From: Sasha Levin Date: Sat, 27 Jul 2024 14:04:12 +0000 (-0400) Subject: Fixes for 6.10 X-Git-Tag: v6.1.103~106 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5f28515bb99df71a9e49d4e57a4e3768b48b0968;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.10 Signed-off-by: Sasha Levin --- diff --git a/queue-6.10/alloc_tag-fix-page_ext_get-page_ext_put-sequence-dur.patch b/queue-6.10/alloc_tag-fix-page_ext_get-page_ext_put-sequence-dur.patch new file mode 100644 index 00000000000..b9f695d4172 --- /dev/null +++ b/queue-6.10/alloc_tag-fix-page_ext_get-page_ext_put-sequence-dur.patch @@ -0,0 +1,63 @@ +From 66b986594391bb2d2a9c2dda61ae9c7f89bc497d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:04:57 -0700 +Subject: alloc_tag: fix page_ext_get/page_ext_put sequence during page + splitting + +From: Suren Baghdasaryan + +[ Upstream commit 6ab42fe21c84d72da752923b4bd7075344f4a362 ] + +pgalloc_tag_sub() might call page_ext_put() using a page different from +the one used in page_ext_get() call. This does not pose an issue since +page_ext_put() ignores this parameter as long as it's non-NULL but +technically this is wrong. Fix it by storing the original page used in +page_ext_get() and passing it to page_ext_put(). + +Link: https://lkml.kernel.org/r/20240711220457.1751071-3-surenb@google.com +Fixes: be25d1d4e822 ("mm: create new codetag references during page splitting") +Signed-off-by: Suren Baghdasaryan +Cc: Kees Cook +Cc: Kent Overstreet +Cc: Pasha Tatashin +Cc: Sourav Panda +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/pgalloc_tag.h | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/pgalloc_tag.h b/include/linux/pgalloc_tag.h +index acb1e9ce79815..18cd0c0c73d93 100644 +--- a/include/linux/pgalloc_tag.h ++++ b/include/linux/pgalloc_tag.h +@@ -71,6 +71,7 @@ static inline void pgalloc_tag_sub(struct page *page, unsigned int nr) + static inline void pgalloc_tag_split(struct page *page, unsigned int nr) + { + int i; ++ struct page_ext *first_page_ext; + struct page_ext *page_ext; + union codetag_ref *ref; + struct alloc_tag *tag; +@@ -78,7 +79,7 @@ static inline void pgalloc_tag_split(struct page *page, unsigned int nr) + if (!mem_alloc_profiling_enabled()) + return; + +- page_ext = page_ext_get(page); ++ first_page_ext = page_ext = page_ext_get(page); + if (unlikely(!page_ext)) + return; + +@@ -94,7 +95,7 @@ static inline void pgalloc_tag_split(struct page *page, unsigned int nr) + page_ext = page_ext_next(page_ext); + } + out: +- page_ext_put(page_ext); ++ page_ext_put(first_page_ext); + } + + static inline struct alloc_tag *pgalloc_tag_get(struct page *page) +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch new file mode 100644 index 00000000000..69eccbd3bd5 --- /dev/null +++ b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch @@ -0,0 +1,36 @@ +From 9333fc1801c972cd8bd763703ea80386dee02651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:31 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix board reset + +From: Michael Walle + +[ Upstream commit b972d6b3b46345023aee56a95df8e2c137aa4ee4 ] + +On i.MX6 the board is reset by the watchdog. But in turn to do a +complete board reset, we have to assert the WDOG_B output which is +routed also to the CPLD which then do a complete power-cycle of the +board. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +index d6c049b9a9c69..700780bf64f58 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +@@ -817,5 +817,6 @@ &wdog1 { + /* CPLD is feeded by watchdog (hardwired) */ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_wdog1>; ++ fsl,ext-reset-output; + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch new file mode 100644 index 00000000000..16b45a64327 --- /dev/null +++ b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch @@ -0,0 +1,35 @@ +From 93ab38806db63897dab2b5552d42ed7209bcc0cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:38 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity + +From: Michael Walle + +[ Upstream commit df35c6e9027cf9affe699e632a48082ab1bbba4c ] + +The PCIe reset line is active low. Fix it. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +index 78cbc2df279e6..668d33d1ff0c1 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +@@ -732,7 +732,7 @@ &pcie { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_pcie>; + wake-up-gpio = <&gpio6 18 GPIO_ACTIVE_HIGH>; +- reset-gpio = <&gpio3 13 GPIO_ACTIVE_HIGH>; ++ reset-gpio = <&gpio3 13 GPIO_ACTIVE_LOW>; + }; + + /* LCD_BKLT_PWM */ +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch new file mode 100644 index 00000000000..827d07556de --- /dev/null +++ b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch @@ -0,0 +1,37 @@ +From d5d8882bbd76f03fd58ff1d31331233ba73c5f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:29 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode + +From: Michael Walle + +[ Upstream commit 0df3c7d7a73d75153090637392c0b73a63cdc24a ] + +The i.MX6 cannot add any RGMII delays. The PHY has to add both the RX +and TX delays on the RGMII interface. Fix the interface mode. While at +it, use the new phy-connection-type property name. + +Fixes: 5694eed98cca ("ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +index 85aeebc9485dd..d8c1dfb8c9abb 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +@@ -259,7 +259,7 @@ smarc_flash: flash@0 { + &fec { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-mode = "rgmii"; ++ phy-connection-type = "rgmii-id"; + phy-handle = <ðphy>; + + mdio { +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch new file mode 100644 index 00000000000..7c6430ec0cb --- /dev/null +++ b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch @@ -0,0 +1,49 @@ +From 2efb2372786943a594a1ce17e38f62b3e2e9bf0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:30 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset + +From: Michael Walle + +[ Upstream commit edfea889a049abe80f0d55c0365bf60fbade272f ] + +The PHY reset line is connected to both the SoC (GPIO1_25) and +the CPLD. We must not use the GPIO1_25 as it will drive against +the output buffer of the CPLD. Instead there is another GPIO +(GPIO2_01), an input to the CPLD, which will tell the CPLD to +assert the PHY reset line. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Fixes: 5694eed98cca ("ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +index d8c1dfb8c9abb..d6c049b9a9c69 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +@@ -269,7 +269,7 @@ mdio { + ethphy: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <1>; +- reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + }; + }; +@@ -516,7 +516,7 @@ MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b0b0 + MX6QDL_PAD_ENET_MDIO__ENET_MDIO 0x1b0b0 + MX6QDL_PAD_ENET_MDC__ENET_MDC 0x1b0b0 + MX6QDL_PAD_ENET_REF_CLK__ENET_TX_CLK 0x1b0b0 +- MX6QDL_PAD_ENET_CRS_DV__GPIO1_IO25 0x1b0b0 /* RST_GBE0_PHY# */ ++ MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x1b0b0 /* RST_GBE0_PHY# */ + >; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch new file mode 100644 index 00000000000..bd81578250e --- /dev/null +++ b/queue-6.10/arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch @@ -0,0 +1,88 @@ +From 1ba7acd8aa9bb131961f95a4f729d25650817afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:13:33 +0200 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects + +From: Michael Walle + +[ Upstream commit 74e1c956a68a65d642447d852e95b3fbb69bebaa ] + +There is a comment in the imx6q variant dtsi claiming that these +modules will have one more chip select than the imx6dl variant. +This is wrong. Ordinary GPIOs are used for chip selects and both +variants of the module share the very same PCB and both have this +GPIO routed to the SPI0_CS1# pin of the SMARC connector. + +Fix it by moving the third chip select description to the common dtsi. + +Fixes: 2125212785c9 ("ARM: dts: imx6qdl-kontron-samx6i: add Kontron SMARC SoM Support") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../dts/nxp/imx/imx6q-kontron-samx6i.dtsi | 23 ------------------- + .../dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi | 5 +++- + 2 files changed, 4 insertions(+), 24 deletions(-) + +diff --git a/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi +index 4d6a0c3e8455f..ff062f4fd726e 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6q-kontron-samx6i.dtsi +@@ -5,31 +5,8 @@ + + #include "imx6q.dtsi" + #include "imx6qdl-kontron-samx6i.dtsi" +-#include + + / { + model = "Kontron SMARC sAMX6i Quad/Dual"; + compatible = "kontron,imx6q-samx6i", "fsl,imx6q"; + }; +- +-/* Quad/Dual SoMs have 3 chip-select signals */ +-&ecspi4 { +- cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, +- <&gpio3 29 GPIO_ACTIVE_LOW>, +- <&gpio3 25 GPIO_ACTIVE_LOW>; +-}; +- +-&pinctrl_ecspi4 { +- fsl,pins = < +- MX6QDL_PAD_EIM_D21__ECSPI4_SCLK 0x100b1 +- MX6QDL_PAD_EIM_D28__ECSPI4_MOSI 0x100b1 +- MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 +- +- /* SPI4_IMX_CS2# - connected to internal flash */ +- MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 +- /* SPI4_IMX_CS0# - connected to SMARC SPI0_CS0# */ +- MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 +- /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ +- MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 +- >; +-}; +diff --git a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +index 700780bf64f58..78cbc2df279e6 100644 +--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-kontron-samx6i.dtsi +@@ -244,7 +244,8 @@ &ecspi4 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_ecspi4>; + cs-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>, +- <&gpio3 29 GPIO_ACTIVE_LOW>; ++ <&gpio3 29 GPIO_ACTIVE_LOW>, ++ <&gpio3 25 GPIO_ACTIVE_LOW>; + status = "okay"; + + /* default boot source: workaround #1 for errata ERR006282 */ +@@ -464,6 +465,8 @@ MX6QDL_PAD_EIM_D22__ECSPI4_MISO 0x100b1 + MX6QDL_PAD_EIM_D24__GPIO3_IO24 0x1b0b0 + /* SPI_IMX_CS0# - connected to SMARC SPI0_CS0# */ + MX6QDL_PAD_EIM_D29__GPIO3_IO29 0x1b0b0 ++ /* SPI4_CS3# - connected to SMARC SPI0_CS1# */ ++ MX6QDL_PAD_EIM_D25__GPIO3_IO25 0x1b0b0 + >; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-qcom-msm8226-microsoft-common-enable-smbb-ex.patch b/queue-6.10/arm-dts-qcom-msm8226-microsoft-common-enable-smbb-ex.patch new file mode 100644 index 00000000000..41e02f5cc3a --- /dev/null +++ b/queue-6.10/arm-dts-qcom-msm8226-microsoft-common-enable-smbb-ex.patch @@ -0,0 +1,43 @@ +From a006efe777bafe12be34369ae456c6028281483e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 18:42:06 +0100 +Subject: ARM: dts: qcom: msm8226-microsoft-common: Enable smbb explicitly + +From: Rayyan Ansari + +[ Upstream commit 81a0a21b6159c6a9ed1e39c23e755cd05a102ce3 ] + +Enable the smbb node explicitly for MSM8x26 Lumia devices. These devices +rely on the smbb driver in order to detect USB state. + +It seems that this was accidentally missed in the commit that this +fixes. + +Fixes: c9c8179d0ccd ("ARM: dts: qcom: Disable pm8941 & pm8226 smbb charger by default") +Signed-off-by: Rayyan Ansari +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240424174206.4220-1-rayyan@ansari.sh +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi b/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi +index 525d8c608b06f..8839b23fc6936 100644 +--- a/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi ++++ b/arch/arm/boot/dts/qcom/qcom-msm8226-microsoft-common.dtsi +@@ -287,6 +287,10 @@ &sdhc_2 { + status = "okay"; + }; + ++&smbb { ++ status = "okay"; ++}; ++ + &usb { + extcon = <&smbb>; + dr_mode = "peripheral"; +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-stm32-add-arm-no-tick-in-suspend-to-stm32mp1.patch b/queue-6.10/arm-dts-stm32-add-arm-no-tick-in-suspend-to-stm32mp1.patch new file mode 100644 index 00000000000..1a80864ad49 --- /dev/null +++ b/queue-6.10/arm-dts-stm32-add-arm-no-tick-in-suspend-to-stm32mp1.patch @@ -0,0 +1,46 @@ +From 2edba3a66f1126917ca3efc725b3b890dfa3054f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 23:58:15 +0200 +Subject: ARM: dts: stm32: Add arm,no-tick-in-suspend to STM32MP15xx STGEN + timer + +From: Marek Vasut + +[ Upstream commit 4306c047415a227bc72f0e7ba9bde1ccdac10435 ] + +STM32MP15xx RM0436 Rev 6 section 46.3 System timer generator (STGEN) states +" +Arm recommends that the system counter is in an always-on power domain. +This is not supported in the current implementation, therefore STGEN should +be saved and restored before Standby mode entry, and restored at Standby +exit by secure software. +... +" +Instead of piling up workarounds in the firmware which is difficult to +update, add "arm,no-tick-in-suspend" DT property into the timer node to +indicate the timer is stopped in suspend, and let the kernel fix the +timer up. + +Fixes: 8471a20253eb ("ARM: dts: stm32: add stm32mp157c initial support") +Signed-off-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/st/stm32mp151.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi +index 90c5c72c87ab7..4f878ec102c1f 100644 +--- a/arch/arm/boot/dts/st/stm32mp151.dtsi ++++ b/arch/arm/boot/dts/st/stm32mp151.dtsi +@@ -50,6 +50,7 @@ timer { + , + ; + interrupt-parent = <&intc>; ++ arm,no-tick-in-suspend; + }; + + clocks { +-- +2.43.0 + diff --git a/queue-6.10/arm-dts-sunxi-remove-duplicated-entries-in-makefile.patch b/queue-6.10/arm-dts-sunxi-remove-duplicated-entries-in-makefile.patch new file mode 100644 index 00000000000..ebd5bb2a5f9 --- /dev/null +++ b/queue-6.10/arm-dts-sunxi-remove-duplicated-entries-in-makefile.patch @@ -0,0 +1,102 @@ +From 1de2372397994ea6ccdd7629a7a4195c755979fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 07:10:19 +0100 +Subject: ARM: dts: sunxi: remove duplicated entries in makefile +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Löbl + +[ Upstream commit bba474656dd85b13e4c5d5bdb73ca08d9136df21 ] + +During introduction of DTS vendor subdirectories in 724ba6751532, sun8i +section of the makefile got duplicated. Clean that up. + +Fixes: 724ba6751532 ("ARM: dts: Move .dts files to vendor sub-directories") +Signed-off-by: Pavel Löbl +Reviewed-by: Jernej Skrabec +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/20240320061027.4078852-1-pavel@loebl.cz +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/allwinner/Makefile | 62 ---------------------------- + 1 file changed, 62 deletions(-) + +diff --git a/arch/arm/boot/dts/allwinner/Makefile b/arch/arm/boot/dts/allwinner/Makefile +index 4247f19b1adc2..cd0d044882cf8 100644 +--- a/arch/arm/boot/dts/allwinner/Makefile ++++ b/arch/arm/boot/dts/allwinner/Makefile +@@ -261,68 +261,6 @@ dtb-$(CONFIG_MACH_SUN8I) += \ + sun8i-v3s-licheepi-zero.dtb \ + sun8i-v3s-licheepi-zero-dock.dtb \ + sun8i-v40-bananapi-m2-berry.dtb +-dtb-$(CONFIG_MACH_SUN8I) += \ +- sun8i-a23-evb.dtb \ +- sun8i-a23-gt90h-v4.dtb \ +- sun8i-a23-inet86dz.dtb \ +- sun8i-a23-ippo-q8h-v5.dtb \ +- sun8i-a23-ippo-q8h-v1.2.dtb \ +- sun8i-a23-polaroid-mid2407pxe03.dtb \ +- sun8i-a23-polaroid-mid2809pxe04.dtb \ +- sun8i-a23-q8-tablet.dtb \ +- sun8i-a33-et-q8-v1.6.dtb \ +- sun8i-a33-ga10h-v1.1.dtb \ +- sun8i-a33-inet-d978-rev2.dtb \ +- sun8i-a33-ippo-q8h-v1.2.dtb \ +- sun8i-a33-olinuxino.dtb \ +- sun8i-a33-q8-tablet.dtb \ +- sun8i-a33-sinlinx-sina33.dtb \ +- sun8i-a83t-allwinner-h8homlet-v2.dtb \ +- sun8i-a83t-bananapi-m3.dtb \ +- sun8i-a83t-cubietruck-plus.dtb \ +- sun8i-a83t-tbs-a711.dtb \ +- sun8i-h2-plus-bananapi-m2-zero.dtb \ +- sun8i-h2-plus-libretech-all-h3-cc.dtb \ +- sun8i-h2-plus-orangepi-r1.dtb \ +- sun8i-h2-plus-orangepi-zero.dtb \ +- sun8i-h3-bananapi-m2-plus.dtb \ +- sun8i-h3-bananapi-m2-plus-v1.2.dtb \ +- sun8i-h3-beelink-x2.dtb \ +- sun8i-h3-libretech-all-h3-cc.dtb \ +- sun8i-h3-mapleboard-mp130.dtb \ +- sun8i-h3-nanopi-duo2.dtb \ +- sun8i-h3-nanopi-m1.dtb\ +- \ +- sun8i-h3-nanopi-m1-plus.dtb \ +- sun8i-h3-nanopi-neo.dtb \ +- sun8i-h3-nanopi-neo-air.dtb \ +- sun8i-h3-nanopi-r1.dtb \ +- sun8i-h3-orangepi-2.dtb \ +- sun8i-h3-orangepi-lite.dtb \ +- sun8i-h3-orangepi-one.dtb \ +- sun8i-h3-orangepi-pc.dtb \ +- sun8i-h3-orangepi-pc-plus.dtb \ +- sun8i-h3-orangepi-plus.dtb \ +- sun8i-h3-orangepi-plus2e.dtb \ +- sun8i-h3-orangepi-zero-plus2.dtb \ +- sun8i-h3-rervision-dvk.dtb \ +- sun8i-h3-zeropi.dtb \ +- sun8i-h3-emlid-neutis-n5h3-devboard.dtb \ +- sun8i-r16-bananapi-m2m.dtb \ +- sun8i-r16-nintendo-nes-classic.dtb \ +- sun8i-r16-nintendo-super-nes-classic.dtb \ +- sun8i-r16-parrot.dtb \ +- sun8i-r40-bananapi-m2-ultra.dtb \ +- sun8i-r40-oka40i-c.dtb \ +- sun8i-s3-elimo-initium.dtb \ +- sun8i-s3-lichee-zero-plus.dtb \ +- sun8i-s3-pinecube.dtb \ +- sun8i-t113s-mangopi-mq-r-t113.dtb \ +- sun8i-t3-cqa3t-bv3.dtb \ +- sun8i-v3-sl631-imx179.dtb \ +- sun8i-v3s-licheepi-zero.dtb \ +- sun8i-v3s-licheepi-zero-dock.dtb \ +- sun8i-v40-bananapi-m2-berry.dtb + dtb-$(CONFIG_MACH_SUN9I) += \ + sun9i-a80-optimus.dtb \ + sun9i-a80-cubieboard4.dtb +-- +2.43.0 + diff --git a/queue-6.10/arm-remove-address-checking-for-mmuless-devices.patch b/queue-6.10/arm-remove-address-checking-for-mmuless-devices.patch new file mode 100644 index 00000000000..f335b3fc512 --- /dev/null +++ b/queue-6.10/arm-remove-address-checking-for-mmuless-devices.patch @@ -0,0 +1,51 @@ +From b66947b948dad814b94972004e8211c2ee1f1602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 18:09:47 +0800 +Subject: ARM: Remove address checking for MMUless devices + +From: Yanjun Yang + +[ Upstream commit 3ccea4784fddd96fbd6c4497eb28b45dab638c2a ] + +Commit 169f9102f9198b ("ARM: 9350/1: fault: Implement +copy_from_kernel_nofault_allowed()") added the function to check address +before use. However, for devices without MMU, addr > TASK_SIZE will +always fail. This patch move this function after the #ifdef CONFIG_MMU +statement. + +Signed-off-by: Yanjun Yang +Acked-by: Ard Biesheuvel +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218953 +Fixes: 169f9102f9198b ("ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()") +Link: https://lore.kernel.org/r/20240611100947.32241-1-yangyj.ee@gmail.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + arch/arm/mm/fault.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c +index 67c425341a951..ab01b51de5590 100644 +--- a/arch/arm/mm/fault.c ++++ b/arch/arm/mm/fault.c +@@ -25,6 +25,8 @@ + + #include "fault.h" + ++#ifdef CONFIG_MMU ++ + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + { + unsigned long addr = (unsigned long)unsafe_src; +@@ -32,8 +34,6 @@ bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) + return addr >= TASK_SIZE && ULONG_MAX - addr >= size; + } + +-#ifdef CONFIG_MMU +- + /* + * This is useful to dump out the page tables associated with + * 'addr' in mm 'mm'. +-- +2.43.0 + diff --git a/queue-6.10/arm-spitz-fix-gpio-assignment-for-backlight.patch b/queue-6.10/arm-spitz-fix-gpio-assignment-for-backlight.patch new file mode 100644 index 00000000000..701286dff57 --- /dev/null +++ b/queue-6.10/arm-spitz-fix-gpio-assignment-for-backlight.patch @@ -0,0 +1,91 @@ +From d0ecf375f87eb5af45bb9ffc23fe64e0cb10ee1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 11:08:41 -0700 +Subject: ARM: spitz: fix GPIO assignment for backlight + +From: Dmitry Torokhov + +[ Upstream commit 78ab3d352f2982bf3f7e506bfbaba7afee1ed8a9 ] + +GPIOs controlling backlight on Spitz and Akita are coming from GPIO +expanders, not the pxa27xx-gpio block, correct it. + +Additionally GPIO lookup tables operate with pin numbers rather than +legacy GPIO numbers, fix that as well. Use raw numbers instead of legacy +GPIO names to avoid confusion. + +Fixes: ee0c8e494cc3 ("backlight: corgi: Convert to use GPIO descriptors") +Reviewed-by: Linus Walleij +Signed-off-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20240628180852.1738922-2-dmitry.torokhov@gmail.com +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-pxa/spitz.c | 30 ++++++++++-------------------- + 1 file changed, 10 insertions(+), 20 deletions(-) + +diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c +index 3c5f5a3cb480c..10ab16dcd8276 100644 +--- a/arch/arm/mach-pxa/spitz.c ++++ b/arch/arm/mach-pxa/spitz.c +@@ -520,10 +520,8 @@ static struct gpiod_lookup_table spitz_ads7846_gpio_table = { + static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { + .dev_id = "spi2.1", + .table = { +- GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_CONT, +- "BL_CONT", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", SPITZ_GPIO_BACKLIGHT_ON, +- "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.1", 6, "BL_CONT", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("sharp-scoop.1", 7, "BL_ON", GPIO_ACTIVE_HIGH), + { }, + }, + }; +@@ -531,10 +529,8 @@ static struct gpiod_lookup_table spitz_lcdcon_gpio_table = { + static struct gpiod_lookup_table akita_lcdcon_gpio_table = { + .dev_id = "spi2.1", + .table = { +- GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_CONT, +- "BL_CONT", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", AKITA_GPIO_BACKLIGHT_ON, +- "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 3, "BL_ON", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 4, "BL_CONT", GPIO_ACTIVE_LOW), + { }, + }, + }; +@@ -964,12 +960,9 @@ static inline void spitz_i2c_init(void) {} + static struct gpiod_lookup_table spitz_audio_gpio_table = { + .dev_id = "spitz-audio", + .table = { +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE, +- "mute-l", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE, +- "mute-r", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.1", SPITZ_GPIO_MIC_BIAS - SPITZ_SCP2_GPIO_BASE, +- "mic", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.1", 8, "mic", GPIO_ACTIVE_HIGH), + { }, + }, + }; +@@ -977,12 +970,9 @@ static struct gpiod_lookup_table spitz_audio_gpio_table = { + static struct gpiod_lookup_table akita_audio_gpio_table = { + .dev_id = "spitz-audio", + .table = { +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_L - SPITZ_SCP_GPIO_BASE, +- "mute-l", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("sharp-scoop.0", SPITZ_GPIO_MUTE_R - SPITZ_SCP_GPIO_BASE, +- "mute-r", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("i2c-max7310", AKITA_GPIO_MIC_BIAS - AKITA_IOEXP_GPIO_BASE, +- "mic", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 3, "mute-l", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sharp-scoop.0", 4, "mute-r", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("i2c-max7310", 2, "mic", GPIO_ACTIVE_HIGH), + { }, + }, + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-amlogic-add-power-domain-to-hdmitx.patch b/queue-6.10/arm64-dts-amlogic-add-power-domain-to-hdmitx.patch new file mode 100644 index 00000000000..06d9de70e10 --- /dev/null +++ b/queue-6.10/arm64-dts-amlogic-add-power-domain-to-hdmitx.patch @@ -0,0 +1,87 @@ +From 9cfc6b9b88743cd35e07ee9368ed5a619cb7faac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 16:50:15 +0200 +Subject: arm64: dts: amlogic: add power domain to hdmitx + +From: Jerome Brunet + +[ Upstream commit f1ab099d6591a353899a2ee09c89de0fc908e2d2 ] + +HDMI Tx needs HDMI Tx memory power domain turned on. This power domain is +handled under the VPU power domain. + +The HDMI Tx currently works because it is enabling the PD by directly +poking the power controller register. It is should not do that but properly +use the power domain controller. + +Fix this by adding the power domain to HDMI Tx. + +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240625145017.1003346-3-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Stable-dep-of: 1443b6ea806d ("arm64: dts: amlogic: setup hdmi system clock") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12.dtsi | 4 ++++ + arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 1 + + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 1 + + arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 4 ++++ + 4 files changed, 10 insertions(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12.dtsi +index e732df3f3114d..664912d1beaab 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12.dtsi +@@ -363,6 +363,10 @@ ðmac { + power-domains = <&pwrc PWRC_G12A_ETH_ID>; + }; + ++&hdmi_tx { ++ power-domains = <&pwrc PWRC_G12A_VPU_ID>; ++}; ++ + &vpu { + power-domains = <&pwrc PWRC_G12A_VPU_ID>; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +index a15c1ef30a88b..041c37b809f27 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +@@ -315,6 +315,7 @@ &hdmi_tx { + <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; ++ power-domains = <&pwrc PWRC_GXBB_VPU_ID>; + }; + + &sysctrl { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index a53b38045b3d2..067108800a58d 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -327,6 +327,7 @@ &hdmi_tx { + <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; ++ power-domains = <&pwrc PWRC_GXBB_VPU_ID>; + }; + + &sysctrl { +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +index fcaa1a273829c..13e742ba00bea 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +@@ -518,6 +518,10 @@ &gpio_intc { + "amlogic,meson-gpio-intc"; + }; + ++&hdmi_tx { ++ power-domains = <&pwrc PWRC_SM1_VPU_ID>; ++}; ++ + &pcie { + power-domains = <&pwrc PWRC_SM1_PCIE_ID>; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch b/queue-6.10/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch new file mode 100644 index 00000000000..ca57a5e4b7d --- /dev/null +++ b/queue-6.10/arm64-dts-amlogic-gx-correct-hdmi-clocks.patch @@ -0,0 +1,63 @@ +From af96d39bcbc0b95896509a1107474a91fc9f9eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 17:27:30 +0200 +Subject: arm64: dts: amlogic: gx: correct hdmi clocks + +From: Jerome Brunet + +[ Upstream commit 0602ba0dcd0e76067a0b7543e92b2de3fb231073 ] + +The clocks provided to HDMI tx are not consistent between gx and g12: +* gx receives the peripheral clock as 'isfr' while g12 receives it as + 'iahb' +* g12 gets the HDMI system clock as 'isfr' but gx does not even get it. + It surely needs that clock since the driver is directly poking around + the clock controller's registers for that clock. + +Align gx SoCs with g12 and provide: + * the HDMI peripheral clock as 'iahb' + * the HDMI system clock as 'isfr' + +Fixes: 6939db7e0dbf ("ARM64: dts: meson-gx: Add support for HDMI output") +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240626152733.1350376-2-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 4 ++-- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +index 12ef6e81c8bd6..a15c1ef30a88b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +@@ -311,8 +311,8 @@ &hdmi_tx { + <&reset RESET_HDMI_SYSTEM_RESET>, + <&reset RESET_HDMI_TX>; + reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; +- clocks = <&clkc CLKID_HDMI_PCLK>, +- <&clkc CLKID_CLK81>, ++ clocks = <&clkc CLKID_HDMI>, ++ <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 17bcfa4702e17..a53b38045b3d2 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -323,8 +323,8 @@ &hdmi_tx { + <&reset RESET_HDMI_SYSTEM_RESET>, + <&reset RESET_HDMI_TX>; + reset-names = "hdmitx_apb", "hdmitx", "hdmitx_phy"; +- clocks = <&clkc CLKID_HDMI_PCLK>, +- <&clkc CLKID_CLK81>, ++ clocks = <&clkc CLKID_HDMI>, ++ <&clkc CLKID_HDMI_PCLK>, + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-amlogic-setup-hdmi-system-clock.patch b/queue-6.10/arm64-dts-amlogic-setup-hdmi-system-clock.patch new file mode 100644 index 00000000000..edc0b1f6b21 --- /dev/null +++ b/queue-6.10/arm64-dts-amlogic-setup-hdmi-system-clock.patch @@ -0,0 +1,80 @@ +From 7079de03a9495fab2ab172616eb6a07d43fb89e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 17:27:31 +0200 +Subject: arm64: dts: amlogic: setup hdmi system clock + +From: Jerome Brunet + +[ Upstream commit 1443b6ea806dfcdcee6c894784332c9c947ac319 ] + +HDMI Tx needs the system clock set on the xtal rate. +This clock is managed by the main clock controller of the related SoCs. + +Currently 2 part of the display drivers race to setup the HDMI system +clock by directly poking the controller register. The clock API should +be used to setup the rate instead. + +Use assigned-clock to setup the HDMI system clock. + +Fixes: 6939db7e0dbf ("ARM64: dts: meson-gx: Add support for HDMI output") +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240626152733.1350376-3-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 5 +++++ + arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 5 +++++ + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 5 +++++ + 3 files changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index b058ed78faf00..dbadbdb8f9310 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -215,6 +215,11 @@ hdmi_tx: hdmi-tx@0 { + #sound-dai-cells = <0>; + status = "disabled"; + ++ assigned-clocks = <&clkc CLKID_HDMI_SEL>, ++ <&clkc CLKID_HDMI>; ++ assigned-clock-parents = <&xtal>, <0>; ++ assigned-clock-rates = <0>, <24000000>; ++ + /* VPU VENC Input */ + hdmi_tx_venc_port: port@0 { + reg = <0>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +index 041c37b809f27..ed00e67e6923a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi +@@ -316,6 +316,11 @@ &hdmi_tx { + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + power-domains = <&pwrc PWRC_GXBB_VPU_ID>; ++ ++ assigned-clocks = <&clkc CLKID_HDMI_SEL>, ++ <&clkc CLKID_HDMI>; ++ assigned-clock-parents = <&xtal>, <0>; ++ assigned-clock-rates = <0>, <24000000>; + }; + + &sysctrl { +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index 067108800a58d..f58d1790de1cb 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -328,6 +328,11 @@ &hdmi_tx { + <&clkc CLKID_GCLK_VENCI_INT0>; + clock-names = "isfr", "iahb", "venci"; + power-domains = <&pwrc PWRC_GXBB_VPU_ID>; ++ ++ assigned-clocks = <&clkc CLKID_HDMI_SEL>, ++ <&clkc CLKID_HDMI>; ++ assigned-clock-parents = <&xtal>, <0>; ++ assigned-clock-rates = <0>, <24000000>; + }; + + &sysctrl { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch b/queue-6.10/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch new file mode 100644 index 00000000000..fd236924159 --- /dev/null +++ b/queue-6.10/arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch @@ -0,0 +1,46 @@ +From c7a3f387c449102acf535bfd1708b2f6630bcbe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:18:43 +0200 +Subject: arm64: dts: amlogic: sm1: fix spdif compatibles + +From: Jerome Brunet + +[ Upstream commit b0aba467c329a89e8b325eda0cf60776958353fe ] + +The spdif input and output of g12 and sm1 are compatible but +sm1 should use the related compatible since it exists. + +Fixes: 86f2159468d5 ("arm64: dts: meson-sm1: add spdifin and pdifout nodes") +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20240625111845.928192-1-jbrunet@baylibre.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +index 643f94d9d08e1..fcaa1a273829c 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +@@ -339,7 +339,7 @@ tdmin_lb: audio-controller@3c0 { + }; + + spdifin: audio-controller@400 { +- compatible = "amlogic,g12a-spdifin", ++ compatible = "amlogic,sm1-spdifin", + "amlogic,axg-spdifin"; + reg = <0x0 0x400 0x0 0x30>; + #sound-dai-cells = <0>; +@@ -353,7 +353,7 @@ spdifin: audio-controller@400 { + }; + + spdifout_a: audio-controller@480 { +- compatible = "amlogic,g12a-spdifout", ++ compatible = "amlogic,sm1-spdifout", + "amlogic,axg-spdifout"; + reg = <0x0 0x480 0x0 0x50>; + #sound-dai-cells = <0>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-imx8mp-fix-pgc-vpu-locations.patch b/queue-6.10/arm64-dts-imx8mp-fix-pgc-vpu-locations.patch new file mode 100644 index 00000000000..4b3b977164f --- /dev/null +++ b/queue-6.10/arm64-dts-imx8mp-fix-pgc-vpu-locations.patch @@ -0,0 +1,106 @@ +From f6bd854a4425cc66a2bc95efeee3539bc90e0f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 05:10:44 -0500 +Subject: arm64: dts: imx8mp: Fix pgc vpu locations + +From: Adam Ford + +[ Upstream commit 2f8405fb077bcb8e98c8cd87c2a0a238b15d8da8 ] + +The various pgv_vpu nodes have a mismatch between the value after +the @ symbol and what is referenced by 'reg' so reorder the nodes +to align. + +Fixes: df680992dd62 ("arm64: dts: imx8mp: add vpu pgc nodes") +Suggested-by: Alexander Stein +Signed-off-by: Adam Ford +Reviewd-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 55 ++++++++++++----------- + 1 file changed, 28 insertions(+), 27 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 3576d2b89b439..ee0c864f27e89 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -838,6 +838,12 @@ pgc_gpumix: power-domain@7 { + assigned-clock-rates = <800000000>, <400000000>; + }; + ++ pgc_vpumix: power-domain@8 { ++ #power-domain-cells = <0>; ++ reg = ; ++ clocks = <&clk IMX8MP_CLK_VPU_ROOT>; ++ }; ++ + pgc_gpu3d: power-domain@9 { + #power-domain-cells = <0>; + reg = ; +@@ -853,6 +859,28 @@ pgc_mediamix: power-domain@10 { + <&clk IMX8MP_CLK_MEDIA_APB_ROOT>; + }; + ++ pgc_vpu_g1: power-domain@11 { ++ #power-domain-cells = <0>; ++ power-domains = <&pgc_vpumix>; ++ reg = ; ++ clocks = <&clk IMX8MP_CLK_VPU_G1_ROOT>; ++ }; ++ ++ pgc_vpu_g2: power-domain@12 { ++ #power-domain-cells = <0>; ++ power-domains = <&pgc_vpumix>; ++ reg = ; ++ clocks = <&clk IMX8MP_CLK_VPU_G2_ROOT>; ++ ++ }; ++ ++ pgc_vpu_vc8000e: power-domain@13 { ++ #power-domain-cells = <0>; ++ power-domains = <&pgc_vpumix>; ++ reg = ; ++ clocks = <&clk IMX8MP_CLK_VPU_VC8KE_ROOT>; ++ }; ++ + pgc_hdmimix: power-domain@14 { + #power-domain-cells = <0>; + reg = ; +@@ -890,33 +918,6 @@ pgc_ispdwp: power-domain@18 { + reg = ; + clocks = <&clk IMX8MP_CLK_MEDIA_ISP_ROOT>; + }; +- +- pgc_vpumix: power-domain@19 { +- #power-domain-cells = <0>; +- reg = ; +- clocks = <&clk IMX8MP_CLK_VPU_ROOT>; +- }; +- +- pgc_vpu_g1: power-domain@20 { +- #power-domain-cells = <0>; +- power-domains = <&pgc_vpumix>; +- reg = ; +- clocks = <&clk IMX8MP_CLK_VPU_G1_ROOT>; +- }; +- +- pgc_vpu_g2: power-domain@21 { +- #power-domain-cells = <0>; +- power-domains = <&pgc_vpumix>; +- reg = ; +- clocks = <&clk IMX8MP_CLK_VPU_G2_ROOT>; +- }; +- +- pgc_vpu_vc8000e: power-domain@22 { +- #power-domain-cells = <0>; +- power-domains = <&pgc_vpumix>; +- reg = ; +- clocks = <&clk IMX8MP_CLK_VPU_VC8KE_ROOT>; +- }; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-imx8mp-fix-pgc_mlmix-location.patch b/queue-6.10/arm64-dts-imx8mp-fix-pgc_mlmix-location.patch new file mode 100644 index 00000000000..468dfae309d --- /dev/null +++ b/queue-6.10/arm64-dts-imx8mp-fix-pgc_mlmix-location.patch @@ -0,0 +1,82 @@ +From 313205f5062afc25f40b3ce9ac0bd895eb33520c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 17:39:51 -0500 +Subject: arm64: dts: imx8mp: Fix pgc_mlmix location + +From: Adam Ford + +[ Upstream commit 106f68fc9da3d4835070b55a2229d2c54ef5cba1 ] + +The pgc_mlmix shows a power-domain@24, but the reg value is +IMX8MP_POWER_DOMAIN_MLMIX which is set to 4. + +The stuff after the @ symbol should match the stuff referenced +by 'reg' so reorder the pgc_mlmix so it to appear as power-domain@4. + +Fixes: 834464c8504c ("arm64: dts: imx8mp: add mlmix power domain") +Fixes: 4bedc468b725 ("arm64: dts: imx8mp: Add NPU Node") +Signed-off-by: Adam Ford +Reviewed-by: Peng Fan +Reviewed-by: Marek Vasut +Reviewed-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 34 +++++++++++------------ + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index b92abb5a5c536..3576d2b89b439 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -789,6 +789,23 @@ pgc_usb2_phy: power-domain@3 { + reg = ; + }; + ++ pgc_mlmix: power-domain@4 { ++ #power-domain-cells = <0>; ++ reg = ; ++ clocks = <&clk IMX8MP_CLK_ML_AXI>, ++ <&clk IMX8MP_CLK_ML_AHB>, ++ <&clk IMX8MP_CLK_NPU_ROOT>; ++ assigned-clocks = <&clk IMX8MP_CLK_ML_CORE>, ++ <&clk IMX8MP_CLK_ML_AXI>, ++ <&clk IMX8MP_CLK_ML_AHB>; ++ assigned-clock-parents = <&clk IMX8MP_SYS_PLL1_800M>, ++ <&clk IMX8MP_SYS_PLL1_800M>, ++ <&clk IMX8MP_SYS_PLL1_800M>; ++ assigned-clock-rates = <800000000>, ++ <800000000>, ++ <300000000>; ++ }; ++ + pgc_audio: power-domain@5 { + #power-domain-cells = <0>; + reg = ; +@@ -900,23 +917,6 @@ pgc_vpu_vc8000e: power-domain@22 { + reg = ; + clocks = <&clk IMX8MP_CLK_VPU_VC8KE_ROOT>; + }; +- +- pgc_mlmix: power-domain@24 { +- #power-domain-cells = <0>; +- reg = ; +- clocks = <&clk IMX8MP_CLK_ML_AXI>, +- <&clk IMX8MP_CLK_ML_AHB>, +- <&clk IMX8MP_CLK_NPU_ROOT>; +- assigned-clocks = <&clk IMX8MP_CLK_ML_CORE>, +- <&clk IMX8MP_CLK_ML_AXI>, +- <&clk IMX8MP_CLK_ML_AHB>; +- assigned-clock-parents = <&clk IMX8MP_SYS_PLL1_800M>, +- <&clk IMX8MP_SYS_PLL1_800M>, +- <&clk IMX8MP_SYS_PLL1_800M>; +- assigned-clock-rates = <800000000>, +- <800000000>, +- <300000000>; +- }; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-medaitek-mt8395-nio-12l-set-i2c6-pins-to-b.patch b/queue-6.10/arm64-dts-medaitek-mt8395-nio-12l-set-i2c6-pins-to-b.patch new file mode 100644 index 00000000000..510542bf95c --- /dev/null +++ b/queue-6.10/arm64-dts-medaitek-mt8395-nio-12l-set-i2c6-pins-to-b.patch @@ -0,0 +1,37 @@ +From 6de7dd21bf161623c7b84b87e9881a4c0c3afb02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 13:42:08 +0200 +Subject: arm64: dts: medaitek: mt8395-nio-12l: Set i2c6 pins to bias-disable + +From: AngeloGioacchino Del Regno + +[ Upstream commit 32b33be8894f3389d15b409140d663acbdf9de1d ] + +GPIOs 25 and 26 do not support pull-up/pull-down when those are muxed +as I2C6's SDA6/SCL6 lines: set those to bias-disable to avoid warning +messages from the pinctrl driver. + +Fixes: 96564b1e2ea4 ("arm64: dts: mediatek: Introduce the MT8395 Radxa NIO 12L board") +Link: https://lore.kernel.org/r/20240409114211.310462-3-angelogioacchino.delregno@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts b/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts +index e5d9b671a4057..97634cc04e659 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8395-radxa-nio-12l.dts +@@ -528,7 +528,7 @@ i2c6_pins: i2c6-pins { + pins { + pinmux = , + ; +- bias-pull-up = ; ++ bias-disable; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch b/queue-6.10/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch new file mode 100644 index 00000000000..1c6914348d0 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch @@ -0,0 +1,66 @@ +From c3441005e7f6fb9ce12d8e897c564815f027fb6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 09:49:16 +0200 +Subject: arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit aebba1030a5766cdf894ed4ab0cac7aed5aee9c1 ] + +Value "emmc_rst" is a group name and should be part of the "groups" +property. + +This fixes: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml# +arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: pinctrl@10211000: emmc-pins-default:mux:function: ['emmc', 'emmc_rst'] is too long + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt7622-pinctrl.yaml# + +Fixes: 3725ba3f5574 ("arm64: dts: mt7622: add pinctrl related device nodes") +Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board") +Signed-off-by: Rafał Miłecki +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240604074916.7929-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 4 ++-- + arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +index 224bb289660c0..2791de5b28f6a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +@@ -329,8 +329,8 @@ asm_sel { + /* eMMC is shared pin with parallel NAND */ + emmc_pins_default: emmc-pins-default { + mux { +- function = "emmc", "emmc_rst"; +- groups = "emmc"; ++ function = "emmc"; ++ groups = "emmc", "emmc_rst"; + }; + + /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7", +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +index 41629769bdc85..8c3e2e2578bce 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts +@@ -268,8 +268,8 @@ &pio { + /* eMMC is shared pin with parallel NAND */ + emmc_pins_default: emmc-pins-default { + mux { +- function = "emmc", "emmc_rst"; +- groups = "emmc"; ++ function = "emmc"; ++ groups = "emmc", "emmc_rst"; + }; + + /* "NDL0","NDL1","NDL2","NDL3","NDL4","NDL5","NDL6","NDL7", +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt7981-fix-code-alignment-for-pwm.patch b/queue-6.10/arm64-dts-mediatek-mt7981-fix-code-alignment-for-pwm.patch new file mode 100644 index 00000000000..73266cbfab1 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt7981-fix-code-alignment-for-pwm.patch @@ -0,0 +1,45 @@ +From fce0f419529e704f07ba461036ee063ab1e4c802 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 12:50:30 +0200 +Subject: arm64: dts: mediatek: mt7981: fix code alignment for PWM clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit f80cfe9616b7448eca709a3e87ca57201cd5787c ] + +Align "clocks" array entries to start at the same column. + +Fixes: cf29427573cc ("arm64: dts: mediatek: Add initial MT7981B and Xiaomi AX3000T") +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240405105030.24559-1-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7981b.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7981b.dtsi b/arch/arm64/boot/dts/mediatek/mt7981b.dtsi +index 4feff3d1c5f4e..178e1e96c3a49 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7981b.