq_unique_tag_to_hwq(blk_tag); ++ } ++ } + + if (native_hba) { + if (fib->flags & FIB_CONTEXT_FLAG_NATIVE_HBA_TMF) { +-- +2.40.1 + diff --git a/queue-6.1/scsi-lpfc-fix-incorrect-big-endian-type-assignment-i.patch b/queue-6.1/scsi-lpfc-fix-incorrect-big-endian-type-assignment-i.patch new file mode 100644 index 00000000000..5739d1ae3b2 --- /dev/null +++ b/queue-6.1/scsi-lpfc-fix-incorrect-big-endian-type-assignment-i.patch @@ -0,0 +1,62 @@ +From b11ccdca4a01e90f26d19ffa012b6ebb0d2ff4ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 10:59:44 -0700 +Subject: scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback + path + +From: Justin Tee + +[ Upstream commit 9cefd6e7e0a77b0fbca5c793f6fb6821b0962775 ] + +The kernel test robot reported sparse warnings regarding incorrect type +assignment for __be16 variables in bsg loopback path. + +Change the flagged lines to use the be16_to_cpu() and cpu_to_be16() macros +appropriately. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230614175944.3577-1-justintee8345@gmail.com +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306110819.sDIKiGgg-lkp@intel.com/ +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_bsg.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c +index 852b025e2fecf..b54fafb486e06 100644 +--- a/drivers/scsi/lpfc/lpfc_bsg.c ++++ b/drivers/scsi/lpfc/lpfc_bsg.c +@@ -889,7 +889,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, + struct lpfc_iocbq *piocbq) + { + uint32_t evt_req_id = 0; +- uint32_t cmd; ++ u16 cmd; + struct lpfc_dmabuf *dmabuf = NULL; + struct lpfc_bsg_event *evt; + struct event_data *evt_dat = NULL; +@@ -915,7 +915,7 @@ lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, + + ct_req = (struct lpfc_sli_ct_request *)bdeBuf1->virt; + evt_req_id = ct_req->FsType; +- cmd = ct_req->CommandResponse.bits.CmdRsp; ++ cmd = be16_to_cpu(ct_req->CommandResponse.bits.CmdRsp); + + spin_lock_irqsave(&phba->ct_ev_lock, flags); + list_for_each_entry(evt, &phba->ct_ev_waiters, node) { +@@ -3186,8 +3186,8 @@ lpfc_bsg_diag_loopback_run(struct bsg_job *job) + ctreq->RevisionId.bits.InId = 0; + ctreq->FsType = SLI_CT_ELX_LOOPBACK; + ctreq->FsSubType = 0; +- ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_DATA; +- ctreq->CommandResponse.bits.Size = size; ++ ctreq->CommandResponse.bits.CmdRsp = cpu_to_be16(ELX_LOOPBACK_DATA); ++ ctreq->CommandResponse.bits.Size = cpu_to_be16(size); + segment_offset = ELX_LOOPBACK_HEADER_SZ; + } else + segment_offset = 0; +-- +2.40.1 + diff --git a/queue-6.1/scsi-lpfc-remove-reftag-check-in-dif-paths.patch b/queue-6.1/scsi-lpfc-remove-reftag-check-in-dif-paths.patch new file mode 100644 index 00000000000..40d6949641d --- /dev/null +++ b/queue-6.1/scsi-lpfc-remove-reftag-check-in-dif-paths.patch @@ -0,0 +1,108 @@ +From 59a885f7be08cb6803f35501767ccbcca7a1d44f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 14:19:32 -0700 +Subject: scsi: lpfc: Remove reftag check in DIF paths + +From: Justin Tee + +[ Upstream commit 8eebf0e84f0614cebc7347f7bbccba4056d77d42 ] + +When preparing protection DIF I/O for DMA, the driver obtains reference +tags from scsi_prot_ref_tag(). Previously, there was a wrong assumption +that an all 0xffffffff value meant error and thus the driver failed the +I/O. This patch removes the evaluation code and accepts whatever the upper +layer returns. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230803211932.155745-1-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_scsi.c | 20 +++----------------- + 1 file changed, 3 insertions(+), 17 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 7a1563564df7f..7aac9fc719675 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -109,8 +109,6 @@ lpfc_sli4_set_rsp_sgl_last(struct lpfc_hba *phba, + } + } + +-#define LPFC_INVALID_REFTAG ((u32)-1) +- + /** + * lpfc_rampdown_queue_depth - Post RAMP_DOWN_QUEUE event to worker thread + * @phba: The Hba for which this call is being executed. +@@ -978,8 +976,6 @@ lpfc_bg_err_inject(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + sgpe = scsi_prot_sglist(sc); + lba = scsi_prot_ref_tag(sc); +- if (lba == LPFC_INVALID_REFTAG) +- return 0; + + /* First check if we need to match the LBA */ + if (phba->lpfc_injerr_lba != LPFC_INJERR_LBA_OFF) { +@@ -1560,8 +1556,6 @@ lpfc_bg_setup_bpl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + /* extract some info from the scsi command for pde*/ + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -1723,8 +1717,6 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + /* extract some info from the scsi command */ + blksize = scsi_prot_interval(sc); + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -1954,8 +1946,6 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + /* extract some info from the scsi command for pde*/ + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -2155,8 +2145,6 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + /* extract some info from the scsi command */ + blksize = scsi_prot_interval(sc); + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -2748,8 +2736,6 @@ lpfc_calc_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) + + src = (struct scsi_dif_tuple *)sg_virt(sgpe); + start_ref_tag = scsi_prot_ref_tag(cmd); +- if (start_ref_tag == LPFC_INVALID_REFTAG) +- goto out; + start_app_tag = src->app_tag; + len = sgpe->length; + while (src && protsegcnt) { +@@ -3495,11 +3481,11 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + scsi_cmnd->sc_data_direction); + + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +- "9084 Cannot setup S/G List for HBA" +- "IO segs %d/%d SGL %d SCSI %d: %d %d\n", ++ "9084 Cannot setup S/G List for HBA " ++ "IO segs %d/%d SGL %d SCSI %d: %d %d %d\n", + lpfc_cmd->seg_cnt, lpfc_cmd->prot_seg_cnt, + phba->cfg_total_seg_cnt, phba->cfg_sg_seg_cnt, +- prot_group_type, num_sge); ++ prot_group_type, num_sge, ret); + + lpfc_cmd->seg_cnt = 0; + lpfc_cmd->prot_seg_cnt = 0; +-- +2.40.1 + diff --git a/queue-6.1/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch b/queue-6.1/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch new file mode 100644 index 00000000000..13be1f136bf --- /dev/null +++ b/queue-6.1/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch @@ -0,0 +1,67 @@ +From f5acca083022bc11c94960d3a4c686773ddc6250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 12:56:55 +0000 +Subject: scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock + +From: Chengfeng Ye + +[ Upstream commit dd64f80587190265ca8a0f4be6c64c2fda6d3ac2 ] + +As &qedi_percpu->p_work_lock is acquired by hard IRQ qedi_msix_handler(), +other acquisitions of the same lock under process context should disable +IRQ, otherwise deadlock could happen if the IRQ preempts the execution +while the lock is held in process context on the same CPU. + +qedi_cpu_offline() is one such function which acquires the lock in process +context. + +[Deadlock Scenario] +qedi_cpu_offline() + ->spin_lock(&p->p_work_lock) + + ->qedi_msix_handler() + ->edi_process_completions() + ->spin_lock_irqsave(&p->p_work_lock, flags); (deadlock here) + +This flaw was found by an experimental static analysis tool I am developing +for IRQ-related deadlocks. + +The tentative patch fix the potential deadlock by spin_lock_irqsave() +under process context. + +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20230726125655.4197-1-dg573847474@gmail.com +Acked-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 9fd68d362698f..2ee109fb65616 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1977,8 +1977,9 @@ static int qedi_cpu_offline(unsigned int cpu) + struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu); + struct qedi_work *work, *tmp; + struct task_struct *thread; ++ unsigned long flags; + +- spin_lock_bh(&p->p_work_lock); ++ spin_lock_irqsave(&p->p_work_lock, flags); + thread = p->iothread; + p->iothread = NULL; + +@@ -1989,7 +1990,7 @@ static int qedi_cpu_offline(unsigned int cpu) + kfree(work); + } + +- spin_unlock_bh(&p->p_work_lock); ++ spin_unlock_irqrestore(&p->p_work_lock, flags); + if (thread) + kthread_stop(thread); + return 0; +-- +2.40.1 + diff --git a/queue-6.1/scsi-storvsc-always-set-no_report_opcodes.patch b/queue-6.1/scsi-storvsc-always-set-no_report_opcodes.patch new file mode 100644 index 00000000000..1766b56a6ec --- /dev/null +++ b/queue-6.1/scsi-storvsc-always-set-no_report_opcodes.patch @@ -0,0 +1,48 @@ +From 56896d57ed3c14bf33fd01a738e2c5c0dbccf6f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 13:38:21 -0700 +Subject: scsi: storvsc: Always set no_report_opcodes + +From: Michael Kelley + +[ Upstream commit 31d16e712bdcaee769de4780f72ff8d6cd3f0589 ] + +Hyper-V synthetic SCSI devices do not support the MAINTENANCE_IN SCSI +command, so scsi_report_opcode() always fails, resulting in messages like +this: + +hv_storvsc : tag#205 cmd 0xa3 status: scsi 0x2 srb 0x86 hv 0xc0000001 + +The recently added support for command duration limits calls +scsi_report_opcode() four times as each device comes online, which +significantly increases the number of messages logged in a system with many +disks. + +Fix the problem by always marking Hyper-V synthetic SCSI devices as not +supporting scsi_report_opcode(). With this setting, the MAINTENANCE_IN SCSI +command is not issued and no messages are logged. + +Signed-off-by: Michael Kelley +Link: https://lore.kernel.org/r/1686343101-18930-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 83d09c2009280..7a1dc5c7c49ee 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1568,6 +1568,8 @@ static int storvsc_device_configure(struct scsi_device *sdevice) + { + blk_queue_rq_timeout(sdevice->request_queue, (storvsc_timeout * HZ)); + ++ /* storvsc devices don't support MAINTENANCE_IN SCSI cmd */ ++ sdevice->no_report_opcodes = 1; + sdevice->no_write_same = 1; + + /* +-- +2.40.1 + diff --git a/queue-6.1/scsi-ufs-try-harder-to-change-the-power-mode.patch b/queue-6.1/scsi-ufs-try-harder-to-change-the-power-mode.patch new file mode 100644 index 00000000000..332bd5ffec0 --- /dev/null +++ b/queue-6.1/scsi-ufs-try-harder-to-change-the-power-mode.patch @@ -0,0 +1,44 @@ +From 0772eb5de014d3520dc438aa92b76923340bd3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 13:29:55 -0700 +Subject: scsi: ufs: Try harder to change the power mode + +From: Bart Van Assche + +[ Upstream commit 579a4e9dbd53978cad8df88dc612837cdd210ce0 ] + +Instead of only retrying the START STOP UNIT command if a unit attention is +reported, repeat it if any SCSI error is reported by the device or if the +command timed out. + +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20221018202958.1902564-8-bvanassche@acm.org +Signed-off-by: Martin K. Petersen +Stable-dep-of: fe8637f7708c ("scsi: ufs: core: Increase the START STOP UNIT timeout from one to ten seconds") +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 977bd4b9dd0b4..36437d39b93c8 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8830,9 +8830,11 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, + for (retries = 3; retries > 0; --retries) { + ret = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr, + HZ, 0, 0, RQF_PM, NULL); +- if (!scsi_status_is_check_condition(ret) || +- !scsi_sense_valid(&sshdr) || +- sshdr.sense_key != UNIT_ATTENTION) ++ /* ++ * scsi_execute() only returns a negative value if the request ++ * queue is dying. ++ */ ++ if (ret <= 0) + break; + } + if (ret) { +-- +2.40.1 + diff --git a/queue-6.1/sctp-handle-invalid-error-codes-without-calling-bug.patch b/queue-6.1/sctp-handle-invalid-error-codes-without-calling-bug.patch new file mode 100644 index 00000000000..5bcd38f6cf5 --- /dev/null +++ b/queue-6.1/sctp-handle-invalid-error-codes-without-calling-bug.patch @@ -0,0 +1,45 @@ +From fa63699d408ddac0168ba712e2b348667ed297d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 14:04:43 +0300 +Subject: sctp: handle invalid error codes without calling BUG() + +From: Dan Carpenter + +[ Upstream commit a0067dfcd9418fd3b0632bc59210d120d038a9c6 ] + +The sctp_sf_eat_auth() function is supposed to return enum sctp_disposition +values but if the call to sctp_ulpevent_make_authkey() fails, it returns +-ENOMEM. + +This results in calling BUG() inside the sctp_side_effects() function. +Calling BUG() is an over reaction and not helpful. Call WARN_ON_ONCE() +instead. + +This code predates git. + +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/sm_sideeffect.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index 463c4a58d2c36..970c6a486a9b0 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -1251,7 +1251,10 @@ static int sctp_side_effects(enum sctp_event_type event_type, + default: + pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n", + status, state, event_type, subtype.chunk); +- BUG(); ++ error = status; ++ if (error >= 0) ++ error = -EINVAL; ++ WARN_ON_ONCE(1); + break; + } + +-- +2.40.1 + diff --git a/queue-6.1/security-keys-perform-capable-check-only-on-privileg.patch b/queue-6.1/security-keys-perform-capable-check-only-on-privileg.patch new file mode 100644 index 00000000000..ca6df6d77f0 --- /dev/null +++ b/queue-6.1/security-keys-perform-capable-check-only-on-privileg.patch @@ -0,0 +1,66 @@ +From a16676414359bda2dde426285594be76f5b20b7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 14:32:52 +0200 +Subject: security: keys: perform capable check only on privileged operations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Göttsche + +[ Upstream commit 2d7f105edbb3b2be5ffa4d833abbf9b6965e9ce7 ] + +If the current task fails the check for the queried capability via +`capable(CAP_SYS_ADMIN)` LSMs like SELinux generate a denial message. +Issuing such denial messages unnecessarily can lead to a policy author +granting more privileges to a subject than needed to silence them. + +Reorder CAP_SYS_ADMIN checks after the check whether the operation is +actually privileged. + +Signed-off-by: Christian Göttsche +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + security/keys/keyctl.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index d54f73c558f72..19be69fa4d052 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -980,14 +980,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) + ret = -EACCES; + down_write(&key->sem); + +- if (!capable(CAP_SYS_ADMIN)) { ++ { ++ bool is_privileged_op = false; ++ + /* only the sysadmin can chown a key to some other UID */ + if (user != (uid_t) -1 && !uid_eq(key->uid, uid)) +- goto error_put; ++ is_privileged_op = true; + + /* only the sysadmin can set the key's GID to a group other + * than one of those that the current process subscribes to */ + if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid)) ++ is_privileged_op = true; ++ ++ if (is_privileged_op && !capable(CAP_SYS_ADMIN)) + goto error_put; + } + +@@ -1088,7 +1093,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm) + down_write(&key->sem); + + /* if we're not the sysadmin, we can only change a key that we own */ +- if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { ++ if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) { + key->perm = perm; + notify_key(key, NOTIFY_KEY_SETATTR, 0); + ret = 0; +-- +2.40.1 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..e4a674f00e0 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,78 @@ +revert-bridge-add-extack-warning-when-enabling-stp-i.patch +partially-revert-drm-amd-display-fix-possible-underf.patch +scsi-ufs-try-harder-to-change-the-power-mode.patch +revert-revert-drm-amd-display-enable-freesync-video-.patch +arm-dts-imx-set-default-tuning-step-for-imx7d-usdhc.patch +alsa-hda-realtek-enable-4-amplifiers-instead-of-2-on.patch +powerpc-boot-disable-power10-features-after-bootafla.patch +media-uapi-hevc-add-num_delta_pocs_of_ref_rps_idx-fi.patch +revert-mips-unhide-pata_platform.patch +phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch +media-amphion-use-dev_err_probe.patch +media-pulse8-cec-handle-possible-ping-error.patch +media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch +9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch +9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch +ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch +ksmbd-validate-session-id-and-tree-id-in-compound-re.patch +ksmbd-no-response-from-compound-read.patch +ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch +asoc-da7219-flush-pending-aad-irq-when-suspending.patch +asoc-da7219-check-for-failure-reading-aad-irq-events.patch +asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch +thermal-core-constify-params-in-thermal_zone_device_.patch +ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch +m68k-fix-invalid-.section-syntax.patch +s390-dasd-use-correct-number-of-retries-for-erp-requ.patch +s390-dasd-fix-hanging-device-after-request-requeue.patch +fs-nls-make-load_nls-take-a-const-parameter.patch +asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch +asoc-codecs-es8316-fix-dmic-config.patch +asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch +asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch +asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch +alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch +platform-x86-intel-hid-always-call-btnl-acpi-method.patch +platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch +platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch +platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch +platform-x86-huawei-wmi-silence-ambient-light-sensor.patch +drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch +drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch +drm-amd-display-exit-idle-optimizations-before-attem.patch +ovl-always-reevaluate-the-file-signature-for-ima.patch +ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch +alsa-usb-audio-update-for-native-dsd-support-quirks.patch +staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch +security-keys-perform-capable-check-only-on-privileg.patch +kprobes-prohibit-probing-on-cfi-preamble-symbol.patch +clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch +vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch +revert-wifi-ath6k-silence-false-positive-wno-danglin.patch +net-dsa-microchip-ksz9477-register-regmap-alignment-.patch +net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch +net-usb-qmi_wwan-add-quectel-em05gv2.patch +wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch +powerpc-powermac-use-early_-io-variants-in-via_calib.patch +idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch +platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch +scsi-lpfc-remove-reftag-check-in-dif-paths.patch +scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch +net-hns3-restore-user-pause-configure-when-disable-a.patch +drm-amdgpu-match-against-exact-bootloader-status.patch +wifi-cfg80211-remove-links-only-on-ap.patch +wifi-mac80211-use-active_links-instead-of-valid_link.patch +netlabel-fix-shift-wrapping-bug-in-netlbl_catmap_set.patch +bnx2x-fix-page-fault-following-eeh-recovery.patch +cifs-fix-sockaddr-comparison-in-iface_cmp.patch +cifs-fix-max_credits-implementation.patch +sctp-handle-invalid-error-codes-without-calling-bug.patch +scsi-aacraid-reply-queue-mapping-to-cpus-based-on-ir.patch +scsi-storvsc-always-set-no_report_opcodes.patch +scsi-lpfc-fix-incorrect-big-endian-type-assignment-i.patch +loongarch-let-pmd_present-return-true-when-splitting.patch +loongarch-fix-the-write_fcsr-macro.patch +alsa-seq-oss-fix-racy-open-close-of-midi-devices.patch +net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch +tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch +platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch diff --git a/queue-6.1/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch b/queue-6.1/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch new file mode 100644 index 00000000000..66d95222421 --- /dev/null +++ b/queue-6.1/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch @@ -0,0 +1,36 @@ +From 881abb478a9cb3a6b3aa44c935e587f27ca07a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 19:20:24 +0200 +Subject: staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER + +From: Raphael Gallais-Pou + +[ Upstream commit 4912649e1cf0317bf563f91655e04a303cacaf8d ] + +Using FBTFT_REGISTER_DRIVER resolves to a NULL struct spi_device_id. This +ultimately causes a warning when the module probes. Fixes it. + +Signed-off-by: Raphael Gallais-Pou +Link: https://lore.kernel.org/r/20230718172024.67488-1-rgallaispou@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fb_ili9341.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/fbtft/fb_ili9341.c b/drivers/staging/fbtft/fb_ili9341.c +index 9ccd0823c3ab3..47e72b87d76d9 100644 +--- a/drivers/staging/fbtft/fb_ili9341.c ++++ b/drivers/staging/fbtft/fb_ili9341.c +@@ -145,7 +145,7 @@ static struct fbtft_display display = { + }, + }; + +-FBTFT_REGISTER_DRIVER(DRVNAME, "ilitek,ili9341", &display); ++FBTFT_REGISTER_SPI_DRIVER(DRVNAME, "ilitek", "ili9341", &display); + + MODULE_ALIAS("spi:" DRVNAME); + MODULE_ALIAS("platform:" DRVNAME); +-- +2.40.1 + diff --git a/queue-6.1/thermal-core-constify-params-in-thermal_zone_device_.patch b/queue-6.1/thermal-core-constify-params-in-thermal_zone_device_.patch new file mode 100644 index 00000000000..3dee3e3adba --- /dev/null +++ b/queue-6.1/thermal-core-constify-params-in-thermal_zone_device_.patch @@ -0,0 +1,82 @@ +From 31a88a958cf048c35fab90f3164189989d88d723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 13:27:19 +0200 +Subject: thermal: core: constify params in thermal_zone_device_register + +From: Ahmad Fatoum + +[ Upstream commit 80ddce5f2dbd0e83eadc9f9d373439180d599fe5 ] + +Since commit 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone +parameters structure"), thermal_zone_device_register() allocates a copy +of the tzp argument and callers need not explicitly manage its lifetime. + +This means the function no longer cares about the parameter being +mutable, so constify it. + +No functional change. + +Signed-off-by: Ahmad Fatoum +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_core.c | 4 ++-- + include/linux/thermal.h | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 1eae4ec719a8f..2d5085488733e 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -1178,7 +1178,7 @@ static void thermal_set_delay_jiffies(unsigned long *delay_jiffies, int delay_ms + struct thermal_zone_device * + thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *trips, int num_trips, int mask, + void *devdata, struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, int passive_delay, ++ const struct thermal_zone_params *tzp, int passive_delay, + int polling_delay) + { + struct thermal_zone_device *tz; +@@ -1335,7 +1335,7 @@ EXPORT_SYMBOL_GPL(thermal_zone_device_register_with_trips); + + struct thermal_zone_device *thermal_zone_device_register(const char *type, int ntrips, int mask, + void *devdata, struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, int passive_delay, ++ const struct thermal_zone_params *tzp, int passive_delay, + int polling_delay) + { + return thermal_zone_device_register_with_trips(type, NULL, ntrips, mask, +diff --git a/include/linux/thermal.h b/include/linux/thermal.h +index 5e093602e8fcd..a339d3af9f9f4 100644 +--- a/include/linux/thermal.h ++++ b/include/linux/thermal.h +@@ -337,14 +337,14 @@ static inline void devm_thermal_of_zone_unregister(struct device *dev, + #ifdef CONFIG_THERMAL + struct thermal_zone_device *thermal_zone_device_register(const char *, int, int, + void *, struct thermal_zone_device_ops *, +- struct thermal_zone_params *, int, int); ++ const struct thermal_zone_params *, int, int); + + void thermal_zone_device_unregister(struct thermal_zone_device *); + + struct thermal_zone_device * + thermal_zone_device_register_with_trips(const char *, struct thermal_trip *, int, int, + void *, struct thermal_zone_device_ops *, +- struct thermal_zone_params *, int, int); ++ const struct thermal_zone_params *, int, int); + + int thermal_zone_bind_cooling_device(struct thermal_zone_device *, int, + struct thermal_cooling_device *, +@@ -378,7 +378,7 @@ void thermal_zone_device_critical(struct thermal_zone_device *tz); + static inline struct thermal_zone_device *thermal_zone_device_register( + const char *type, int trips, int mask, void *devdata, + struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, ++ const struct thermal_zone_params *tzp, + int passive_delay, int polling_delay) + { return ERR_PTR(-ENODEV); } + static