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7981b.dtsi +@@ -78,10 +78,10 @@ pwm@10048000 { + compatible = "mediatek,mt7981-pwm"; + reg = <0 0x10048000 0 0x1000>; + clocks = <&infracfg CLK_INFRA_PWM_STA>, +- <&infracfg CLK_INFRA_PWM_HCK>, +- <&infracfg CLK_INFRA_PWM1_CK>, +- <&infracfg CLK_INFRA_PWM2_CK>, +- <&infracfg CLK_INFRA_PWM3_CK>; ++ <&infracfg CLK_INFRA_PWM_HCK>, ++ <&infracfg CLK_INFRA_PWM1_CK>, ++ <&infracfg CLK_INFRA_PWM2_CK>, ++ <&infracfg CLK_INFRA_PWM3_CK>; + clock-names = "top", "main", "pwm1", "pwm2", "pwm3"; + #pwm-cells = <2>; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch new file mode 100644 index 00000000000..1e7acaf8697 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch @@ -0,0 +1,51 @@ +From e3442cacd83a4e1d43e2b77391c6dc5898eb8955 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 15:56:12 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property + +From: Chen-Yu Tsai + +[ Upstream commit e9a9055fdcdc1e5a27cef118c5b4f09cdd2fa28e ] + +The "output-enable" property is set on uart1's RTS pin. This is bogus +because the hardware does not actually have a controllable output +buffer. Secondly, the implementation incorrectly treats this property +as a request to switch the pin to GPIO output. This does not fit the +intended semantic of "output-enable" and it does not have any affect +either because the pin is muxed to the UART function, not the GPIO +function. + +Drop the property. + +Fixes: cd894e274b74 ("arm64: dts: mt8183: Add krane-sku176 board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20240412075613.1200048-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index 100191c6453ba..feb8a5acf2cd6 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -803,7 +803,6 @@ pins-tx { + }; + pins-rts { + pinmux = ; +- output-enable; + }; + pins-cts { + pinmux = ; +@@ -822,7 +821,6 @@ pins-tx { + }; + pins-rts { + pinmux = ; +- output-enable; + }; + pins-cts { + pinmux = ; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8183-kukui-fix-the-value-of-dlg.patch b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-fix-the-value-of-dlg.patch new file mode 100644 index 00000000000..9365f7f75af --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-fix-the-value-of-dlg.patch @@ -0,0 +1,39 @@ +From f10f9b7a7162fa3a2bcb52fab4e18999ae8a8303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 11:58:54 +0000 +Subject: arm64: dts: mediatek: mt8183-kukui: Fix the value of + `dlg,jack-det-rate` mismatch + +From: Hsin-Te Yuan + +[ Upstream commit 95173af725e6f41eb470466a52ddf2054439409c ] + +According to Documentation/devicetree/bindings/sound/dialog,da7219.yaml, +the value of `dlg,jack-det-rate` property should be "32_64" instead of +"32ms_64ms". + +Fixes: dc0ff0fa3a9b ("ASoC: da7219: Add Jack insertion detection polarity") +Signed-off-by: Hsin-Te Yuan +Link: https://lore.kernel.org/r/20240613-jack-rate-v2-1-ebc5f9f37931@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi +index 8b57706ac8140..586eee79c73cf 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-audio-da7219.dtsi +@@ -27,7 +27,7 @@ da7219_aad { + dlg,btn-cfg = <50>; + dlg,mic-det-thr = <500>; + dlg,jack-ins-deb = <20>; +- dlg,jack-det-rate = "32ms_64ms"; ++ dlg,jack-det-rate = "32_64"; + dlg,jack-rem-deb = <1>; + + dlg,a-d-btn-thr = <0xa>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch new file mode 100644 index 00000000000..d6893f7b552 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch @@ -0,0 +1,69 @@ +From fb54770d6124434ed24cd70789798ea3c557411c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 16:39:29 +0800 +Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Add ports node for + anx7625 + +From: Chen-Yu Tsai + +[ Upstream commit 4055416e6c51347e7dd5784065263fe0ced0bb7d ] + +The anx7625 binding requires a "ports" node as a container for the +"port" nodes. The jacuzzi dtsi file is missing it. + +Add a "ports" node under the anx7625 node, and move the port related +nodes and properties under it. + +Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240131083931.3970388-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 25 +++++++++++-------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +index 7592e3b860377..fa4ab4d2899f9 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi +@@ -155,21 +155,24 @@ anx_bridge: anx7625@58 { + vdd18-supply = <&pp1800_mipibrdg>; + vdd33-supply = <&vddio_mipibrdg>; + +- #address-cells = <1>; +- #size-cells = <0>; +- port@0 { +- reg = <0>; ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; + +- anx7625_in: endpoint { +- remote-endpoint = <&dsi_out>; ++ port@0 { ++ reg = <0>; ++ ++ anx7625_in: endpoint { ++ remote-endpoint = <&dsi_out>; ++ }; + }; +- }; + +- port@1 { +- reg = <1>; ++ port@1 { ++ reg = <1>; + +- anx7625_out: endpoint { +- remote-endpoint = <&panel_in>; ++ anx7625_out: endpoint { ++ remote-endpoint = <&panel_in>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8183-pico6-fix-wake-on-x-event-.patch b/queue-6.10/arm64-dts-mediatek-mt8183-pico6-fix-wake-on-x-event-.patch new file mode 100644 index 00000000000..f3ac59f1349 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8183-pico6-fix-wake-on-x-event-.patch @@ -0,0 +1,71 @@ +From 4792513dcda5b3dfdc0e085b01fe945679d0995e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 16:40:41 +0800 +Subject: arm64: dts: mediatek: mt8183-pico6: Fix wake-on-X event node names + +From: Chen-Yu Tsai + +[ Upstream commit 70bf81dd2c2dedbed1f19dfc5d1d2f22474a5296 ] + +The wake-on-bt and wake-on-wlan nodes don't have a button- or event- +prefix that the gpio-keys binding requires. + +Fix up the node names to satisfy the binding. While at it, also fix up +the GPIO overriding structure for the wake-on-wlan node. Instead of +referencing the gpio-keys node and then open coding the node, add a +label for the event node, and use that to reference and override the +GPIO settings. + +Fixes: 055ef10ccdd4 ("arm64: dts: mt8183: Add jacuzzi pico/pico6 board") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240131084043.3970576-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + .../boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts | 8 +++----- + arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 2 +- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts +index 6a7ae616512d6..0d5a11c93c681 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts +@@ -17,7 +17,7 @@ bt_wakeup: bt-wakeup { + pinctrl-names = "default"; + pinctrl-0 = <&bt_pins_wakeup>; + +- wobt { ++ event-wobt { + label = "Wake on BT"; + gpios = <&pio 42 GPIO_ACTIVE_HIGH>; + linux,code = ; +@@ -47,10 +47,8 @@ trackpad@2c { + }; + }; + +-&wifi_wakeup { +- wowlan { +- gpios = <&pio 113 GPIO_ACTIVE_LOW>; +- }; ++&wifi_wakeup_event { ++ gpios = <&pio 113 GPIO_ACTIVE_LOW>; + }; + + &wifi_pwrseq { +diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +index feb8a5acf2cd6..2fbd226bf142c 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi +@@ -152,7 +152,7 @@ wifi_wakeup: wifi-wakeup { + pinctrl-names = "default"; + pinctrl-0 = <&wifi_pins_wakeup>; + +- button-wowlan { ++ wifi_wakeup_event: event-wowlan { + label = "Wake on WiFi"; + gpios = <&pio 113 GPIO_ACTIVE_HIGH>; + linux,code = ; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8192-asurada-add-off-on-delay-u.patch b/queue-6.10/arm64-dts-mediatek-mt8192-asurada-add-off-on-delay-u.patch new file mode 100644 index 00000000000..52362ebf391 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8192-asurada-add-off-on-delay-u.patch @@ -0,0 +1,54 @@ +From e679f80d9e90c1ec10dfbbb8a2a8583c91f9c810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 23:39:51 +0800 +Subject: arm64: dts: mediatek: mt8192-asurada: Add off-on-delay-us for + pp3300_mipibrdg + +From: Pin-yen Lin + +[ Upstream commit 897a7edba9330974726c564dfdbf4fb5e203b9ac ] + +Set off-on-delay-us to 500000 us for pp3300_mipibrdg to make sure it +complies with the panel's unprepare delay (the time to power down +completely) of the power sequence. Explicit configuration on the +regulator node is required because mt8192-asurada uses the same power +supply for the panel and the anx7625 DP bridge. + +For example, the power sequence could be violated in this sequence: +1. Bridge on: panel goes off, but regulator doesn't turn off (refcount=1). +2. Bridge off: regulator turns off (refcount=0). +3. Bridge resume -> regulator turns on but the bridge driver doesn't + check the delay. + +Or in this sequence: +1. Bridge on: panel goes off. The regulator doesn't turn off (refcount=1), + but the .unprepared_time in panel_edp is still updated. +2. Bridge off, regulator goes off (refcount=0). +3. Panel on, but the panel driver uses the wrong .unprepared_time to check + the unprepare delay. + +Fixes: f9f00b1f6b9b ("arm64: dts: mediatek: asurada: Add display regulators") +Signed-off-by: Pin-yen Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240502154455.3427793-1-treapking@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +index 7a704246678f0..08d71ddf36683 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi +@@ -147,6 +147,7 @@ pp3300_mipibrdg: regulator-3v3-mipibrdg { + regulator-boot-on; + gpio = <&pio 127 GPIO_ACTIVE_HIGH>; + vin-supply = <&pp3300_g>; ++ off-on-delay-us = <500000>; + }; + + /* separately switched 3.3V power rail */ +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8192-fix-gpu-thermal-zone-name-.patch b/queue-6.10/arm64-dts-mediatek-mt8192-fix-gpu-thermal-zone-name-.patch new file mode 100644 index 00000000000..06c8d7fb61d --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8192-fix-gpu-thermal-zone-name-.patch @@ -0,0 +1,36 @@ +From e45dc303671a0a36fe9097a63ff60797bf120d29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 10:30:01 +0200 +Subject: arm64: dts: mediatek: mt8192: Fix GPU thermal zone name for SVS + +From: AngeloGioacchino Del Regno + +[ Upstream commit 86beeec5dd2b8e28217f67815a3fb15752031667 ] + +This SoC has two GPU related thermal zones: the primary zone must be +called "gpu-thermal" for SVS to pick it up. + +Fixes: c7a728051f4e ("arm64: dts: mediatek: mt8192: Add thermal nodes and thermal zones") +Link: https://lore.kernel.org/r/20240410083002.1357857-3-angelogioacchino.delregno@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 84cbdf6e9eb0c..47dea10dd3b8b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -2234,7 +2234,7 @@ vpu1_crit: trip-crit { + }; + }; + +- gpu0-thermal { ++ gpu-thermal { + polling-delay = <1000>; + polling-delay-passive = <250>; + thermal-sensors = <&lvts_ap MT8192_AP_GPU0>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-mediatek-mt8195-fix-gpu-thermal-zone-name-.patch b/queue-6.10/arm64-dts-mediatek-mt8195-fix-gpu-thermal-zone-name-.patch new file mode 100644 index 00000000000..8f0eb545e38 --- /dev/null +++ b/queue-6.10/arm64-dts-mediatek-mt8195-fix-gpu-thermal-zone-name-.patch @@ -0,0 +1,36 @@ +From da0cc0487cae26a0df6621c423e72e4e4495ac1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 10:30:00 +0200 +Subject: arm64: dts: mediatek: mt8195: Fix GPU thermal zone name for SVS + +From: AngeloGioacchino Del Regno + +[ Upstream commit b2b6f2edb82a08abe8942535bc77da55a0f43e14 ] + +This SoC has two GPU related thermal zones: the primary zone must be +called "gpu-thermal" for SVS to pick it up. + +Fixes: 1e5b6725199f ("arm64: dts: mediatek: mt8195: Add AP domain thermal zones") +Link: https://lore.kernel.org/r/20240410083002.1357857-2-angelogioacchino.delregno@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +index 5d8b68f86ce44..2ee45752583c0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi +@@ -3880,7 +3880,7 @@ vpu1_crit: trip-crit { + }; + }; + +- gpu0-thermal { ++ gpu-thermal { + polling-delay = <1000>; + polling-delay-passive = <250>; + thermal-sensors = <&lvts_ap MT8195_AP_GPU0>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch b/queue-6.10/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch new file mode 100644 index 00000000000..79a025fdf22 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch @@ -0,0 +1,42 @@ +From 07a02bebabf61ca5b39b2cf999dabe248fe3f29f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 03:04:31 +0300 +Subject: arm64: dts: qcom: msm8996: specify UFS core_clk frequencies + +From: Dmitry Baryshkov + +[ Upstream commit 02f838b7f8cdfb7a96b7f08e7f6716f230bdecba ] + +Follow the example of other platforms and specify core_clk frequencies +in the frequency table in addition to the core_clk_src frequencies. The +driver should be setting the leaf frequency instead of some interim +clock freq. + +Suggested-by: Nitin Rawat +Fixes: 57fc67ef0d35 ("arm64: dts: qcom: msm8996: Add ufs related nodes") +Reviewed-by: Konrad Dybcio +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240408-msm8996-fix-ufs-v4-1-ee1a28bf8579@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 6e7a4bb08b35c..0717605ac5a0e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -2102,7 +2102,7 @@ ufshc: ufshc@624000 { + <&gcc GCC_UFS_RX_SYMBOL_0_CLK>; + freq-table-hz = + <100000000 200000000>, +- <0 0>, ++ <100000000 200000000>, + <0 0>, + <0 0>, + <0 0>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch b/queue-6.10/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch new file mode 100644 index 00000000000..9a84e049849 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch @@ -0,0 +1,38 @@ +From c33d9cac0ba718c93f4a1aaa3d6964ff9c495736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:39 +0300 +Subject: arm64: dts: qcom: msm8996-xiaomi-common: drop excton from the USB PHY + +From: Dmitry Baryshkov + +[ Upstream commit c1aefeae8cb7b71c1bb6d33b1bda7fc322094e16 ] + +The USB PHYs don't use extcon connectors, drop the extcon property from +the hsusb_phy1 node. + +Fixes: 46680fe9ba61 ("arm64: dts: qcom: msm8996: Add support for the Xiaomi MSM8996 platform") +Cc: Yassine Oudjana +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-13-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi +index 5ab583be9e0a0..0386636a29f05 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-common.dtsi +@@ -405,7 +405,6 @@ &usb3_dwc3 { + + &hsusb_phy1 { + status = "okay"; +- extcon = <&typec>; + + vdda-pll-supply = <&vreg_l12a_1p8>; + vdda-phy-dpdm-supply = <&vreg_l24a_3p075>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch b/queue-6.10/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch new file mode 100644 index 00000000000..37f37c8eab5 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch @@ -0,0 +1,48 @@ +From 6a25ee732dfe8f46beeacbcb2032dfc795cb701a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:27:44 +0200 +Subject: arm64: dts: qcom: msm8998: enable adreno_smmu by default + +From: Marc Gonzalez + +[ Upstream commit 98a0c4f2278b4d6c1c7722735c20b2247de6293f ] + +15 qcom platform DTSI files define an adreno_smmu node. +msm8998 is the only one with adreno_smmu disabled by default. + +There's no reason why this SMMU should be disabled by default, +it doesn't need any further configuration. + +Bring msm8998 in line with the 14 other platforms. + +This fixes GPU init failing with ENODEV: +msm_dpu c901000.display-controller: failed to load adreno gpu +msm_dpu c901000.display-controller: failed to bind 5000000.gpu (ops a3xx_ops): -19 + +Fixes: 87cd46d68aeac8 ("Configure Adreno GPU and related IOMMU") +Signed-off-by: Marc Gonzalez +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Marijn Suijten +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/be51d1a4-e8fc-48d1-9afb-a42b1d6ca478@freebox.fr +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index 2dbef4b526ab7..a88bff737d173 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -1590,7 +1590,6 @@ adreno_smmu: iommu@5040000 { + * SoC VDDMX RPM Power Domain in the Adreno driver. + */ + power-domains = <&gpucc GPU_GX_GDSC>; +- status = "disabled"; + }; + + gpucc: clock-controller@5065000 { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-qdu1000-add-secure-qfprom-node.patch b/queue-6.10/arm64-dts-qcom-qdu1000-add-secure-qfprom-node.patch new file mode 100644 index 00000000000..38ce9764543 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-qdu1000-add-secure-qfprom-node.patch @@ -0,0 +1,54 @@ +From 8066469c95035b824da7373b798b571c9a9d3028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 14:57:11 +0530 +Subject: arm64: dts: qcom: qdu1000: Add secure qfprom node + +From: Komal Bajaj + +[ Upstream commit 367fb3f0aaa6eac9101dc683dd27c268b4cc702e ] + +Add secure qfprom node and also add properties for multi channel +DDR. This is required for LLCC driver to pick the correct LLCC +configuration. + +Fixes: 6209038f131f ("arm64: dts: qcom: qdu1000: Add LLCC/system-cache-controller") +Signed-off-by: Komal Bajaj +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Reviewed-by: Mukesh Ojha +Link: https://lore.kernel.org/r/20240618092711.15037-1-quic_kbajaj@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qdu1000.dtsi | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qdu1000.dtsi b/arch/arm64/boot/dts/qcom/qdu1000.dtsi +index f90f03fa6a24f..1da40f4b4f8ac 100644 +--- a/arch/arm64/boot/dts/qcom/qdu1000.dtsi ++++ b/arch/arm64/boot/dts/qcom/qdu1000.dtsi +@@ -1478,6 +1478,21 @@ system-cache-controller@19200000 { + "llcc7_base", + "llcc_broadcast_base"; + interrupts = ; ++ ++ nvmem-cells = <&multi_chan_ddr>; ++ nvmem-cell-names = "multi-chan-ddr"; ++ }; ++ ++ sec_qfprom: efuse@221c8000 { ++ compatible = "qcom,qdu1000-sec-qfprom", "qcom,sec-qfprom"; ++ reg = <0 0x221c8000 0 0x1000>; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ++ multi_chan_ddr: multi-chan-ddr@12b { ++ reg = <0x12b 0x1>; ++ bits = <0 2>; ++ }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-qrb4210-rb2-correct-max-current-draw-.patch b/queue-6.10/arm64-dts-qcom-qrb4210-rb2-correct-max-current-draw-.patch new file mode 100644 index 00000000000..5f1060478da --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-qrb4210-rb2-correct-max-current-draw-.patch @@ -0,0 +1,42 @@ +From 696ff343c85149c07f8dcad7ababf2fbe47b3e31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 13:01:19 +0700 +Subject: arm64: dts: qcom: qrb4210-rb2: Correct max current draw for VBUS + +From: Dang Huynh + +[ Upstream commit c6050d45cd372e4a34f9f501b30243caf2e810c6 ] + +According to downstream sources, maximum current for PMI632 VBUS +is 1A. + +Taken from msm-4.19 (631561973a034e46ccacd0e53ef65d13a40d87a4) +Line 685-687 in drivers/power/supply/qcom/qpnp-smb5.c + +Fixes: a06a2f12f9e2 ("arm64: dts: qcom: qrb4210-rb2: enable USB-C port handling") +Reviewed-by: Luca Weiss +Signed-off-by: Dang Huynh +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240702-qrd4210rb2-vbus-volt-v3-1-fbd24661eec4@riseup.net +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +index 1c7de7f2db791..1888d99d398b1 100644 +--- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts ++++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +@@ -305,7 +305,7 @@ pmi632_ss_in: endpoint { + + &pmi632_vbus { + regulator-min-microamp = <500000>; +- regulator-max-microamp = <3000000>; ++ regulator-max-microamp = <1000000>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-qrb4210-rb2-make-l9a-always-on.patch b/queue-6.10/arm64-dts-qcom-qrb4210-rb2-make-l9a-always-on.patch new file mode 100644 index 00000000000..76450fe58ab --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-qrb4210-rb2-make-l9a-always-on.patch @@ -0,0 +1,41 @@ +From c8b9a6dea3e0f446a9cafa824caecf1999db3616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 12:00:49 +0300 +Subject: arm64: dts: qcom: qrb4210-rb2: make L9A always-on + +From: Dmitry Baryshkov + +[ Upstream commit d6c6b85bf5582bbe2efefa9a083178b5f7eef439 ] + +The L9A regulator is used to further control voltage regulators on the +board. It can be used to disable VBAT_mains, 1.8V, 3.3V, 5V rails). Make +sure that is stays always on to prevent undervolting of these volage +rails. + +Fixes: 8d58a8c0d930 ("arm64: dts: qcom: Add base qrb4210-rb2 board dts") +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240605-rb2-l9a-aon-v2-1-0d493d0d107c@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +index cb8a62714a302..1c7de7f2db791 100644 +--- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts ++++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts +@@ -414,6 +414,8 @@ vreg_l9a_1p8: l9 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-allow-set-load; ++ regulator-always-on; ++ regulator-boot-on; + }; + + vreg_l10a_1p8: l10 { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sa8775p-mark-ethernet-devices-as-dma-.patch b/queue-6.10/arm64-dts-qcom-sa8775p-mark-ethernet-devices-as-dma-.patch new file mode 100644 index 00000000000..625fc98c17b --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sa8775p-mark-ethernet-devices-as-dma-.patch @@ -0,0 +1,44 @@ +From 1cf083fa13e1a3d131428eccfc5f95367ffd556f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 17:06:51 -0700 +Subject: arm64: dts: qcom: sa8775p: mark ethernet devices as DMA-coherent + +From: Sagar Cheluvegowda + +[ Upstream commit 49cc31f8ab44e60d8109da7e18c0983a917d4d74 ] + +Ethernet devices are cache coherent, mark it as such in the dtsi. + +Fixes: ff499a0fbb23 ("arm64: dts: qcom: sa8775p: add the first 1Gb ethernet interface") +Fixes: e952348a7cc7 ("arm64: dts: qcom: sa8775p: add a node for EMAC1") +Signed-off-by: Sagar Cheluvegowda +Link: https://lore.kernel.org/r/20240514-mark_ethernet_devices_dma_coherent-v4-1-04e1198858c5@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sa8775p.