inline void thermal_zone_device_unregister( +-- +2.40.1 + diff --git a/queue-6.1/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch b/queue-6.1/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch new file mode 100644 index 00000000000..f13f45c580c --- /dev/null +++ b/queue-6.1/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch @@ -0,0 +1,211 @@ +From 762d9d17eafa69a986bf9951cd82ed41de4da097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 10:26:45 +0800 +Subject: tracing: Introduce pipe_cpumask to avoid race on trace_pipes + +From: Zheng Yejian + +[ Upstream commit c2489bb7e6be2e8cdced12c16c42fa128403ac03 ] + +There is race issue when concurrently splice_read main trace_pipe and +per_cpu trace_pipes which will result in data read out being different +from what actually writen. + +As suggested by Steven: + > I believe we should add a ref count to trace_pipe and the per_cpu + > trace_pipes, where if they are opened, nothing else can read it. + > + > Opening trace_pipe locks all per_cpu ref counts, if any of them are + > open, then the trace_pipe open will fail (and releases any ref counts + > it had taken). + > + > Opening a per_cpu trace_pipe will up the ref count for just that + > CPU buffer. This will allow multiple tasks to read different per_cpu + > trace_pipe files, but will prevent the main trace_pipe file from + > being opened. + +But because we only need to know whether per_cpu trace_pipe is open or +not, using a cpumask instead of using ref count may be easier. + +After this patch, users will find that: + - Main trace_pipe can be opened by only one user, and if it is + opened, all per_cpu trace_pipes cannot be opened; + - Per_cpu trace_pipes can be opened by multiple users, but each per_cpu + trace_pipe can only be opened by one user. And if one of them is + opened, main trace_pipe cannot be opened. + +Link: https://lore.kernel.org/linux-trace-kernel/20230818022645.1948314-1-zhengyejian1@huawei.com + +Suggested-by: Steven Rostedt (Google) +Signed-off-by: Zheng Yejian +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 55 ++++++++++++++++++++++++++++++++++++++------ + kernel/trace/trace.h | 2 ++ + 2 files changed, 50 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 1a87cb70f1eb5..e581253ecc535 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6616,10 +6616,36 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf, + + #endif + ++static int open_pipe_on_cpu(struct trace_array *tr, int cpu) ++{ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ if (cpumask_empty(tr->pipe_cpumask)) { ++ cpumask_setall(tr->pipe_cpumask); ++ return 0; ++ } ++ } else if (!cpumask_test_cpu(cpu, tr->pipe_cpumask)) { ++ cpumask_set_cpu(cpu, tr->pipe_cpumask); ++ return 0; ++ } ++ return -EBUSY; ++} ++ ++static void close_pipe_on_cpu(struct trace_array *tr, int cpu) ++{ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ WARN_ON(!cpumask_full(tr->pipe_cpumask)); ++ cpumask_clear(tr->pipe_cpumask); ++ } else { ++ WARN_ON(!cpumask_test_cpu(cpu, tr->pipe_cpumask)); ++ cpumask_clear_cpu(cpu, tr->pipe_cpumask); ++ } ++} ++ + static int tracing_open_pipe(struct inode *inode, struct file *filp) + { + struct trace_array *tr = inode->i_private; + struct trace_iterator *iter; ++ int cpu; + int ret; + + ret = tracing_check_open_get_tr(tr); +@@ -6627,13 +6653,16 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + return ret; + + mutex_lock(&trace_types_lock); ++ cpu = tracing_get_cpu(inode); ++ ret = open_pipe_on_cpu(tr, cpu); ++ if (ret) ++ goto fail_pipe_on_cpu; + + /* create a buffer to store the information to pass to userspace */ + iter = kzalloc(sizeof(*iter), GFP_KERNEL); + if (!iter) { + ret = -ENOMEM; +- __trace_array_put(tr); +- goto out; ++ goto fail_alloc_iter; + } + + trace_seq_init(&iter->seq); +@@ -6656,7 +6685,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + + iter->tr = tr; + iter->array_buffer = &tr->array_buffer; +- iter->cpu_file = tracing_get_cpu(inode); ++ iter->cpu_file = cpu; + mutex_init(&iter->mutex); + filp->private_data = iter; + +@@ -6666,12 +6695,15 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + nonseekable_open(inode, filp); + + tr->trace_ref++; +-out: ++ + mutex_unlock(&trace_types_lock); + return ret; + + fail: + kfree(iter); ++fail_alloc_iter: ++ close_pipe_on_cpu(tr, cpu); ++fail_pipe_on_cpu: + __trace_array_put(tr); + mutex_unlock(&trace_types_lock); + return ret; +@@ -6688,7 +6720,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file) + + if (iter->trace->pipe_close) + iter->trace->pipe_close(iter); +- ++ close_pipe_on_cpu(tr, iter->cpu_file); + mutex_unlock(&trace_types_lock); + + free_cpumask_var(iter->started); +@@ -9356,6 +9388,9 @@ static struct trace_array *trace_array_create(const char *name) + if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL)) + goto out_free_tr; + ++ if (!alloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL)) ++ goto out_free_tr; ++ + tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS; + + cpumask_copy(tr->tracing_cpumask, cpu_all_mask); +@@ -9397,6 +9432,7 @@ static struct trace_array *trace_array_create(const char *name) + out_free_tr: + ftrace_free_ftrace_ops(tr); + free_trace_buffers(tr); ++ free_cpumask_var(tr->pipe_cpumask); + free_cpumask_var(tr->tracing_cpumask); + kfree(tr->name); + kfree(tr); +@@ -9499,6 +9535,7 @@ static int __remove_instance(struct trace_array *tr) + } + kfree(tr->topts); + ++ free_cpumask_var(tr->pipe_cpumask); + free_cpumask_var(tr->tracing_cpumask); + kfree(tr->name); + kfree(tr); +@@ -10223,12 +10260,14 @@ __init static int tracer_alloc_buffers(void) + if (trace_create_savedcmd() < 0) + goto out_free_temp_buffer; + ++ if (!alloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL)) ++ goto out_free_savedcmd; ++ + /* TODO: make the number of buffers hot pluggable with CPUS */ + if (allocate_trace_buffers(&global_trace, ring_buf_size) < 0) { + MEM_FAIL(1, "tracer: failed to allocate ring buffer!\n"); +- goto out_free_savedcmd; ++ goto out_free_pipe_cpumask; + } +- + if (global_trace.buffer_disabled) + tracing_off(); + +@@ -10281,6 +10320,8 @@ __init static int tracer_alloc_buffers(void) + + return 0; + ++out_free_pipe_cpumask: ++ free_cpumask_var(global_trace.pipe_cpumask); + out_free_savedcmd: + free_saved_cmdlines_buffer(savedcmd); + out_free_temp_buffer: +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 3d3505286aa7f..dbb86b0dd3b7b 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -366,6 +366,8 @@ struct trace_array { + struct list_head events; + struct trace_event_file *trace_marker_file; + cpumask_var_t tracing_cpumask; /* only trace on set CPUs */ ++ /* one per_cpu trace_pipe can be opened by only one user */ ++ cpumask_var_t pipe_cpumask; + int ref; + int trace_ref; + #ifdef CONFIG_FUNCTION_TRACER +-- +2.40.1 + diff --git a/queue-6.1/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch b/queue-6.1/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch new file mode 100644 index 00000000000..bca210ca17f --- /dev/null +++ b/queue-6.1/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch @@ -0,0 +1,52 @@ +From 9a87252317b7ce6ab5b5d7b825767ebc28f64064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 19:14:07 +0530 +Subject: vmbus_testing: fix wrong python syntax for integer value comparison + +From: Ani Sinha + +[ Upstream commit ed0cf84e9cc42e6310961c87709621f1825c2bb8 ] + +It is incorrect in python to compare integer values using the "is" keyword. +The "is" keyword in python is used to compare references to two objects, +not their values. Newer version of python3 (version 3.8) throws a warning +when such incorrect comparison is made. For value comparison, "==" should +be used. + +Fix this in the code and suppress the following warning: + +/usr/sbin/vmbus_testing:167: SyntaxWarning: "is" with a literal. Did you mean "=="? + +Signed-off-by: Ani Sinha +Link: https://lore.kernel.org/r/20230705134408.6302-1-anisinha@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + tools/hv/vmbus_testing | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/hv/vmbus_testing b/tools/hv/vmbus_testing +index e7212903dd1d9..4467979d8f699 100755 +--- a/tools/hv/vmbus_testing ++++ b/tools/hv/vmbus_testing +@@ -164,7 +164,7 @@ def recursive_file_lookup(path, file_map): + def get_all_devices_test_status(file_map): + + for device in file_map: +- if (get_test_state(locate_state(device, file_map)) is 1): ++ if (get_test_state(locate_state(device, file_map)) == 1): + print("Testing = ON for: {}" + .format(device.split("/")[5])) + else: +@@ -203,7 +203,7 @@ def write_test_files(path, value): + def set_test_state(state_path, state_value, quiet): + + write_test_files(state_path, state_value) +- if (get_test_state(state_path) is 1): ++ if (get_test_state(state_path) == 1): + if (not quiet): + print("Testing = ON for device: {}" + .format(state_path.split("/")[5])) +-- +2.40.1 + diff --git a/queue-6.1/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch b/queue-6.1/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch new file mode 100644 index 00000000000..e33ba318d7c --- /dev/null +++ b/queue-6.1/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch @@ -0,0 +1,66 @@ +From 5b864a186cdf07492dd113a1a46f74311e81832b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jul 2023 16:05:00 +0200 +Subject: wifi: brcmfmac: Fix field-spanning write in + brcmf_scan_params_v2_to_v1() + +From: Hans de Goede + +[ Upstream commit 16e455a465fca91907af0108f3d013150386df30 ] + +Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers +a backtrace caused by the following field-spanning warning: + +memcpy: detected field-spanning write (size 120) of single field + "¶ms_le->channel_list[0]" at + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) + +The driver still works after this warning. The warning was introduced by the +new field-spanning write checks which were enabled recently. + +Fix this by replacing the channel_list[1] declaration at the end of +the struct with a flexible array declaration. + +Most users of struct brcmf_scan_params_le calculate the size to alloc +using the size of the non flex-array part of the struct + needed extra +space, so they do not care about sizeof(struct brcmf_scan_params_le). + +brcmf_notify_escan_complete() however uses the struct on the stack, +expecting there to be room for at least 1 entry in the channel-list +to store the special -1 abort channel-id. + +To make this work use an anonymous union with a padding member +added + the actual channel_list flexible array. + +Cc: Kees Cook +Signed-off-by: Hans de Goede +Reviewed-by: Kees Cook +Reviewed-by: Franky Lin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +index f518e025d6e46..a8d88aedc4227 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +@@ -383,7 +383,12 @@ struct brcmf_scan_params_le { + * fixed parameter portion is assumed, otherwise + * ssid in the fixed portion is ignored + */ +- __le16 channel_list[1]; /* list of chanspecs */ ++ union { ++ __le16 padding; /* Reserve space for at least 1 entry for abort ++ * which uses an on stack brcmf_scan_params_le ++ */ ++ DECLARE_FLEX_ARRAY(__le16, channel_list); /* chanspecs */ ++ }; + }; + + struct brcmf_scan_results { +-- +2.40.1 + diff --git a/queue-6.1/wifi-cfg80211-remove-links-only-on-ap.patch b/queue-6.1/wifi-cfg80211-remove-links-only-on-ap.patch new file mode 100644 index 00000000000..d55e446f694 --- /dev/null +++ b/queue-6.1/wifi-cfg80211-remove-links-only-on-ap.patch @@ -0,0 +1,52 @@ +From 88f7f8c4960910891d469ceebb29664c929db89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 16:36:04 +0300 +Subject: wifi: cfg80211: remove links only on AP + +From: Johannes Berg + +[ Upstream commit 34d4e3eb67fed9c19719bedb748e5a8b6ccc97a5 ] + +Since links are only controlled by userspace via cfg80211 +in AP mode, also only remove them from the driver in that +case. + +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230608163202.ed65b94916fa.I2458c46888284cc5ce30715fe642bc5fc4340c8f@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 39680e7bad45a..f433f3fdd9e94 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -5,7 +5,7 @@ + * Copyright 2007-2009 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH + * Copyright 2017 Intel Deutschland GmbH +- * Copyright (C) 2018-2022 Intel Corporation ++ * Copyright (C) 2018-2023 Intel Corporation + */ + #include + #include +@@ -2479,6 +2479,13 @@ void cfg80211_remove_links(struct wireless_dev *wdev) + { + unsigned int link_id; + ++ /* ++ * links are controlled by upper layers (userspace/cfg) ++ * only for AP mode, so only remove them here for AP ++ */ ++ if (wdev->iftype != NL80211_IFTYPE_AP) ++ return; ++ + wdev_lock(wdev); + if (wdev->valid_links) { + for_each_valid_link(wdev, link_id) +-- +2.40.1 + diff --git a/queue-6.1/wifi-mac80211-use-active_links-instead-of-valid_link.patch b/queue-6.1/wifi-mac80211-use-active_links-instead-of-valid_link.patch new file mode 100644 index 00000000000..b5029987e25 --- /dev/null +++ b/queue-6.1/wifi-mac80211-use-active_links-instead-of-valid_link.patch @@ -0,0 +1,55 @@ +From 1f07c61cdea2439b8b8c69d2a89cbe6a57d14c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 16:36:07 +0300 +Subject: wifi: mac80211: Use active_links instead of valid_links in Tx + +From: Ilan Peer + +[ Upstream commit 7b3b9ac899b54f53f7c9fc07e1c562f56b2187fa ] + +Fix few places on the Tx path where the valid_links were used instead +of active links. + +Signed-off-by: Ilan Peer +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230608163202.e24832691fc8.I9ac10dc246d7798a8d26b1a94933df5668df63fc@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 763cefd0cc268..2f9e1abdf375d 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4391,7 +4391,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev, + struct sk_buff *skb) + { + struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); +- unsigned long links = sdata->vif.valid_links; ++ unsigned long links = sdata->vif.active_links; + unsigned int link; + u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX; + +@@ -5827,7 +5827,7 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata, + rcu_read_unlock(); + + if (WARN_ON_ONCE(link == ARRAY_SIZE(sdata->vif.link_conf))) +- link = ffs(sdata->vif.valid_links) - 1; ++ link = ffs(sdata->vif.active_links) - 1; + } + + IEEE80211_SKB_CB(skb)->control.flags |= +@@ -5863,7 +5863,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata, + band = chanctx_conf->def.chan->band; + } else { + WARN_ON(link_id >= 0 && +- !(sdata->vif.valid_links & BIT(link_id))); ++ !(sdata->vif.active_links & BIT(link_id))); + /* MLD transmissions must not rely on the band */ + band = 0; + } +-- +2.40.1 +