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sa8775p.dtsi b/arch/arm64/boot/dts/qcom/sa8775p.dtsi +index 1b3dc0ece54de..490e0369f5299 100644 +--- a/arch/arm64/boot/dts/qcom/sa8775p.dtsi ++++ b/arch/arm64/boot/dts/qcom/sa8775p.dtsi +@@ -2504,6 +2504,7 @@ ethernet1: ethernet@23000000 { + phy-names = "serdes"; + + iommus = <&apps_smmu 0x140 0xf>; ++ dma-coherent; + + snps,tso; + snps,pbl = <32>; +@@ -2538,6 +2539,7 @@ ethernet0: ethernet@23040000 { + phy-names = "serdes"; + + iommus = <&apps_smmu 0x120 0xf>; ++ dma-coherent; + + snps,tso; + snps,pbl = <32>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc7180-drop-extra-ufs-phy-compat.patch b/queue-6.10/arm64-dts-qcom-sc7180-drop-extra-ufs-phy-compat.patch new file mode 100644 index 00000000000..c5448a66116 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc7180-drop-extra-ufs-phy-compat.patch @@ -0,0 +1,39 @@ +From 04a4798a3b48cdf3aa7c9881b9d4a5737d5e61dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:30 +0300 +Subject: arm64: dts: qcom: sc7180: drop extra UFS PHY compat + +From: Dmitry Baryshkov + +[ Upstream commit 48299f604d27dad1168cc90b89f33853162c6e33 ] + +The DT schema doesn't have a fallback compatible for +qcom,sc7180-qmp-ufs-phy. Drop it from the dtsi too. + +Fixes: 858536d9dc94 ("arm64: dts: qcom: sc7180: Add UFS nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-4-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index e9deffe3aaf6c..9ab0c98cac054 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -1582,8 +1582,7 @@ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>, + }; + + ufs_mem_phy: phy@1d87000 { +- compatible = "qcom,sc7180-qmp-ufs-phy", +- "qcom,sm7150-qmp-ufs-phy"; ++ compatible = "qcom,sc7180-qmp-ufs-phy"; + reg = <0 0x01d87000 0 0x1000>; + clocks = <&rpmhcc RPMH_CXO_CLK>, + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc7180-trogdor-disable-pwmleds-node-w.patch b/queue-6.10/arm64-dts-qcom-sc7180-trogdor-disable-pwmleds-node-w.patch new file mode 100644 index 00000000000..5f503addfe9 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc7180-trogdor-disable-pwmleds-node-w.patch @@ -0,0 +1,171 @@ +From 11cbb164f18e84f8c8d0a6fe94be03c7e5a32543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 16:59:36 -0400 +Subject: arm64: dts: qcom: sc7180-trogdor: Disable pwmleds node where unused +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 99e94768c890c7522af020ff0e5e5317b2d046d9 ] + +Currently the keyboard backlight is described in the common +sc7180-trogdor dtsi as an led node below a pwmleds node, and the led +node is set to disabled. Only the boards that have a keyboard backlight +enable it. + +However, since the parent pwmleds node is still enabled everywhere, even +on boards that don't have keyboard backlight it is probed and fails, +resulting in an error: + + leds_pwm pwmleds: probe with driver leds_pwm failed with error -22 + +as well as a failure in the DT kselftest: + + not ok 45 /pwmleds + +Fix this by controlling the status of the parent pwmleds node instead of +the child led, based on the presence of keyboard backlight. This is what +is done on sc7280 already. + +While at it add a missing blank line before the child node to follow the +coding style. + +Fixes: 7ec3e67307f8 ("arm64: dts: qcom: sc7180-trogdor: add initial trogdor and lazor dt") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Konrad Dybcio +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240614-sc7180-pwmleds-probe-v1-1-e2c3f1b42a43@collabora.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts | 2 +- + arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 5 +++-- + 9 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts +index 919bfaea6189c..340cb119d0a0d 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-kb.dts +@@ -12,6 +12,6 @@ / { + compatible = "google,lazor-rev1-sku2", "google,lazor-rev2-sku2", "qcom,sc7180"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts +index eb20157f6af98..d45e60e3eb9eb 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r1-lte.dts +@@ -17,6 +17,6 @@ &ap_sar_sensor_i2c { + status = "okay"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts +index 45d34718a1bce..e906ce877b8cd 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-kb.dts +@@ -18,6 +18,6 @@ / { + compatible = "google,lazor-sku2", "qcom,sc7180"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts +index 79028d0dd1b0c..4b9ee15b09f6b 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r10-lte.dts +@@ -22,6 +22,6 @@ &ap_sar_sensor_i2c { + status = "okay"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts +index 3459b81c56283..a960553f39946 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-kb.dts +@@ -21,6 +21,6 @@ / { + "qcom,sc7180"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts +index ff8f47da109d8..82bd9ed7e21a9 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r3-lte.dts +@@ -25,6 +25,6 @@ &ap_sar_sensor_i2c { + status = "okay"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts +index faf527972977a..6278c1715d3fd 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-kb.dts +@@ -18,6 +18,6 @@ / { + compatible = "google,lazor-rev9-sku2", "qcom,sc7180"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts +index d737fd0637fbc..0ec1697ae2c97 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-lazor-r9-lte.dts +@@ -22,6 +22,6 @@ &ap_sar_sensor_i2c { + status = "okay"; + }; + +-&keyboard_backlight { ++&pwmleds { + status = "okay"; + }; +diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi +index 8513be2971201..098a8b4c793e6 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi +@@ -359,10 +359,11 @@ max98360a: audio-codec-0 { + #sound-dai-cells = <0>; + }; + +- pwmleds { ++ pwmleds: pwmleds { + compatible = "pwm-leds"; ++ status = "disabled"; ++ + keyboard_backlight: led-0 { +- status = "disabled"; + label = "cros_ec::kbd_backlight"; + function = LED_FUNCTION_KBD_BACKLIGHT; + pwms = <&cros_ec_pwm 0>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc7280-remove-cts-rts-configuration.patch b/queue-6.10/arm64-dts-qcom-sc7280-remove-cts-rts-configuration.patch new file mode 100644 index 00000000000..faf4beddd52 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc7280-remove-cts-rts-configuration.patch @@ -0,0 +1,136 @@ +From 958d715c7a19dea209397afcab094a851b0c2588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 13:28:53 +0530 +Subject: arm64: dts: qcom: sc7280: Remove CTS/RTS configuration + +From: Viken Dadhaniya + +[ Upstream commit 2b96407b8f10f1d71b58cb35704eb91b8ea78db1 ] + +For IDP variant, GPIO 20/21 is used by camera use case and camera +driver is not able acquire these GPIOs as it is acquired by UART5 +driver as RTS/CTS pin. + +UART5 is designed for debug UART for all the board variants of the +sc7280 chipset and RTS/CTS configuration is not required for debug +uart usecase. + +Remove CTS/RTS configuration for UART5 instance and change compatible +string to debug UART. + +Remove overwriting compatible property from individual target specific +file as it is not required. + +Fixes: 38cd93f413fd ("arm64: dts: qcom: sc7280: Update QUPv3 UART5 DT node") +Signed-off-by: Viken Dadhaniya +Link: https://lore.kernel.org/r/20240424075853.11445-1-quic_vdadhani@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 1 - + arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 1 - + arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 1 - + arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 1 - + arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi | 1 - + arch/arm64/boot/dts/qcom/sc7280.dtsi | 14 ++------------ + 6 files changed, 2 insertions(+), 17 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts +index f3432701945f7..8cd2fe80dbb2c 100644 +--- a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts ++++ b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts +@@ -864,7 +864,6 @@ sw_ctrl_default: sw-ctrl-default-state { + }; + + &uart5 { +- compatible = "qcom,geni-debug-uart"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts +index 47ca2d0003414..107302680f562 100644 +--- a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts ++++ b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts +@@ -658,7 +658,6 @@ &tlmm { + }; + + &uart5 { +- compatible = "qcom,geni-debug-uart"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts +index a085ff5b5fb21..7256b51eb08f9 100644 +--- a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts ++++ b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts +@@ -632,7 +632,6 @@ &tlmm { + }; + + &uart5 { +- compatible = "qcom,geni-debug-uart"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +index a0059527d9e48..7370aa0dbf0e3 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +@@ -495,7 +495,6 @@ wcd_tx: codec@0,3 { + }; + + &uart5 { +- compatible = "qcom,geni-debug-uart"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi b/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi +index f9b96bd2477ea..7d1d5bbbbbd95 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi +@@ -427,7 +427,6 @@ wcd_tx: codec@0,3 { + }; + + uart_dbg: &uart5 { +- compatible = "qcom,geni-debug-uart"; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 2f7780f629ac5..c4a05d7b7ce65 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1440,12 +1440,12 @@ spi5: spi@994000 { + }; + + uart5: serial@994000 { +- compatible = "qcom,geni-uart"; ++ compatible = "qcom,geni-debug-uart"; + reg = <0 0x00994000 0 0x4000>; + clocks = <&gcc GCC_QUPV3_WRAP0_S5_CLK>; + clock-names = "se"; + pinctrl-names = "default"; +- pinctrl-0 = <&qup_uart5_cts>, <&qup_uart5_rts>, <&qup_uart5_tx>, <&qup_uart5_rx>; ++ pinctrl-0 = <&qup_uart5_tx>, <&qup_uart5_rx>; + interrupts = ; + power-domains = <&rpmhpd SC7280_CX>; + operating-points-v2 = <&qup_opp_table>; +@@ -5408,16 +5408,6 @@ qup_uart4_rx: qup-uart4-rx-state { + function = "qup04"; + }; + +- qup_uart5_cts: qup-uart5-cts-state { +- pins = "gpio20"; +- function = "qup05"; +- }; +- +- qup_uart5_rts: qup-uart5-rts-state { +- pins = "gpio21"; +- function = "qup05"; +- }; +- + qup_uart5_tx: qup-uart5-tx-state { + pins = "gpio22"; + function = "qup05"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc8180x-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sc8180x-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..1e348f7cbff --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc8180x-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 1a38b4fee1f626d718c178fb15375b99d8c86538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:31 +0300 +Subject: arm64: dts: qcom: sc8180x: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 9a80ecce60bd4919019a3cdb64604c9b183a8518 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-5-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index 456ec81327021..da69577b6f09b 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -2245,6 +2245,8 @@ ufs_mem_phy: phy-wrapper@1d87000 { + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + #phy-cells = <0>; + + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc8180x-correct-pcie-slave-ports.patch b/queue-6.10/arm64-dts-qcom-sc8180x-correct-pcie-slave-ports.patch new file mode 100644 index 00000000000..2d829a22ff3 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc8180x-correct-pcie-slave-ports.patch @@ -0,0 +1,59 @@ +From b87533c1f081db9be77d67a2669bf90c04f3206d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 May 2024 10:56:20 -0700 +Subject: arm64: dts: qcom: sc8180x: Correct PCIe slave ports + +From: Bjorn Andersson + +[ Upstream commit dc402e084a9e0cc714ffd6008dce3c63281b8142 ] + +The interconnects property was clearly copy-pasted between the 4 PCIe +controllers, giving all four the cpu-pcie path destination of SLAVE_0. + +The four ports are all associated with CN0, but update the property for +correctness sake. + +Fixes: d20b6c84f56a ("arm64: dts: qcom: sc8180x: Add PCIe instances") +Signed-off-by: Bjorn Andersson +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240525-sc8180x-pcie-interconnect-port-fix-v1-1-f86affa02392@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8180x.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +index 581a70c34fd29..456ec81327021 100644 +--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi +@@ -1890,7 +1890,7 @@ pcie3: pcie@1c08000 { + power-domains = <&gcc PCIE_3_GDSC>; + + interconnects = <&aggre2_noc MASTER_PCIE_3 0 &mc_virt SLAVE_EBI_CH0 0>, +- <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>; ++ <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_3 0>; + interconnect-names = "pcie-mem", "cpu-pcie"; + + phys = <&pcie3_phy>; +@@ -2012,7 +2012,7 @@ pcie1: pcie@1c10000 { + power-domains = <&gcc PCIE_1_GDSC>; + + interconnects = <&aggre2_noc MASTER_PCIE_1 0 &mc_virt SLAVE_EBI_CH0 0>, +- <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>; ++ <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_1 0>; + interconnect-names = "pcie-mem", "cpu-pcie"; + + phys = <&pcie1_phy>; +@@ -2134,7 +2134,7 @@ pcie2: pcie@1c18000 { + power-domains = <&gcc PCIE_2_GDSC>; + + interconnects = <&aggre2_noc MASTER_PCIE_2 0 &mc_virt SLAVE_EBI_CH0 0>, +- <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_0 0>; ++ <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_PCIE_2 0>; + interconnect-names = "pcie-mem", "cpu-pcie"; + + phys = <&pcie2_phy>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc8280xp-remove-thermal-zone-polling-.patch b/queue-6.10/arm64-dts-qcom-sc8280xp-remove-thermal-zone-polling-.patch new file mode 100644 index 00000000000..bdc28f8ff0f --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc8280xp-remove-thermal-zone-polling-.patch @@ -0,0 +1,155 @@ +From 67281a19ea0e1aeb8d9683c685233eebd23d9a91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 13:59:42 +0200 +Subject: arm64: dts: qcom: sc8280xp-*: Remove thermal zone polling delays + +From: Konrad Dybcio + +[ Upstream commit e388421387e8b1b51c507883aaf13f40277fe137 ] + +All of the thermal zone suppliers are interrupt-driven, remove the +bogus and unnecessary polling that only wastes CPU time. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240510-topic-msm-polling-cleanup-v2-19-436ca4218da2@linaro.org +Signed-off-by: Bjorn Andersson +Stable-dep-of: f7fd6d04c104 ("arm64: dts: qcom: sc8280xp: Throttle the GPU when overheating") +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 +- + arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi | 4 ++-- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 13 ------------- + 3 files changed, 3 insertions(+), 16 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +index 4bf99b6b6e5fb..6b759e67f4d3d 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +@@ -299,7 +299,7 @@ linux,cma { + thermal-zones { + skin-temp-thermal { + polling-delay-passive = <250>; +- polling-delay = <0>; ++ + thermal-sensors = <&pmk8280_adc_tm 5>; + + trips { +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi +index 945de77911de1..1e3babf2e40d8 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-pmics.dtsi +@@ -14,7 +14,7 @@ / { + thermal-zones { + pm8280_1_thermal: pm8280-1-thermal { + polling-delay-passive = <100>; +- polling-delay = <0>; ++ + thermal-sensors = <&pm8280_1_temp_alarm>; + + trips { +@@ -34,7 +34,7 @@ trip1 { + + pm8280_2_thermal: pm8280-2-thermal { + polling-delay-passive = <100>; +- polling-delay = <0>; ++ + thermal-sensors = <&pm8280_2_temp_alarm>; + + trips { +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 59f0a850671a3..de554d5d02010 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -5833,7 +5833,6 @@ sound: sound { + thermal-zones { + cpu0-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 1>; + +@@ -5848,7 +5847,6 @@ cpu-crit { + + cpu1-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 2>; + +@@ -5863,7 +5861,6 @@ cpu-crit { + + cpu2-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 3>; + +@@ -5878,7 +5875,6 @@ cpu-crit { + + cpu3-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 4>; + +@@ -5893,7 +5889,6 @@ cpu-crit { + + cpu4-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 5>; + +@@ -5908,7 +5903,6 @@ cpu-crit { + + cpu5-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 6>; + +@@ -5923,7 +5917,6 @@ cpu-crit { + + cpu6-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 7>; + +@@ -5938,7 +5931,6 @@ cpu-crit { + + cpu7-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 8>; + +@@ -5953,7 +5945,6 @@ cpu-crit { + + cluster0-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens0 9>; + +@@ -5967,9 +5958,6 @@ cpu-crit { + }; + + gpu-thermal { +- polling-delay-passive = <0>; +- polling-delay = <0>; +- + thermal-sensors = <&tsens2 2>; + + trips { +@@ -5983,7 +5971,6 @@ gpu-crit { + + mem-thermal { + polling-delay-passive = <250>; +- polling-delay = <1000>; + + thermal-sensors = <&tsens1 15>; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sc8280xp-throttle-the-gpu-when-overhe.patch b/queue-6.10/arm64-dts-qcom-sc8280xp-throttle-the-gpu-when-overhe.patch new file mode 100644 index 00000000000..114c13ab279 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sc8280xp-throttle-the-gpu-when-overhe.patch @@ -0,0 +1,57 @@ +From 71a4e43a1f799b65b48c17039826700c2c63654f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 14:58:31 +0200 +Subject: arm64: dts: qcom: sc8280xp: Throttle the GPU when overheating + +From: Konrad Dybcio + +[ Upstream commit f7fd6d04c1046107a87a0fc883ed044cf8b877a1 ] + +Add an 85C passive trip point with 1C of hysteresis to ensure the +thermal framework takes sufficient action to prevent reaching junction +temperature. Also, add passive polling to ensure more than one +temperature change event is recorded. + +Fixes: 014bbc990e27 ("arm64: dts: qcom: sc8280xp: Introduce additional tsens instances") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240510-topic-gpus_are_cool_now-v1-2-ababc269a438@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index de554d5d02010..b0b0ab7794466 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -5958,10 +5958,25 @@ cpu-crit { + }; + + gpu-thermal { ++ polling-delay-passive = <250>; ++ + thermal-sensors = <&tsens2 2>; + ++ cooling-maps { ++ map0 { ++ trip = <&gpu_alert0>; ++ cooling-device = <&gpu THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; ++ }; ++ }; ++ + trips { +- gpu-crit { ++ gpu_alert0: trip-point0 { ++ temperature = <85000>; ++ hysteresis = <1000>; ++ type = "passive"; ++ }; ++ ++ trip-point1 { + temperature = <110000>; + hysteresis = <1000>; + type = "critical"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..e6673675f19 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From b4eb090eea9de35b7b463481ada8bee7a634dff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:32 +0300 +Subject: arm64: dts: qcom: sdm845: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit fd39ae8b9bc10419b1e4b849cdbc6755a967ade1 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: cc16687fbd74 ("arm64: dts: qcom: sdm845: add UFS controller") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-6-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index d817a7751086e..4ad82b0eb1139 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -2666,6 +2666,8 @@ ufs_mem_phy: phy@1d87000 { + "ref_aux", + "qref"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sdm850-lenovo-yoga-c630-fix-ipa-firmw.patch b/queue-6.10/arm64-dts-qcom-sdm850-lenovo-yoga-c630-fix-ipa-firmw.patch new file mode 100644 index 00000000000..c0b3b76c51c --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sdm850-lenovo-yoga-c630-fix-ipa-firmw.patch @@ -0,0 +1,37 @@ +From 82aea49e0d62e8679ac0a511b5bbbd4d97ec6062 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 07:00:22 +0300 +Subject: arm64: dts: qcom: sdm850-lenovo-yoga-c630: fix IPA firmware path + +From: Dmitry Baryshkov + +[ Upstream commit cae4c862d8b2d7debb07e6d831e079520163ac4f ] + +Specify firmware path for the IPA network controller on the Lenovo Yoga +C630 laptop. Without this property IPA tries to load firmware from the +default location, which likely will fail. + +Fixes: 2e01e0c21459 ("arm64: dts: qcom: sdm850-yoga: Enable IPA") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240527-yoga-ipa-fw-v1-1-99ac1f5db283@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +index 47dc42f6e936c..8e30f8cc0916c 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +@@ -494,6 +494,7 @@ ecsh: hid@5c { + &ipa { + qcom,gsi-loader = "self"; + memory-region = <&ipa_fw_mem>; ++ firmware-name = "qcom/sdm850/LENOVO/81JL/ipa_fws.elf"; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm6115-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sm6115-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..0e9e72a51c1 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm6115-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 8f37480e763a059812a83a3a0cb1dc125dc71c6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:33 +0300 +Subject: arm64: dts: qcom: sm6115: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit a9eb454873a813ddc4578e5c3b37778de6fda472 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-7-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi +index b4ce5a322107e..8fa3bacfb2391 100644 +--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi +@@ -1231,6 +1231,8 @@ ufs_mem_phy: phy@4807000 { + "ref_aux", + "qref"; + ++ power-domains = <&gcc GCC_UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch b/queue-6.10/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch new file mode 100644 index 00000000000..d8eedcf9f69 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch @@ -0,0 +1,46 @@ +From b609d293f51153cadf202b8aa051cb6f75657918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 09:43:11 +0200 +Subject: arm64: dts: qcom: sm6350: Add missing qcom,non-secure-domain property + +From: Luca Weiss + +[ Upstream commit 81008068ee4f2c4c26e97a0404405bb4b450241b ] + +By default the DSP domains are secure, add the missing +qcom,non-secure-domain property to mark them as non-secure. + +Fixes: efc33c969f23 ("arm64: dts: qcom: sm6350: Add ADSP nodes") +Fixes: 8eb5287e8a42 ("arm64: dts: qcom: sm6350: Add CDSP nodes") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20240705-sm6350-fastrpc-fix-v2-1-89a43166c9bb@fairphone.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 5f862cf8858a7..60383f0d09f32 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -1323,6 +1323,7 @@ fastrpc { + compatible = "qcom,fastrpc"; + qcom,glink-channels = "fastrpcglink-apps-dsp"; + label = "adsp"; ++ qcom,non-secure-domain; + #address-cells = <1>; + #size-cells = <0>; + +@@ -1582,6 +1583,7 @@ fastrpc { + compatible = "qcom,fastrpc"; + qcom,glink-channels = "fastrpcglink-apps-dsp"; + label = "cdsp"; ++ qcom,non-secure-domain; + #address-cells = <1>; + #size-cells = <0>; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..01d6cb26b6a --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 0460a16e0c525e3f5bea45d96fbf0c06de1e610b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:34 +0300 +Subject: arm64: dts: qcom: sm6350: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 18c2727282c5264ff5502daac26c43000e8eb202 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-8-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi +index 6c7eac0110ba1..5f862cf8858a7 100644 +--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi +@@ -1197,6 +1197,8 @@ ufs_mem_phy: phy@1d87000 { + "ref_aux", + "qref"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..32a98a5188f --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From e85733ee64a9b811f786eec85b5475f8c81afc88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:35 +0300 +Subject: arm64: dts: qcom: sm8250: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 154ed5ea328d8a97a4ef5d1447e6f06d11fe2bbe ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: b7e2fba06622 ("arm64: dts: qcom: sm8250: Add UFS controller and PHY") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-9-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 8ccade628f1f4..b2af44bc3b78c 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -2580,6 +2580,8 @@ ufs_mem_phy: phy@1d87000 { + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + #phy-cells = <0>; + + status = "disabled"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm8350-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sm8350-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..75546a960fa --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm8350-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 5f890807cf832e6530b7f4b707e39ffd34760b0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:36 +0300 +Subject: arm64: dts: qcom: sm8350: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 634acc8cea1584b507801315831a330443f819b4 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 59c7cf814783 ("arm64: dts: qcom: sm8350: Add UFS nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-10-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi +index f7c4700f00c36..da936548c2ac3 100644 +--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi +@@ -1779,6 +1779,8 @@ ufs_mem_phy: phy@1d87000 { + "ref_aux", + "qref"; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch b/queue-6.10/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch new file mode 100644 index 00000000000..e37224c7ee7 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch @@ -0,0 +1,38 @@ +From 4a7dd520743cc9498b7c7a05ebeb33c40ca320be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2024 19:19:37 +0300 +Subject: arm64: dts: qcom: sm8450: add power-domain to UFS PHY + +From: Dmitry Baryshkov + +[ Upstream commit 27d3f57cf5a71484ea38770d4bfd10f6ef035cf4 ] + +The UFS PHY is powered on via the UFS_PHY_GDSC power domain. Add +corresponding power-domain the the PHY node. + +Fixes: 07fa917a335e ("arm64: dts: qcom: sm8450: add ufs nodes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-11-f1fd15c33fb3@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 616461fcbab99..59428d2ee1ad8 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -4429,6 +4429,8 @@ ufs_mem_phy: phy@1d87000 { + <&gcc GCC_UFS_PHY_PHY_AUX_CLK>, + <&gcc GCC_UFS_0_CLKREF_EN>; + ++ power-domains = <&gcc UFS_PHY_GDSC>; ++ + resets = <&ufs_mem_hc 0>; + reset-names = "ufsphy"; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-qcom-x1e80100-fix-usb-hs-phy-0.8v-supply.patch b/queue-6.10/arm64-dts-qcom-x1e80100-fix-usb-hs-phy-0.8v-supply.patch new file mode 100644 index 00000000000..911eaed7499 --- /dev/null +++ b/queue-6.10/arm64-dts-qcom-x1e80100-fix-usb-hs-phy-0.8v-supply.patch @@ -0,0 +1,89 @@ +From db4bfa2a638f608fa24d8dc3cc104cd8551ad766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jun 2024 09:29:43 +0300 +Subject: arm64: dts: qcom: x1e80100: Fix USB HS PHY 0.8V supply + +From: Abel Vesa + +[ Upstream commit 9c99c33a904c86d95ecf4e2690de6a826b88671c ] + +According to the power grid documentation, the 0.8v HS PHY shared +regulator is actually LDO3 from PM8550ve id J. Fix both CRD and QCP +boards. + +Fixes: d7e03cce0400 ("arm64: dts: qcom: x1e80100-crd: Enable more support") +Signed-off-by: Abel Vesa +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240629-x1e80100-dts-fix-hsphy-0-8v-supplies-v1-1-de99ee030b27@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 6 +++--- + arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/x1e80100-crd.dts b/arch/arm64/boot/dts/qcom/x1e80100-crd.dts +index 7618ae1f8b1c9..b063dd28149e7 100644 +--- a/arch/arm64/boot/dts/qcom/x1e80100-crd.dts ++++ b/arch/arm64/boot/dts/qcom/x1e80100-crd.dts +@@ -840,7 +840,7 @@ &uart21 { + }; + + &usb_1_ss0_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_0_eusb2_repeater>; +@@ -865,7 +865,7 @@ &usb_1_ss0_dwc3 { + }; + + &usb_1_ss1_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_1_eusb2_repeater>; +@@ -890,7 +890,7 @@ &usb_1_ss1_dwc3 { + }; + + &usb_1_ss2_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_2_eusb2_repeater>; +diff --git a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +index 5567636c8b27f..df3577fcd93c9 100644 +--- a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts ++++ b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts +@@ -536,7 +536,7 @@ &uart21 { + }; + + &usb_1_ss0_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_0_eusb2_repeater>; +@@ -561,7 +561,7 @@ &usb_1_ss0_dwc3 { + }; + + &usb_1_ss1_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_1_eusb2_repeater>; +@@ -586,7 +586,7 @@ &usb_1_ss1_dwc3 { + }; + + &usb_1_ss2_hsphy { +- vdd-supply = <&vreg_l2e_0p8>; ++ vdd-supply = <&vreg_l3j_0p8>; + vdda12-supply = <&vreg_l2j_1p2>; + + phys = <&smb2360_2_eusb2_repeater>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch b/queue-6.10/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..73cc599e8e6 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch @@ -0,0 +1,40 @@ +From be7b5ce240e8587b84a559944b95cf18a6f3d864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:31 +0200 +Subject: arm64: dts: renesas: r8a779a0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 6fca24a07e1de664c3d0b280043302e0387726df ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 834c310f541839b6 ("arm64: dts: renesas: Add Renesas R8A779A0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/671416fb31e3992101c32fe7e46147fe4cd623ae.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +index cfa70b441e329..d76347001cc13 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi +@@ -2919,6 +2919,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch b/queue-6.10/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..4476c2de992 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch @@ -0,0 +1,41 @@ +From 885a35ec2828df1d40f3df3b0f76bf299f379072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:32 +0200 +Subject: arm64: dts: renesas: r8a779f0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit b1c34567aebe300f9a0f70320eaeef0b3d56ffc7 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: c62331e8222f8f21 ("arm64: dts: renesas: Add Renesas R8A779F0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/46deba1008f73e4b6864f937642d17f9d4ae7205.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779f0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +index 72cf30341fc4d..9629adb47d99f 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779f0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779f0.dtsi +@@ -1324,7 +1324,10 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + + ufs30_clk: ufs30-clk { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch b/queue-6.10/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch new file mode 100644 index 00000000000..ac1cdfd6d75 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch @@ -0,0 +1,40 @@ +From 0686deae9800ae1aab17e0d649ab07f6bc49cd89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:33 +0200 +Subject: arm64: dts: renesas: r8a779g0: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 6775165fc95052a03acc91e25bc20fcf286910a7 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 987da486d84a5643 ("arm64: dts: renesas: Add Renesas R8A779G0 SoC support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5eeabbeaea1c5fd518a608f2e8013d260b00fd7e.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +index 9bc542bc61690..873588a84e15f 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi +@@ -2359,6 +2359,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r8a779h0-drop-opp-shared-from-opp-.patch b/queue-6.10/arm64-dts-renesas-r8a779h0-drop-opp-shared-from-opp-.patch new file mode 100644 index 00000000000..1a2791f538b --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r8a779h0-drop-opp-shared-from-opp-.patch @@ -0,0 +1,37 @@ +From 1e1bce725235760b097f2cbb55a90b1d863a0e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:38:45 +0200 +Subject: arm64: dts: renesas: r8a779h0: Drop "opp-shared" from opp-table-0 + +From: Geert Uytterhoeven + +[ Upstream commit f3acb237a17962349b61eed813f62dddf7aead29 ] + +The four Cortex-A76 CPU cores on R-Car V4M share their Operating +Performance Points (OPP) table, but they have independent clocks. +All cores in the cluster can switch DVFS states independently, hence +the cluster's OPP table should not have an "opp-shared" property. + +Fixes: 6bd8b0bc444eae56 ("arm64: dts: renesas: r8a779h0: Add CA76 operating points") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/4e0227ff4388485cdb1ca2855ee6df92754e756e.1718890585.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a779h0.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a779h0.dtsi b/arch/arm64/boot/dts/renesas/r8a779h0.dtsi +index 6d791024cabe1..792afe1a45747 100644 +--- a/arch/arm64/boot/dts/renesas/r8a779h0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a779h0.dtsi +@@ -16,7 +16,6 @@ / { + + cluster0_opp: opp-table-0 { + compatible = "operating-points-v2"; +- opp-shared; + + opp-500000000 { + opp-hz = /bits/ 64 <500000000>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch b/queue-6.10/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch new file mode 100644 index 00000000000..91309e3a425 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch @@ -0,0 +1,42 @@ +From d6ad1672b85b93feb172c716ad2f5c7bd5993f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:34 +0200 +Subject: arm64: dts: renesas: r9a07g043u: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 4036bae6dfd782d414040e7d714abc525b2e8792 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: cf40c9689e5109bf ("arm64: dts: renesas: Add initial DTSI for RZ/G2UL SoC") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/15cc7a7522b1658327a2bd0c4990d0131bbcb4d7.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +index 165bfcfef3bcc..18ef297db9336 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi +@@ -50,7 +50,10 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch b/queue-6.10/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch new file mode 100644 index 00000000000..1b36ed92859 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch @@ -0,0 +1,41 @@ +From 0d8fa3580bc0b5e75724e5ae11d8558901925d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:35 +0200 +Subject: arm64: dts: renesas: r9a07g044: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit ecbc5206a1a0532258144a4703cccf4e70f3fe6c ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 68a45525297b2e9a ("arm64: dts: renesas: Add initial DTSI for RZ/G2{L,LC} SoC's") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/21f556eb7e903d5b9f4c96188fd4b6ae0db71856.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g044.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +index 88634ae432872..1a9891ba6c02c 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi +@@ -1334,6 +1334,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch b/queue-6.10/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch new file mode 100644 index 00000000000..ce0742de715 --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch @@ -0,0 +1,41 @@ +From 5e5c2c636ea94a047c5a621194c762d3a2262e3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:36 +0200 +Subject: arm64: dts: renesas: r9a07g054: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 2918674704aad620215c41979a331021fe3f1ec4 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: 7c2b8198f4f321df ("arm64: dts: renesas: Add initial DTSI for RZ/V2L SoC") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/834244e77e5f407ee6fab1ab5c10c98a8a933085.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a07g054.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +index e89bfe4085f5d..a2318478a66ba 100644 +--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi +@@ -1342,6 +1342,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-renesas-r9a08g045-add-missing-hypervisor-v.patch b/queue-6.10/arm64-dts-renesas-r9a08g045-add-missing-hypervisor-v.patch new file mode 100644 index 00000000000..415e124d6bf --- /dev/null +++ b/queue-6.10/arm64-dts-renesas-r9a08g045-add-missing-hypervisor-v.patch @@ -0,0 +1,42 @@ +From b7d8aed706f0e30578157fc4f3200ecebe09dff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 15:57:37 +0200 +Subject: arm64: dts: renesas: r9a08g045: Add missing hypervisor virtual timer + IRQ + +From: Geert Uytterhoeven + +[ Upstream commit 10f9badc473d43ebfddd1ddedbcb8eb3f8f3fdd9 ] + +Add the missing fifth interrupt to the device node that represents the +ARM architected timer. While at it, add an interrupt-names property for +clarity, + +Fixes: e20396d65b959a65 ("arm64: dts: renesas: Add initial DTSI for RZ/G3S SoC") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea +Link: https://lore.kernel.org/884c683fb6c1d1bf7d0d383a8df8f65a0a424dc7.1718890849.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r9a08g045.dtsi | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r9a08g045.dtsi b/arch/arm64/boot/dts/renesas/r9a08g045.dtsi +index f5f3f4f4c8d67..a2adc4e27ce97 100644 +--- a/arch/arm64/boot/dts/renesas/r9a08g045.dtsi ++++ b/arch/arm64/boot/dts/renesas/r9a08g045.dtsi +@@ -294,6 +294,9 @@ timer { + interrupts-extended = <&gic GIC_PPI 13 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 14 IRQ_TYPE_LEVEL_LOW>, + <&gic GIC_PPI 11 IRQ_TYPE_LEVEL_LOW>, +- <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>; ++ <&gic GIC_PPI 10 IRQ_TYPE_LEVEL_LOW>, ++ <&gic GIC_PPI 12 IRQ_TYPE_LEVEL_LOW>; ++ interrupt-names = "sec-phys", "phys", "virt", "hyp-phys", ++ "hyp-virt"; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch b/queue-6.10/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch new file mode 100644 index 00000000000..f974ee0c424 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch @@ -0,0 +1,71 @@ +From c8d029a966450090bc5819d15ad31fe22415933a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:10 +0000 +Subject: arm64: dts: rockchip: Add mdio and ethernet-phy nodes to + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 4b64ed510ed946a4e4ca6d51d6512bf5361f6a04 ] + +Be explicit about the Ethernet port and define mdio and ethernet-phy +nodes in the device tree for ROCK Pi S. + +Fixes: bc3753aed81f ("arm64: dts: rockchip: rock-pi-s add more peripherals") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-8-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3308-rock-pi-s.dts | 26 ++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index d4cf6026241c4..f6fb90e13ad01 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -144,11 +144,25 @@ &emmc { + + &gmac { + clock_in_out = "output"; ++ phy-handle = <&rtl8201f>; + phy-supply = <&vcc_io>; +- snps,reset-gpio = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; +- snps,reset-active-low; +- snps,reset-delays-us = <0 50000 50000>; + status = "okay"; ++ ++ mdio { ++ compatible = "snps,dwmac-mdio"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ rtl8201f: ethernet-phy@1 { ++ compatible = "ethernet-phy-ieee802.3-c22"; ++ reg = <1>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mac_rst>; ++ reset-assert-us = <20000>; ++ reset-deassert-us = <50000>; ++ reset-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; ++ }; ++ }; + }; + + &gpio0 { +@@ -221,6 +235,12 @@ &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&rtc_32k>; + ++ gmac { ++ mac_rst: mac-rst { ++ rockchip,pins = <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + leds { + green_led: green-led { + rockchip,pins = <0 RK_PA6 RK_FUNC_GPIO &pcfg_pull_none>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch b/queue-6.10/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch new file mode 100644 index 00000000000..91ef5b493f8 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch @@ -0,0 +1,43 @@ +From b8db599eb8138d874c294fc9813fafefbb5b1ef7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 04:12:52 +0300 +Subject: arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu + +From: Cristian Ciocaltea + +[ Upstream commit 9d42c3ee3ce37cdad6f98c9e77bfbd0d791ac7da ] + +The iommu@fe043e00 on RK356x SoC shares the VOP power domain, but the +power-domains property was not provided when the node has been added. + +The consequence is that an attempt to reload the rockchipdrm module will +freeze the entire system. That is because on probe time, +pm_runtime_get_suppliers() gets called for vop@fe040000, which blocks +when pm_runtime_get_sync() is being invoked for iommu@fe043e00. + +Fix the issue by adding the missing property. + +Fixes: 9d6c6d978f97 ("arm64: dts: rockchip: rk356x: Add VOP2 nodes") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240702-rk356x-fix-vop-mmu-v1-1-a66d1a0c45ea@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +index d8543b5557ee7..3e2a8bfcafeaa 100644 +--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi +@@ -790,6 +790,7 @@ vop_mmu: iommu@fe043e00 { + clocks = <&cru ACLK_VOP>, <&cru HCLK_VOP>; + clock-names = "aclk", "iface"; + #iommu-cells = <0>; ++ power-domains = <&power RK3568_PD_VO>; + status = "disabled"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch b/queue-6.10/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch new file mode 100644 index 00000000000..dac593fa9b0 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch @@ -0,0 +1,40 @@ +From 637fb9eb6564374d39b29835a6c64e48388ba8d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:08 +0000 +Subject: arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 7affb86ef62581e3475ce3e0a7640da1f2ee29f8 ] + +UAR0 CTS/RTS is not wired to any pin and is not used for the default +serial console use of UART0 on ROCK Pi S. + +Override the SoC defined pinctrl props to limit configuration of the +two xfer pins wired to one of the GPIO pin headers. + +Fixes: 2e04c25b1320 ("arm64: dts: rockchip: add ROCK Pi S DTS support") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-6-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index 8ea9849064032..d4cf6026241c4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -294,6 +294,8 @@ u2phy_otg: otg-port { + }; + + &uart0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart0_xfer>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch b/queue-6.10/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch new file mode 100644 index 00000000000..6d7495c84c6 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch @@ -0,0 +1,42 @@ +From 1491b771c8c54156cc55b8548eb9315b21524d5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:07 +0000 +Subject: arm64: dts: rockchip: Add sdmmc related properties on + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit fc0daeccc384233eadfa9d5ddbd00159653c6bdc ] + +Add cap-mmc-highspeed to allow use of high speed MMC mode using an eMMC +to uSD board. Use disable-wp to signal that no physical write-protect +line is present. Also add vcc_io used for card and IO line power as +vmmc-supply. + +Fixes: 2e04c25b1320 ("arm64: dts: rockchip: add ROCK Pi S DTS support") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-5-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index 079101cddd65f..8ea9849064032 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -272,7 +272,10 @@ &sdio { + }; + + &sdmmc { ++ cap-mmc-highspeed; + cap-sd-highspeed; ++ disable-wp; ++ vmmc-supply = <&vcc_io>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-disable-display-subsystem-for-lun.patch b/queue-6.10/arm64-dts-rockchip-disable-display-subsystem-for-lun.patch new file mode 100644 index 00000000000..42d20bc6932 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-disable-display-subsystem-for-lun.patch @@ -0,0 +1,40 @@ +From b92c0559e07cab2971ad110410667efb5492383f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 22:30:27 +0800 +Subject: arm64: dts: rockchip: disable display subsystem for Lunzn Fastrhino + R6xS + +From: Chukun Pan + +[ Upstream commit 2bf5d445df2ec89689d15ea259a916260c936959 ] + +The R66S and R68S boards do not have HDMI output, so disable +the display subsystem. + +Fixes: c79dab407afd ("arm64: dts: rockchip: Add Lunzn Fastrhino R66S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240701143028.1203997-3-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +index e08c9eab6f170..25c49bdbadbcb 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +@@ -115,6 +115,10 @@ &cpu3 { + cpu-supply = <&vdd_cpu>; + }; + ++&display_subsystem { ++ status = "disabled"; ++}; ++ + &gpu { + mali-supply = <&vdd_gpu>; + status = "okay"; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch b/queue-6.10/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch new file mode 100644 index 00000000000..a0e6a5a562f --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch @@ -0,0 +1,48 @@ +From 82af174f435063317ded01e63770fb28ccda5140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 00:57:20 +0300 +Subject: arm64: dts: rockchip: Drop invalid mic-in-differential on + rk3568-rock-3a + +From: Cristian Ciocaltea + +[ Upstream commit 406a554b382200abfabd1df423a425f6efee53e0 ] + +The 'mic-in-differential' DT property supported by the RK809/RK817 audio +codec driver is actually valid if prefixed with 'rockchip,': + + DTC_CHK arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dtb + rk3568-rock-3a.dtb: pmic@20: codec: 'mic-in-differential' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/mfd/rockchip,rk809.yaml# + +However, the board doesn't make use of differential signaling, hence +drop the incorrect property and the now unnecessary 'codec' node. + +Fixes: 22a442e6586c ("arm64: dts: rockchip: add basic dts for the radxa rock3 model a") +Reported-by: Jonas Karlman +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240622-rk809-fixes-v2-3-c0db420d3639@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +index ebdedea15ad16..59f1403b4fa56 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts +@@ -531,10 +531,6 @@ regulator-state-mem { + }; + }; + }; +- +- codec { +- mic-in-differential; +- }; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch b/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch new file mode 100644 index 00000000000..71f8ac67bc7 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch @@ -0,0 +1,43 @@ +From ac7ae8b359b2591f8d52b8b2fddc6c84f81dbacd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 00:57:21 +0300 +Subject: arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc + +From: Cristian Ciocaltea + +[ Upstream commit e643e4eb4bef6a2f95bf0c61a20c991bccecb212 ] + +The 'mic-in-differential' DT property supported by the RK809/RK817 audio +codec driver is actually valid if prefixed with 'rockchip,': + + DTC_CHK arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dtb + rk3566-roc-pc.dtb: pmic@20: codec: 'mic-in-differential' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/mfd/rockchip,rk809.yaml# + +Make use of the correct property name. + +Fixes: a8e35c4bebe4 ("arm64: dts: rockchip: add audio nodes to rk3566-roc-pc") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240622-rk809-fixes-v2-4-c0db420d3639@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +index 63eea27293fe9..67e7801bd4896 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +@@ -269,7 +269,7 @@ rk809: pmic@20 { + vcc9-supply = <&vcc3v3_sys>; + + codec { +- mic-in-differential; ++ rockchip,mic-in-differential; + }; + + regulators { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch-16708 b/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch-16708 new file mode 100644 index 00000000000..9b9fc16a774 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch-16708 @@ -0,0 +1,45 @@ +From d5690e8b6c8a409d459d0e101abd124fcbe04bb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 00:57:22 +0300 +Subject: arm64: dts: rockchip: Fix mic-in-differential usage on + rk3568-evb1-v10 + +From: Cristian Ciocaltea + +[ Upstream commit ec03073888ad23223ebb986e62583c20a9ed3c07 ] + +The 'mic-in-differential' DT property supported by the RK809/RK817 audio +codec driver is actually valid if prefixed with 'rockchip,': + + DTC_CHK arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dtb + + rk3568-evb1-v10.dtb: pmic@20: codec: 'mic-in-differential' does not match any of the regexes: 'pinctrl-[0-9]+' + from schema $id: http://devicetree.org/schemas/mfd/rockchip,rk809.yaml# + +Make use of the correct property name. + +Fixes: 3e4c629ca680 ("arm64: dts: rockchip: enable rk809 audio codec on the rk3568 evb1-v10") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/20240622-rk809-fixes-v2-5-c0db420d3639@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +index 19f8fc369b130..8c3ab07d38079 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-evb1-v10.dts +@@ -475,7 +475,7 @@ regulator-state-mem { + }; + + codec { +- mic-in-differential; ++ rockchip,mic-in-differential; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fix-pmu_io-supply-for-lunzn-fastr.patch b/queue-6.10/arm64-dts-rockchip-fix-pmu_io-supply-for-lunzn-fastr.patch new file mode 100644 index 00000000000..7e08421d408 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fix-pmu_io-supply-for-lunzn-fastr.patch @@ -0,0 +1,74 @@ +From e70cb3b621e4a1a219ef91961c1d151ae8ecf978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 23:00:04 +0800 +Subject: arm64: dts: rockchip: fix pmu_io supply for Lunzn Fastrhino R6xS + +From: Chukun Pan + +[ Upstream commit cfeac8e5d05815521f5c5568680735a92ee91fe4 ] + +Fixes pmu_io_domains supply according to the schematic. Among them, +the vccio3 is responsible for the io voltage of sdcard. There is no +sdcard slot on the R68S, and it's connected to vcc_3v3, so describe +the supply of vccio3 separately. + +Fixes: c79dab407afd ("arm64: dts: rockchip: Add Lunzn Fastrhino R66S") +Fixes: b9f8ca655d80 ("arm64: dts: rockchip: Add Lunzn Fastrhino R68S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240630150010.55729-4-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts | 4 ++++ + arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi | 4 ++-- + arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts | 4 ++++ + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts +index 58ab7e9971dbc..b5e67990dd0f8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dts +@@ -11,6 +11,10 @@ aliases { + }; + }; + ++&pmu_io_domains { ++ vccio3-supply = <&vccio_sd>; ++}; ++ + &sdmmc0 { + bus-width = <4>; + cap-mmc-highspeed; +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +index 8f587978fa3b6..82577eba31eb5 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +@@ -397,8 +397,8 @@ vcc5v0_usb_otg_en: vcc5v0-usb-otg-en { + &pmu_io_domains { + pmuio1-supply = <&vcc3v3_pmu>; + pmuio2-supply = <&vcc3v3_pmu>; +- vccio1-supply = <&vccio_acodec>; +- vccio3-supply = <&vccio_sd>; ++ vccio1-supply = <&vcc_3v3>; ++ vccio2-supply = <&vcc_1v8>; + vccio4-supply = <&vcc_1v8>; + vccio5-supply = <&vcc_3v3>; + vccio6-supply = <&vcc_1v8>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts +index e1fe5e442689a..a3339186e89c8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts +@@ -102,6 +102,10 @@ eth_phy1_reset_pin: eth-phy1-reset-pin { + }; + }; + ++&pmu_io_domains { ++ vccio3-supply = <&vcc_3v3>; ++}; ++ + &sdhci { + bus-width = <8>; + max-frequency = <200000000>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fix-regulator-name-for-lunzn-fast.patch b/queue-6.10/arm64-dts-rockchip-fix-regulator-name-for-lunzn-fast.patch new file mode 100644 index 00000000000..8b5dac298b9 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fix-regulator-name-for-lunzn-fast.patch @@ -0,0 +1,57 @@ +From d4d5603ad0da0a33cfacdab86ecc8fc8e1c937f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 23:00:02 +0800 +Subject: arm64: dts: rockchip: fix regulator name for Lunzn Fastrhino R6xS + +From: Chukun Pan + +[ Upstream commit 2dad31528de9ea8b05245ce6ac4f76ebf8dae947 ] + +Make the regulator name the same as those marked by schematics. + +Fixes: c79dab407afd ("arm64: dts: rockchip: Add Lunzn Fastrhino R66S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240630150010.55729-2-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +index 89e84e3a92629..93987c8740f7b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +@@ -39,9 +39,9 @@ status_led: led-status { + }; + }; + +- dc_12v: dc-12v-regulator { ++ vcc12v_dcin: vcc12v-dcin-regulator { + compatible = "regulator-fixed"; +- regulator-name = "dc_12v"; ++ regulator-name = "vcc12v_dcin"; + regulator-always-on; + regulator-boot-on; + regulator-min-microvolt = <12000000>; +@@ -65,7 +65,7 @@ vcc3v3_sys: vcc3v3-sys-regulator { + regulator-boot-on; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; +- vin-supply = <&dc_12v>; ++ vin-supply = <&vcc12v_dcin>; + }; + + vcc5v0_sys: vcc5v0-sys-regulator { +@@ -75,7 +75,7 @@ vcc5v0_sys: vcc5v0-sys-regulator { + regulator-boot-on; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; +- vin-supply = <&dc_12v>; ++ vin-supply = <&vcc12v_dcin>; + }; + + vcc5v0_usb_host: vcc5v0-usb-host-regulator { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fix-usb-regulator-for-lunzn-fastr.patch b/queue-6.10/arm64-dts-rockchip-fix-usb-regulator-for-lunzn-fastr.patch new file mode 100644 index 00000000000..d2a5eff328f --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fix-usb-regulator-for-lunzn-fastr.patch @@ -0,0 +1,66 @@ +From 3978c1eb8a1ea2f9a726e7076f37134eba58075b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 22:30:26 +0800 +Subject: arm64: dts: rockchip: fix usb regulator for Lunzn Fastrhino R6xS + +From: Chukun Pan + +[ Upstream commit 9e823ba92118510c0d1c050b67bb000f9b9a73d7 ] + +Remove the non-existent usb_host regulator and fix the supply according +to the schematic. Also remove the unnecessary always-on and boot-on for +the usb_otg regulator. + +Fixes: c79dab407afd ("arm64: dts: rockchip: Add Lunzn Fastrhino R66S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240701143028.1203997-2-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +index 93987c8740f7b..8f587978fa3b6 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +@@ -78,15 +78,6 @@ vcc5v0_sys: vcc5v0-sys-regulator { + vin-supply = <&vcc12v_dcin>; + }; + +- vcc5v0_usb_host: vcc5v0-usb-host-regulator { +- compatible = "regulator-fixed"; +- regulator-name = "vcc5v0_usb_host"; +- regulator-always-on; +- regulator-boot-on; +- regulator-min-microvolt = <5000000>; +- regulator-max-microvolt = <5000000>; +- }; +- + vcc5v0_usb_otg: vcc5v0-usb-otg-regulator { + compatible = "regulator-fixed"; + enable-active-high; +@@ -94,8 +85,9 @@ vcc5v0_usb_otg: vcc5v0-usb-otg-regulator { + pinctrl-names = "default"; + pinctrl-0 = <&vcc5v0_usb_otg_en>; + regulator-name = "vcc5v0_usb_otg"; +- regulator-always-on; +- regulator-boot-on; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ vin-supply = <&vcc5v0_sys>; + }; + }; + +@@ -460,7 +452,7 @@ &usb2phy0 { + }; + + &usb2phy0_host { +- phy-supply = <&vcc5v0_usb_host>; ++ phy-supply = <&vcc5v0_sys>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-fixes-phy-reset-for-lunzn-fastrhi.patch b/queue-6.10/arm64-dts-rockchip-fixes-phy-reset-for-lunzn-fastrhi.patch new file mode 100644 index 00000000000..4fa6e217f3a --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-fixes-phy-reset-for-lunzn-fastrhi.patch @@ -0,0 +1,69 @@ +From c8922bdf4a65334a842dcfc0ed53ddc25355e3ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 23:00:07 +0800 +Subject: arm64: dts: rockchip: fixes PHY reset for Lunzn Fastrhino R68S + +From: Chukun Pan + +[ Upstream commit e261bd74000ca80e5483ba8a8bda509de8cbe7fd ] + +Fixed the PHY address and reset GPIOs (does not match the corresponding +pinctrl) for gmac0 and gmac1. + +Fixes: b9f8ca655d80 ("arm64: dts: rockchip: Add Lunzn Fastrhino R68S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240630150010.55729-7-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3568-fastrhino-r68s.dts | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts +index a3339186e89c8..ce2a5e1ccefc3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r68s.dts +@@ -39,7 +39,7 @@ &gmac0_tx_bus2 + &gmac0_rx_bus2 + &gmac0_rgmii_clk + &gmac0_rgmii_bus>; +- snps,reset-gpio = <&gpio0 RK_PB0 GPIO_ACTIVE_LOW>; ++ snps,reset-gpio = <&gpio1 RK_PB0 GPIO_ACTIVE_LOW>; + snps,reset-active-low; + /* Reset time is 15ms, 50ms for rtl8211f */ + snps,reset-delays-us = <0 15000 50000>; +@@ -61,7 +61,7 @@ &gmac1m1_tx_bus2 + &gmac1m1_rx_bus2 + &gmac1m1_rgmii_clk + &gmac1m1_rgmii_bus>; +- snps,reset-gpio = <&gpio0 RK_PB1 GPIO_ACTIVE_LOW>; ++ snps,reset-gpio = <&gpio1 RK_PB1 GPIO_ACTIVE_LOW>; + snps,reset-active-low; + /* Reset time is 15ms, 50ms for rtl8211f */ + snps,reset-delays-us = <0 15000 50000>; +@@ -71,18 +71,18 @@ &gmac1m1_rgmii_clk + }; + + &mdio0 { +- rgmii_phy0: ethernet-phy@0 { ++ rgmii_phy0: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; +- reg = <0>; ++ reg = <0x1>; + pinctrl-0 = <ð_phy0_reset_pin>; + pinctrl-names = "default"; + }; + }; + + &mdio1 { +- rgmii_phy1: ethernet-phy@0 { ++ rgmii_phy1: ethernet-phy@1 { + compatible = "ethernet-phy-ieee802.3-c22"; +- reg = <0>; ++ reg = <0x1>; + pinctrl-0 = <ð_phy1_reset_pin>; + pinctrl-names = "default"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch b/queue-6.10/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch new file mode 100644 index 00000000000..03feaaa1121 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch @@ -0,0 +1,42 @@ +From d1406b69ded2039d67de48515a394387009d770c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jun 2024 17:03:52 +0000 +Subject: arm64: dts: rockchip: Increase VOP clk rate on RK3328 + +From: Jonas Karlman + +[ Upstream commit 0f2ddb128fa20f8441d903285632f2c69e90fae1 ] + +The VOP on RK3328 needs to run at a higher rate in order to produce a +proper 3840x2160 signal. + +Change to use 300MHz for VIO clk and 400MHz for VOP clk, same rates used +by vendor 4.4 kernel. + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240615170417.3134517-2-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 07dcc949b8997..b01efd6d042c8 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -850,8 +850,8 @@ cru: clock-controller@ff440000 { + <0>, <24000000>, + <24000000>, <24000000>, + <15000000>, <15000000>, +- <100000000>, <100000000>, +- <100000000>, <100000000>, ++ <300000000>, <100000000>, ++ <400000000>, <100000000>, + <50000000>, <100000000>, + <100000000>, <100000000>, + <50000000>, <50000000>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-remove-unused-usb2-nodes-for-lunz.patch b/queue-6.10/arm64-dts-rockchip-remove-unused-usb2-nodes-for-lunz.patch new file mode 100644 index 00000000000..efba46033d5 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-remove-unused-usb2-nodes-for-lunz.patch @@ -0,0 +1,63 @@ +From eccd934766a1409765bbeddb9c1348f3cd7513f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 23:00:05 +0800 +Subject: arm64: dts: rockchip: remove unused usb2 nodes for Lunzn Fastrhino + R6xS + +From: Chukun Pan + +[ Upstream commit cd77139a307fbabe75e6b5cb8a3753e3c700f394 ] + +Fix the following error when booting: +[ 15.851853] platform fd800000.usb: deferred probe pending +[ 15.852384] platform fd840000.usb: deferred probe pending +[ 15.852881] platform fd880000.usb: deferred probe pending + +This is due to usb2phy1 is not enabled. There is no USB 2.0 +port on the board, just remove it. + +Fixes: c79dab407afd ("arm64: dts: rockchip: Add Lunzn Fastrhino R66S") +Signed-off-by: Chukun Pan +Link: https://lore.kernel.org/r/20240630150010.55729-5-amadeus@jmu.edu.cn +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +index 82577eba31eb5..e08c9eab6f170 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3568-fastrhino-r66s.dtsi +@@ -421,28 +421,12 @@ &uart2 { + status = "okay"; + }; + +-&usb_host0_ehci { +- status = "okay"; +-}; +- +-&usb_host0_ohci { +- status = "okay"; +-}; +- + &usb_host0_xhci { + dr_mode = "host"; + extcon = <&usb2phy0>; + status = "okay"; + }; + +-&usb_host1_ehci { +- status = "okay"; +-}; +- +-&usb_host1_ohci { +- status = "okay"; +-}; +- + &usb_host1_xhci { + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch b/queue-6.10/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch new file mode 100644 index 00000000000..cc464c538b1 --- /dev/null +++ b/queue-6.10/arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch @@ -0,0 +1,107 @@ +From 28efd0d0af3bf202dba9cd10d843b2fc6479677a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 21:10:16 +0000 +Subject: arm64: dts: rockchip: Update WIFi/BT related nodes on + rk3308-rock-pi-s + +From: Jonas Karlman + +[ Upstream commit 12c3ec878cbe3709782e85b88124abecc3bb8617 ] + +Update WiFi SDIO and BT UART related props to better reflect details +about the optional onboard RTL8723DS WiFi/BT module. + +Also correct the compatible used for bluetooth to match the WiFi/BT +module used on the board. + +Fixes: bc3753aed81f ("arm64: dts: rockchip: rock-pi-s add more peripherals") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20240521211029.1236094-14-jonas@kwiboo.se +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3308-rock-pi-s.dts | 40 +++++++++++++++++-- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +index f6fb90e13ad01..f1d4118ffb7d6 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-rock-pi-s.dts +@@ -17,6 +17,7 @@ aliases { + ethernet0 = &gmac; + mmc0 = &emmc; + mmc1 = &sdmmc; ++ mmc2 = &sdio; + }; + + chosen { +@@ -235,6 +236,20 @@ &pinctrl { + pinctrl-names = "default"; + pinctrl-0 = <&rtc_32k>; + ++ bluetooth { ++ bt_reg_on: bt-reg-on { ++ rockchip,pins = <4 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ ++ bt_wake_host: bt-wake-host { ++ rockchip,pins = <4 RK_PB4 RK_FUNC_GPIO &pcfg_pull_down>; ++ }; ++ ++ host_wake_bt: host-wake-bt { ++ rockchip,pins = <4 RK_PB2 RK_FUNC_GPIO &pcfg_pull_none>; ++ }; ++ }; ++ + gmac { + mac_rst: mac-rst { + rockchip,pins = <0 RK_PA7 RK_FUNC_GPIO &pcfg_pull_none>; +@@ -284,11 +299,24 @@ &sdio { + cap-sd-highspeed; + cap-sdio-irq; + keep-power-in-suspend; +- max-frequency = <1000000>; ++ max-frequency = <100000000>; + mmc-pwrseq = <&sdio_pwrseq>; ++ no-mmc; ++ no-sd; + non-removable; +- sd-uhs-sdr104; ++ sd-uhs-sdr50; ++ vmmc-supply = <&vcc_io>; ++ vqmmc-supply = <&vcc_1v8>; + status = "okay"; ++ ++ rtl8723ds: wifi@1 { ++ reg = <1>; ++ interrupt-parent = <&gpio0>; ++ interrupts = ; ++ interrupt-names = "host-wake"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wifi_host_wake>; ++ }; + }; + + &sdmmc { +@@ -320,12 +348,16 @@ &uart0 { + }; + + &uart4 { ++ uart-has-rtscts; + status = "okay"; + + bluetooth { +- compatible = "realtek,rtl8723bs-bt"; +- device-wake-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>; ++ compatible = "realtek,rtl8723ds-bt"; ++ device-wake-gpios = <&gpio4 RK_PB2 GPIO_ACTIVE_HIGH>; ++ enable-gpios = <&gpio4 RK_PB3 GPIO_ACTIVE_HIGH>; + host-wake-gpios = <&gpio4 RK_PB4 GPIO_ACTIVE_HIGH>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&bt_reg_on &bt_wake_host &host_wake_bt>; + }; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62-main-fix-the-reg-range-for-main.patch b/queue-6.10/arm64-dts-ti-k3-am62-main-fix-the-reg-range-for-main.patch new file mode 100644 index 00000000000..3f4d35025f1 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62-main-fix-the-reg-range-for-main.patch @@ -0,0 +1,44 @@ +From a6d6753d9b961a0df9917150c1981e9317645225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 16:22:51 +0530 +Subject: arm64: dts: ti: k3-am62-main: Fix the reg-range for main_pktdma + +From: Jayesh Choudhary + +[ Upstream commit 6edad223553c7f1680fcaca25ded59eba7c6d82d ] + +For main_pktdma node, the TX Channel Realtime Register region 'tchanrt' +is 128KB and Ring Realtime Register region 'ringrt' is 2MB as shown in +memory map in the TRM[0] (Table 2-1). +So fix ranges for those register regions. + +[0]: + +Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes") +Signed-off-by: Jayesh Choudhary +Reviewed-by: Udit Kumar +Link: https://lore.kernel.org/r/20240430105253.203750-2-j-choudhary@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +index 448a59dc53a77..0f2722c4bcc32 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +@@ -141,8 +141,8 @@ main_pktdma: dma-controller@485c0000 { + compatible = "ti,am64-dmss-pktdma"; + reg = <0x00 0x485c0000 0x00 0x100>, + <0x00 0x4a800000 0x00 0x20000>, +- <0x00 0x4aa00000 0x00 0x40000>, +- <0x00 0x4b800000 0x00 0x400000>, ++ <0x00 0x4aa00000 0x00 0x20000>, ++ <0x00 0x4b800000 0x00 0x200000>, + <0x00 0x485e0000 0x00 0x10000>, + <0x00 0x484a0000 0x00 0x2000>, + <0x00 0x484c0000 0x00 0x2000>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62-verdin-drop-mcasp-afifos.patch b/queue-6.10/arm64-dts-ti-k3-am62-verdin-drop-mcasp-afifos.patch new file mode 100644 index 00000000000..a6cc11acfa1 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62-verdin-drop-mcasp-afifos.patch @@ -0,0 +1,47 @@ +From 9c14a3e7b72390cf3394e11032696a8dfa6ddd4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:44 +0530 +Subject: arm64: dts: ti: k3-am62-verdin: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit fb01352801f08740e9f37cbd71f73866c7044927 ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62") +Acked-by: Francesco Dolcini +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-5-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +index 2038c5e046390..359f53f3e019b 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi +@@ -1364,8 +1364,6 @@ &mcasp0 { + 0 0 0 0 + >; + tdm-slots = <2>; +- rx-num-evt = <32>; +- tx-num-evt = <32>; + #sound-dai-cells = <0>; + status = "disabled"; + }; +@@ -1382,8 +1380,6 @@ &mcasp1 { + 0 0 0 0 + >; + tdm-slots = <2>; +- rx-num-evt = <32>; +- tx-num-evt = <32>; + #sound-dai-cells = <0>; + status = "disabled"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am625-beagleplay-drop-mcasp-afifos.patch b/queue-6.10/arm64-dts-ti-k3-am625-beagleplay-drop-mcasp-afifos.patch new file mode 100644 index 00000000000..9d404f32d74 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am625-beagleplay-drop-mcasp-afifos.patch @@ -0,0 +1,35 @@ +From 67624effbc06e88467a3db1034927e8a3dfe48b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:43 +0530 +Subject: arm64: dts: ti: k3-am625-beagleplay: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit 3b4a03357aee07a32a44a49bb6a71f5e82b1ecc1 ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: 1f7226a5e52c ("arm64: dts: ti: k3-am625-beagleplay: Add HDMI support") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-4-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts +index 18e3070a86839..70de288d728e4 100644 +--- a/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts ++++ b/arch/arm64/boot/dts/ti/k3-am625-beagleplay.dts +@@ -924,6 +924,4 @@ &mcasp1 { + 0 0 0 0 + 0 0 0 0 + >; +- tx-num-evt = <32>; +- rx-num-evt = <32>; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am625-phyboard-lyra-rdk-drop-mcasp-a.patch b/queue-6.10/arm64-dts-ti-k3-am625-phyboard-lyra-rdk-drop-mcasp-a.patch new file mode 100644 index 00000000000..c89c597b182 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am625-phyboard-lyra-rdk-drop-mcasp-a.patch @@ -0,0 +1,37 @@ +From 0e6c92aae1f75083d26004ef6c2473e641e7dbf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:45 +0530 +Subject: arm64: dts: ti: k3-am625-phyboard-lyra-rdk: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit 554dd562a5f2f5d7e838f7b229a1c612275678db ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: 28c0cf16b308 ("arm64: dts: ti: k3-am625-phyboard-lyra-rdk: Add Audio Codec") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-6-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am625-phyboard-lyra-rdk.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am625-phyboard-lyra-rdk.dts b/arch/arm64/boot/dts/ti/k3-am625-phyboard-lyra-rdk.dts +index 50d2573c840ee..6c24e4d39ee80 100644 +--- a/arch/arm64/boot/dts/ti/k3-am625-phyboard-lyra-rdk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am625-phyboard-lyra-rdk.dts +@@ -441,8 +441,6 @@ &mcasp2 { + 0 0 0 0 + 0 0 0 0 + >; +- tx-num-evt = <32>; +- rx-num-evt = <32>; + status = "okay"; + }; + +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62a-main-fix-the-reg-range-for-mai.patch b/queue-6.10/arm64-dts-ti-k3-am62a-main-fix-the-reg-range-for-mai.patch new file mode 100644 index 00000000000..01612366e1f --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62a-main-fix-the-reg-range-for-mai.patch @@ -0,0 +1,44 @@ +From d11c0ec25c77b5d8d3a0fe7311b7ed98671f9216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 16:22:52 +0530 +Subject: arm64: dts: ti: k3-am62a-main: Fix the reg-range for main_pktdma + +From: Jayesh Choudhary + +[ Upstream commit d007a883a61f55b9b195c4c18bbe29de5b802822 ] + +For main_pktdma node, the TX Channel Realtime Register region 'tchanrt' +is 128KB and Ring Realtime Register region 'ringrt' is 2MB as shown in +memory map in the TRM[0] (Table 2-1). +So fix ranges for those register regions. + +[0]: + +Fixes: 3dad70def7ff ("arm64: dts: ti: k3-am62a-main: Add more peripheral nodes") +Signed-off-by: Jayesh Choudhary +Reviewed-by: Udit Kumar +Link: https://lore.kernel.org/r/20240430105253.203750-3-j-choudhary@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +index bf9c2d9c6439a..ce4a2f1056300 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi +@@ -120,8 +120,8 @@ main_pktdma: dma-controller@485c0000 { + compatible = "ti,am64-dmss-pktdma"; + reg = <0x00 0x485c0000 0x00 0x100>, + <0x00 0x4a800000 0x00 0x20000>, +- <0x00 0x4aa00000 0x00 0x40000>, +- <0x00 0x4b800000 0x00 0x400000>, ++ <0x00 0x4aa00000 0x00 0x20000>, ++ <0x00 0x4b800000 0x00 0x200000>, + <0x00 0x485e0000 0x00 0x10000>, + <0x00 0x484a0000 0x00 0x2000>, + <0x00 0x484c0000 0x00 0x2000>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62a7-drop-mcasp-afifos.patch b/queue-6.10/arm64-dts-ti-k3-am62a7-drop-mcasp-afifos.patch new file mode 100644 index 00000000000..7d97680a018 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62a7-drop-mcasp-afifos.patch @@ -0,0 +1,37 @@ +From 4a9851cf4ab9e465a6078edb0f8320df7cc42e14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:41 +0530 +Subject: arm64: dts: ti: k3-am62a7: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit a931b81072921a11d5bb8e8201b6228b791d40a9 ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: 4a2c5dddf9e9 ("arm64: dts: ti: k3-am62a7-sk: Enable audio on AM62A") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-2-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +index fa43cd0b631e6..e026f65738b39 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts +@@ -701,8 +701,6 @@ &mcasp1 { + 0 0 0 0 + 0 0 0 0 + >; +- tx-num-evt = <32>; +- rx-num-evt = <32>; + }; + + &dss { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62p-main-fix-the-reg-range-for-mai.patch b/queue-6.10/arm64-dts-ti-k3-am62p-main-fix-the-reg-range-for-mai.patch new file mode 100644 index 00000000000..df3a4be0744 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62p-main-fix-the-reg-range-for-mai.patch @@ -0,0 +1,44 @@ +From b0934a94a8587b8faeb531ff6190db861906c0cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 16:22:53 +0530 +Subject: arm64: dts: ti: k3-am62p-main: Fix the reg-range for main_pktdma + +From: Jayesh Choudhary + +[ Upstream commit a6e6604c600aeedf9700de4a55255850391bc3fc ] + +For main_pktdma node, the TX Channel Realtime Register region 'tchanrt' +is 128KB and Ring Realtime Register region 'ringrt' is 2MB as shown in +memory map in the TRM[0] (Table 2-1). +So fix ranges for those register regions. + +[0]: + +Fixes: b5080c7c1f7e ("arm64: dts: ti: k3-am62p: Add nodes for more IPs") +Signed-off-by: Jayesh Choudhary +Reviewed-by: Udit Kumar +Link: https://lore.kernel.org/r/20240430105253.203750-4-j-choudhary@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p-main.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi +index 900d1f9530a2a..2b9bc77a05404 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi +@@ -123,8 +123,8 @@ main_pktdma: dma-controller@485c0000 { + compatible = "ti,am64-dmss-pktdma"; + reg = <0x00 0x485c0000 0x00 0x100>, + <0x00 0x4a800000 0x00 0x20000>, +- <0x00 0x4aa00000 0x00 0x40000>, +- <0x00 0x4b800000 0x00 0x400000>, ++ <0x00 0x4aa00000 0x00 0x20000>, ++ <0x00 0x4b800000 0x00 0x200000>, + <0x00 0x485e0000 0x00 0x10000>, + <0x00 0x484a0000 0x00 0x2000>, + <0x00 0x484c0000 0x00 0x2000>, +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62p5-drop-mcasp-afifos.patch b/queue-6.10/arm64-dts-ti-k3-am62p5-drop-mcasp-afifos.patch new file mode 100644 index 00000000000..31d9e4f0056 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62p5-drop-mcasp-afifos.patch @@ -0,0 +1,37 @@ +From 0973b255368a5740896b422ff2d4a63ffa121677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:42 +0530 +Subject: arm64: dts: ti: k3-am62p5: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit d3fe4b4e2e44de64ed1f1585151bf4a3627adbaf ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: c00504ea42c0 ("arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-3-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +index 6e72346591113..78d4d44e8bd4e 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +@@ -549,8 +549,6 @@ &mcasp1 { + 0 0 0 0 + 0 0 0 0 + >; +- tx-num-evt = <32>; +- rx-num-evt = <32>; + }; + + &fss { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62p5-sk-fix-pinmux-for-mcasp1-tx.patch b/queue-6.10/arm64-dts-ti-k3-am62p5-sk-fix-pinmux-for-mcasp1-tx.patch new file mode 100644 index 00000000000..12ff89f5dc8 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62p5-sk-fix-pinmux-for-mcasp1-tx.patch @@ -0,0 +1,38 @@ +From 6651f468af21e362a896e1cc5abea6af480bed9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:46 +0530 +Subject: arm64: dts: ti: k3-am62p5-sk: Fix pinmux for McASP1 TX + +From: Jai Luthra + +[ Upstream commit e96e36ce1fdcf08a70e3f09cbe2da02b073c58ac ] + +On SK-AM62P, McASP1 uses two pins for communicating with the codec over +I2S protocol. One of these pins (AXR0) is used for audio playback (TX) +so the direction of the pin should be OUTPUT. + +Fixes: c00504ea42c0 ("arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-7-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +index 78d4d44e8bd4e..fb980d46e3041 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts +@@ -207,7 +207,7 @@ main_mcasp1_pins_default: main-mcasp1-default-pins { + pinctrl-single,pins = < + AM62PX_IOPAD(0x0090, PIN_INPUT, 2) /* (U24) GPMC0_BE0n_CLE.MCASP1_ACLKX */ + AM62PX_IOPAD(0x0098, PIN_INPUT, 2) /* (AA24) GPMC0_WAIT0.MCASP1_AFSX */ +- AM62PX_IOPAD(0x008c, PIN_INPUT, 2) /* (T25) GPMC0_WEn.MCASP1_AXR0 */ ++ AM62PX_IOPAD(0x008c, PIN_OUTPUT, 2) /* (T25) GPMC0_WEn.MCASP1_AXR0 */ + AM62PX_IOPAD(0x0084, PIN_INPUT, 2) /* (R25) GPMC0_ADVn_ALE.MCASP1_AXR2 */ + >; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am62x-drop-mcasp-afifos.patch b/queue-6.10/arm64-dts-ti-k3-am62x-drop-mcasp-afifos.patch new file mode 100644 index 00000000000..a0ae4a84d85 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am62x-drop-mcasp-afifos.patch @@ -0,0 +1,37 @@ +From 42690b5e0889f209426f583689a48338214d06c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:37:40 +0530 +Subject: arm64: dts: ti: k3-am62x: Drop McASP AFIFOs + +From: Jai Luthra + +[ Upstream commit 6ee3ca0ec7fabc63603afdb3485da04164dc8747 ] + +McASP AFIFOs are not necessary with UDMA-P/BCDMA as there is buffering +on the DMA IP. Drop these for better audio latency. + +Fixes: b94b43715e91 ("arm64: dts: ti: Enable audio on SK-AM62(-LP)") +Signed-off-by: Jai Luthra +Link: https://lore.kernel.org/r/20240606-mcasp_fifo_drop-v2-1-8c317dabdd0a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi +index 3c45782ab2b78..63b4e88e3a94a 100644 +--- a/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am62x-sk-common.dtsi +@@ -504,8 +504,6 @@ &mcasp1 { + 0 0 0 0 + 0 0 0 0 + >; +- tx-num-evt = <32>; +- rx-num-evt = <32>; + }; + + &dss { +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-am642-hummingboard-t-correct-rs485-r.patch b/queue-6.10/arm64-dts-ti-k3-am642-hummingboard-t-correct-rs485-r.patch new file mode 100644 index 00000000000..333d0b84e42 --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-am642-hummingboard-t-correct-rs485-r.patch @@ -0,0 +1,40 @@ +From 9ae0a8d94cf07eae799304a59272f01a75a899f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 13:35:54 +0200 +Subject: arm64: dts: ti: k3-am642-hummingboard-t: correct rs485 rts polarity + +From: Josua Mayer + +[ Upstream commit 9dcc0e1065f3c40d0b2ad79a858bb4ebaba33167 ] + +The RS485 transceiver RE (Receiver enable) and DE (Driver enable) are +shorted and connected to both RTS/CTS of the SoC UART. +RE is active-low, DE is active-high. + +Remove the "rs485-rts-active-low" flag to match RTS polarity with DE, +and fix communication in both transmit and receive directions. + +Fixes: d60483faf914 ("arm64: dts: add description for solidrun am642 som and evaluation board") +Signed-off-by: Josua Mayer +Link: https://lore.kernel.org/r/20240504-ti-rs485-rts-v1-1-e88ef1c96f34@solid-run.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am642-hummingboard-t.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t.dts b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t.dts +index 234d76e4e9445..5b5e9eeec5ac4 100644 +--- a/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t.dts ++++ b/arch/arm64/boot/dts/ti/k3-am642-hummingboard-t.dts +@@ -282,7 +282,6 @@ &main_uart3 { + pinctrl-names = "default"; + pinctrl-0 = <&main_uart3_default_pins>; + uart-has-rtscts; +- rs485-rts-active-low; + linux,rs485-enabled-at-boot-time; + status = "okay"; + }; +-- +2.43.0 + diff --git a/queue-6.10/arm64-dts-ti-k3-j722s-fix-main-domain-gpio-count.patch b/queue-6.10/arm64-dts-ti-k3-j722s-fix-main-domain-gpio-count.patch new file mode 100644 index 00000000000..c71a9cef8ed --- /dev/null +++ b/queue-6.10/arm64-dts-ti-k3-j722s-fix-main-domain-gpio-count.patch @@ -0,0 +1,48 @@ +From 1acc3974b735173996734b2b597fd77f00d8abf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 16:03:32 +0530 +Subject: arm64: dts: ti: k3-j722s: Fix main domain GPIO count + +From: Vaishnav Achath + +[ Upstream commit 2cdf63e73415ce6c8f6b3397cdc91d5f928855f9 ] + +J722S does not pin out all of the GPIO same as AM62P and have +more number of GPIO on the main_gpio1 instance. Fix the GPIO +count on both instances by overriding the ti,ngpio property. + +Fixes: ea55b9335ad8 ("arm64: dts: ti: Introduce J722S family of SoCs") + +More details at J722S/AM67 Datasheet (Section 5.3.11, GPIO): + https://www.ti.com/lit/ds/symlink/am67.pdf + +Signed-off-by: Vaishnav Achath +Link: https://lore.kernel.org/r/20240507103332.167928-1-vaishnav.a@ti.com +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j722s.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-j722s.dtsi b/arch/arm64/boot/dts/ti/k3-j722s.dtsi +index c75744edb1433..9132b0232b0ba 100644 +--- a/arch/arm64/boot/dts/ti/k3-j722s.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j722s.dtsi +@@ -83,6 +83,14 @@ &inta_main_dmss { + ti,interrupt-ranges = <7 71 21>; + }; + ++&main_gpio0 { ++ ti,ngpio = <87>; ++}; ++ ++&main_gpio1 { ++ ti,ngpio = <73>; ++}; ++ + &oc_sram { + reg = <0x00 0x70000000 0x00 0x40000>; + ranges = <0x00 0x00 0x70000000 0x40000>; +-- +2.43.0 + diff --git a/queue-6.10/arm64-smp-fix-missing-ipi-statistics.patch b/queue-6.10/arm64-smp-fix-missing-ipi-statistics.patch new file mode 100644 index 00000000000..def2c034fdd --- /dev/null +++ b/queue-6.10/arm64-smp-fix-missing-ipi-statistics.patch @@ -0,0 +1,101 @@ +From 6baec69330b727eb402b56fc49dab3b80a20cc3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 14:36:00 +0800 +Subject: arm64: smp: Fix missing IPI statistics + +From: Jinjie Ruan + +[ Upstream commit 916b93f4e865b35563902f5862b443fc122631b4 ] + +commit 83cfac95c018 ("genirq: Allow interrupts to be excluded from +/proc/interrupts") is to avoid IPIs appear twice in /proc/interrupts. +But the commit 331a1b3a836c ("arm64: smp: Add arch support for backtrace +using pseudo-NMI") and commit 2f5cd0c7ffde("arm64: kgdb: Implement +kgdb_roundup_cpus() to enable pseudo-NMI roundup") set CPU_BACKTRACE and +KGDB_ROUNDUP IPIs "IRQ_HIDDEN" flag but not show them in +arch_show_interrupts(), which cause the interrupt kstat_irqs accounting +is missing in display. + +Before this patch, CPU_BACKTRACE and KGDB_ROUNDUP IPIs are missing: + / # cat /proc/interrupts + CPU0 CPU1 CPU2 CPU3 + 11: 466 600 309 332 GICv3 27 Level arch_timer + 13: 24 0 0 0 GICv3 33 Level uart-pl011 + 15: 64 0 0 0 GICv3 78 Edge virtio0 + 16: 0 0 0 0 GICv3 79 Edge virtio1 + 17: 0 0 0 0 GICv3 34 Level rtc-pl031 + 18: 3 3 3 3 GICv3 23 Level arm-pmu + 19: 0 0 0 0 9030000.pl061 3 Edge GPIO Key Poweroff + IPI0: 7 14 9 26 Rescheduling interrupts + IPI1: 354 93 233 255 Function call interrupts + IPI2: 0 0 0 0 CPU stop interrupts + IPI3: 0 0 0 0 CPU stop (for crash dump) interrupts + IPI4: 0 0 0 0 Timer broadcast interrupts + IPI5: 1 0 0 0 IRQ work interrupts + Err: 0 + +After this pacth, CPU_BACKTRACE and KGDB_ROUNDUP IPIs are displayed: + / # cat /proc/interrupts + CPU0 CPU1 CPU2 CPU3 + 11: 393 281 532 449 GICv3 27 Level arch_timer + 13: 15 0 0 0 GICv3 33 Level uart-pl011 + 15: 64 0 0 0 GICv3 78 Edge virtio0 + 16: 0 0 0 0 GICv3 79 Edge virtio1 + 17: 0 0 0 0 GICv3 34 Level rtc-pl031 + 18: 2 2 2 2 GICv3 23 Level arm-pmu + 19: 0 0 0 0 9030000.pl061 3 Edge GPIO Key Poweroff + IPI0: 11 19 4 23 Rescheduling interrupts + IPI1: 279 347 222 72 Function call interrupts + IPI2: 0 0 0 0 CPU stop interrupts + IPI3: 0 0 0 0 CPU stop (for crash dump) interrupts + IPI4: 0 0 0 0 Timer broadcast interrupts + IPI5: 1 0 0 1 IRQ work interrupts + IPI6: 0 0 0 0 CPU backtrace interrupts + IPI7: 0 0 0 0 KGDB roundup interrupts + Err: 0 + +Fixes: 331a1b3a836c ("arm64: smp: Add arch support for backtrace using pseudo-NMI") +Signed-off-by: Jinjie Ruan +Suggested-by: Doug Anderson +Acked-by: Will Deacon +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240620063600.573559-1-ruanjinjie@huawei.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/smp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 31c8b3094dd7b..5de85dccc09cd 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -767,13 +767,15 @@ void __init smp_prepare_cpus(unsigned int max_cpus) + } + } + +-static const char *ipi_types[NR_IPI] __tracepoint_string = { ++static const char *ipi_types[MAX_IPI] __tracepoint_string = { + [IPI_RESCHEDULE] = "Rescheduling interrupts", + [IPI_CALL_FUNC] = "Function call interrupts", + [IPI_CPU_STOP] = "CPU stop interrupts", + [IPI_CPU_CRASH_STOP] = "CPU stop (for crash dump) interrupts", + [IPI_TIMER] = "Timer broadcast interrupts", + [IPI_IRQ_WORK] = "IRQ work interrupts", ++ [IPI_CPU_BACKTRACE] = "CPU backtrace interrupts", ++ [IPI_KGDB_ROUNDUP] = "KGDB roundup interrupts", + }; + + static void smp_cross_call(const struct cpumask *target, unsigned int ipinr); +@@ -784,7 +786,7 @@ int arch_show_interrupts(struct seq_file *p, int prec) + { + unsigned int cpu, i; + +- for (i = 0; i < NR_IPI; i++) { ++ for (i = 0; i < MAX_IPI; i++) { + seq_printf(p, "%*s%u:%s", prec - 1, "IPI", i, + prec >= 4 ? " " : ""); + for_each_online_cpu(cpu) +-- +2.43.0 + diff --git a/queue-6.10/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch b/queue-6.10/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch new file mode 100644 index 00000000000..b9611133c7c --- /dev/null +++ b/queue-6.10/asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch @@ -0,0 +1,47 @@ +From 070b883aa198cb228f30f9e7738abb544931b81f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 22:10:07 +0300 +Subject: ASoC: amd: Adjust error handling in case of absent codec device + +From: Aleksandr Mishin + +[ Upstream commit 5080808c3339de2220c602ab7c7fa23dc6c1a5a3 ] + +acpi_get_first_physical_node() can return NULL in several cases (no such +device, ACPI table error, reference count drop to 0, etc). +Existing check just emit error message, but doesn't perform return. +Then this NULL pointer is passed to devm_acpi_dev_add_driver_gpios() +where it is dereferenced. + +Adjust this error handling by adding error code return. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 02527c3f2300 ("ASoC: amd: add Machine driver for Jadeite platform") +Signed-off-by: Aleksandr Mishin +Link: https://patch.msgid.link/20240703191007.8524-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp-es8336.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/amd/acp-es8336.c b/sound/soc/amd/acp-es8336.c +index e079b3218c6f4..3756b8bef17bc 100644 +--- a/sound/soc/amd/acp-es8336.c ++++ b/sound/soc/amd/acp-es8336.c +@@ -203,8 +203,10 @@ static int st_es8336_late_probe(struct snd_soc_card *card) + + codec_dev = acpi_get_first_physical_node(adev); + acpi_dev_put(adev); +- if (!codec_dev) ++ if (!codec_dev) { + dev_err(card->dev, "can not find codec dev\n"); ++ return -ENODEV; ++ } + + ret = devm_acpi_dev_add_driver_gpios(codec_dev, acpi_es8336_gpios); + if (ret) +-- +2.43.0 + diff --git a/queue-6.10/asoc-cs35l56-accept-values-greater-than-0-as-irq-num.patch b/queue-6.10/asoc-cs35l56-accept-values-greater-than-0-as-irq-num.patch new file mode 100644 index 00000000000..a12afd7389c --- /dev/null +++ b/queue-6.10/asoc-cs35l56-accept-values-greater-than-0-as-irq-num.patch @@ -0,0 +1,42 @@ +From 909ac205fe61cb4efa61e7bb29cfc482ff32a08d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 14:53:38 +0100 +Subject: ASoC: cs35l56: Accept values greater than 0 as IRQ numbers + +From: Simon Trimmer + +[ Upstream commit 3ec1428d7b7c519d757a013cef908d7e33dee882 ] + +IRQ lookup functions such as those in ACPI can return error values when +an IRQ is not defined. The i2c core driver converts the error codes to a +value of 0 and the SPI bus driver passes them unaltered to client device +drivers. + +The cs35l56 driver should only accept positive non-zero values as IRQ +numbers. + +Signed-off-by: Simon Trimmer +Fixes: 8a731fd37f8b ("ASoC: cs35l56: Move utility functions to shared file") +Link: https://msgid.link/r/20240617135338.82006-1-simont@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l56-shared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l56-shared.c b/sound/soc/codecs/cs35l56-shared.c +index 30497152e02a7..f609cade805d7 100644 +--- a/sound/soc/codecs/cs35l56-shared.c ++++ b/sound/soc/codecs/cs35l56-shared.c +@@ -397,7 +397,7 @@ int cs35l56_irq_request(struct cs35l56_base *cs35l56_base, int irq) + { + int ret; + +- if (!irq) ++ if (irq < 1) + return 0; + + ret = devm_request_threaded_irq(cs35l56_base->dev, irq, NULL, cs35l56_irq, +-- +2.43.0 + diff --git a/queue-6.10/asoc-max98088-check-for-clk_prepare_enable-error.patch b/queue-6.10/asoc-max98088-check-for-clk_prepare_enable-error.patch new file mode 100644 index 00000000000..a96bdf22f17 --- /dev/null +++ b/queue-6.10/asoc-max98088-check-for-clk_prepare_enable-error.patch @@ -0,0 +1,53 @@ +From aafd362a33c2c42bc2e28bf617e3ca8d663adaee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 16:05:34 +0800 +Subject: ASoC: max98088: Check for clk_prepare_enable() error + +From: Chen Ni + +[ Upstream commit 1a70579723fde3624a72dfea6e79e55be6e36659 ] + +clk_prepare_enable() may fail, so we should better check its return +value and propagate it in the case of error. + +Fixes: 62a7fc32a628 ("ASoC: max98088: Add master clock handling") +Signed-off-by: Chen Ni +Link: https://patch.msgid.link/20240628080534.843815-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98088.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c +index 8b56ee550c09e..8b0645c634620 100644 +--- a/sound/soc/codecs/max98088.c ++++ b/sound/soc/codecs/max98088.c +@@ -1318,6 +1318,7 @@ static int max98088_set_bias_level(struct snd_soc_component *component, + enum snd_soc_bias_level level) + { + struct max98088_priv *max98088 = snd_soc_component_get_drvdata(component); ++ int ret; + + switch (level) { + case SND_SOC_BIAS_ON: +@@ -1333,10 +1334,13 @@ static int max98088_set_bias_level(struct snd_soc_component *component, + */ + if (!IS_ERR(max98088->mclk)) { + if (snd_soc_component_get_bias_level(component) == +- SND_SOC_BIAS_ON) ++ SND_SOC_BIAS_ON) { + clk_disable_unprepare(max98088->mclk); +- else +- clk_prepare_enable(max98088->mclk); ++ } else { ++ ret = clk_prepare_enable(max98088->mclk); ++ if (ret) ++ return ret; ++ } + } + break; + +-- +2.43.0 + diff --git a/queue-6.10/asoc-pcm6240-return-directly-after-a-failed-devm_kza.patch b/queue-6.10/asoc-pcm6240-return-directly-after-a-failed-devm_kza.patch new file mode 100644 index 00000000000..8912c2d2e95 --- /dev/null +++ b/queue-6.10/asoc-pcm6240-return-directly-after-a-failed-devm_kza.patch @@ -0,0 +1,48 @@ +From d063982374566f4b8046ea55183eaf3edba313a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 10:09:54 +0800 +Subject: ASoc: PCM6240: Return directly after a failed devm_kzalloc() in + pcmdevice_i2c_probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hao Ge + +[ Upstream commit 3722873d49a1788d5420894d4f6f63e35f5c1f13 ] + +The value “-ENOMEM” was assigned to the local variable “ret” +in one if branch after a devm_kzalloc() call failed at the beginning. +This error code will trigger then a pcmdevice_remove() call with a passed +null pointer so that an undesirable dereference will be performed. +Thus return the appropriate error code directly. + +Fixes: 1324eafd37aa ("ASoc: PCM6240: Create PCM6240 Family driver code") +Signed-off-by: Hao Ge +Link: https://patch.msgid.link/20240617020954.17252-1-hao.ge@linux.dev +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/pcm6240.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/pcm6240.c b/sound/soc/codecs/pcm6240.c +index 86e126783a1df..8f7057e689fbf 100644 +--- a/sound/soc/codecs/pcm6240.c ++++ b/sound/soc/codecs/pcm6240.c +@@ -2087,10 +2087,8 @@ static int pcmdevice_i2c_probe(struct i2c_client *i2c) + #endif + + pcm_dev = devm_kzalloc(&i2c->dev, sizeof(*pcm_dev), GFP_KERNEL); +- if (!pcm_dev) { +- ret = -ENOMEM; +- goto out; +- } ++ if (!pcm_dev) ++ return -ENOMEM; + + pcm_dev->chip_id = (id != NULL) ? id->driver_data : 0; + +-- +2.43.0 + diff --git a/queue-6.10/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch b/queue-6.10/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch new file mode 100644 index 00000000000..c92e924c963 --- /dev/null +++ b/queue-6.10/asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch @@ -0,0 +1,51 @@ +From 00783d9e428e80e3a90b14a50f9932e6365271c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 13:49:53 +0300 +Subject: ASoC: qcom: Adjust issues in case of DT error in + asoc_qcom_lpass_cpu_platform_probe() + +From: Aleksandr Mishin + +[ Upstream commit f9f7f29f64454bb20896c7d918c3abc3a1aa487b ] + +If IORESOURCE_MEM "lpass-rxtx-cdc-dma-lpm" or "lpass-va-cdc-dma-lpm" +resources is not provided in Device Tree due to any error, +platform_get_resource_byname() will return NULL which is later +dereferenced. According to sound/qcom,lpass-cpu.yaml, these resources +are provided, but DT can be broken due to any error. In such cases driver +must be able to protect itself, since the DT is external data for the +driver. +Adjust this issues by adding NULL return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b138706225c9 ("ASoC: qcom: Add regmap config support for codec dma driver") +Signed-off-by: Aleksandr Mishin +Link: https://patch.msgid.link/20240605104953.12072-1-amishin@t-argos.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-cpu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index b0f3e02cb043c..5a47f661e0c6f 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -1166,9 +1166,13 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev) + } + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-rxtx-cdc-dma-lpm"); ++ if (!res) ++ return -EINVAL; + drvdata->rxtx_cdc_dma_lpm_buf = res->start; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "lpass-va-cdc-dma-lpm"); ++ if (!res) ++ return -EINVAL; + drvdata->va_cdc_dma_lpm_buf = res->start; + } + +-- +2.43.0 + diff --git a/queue-6.10/asoc-tas2781-enable-rca-based-playback-without-dsp-f.patch b/queue-6.10/asoc-tas2781-enable-rca-based-playback-without-dsp-f.patch new file mode 100644 index 00000000000..98a0dd593bf --- /dev/null +++ b/queue-6.10/asoc-tas2781-enable-rca-based-playback-without-dsp-f.patch @@ -0,0 +1,175 @@ +From 725437348900fc2852581fc52cc320b6c46c312f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 21:36:45 +0800 +Subject: ASoc: tas2781: Enable RCA-based playback without DSP firmware + download + +From: Shenghao Ding + +[ Upstream commit 9f774c757e3fb2ac32dc4377e8f21f3364a8df81 ] + +In only loading RCA (Reconfigurable Architecture) binary case, no DSP +program will be working inside tas2563/tas2781, that is dsp-bypass mode, +do not support speaker protection, or audio acoustic algorithms in this +mode. + +Fixes: ef3bcde75d06 ("ASoC: tas2781: Add tas2781 driver") +Signed-off-by: Shenghao Ding +Reviewed-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240614133646.910-1-shenghao-ding@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/tas2781-dsp.h | 11 +++++++-- + sound/soc/codecs/tas2781-fmwlib.c | 18 ++++++++++---- + sound/soc/codecs/tas2781-i2c.c | 39 ++++++++++++++++++++----------- + 3 files changed, 48 insertions(+), 20 deletions(-) + +diff --git a/include/sound/tas2781-dsp.h b/include/sound/tas2781-dsp.h +index 7fba7ea26a4b0..3cda9da14f6d1 100644 +--- a/include/sound/tas2781-dsp.h ++++ b/include/sound/tas2781-dsp.h +@@ -117,10 +117,17 @@ struct tasdevice_fw { + struct device *dev; + }; + +-enum tasdevice_dsp_fw_state { +- TASDEVICE_DSP_FW_NONE = 0, ++enum tasdevice_fw_state { ++ /* Driver in startup mode, not load any firmware. */ + TASDEVICE_DSP_FW_PENDING, ++ /* DSP firmware in the system, but parsing error. */ + TASDEVICE_DSP_FW_FAIL, ++ /* ++ * Only RCA (Reconfigurable Architecture) firmware load ++ * successfully. ++ */ ++ TASDEVICE_RCA_FW_OK, ++ /* Both RCA and DSP firmware load successfully. */ + TASDEVICE_DSP_FW_ALL_OK, + }; + +diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c +index 265a8ca25cbbe..838d29fead961 100644 +--- a/sound/soc/codecs/tas2781-fmwlib.c ++++ b/sound/soc/codecs/tas2781-fmwlib.c +@@ -2324,14 +2324,21 @@ void tasdevice_tuning_switch(void *context, int state) + struct tasdevice_fw *tas_fmw = tas_priv->fmw; + int profile_cfg_id = tas_priv->rcabin.profile_cfg_id; + +- if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) { +- dev_err(tas_priv->dev, "DSP bin file not loaded\n"); ++ /* ++ * Only RCA-based Playback can still work with no dsp program running ++ * inside the chip. ++ */ ++ switch (tas_priv->fw_state) { ++ case TASDEVICE_RCA_FW_OK: ++ case TASDEVICE_DSP_FW_ALL_OK: ++ break; ++ default: + return; + } + + if (state == 0) { +- if (tas_priv->cur_prog < tas_fmw->nr_programs) { +- /*dsp mode or tuning mode*/ ++ if (tas_fmw && tas_priv->cur_prog < tas_fmw->nr_programs) { ++ /* dsp mode or tuning mode */ + profile_cfg_id = tas_priv->rcabin.profile_cfg_id; + tasdevice_select_tuningprm_cfg(tas_priv, + tas_priv->cur_prog, tas_priv->cur_conf, +@@ -2340,9 +2347,10 @@ void tasdevice_tuning_switch(void *context, int state) + + tasdevice_select_cfg_blk(tas_priv, profile_cfg_id, + TASDEVICE_BIN_BLK_PRE_POWER_UP); +- } else ++ } else { + tasdevice_select_cfg_blk(tas_priv, profile_cfg_id, + TASDEVICE_BIN_BLK_PRE_SHUTDOWN); ++ } + } + EXPORT_SYMBOL_NS_GPL(tasdevice_tuning_switch, + SND_SOC_TAS2781_FMWLIB); +diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c +index 9350972dfefe7..c64d458e524e2 100644 +--- a/sound/soc/codecs/tas2781-i2c.c ++++ b/sound/soc/codecs/tas2781-i2c.c +@@ -380,23 +380,37 @@ static void tasdevice_fw_ready(const struct firmware *fmw, + mutex_lock(&tas_priv->codec_lock); + + ret = tasdevice_rca_parser(tas_priv, fmw); +- if (ret) ++ if (ret) { ++ tasdevice_config_info_remove(tas_priv); + goto out; ++ } + tasdevice_create_control(tas_priv); + + tasdevice_dsp_remove(tas_priv); + tasdevice_calbin_remove(tas_priv); +- tas_priv->fw_state = TASDEVICE_DSP_FW_PENDING; ++ /* ++ * The baseline is the RCA-only case, and then the code attempts to ++ * load DSP firmware but in case of failures just keep going, i.e. ++ * failing to load DSP firmware is NOT an error. ++ */ ++ tas_priv->fw_state = TASDEVICE_RCA_FW_OK; + scnprintf(tas_priv->coef_binaryname, 64, "%s_coef.bin", + tas_priv->dev_name); + ret = tasdevice_dsp_parser(tas_priv); + if (ret) { + dev_err(tas_priv->dev, "dspfw load %s error\n", + tas_priv->coef_binaryname); +- tas_priv->fw_state = TASDEVICE_DSP_FW_FAIL; + goto out; + } +- tasdevice_dsp_create_ctrls(tas_priv); ++ ++ /* ++ * If no dsp-related kcontrol created, the dsp resource will be freed. ++ */ ++ ret = tasdevice_dsp_create_ctrls(tas_priv); ++ if (ret) { ++ dev_err(tas_priv->dev, "dsp controls error\n"); ++ goto out; ++ } + + tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; + +@@ -417,9 +431,8 @@ static void tasdevice_fw_ready(const struct firmware *fmw, + tasdevice_prmg_load(tas_priv, 0); + tas_priv->cur_prog = 0; + out: +- if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) { +- /*If DSP FW fail, kcontrol won't be created */ +- tasdevice_config_info_remove(tas_priv); ++ if (tas_priv->fw_state == TASDEVICE_RCA_FW_OK) { ++ /* If DSP FW fail, DSP kcontrol won't be created. */ + tasdevice_dsp_remove(tas_priv); + } + mutex_unlock(&tas_priv->codec_lock); +@@ -466,14 +479,14 @@ static int tasdevice_startup(struct snd_pcm_substream *substream, + { + struct snd_soc_component *codec = dai->component; + struct tasdevice_priv *tas_priv = snd_soc_component_get_drvdata(codec); +- int ret = 0; + +- if (tas_priv->fw_state != TASDEVICE_DSP_FW_ALL_OK) { +- dev_err(tas_priv->dev, "DSP bin file not loaded\n"); +- ret = -EINVAL; ++ switch (tas_priv->fw_state) { ++ case TASDEVICE_RCA_FW_OK: ++ case TASDEVICE_DSP_FW_ALL_OK: ++ return 0; ++ default: ++ return -EINVAL; + } +- +- return ret; + } + + static int tasdevice_hw_params(struct snd_pcm_substream *substream, +-- +2.43.0 + diff --git a/queue-6.10/block-call-.limit_depth-after-.hctx-has-been-set.patch b/queue-6.10/block-call-.limit_depth-after-.hctx-has-been-set.patch new file mode 100644 index 00000000000..8689fb76934 --- /dev/null +++ b/queue-6.10/block-call-.limit_depth-after-.hctx-has-been-set.patch @@ -0,0 +1,60 @@ +From 5a5d46a1ea3a3d15bb9ff63e926b7c3e52864858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 10:01:48 -0700 +Subject: block: Call .limit_depth() after .hctx has been set + +From: Bart Van Assche + +[ Upstream commit 6259151c04d4e0085e00d2dcb471ebdd1778e72e ] + +Call .limit_depth() after data->hctx has been set such that data->hctx can +be used in .limit_depth() implementations. + +Cc: Christoph Hellwig +Cc: Damien Le Moal +Cc: Zhiguo Niu +Fixes: 07757588e507 ("block/mq-deadline: Reserve 25% of scheduler tags for synchronous requests") +Signed-off-by: Bart Van Assche +Tested-by: Zhiguo Niu +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240509170149.7639-2-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 3b4df8e5ac9e5..7831af29aadaf 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -448,6 +448,10 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) + if (data->cmd_flags & REQ_NOWAIT) + data->flags |= BLK_MQ_REQ_NOWAIT; + ++retry: ++ data->ctx = blk_mq_get_ctx(q); ++ data->hctx = blk_mq_map_queue(q, data->cmd_flags, data->ctx); ++ + if (q->elevator) { + /* + * All requests use scheduler tags when an I/O scheduler is +@@ -469,13 +473,9 @@ static struct request *__blk_mq_alloc_requests(struct blk_mq_alloc_data *data) + if (ops->limit_depth) + ops->limit_depth(data->cmd_flags, data); + } +- } +- +-retry: +- data->ctx = blk_mq_get_ctx(q); +- data->hctx = blk_mq_map_queue(q, data->cmd_flags, data->ctx); +- if (!(data->rq_flags & RQF_SCHED_TAGS)) ++ } else { + blk_mq_tag_busy(data->hctx); ++ } + + if (data->flags & BLK_MQ_REQ_RESERVED) + data->rq_flags |= RQF_RESV; +-- +2.43.0 + diff --git a/queue-6.10/block-initialize-integrity-buffer-to-zero-before-wri.patch b/queue-6.10/block-initialize-integrity-buffer-to-zero-before-wri.patch new file mode 100644 index 00000000000..a1addfed5d1 --- /dev/null +++ b/queue-6.10/block-initialize-integrity-buffer-to-zero-before-wri.patch @@ -0,0 +1,64 @@ +From f4facc2b0739976a0adcb4e5c740653f7125fb0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 10:48:11 +0200 +Subject: block: initialize integrity buffer to zero before writing it to media + +From: Christoph Hellwig + +[ Upstream commit 899ee2c3829c5ac14bfc7d3c4a5846c0b709b78f ] + +Metadata added by bio_integrity_prep is using plain kmalloc, which leads +to random kernel memory being written media. For PI metadata this is +limited to the app tag that isn't used by kernel generated metadata, +but for non-PI metadata the entire buffer leaks kernel memory. + +Fix this by adding the __GFP_ZERO flag to allocations for writes. + +Fixes: 7ba1ba12eeef ("block: Block layer data integrity support") +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Reviewed-by: Kanchan Joshi +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20240613084839.1044015-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 8b528e12136f5..741581a752c47 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -454,6 +454,7 @@ bool bio_integrity_prep(struct bio *bio) + unsigned long start, end; + unsigned int len, nr_pages; + unsigned int bytes, offset, i; ++ gfp_t gfp = GFP_NOIO; + + if (!bi) + return true; +@@ -476,11 +477,19 @@ bool bio_integrity_prep(struct bio *bio) + if (!bi->profile->generate_fn || + !(bi->flags & BLK_INTEGRITY_GENERATE)) + return true; ++ ++ /* ++ * Zero the memory allocated to not leak uninitialized kernel ++ * memory to disk. For PI this only affects the app tag, but ++ * for non-integrity metadata it affects the entire metadata ++ * buffer. ++ */ ++ gfp |= __GFP_ZERO; + } + + /* Allocate kernel buffer for protection data */ + len = bio_integrity_bytes(bi, bio_sectors(bio)); +- buf = kmalloc(len, GFP_NOIO); ++ buf = kmalloc(len, gfp); + if (unlikely(buf == NULL)) { + printk(KERN_ERR "could not allocate integrity buffer\n"); + goto err_end_io; +-- +2.43.0 + diff --git a/queue-6.10/block-mq-deadline-fix-the-tag-reservation-code.patch b/queue-6.10/block-mq-deadline-fix-the-tag-reservation-code.patch new file mode 100644 index 00000000000..4e69b99bb59 --- /dev/null +++ b/queue-6.10/block-mq-deadline-fix-the-tag-reservation-code.patch @@ -0,0 +1,83 @@ +From 6caa130e67288d99b2e7cbee8de64c0a1df54e63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 10:01:49 -0700 +Subject: block/mq-deadline: Fix the tag reservation code + +From: Bart Van Assche + +[ Upstream commit 39823b47bbd40502632ffba90ebb34fff7c8b5e8 ] + +The current tag reservation code is based on a misunderstanding of the +meaning of data->shallow_depth. Fix the tag reservation code as follows: +* By default, do not reserve any tags for synchronous requests because + for certain use cases reserving tags reduces performance. See also + Harshit Mogalapalli, [bug-report] Performance regression with fio + sequential-write on a multipath setup, 2024-03-07 + (https://lore.kernel.org/linux-block/5ce2ae5d-61e2-4ede-ad55-551112602401@oracle.com/) +* Reduce min_shallow_depth to one because min_shallow_depth must be less + than or equal any shallow_depth value. +* Scale dd->async_depth from the range [1, nr_requests] to [1, + bits_per_sbitmap_word]. + +Cc: Christoph Hellwig +Cc: Damien Le Moal +Cc: Zhiguo Niu +Fixes: 07757588e507 ("block/mq-deadline: Reserve 25% of scheduler tags for synchronous requests") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240509170149.7639-3-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/mq-deadline.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index 94eede4fb9ebe..acdc28756d9d7 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -487,6 +487,20 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx) + return rq; + } + ++/* ++ * 'depth' is a number in the range 1..INT_MAX representing a number of ++ * requests. Scale it with a factor (1 << bt->sb.shift) / q->nr_requests since ++ * 1..(1 << bt->sb.shift) is the range expected by sbitmap_get_shallow(). ++ * Values larger than q->nr_requests have the same effect as q->nr_requests. ++ */ ++static int dd_to_word_depth(struct blk_mq_hw_ctx *hctx, unsigned int qdepth) ++{ ++ struct sbitmap_queue *bt = &hctx->sched_tags->bitmap_tags; ++ const unsigned int nrr = hctx->queue->nr_requests; ++ ++ return ((qdepth << bt->sb.shift) + nrr - 1) / nrr; ++} ++ + /* + * Called by __blk_mq_alloc_request(). The shallow_depth value set by this + * function is used by __blk_mq_get_tag(). +@@ -503,7 +517,7 @@ static void dd_limit_depth(blk_opf_t opf, struct blk_mq_alloc_data *data) + * Throttle asynchronous requests and writes such that these requests + * do not block the allocation of synchronous requests. + */ +- data->shallow_depth = dd->async_depth; ++ data->shallow_depth = dd_to_word_depth(data->hctx, dd->async_depth); + } + + /* Called by blk_mq_update_nr_requests(). */ +@@ -513,9 +527,9 @@ static void dd_depth_updated(struct blk_mq_hw_ctx *hctx) + struct deadline_data *dd = q->elevator->elevator_data; + struct blk_mq_tags *tags = hctx->sched_tags; + +- dd->async_depth = max(1UL, 3 * q->nr_requests / 4); ++ dd->async_depth = q->nr_requests; + +- sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, dd->async_depth); ++ sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, 1); + } + + /* Called by blk_mq_init_hctx() and blk_mq_init_sched(). */ +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-btintel-refactor-btintel_set_ppag.patch b/queue-6.10/bluetooth-btintel-refactor-btintel_set_ppag.patch new file mode 100644 index 00000000000..759981ad881 --- /dev/null +++ b/queue-6.10/bluetooth-btintel-refactor-btintel_set_ppag.patch @@ -0,0 +1,204 @@ +From 64540828886df1669f6e6c65fc84aeef9508eda4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 17:54:36 +0530 +Subject: Bluetooth: btintel: Refactor btintel_set_ppag() + +From: Kiran K + +[ Upstream commit 0a3e2eca1daa5627c8ecd1554e3146de82d61dd2 ] + +Current flow iterates the ACPI table associated with Bluetooth +controller looking for PPAG method. Method name can be directly passed +to acpi_evaluate_object function instead of iterating the table. + +Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG)") +Signed-off-by: Kiran K +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btintel.c | 119 +++++++++++------------------------- + 1 file changed, 34 insertions(+), 85 deletions(-) + +diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c +index 0c855c3ee1c1c..7ecc67deecb09 100644 +--- a/drivers/bluetooth/btintel.c ++++ b/drivers/bluetooth/btintel.c +@@ -26,21 +26,11 @@ + #define ECDSA_OFFSET 644 + #define ECDSA_HEADER_LEN 320 + +-#define BTINTEL_PPAG_NAME "PPAG" +- + enum { + DSM_SET_WDISABLE2_DELAY = 1, + DSM_SET_RESET_METHOD = 3, + }; + +-/* structure to store the PPAG data read from ACPI table */ +-struct btintel_ppag { +- u32 domain; +- u32 mode; +- acpi_status status; +- struct hci_dev *hdev; +-}; +- + #define CMD_WRITE_BOOT_PARAMS 0xfc0e + struct cmd_write_boot_params { + __le32 boot_addr; +@@ -1324,65 +1314,6 @@ static int btintel_read_debug_features(struct hci_dev *hdev, + return 0; + } + +-static acpi_status btintel_ppag_callback(acpi_handle handle, u32 lvl, void *data, +- void **ret) +-{ +- acpi_status status; +- size_t len; +- struct btintel_ppag *ppag = data; +- union acpi_object *p, *elements; +- struct acpi_buffer string = {ACPI_ALLOCATE_BUFFER, NULL}; +- struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; +- struct hci_dev *hdev = ppag->hdev; +- +- status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &string); +- if (ACPI_FAILURE(status)) { +- bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); +- return status; +- } +- +- len = strlen(string.pointer); +- if (len < strlen(BTINTEL_PPAG_NAME)) { +- kfree(string.pointer); +- return AE_OK; +- } +- +- if (strncmp((char *)string.pointer + len - 4, BTINTEL_PPAG_NAME, 4)) { +- kfree(string.pointer); +- return AE_OK; +- } +- kfree(string.pointer); +- +- status = acpi_evaluate_object(handle, NULL, NULL, &buffer); +- if (ACPI_FAILURE(status)) { +- ppag->status = status; +- bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); +- return status; +- } +- +- p = buffer.pointer; +- ppag = (struct btintel_ppag *)data; +- +- if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { +- kfree(buffer.pointer); +- bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", +- p->type, p->package.count); +- ppag->status = AE_ERROR; +- return AE_ERROR; +- } +- +- elements = p->package.elements; +- +- /* PPAG table is located at element[1] */ +- p = &elements[1]; +- +- ppag->domain = (u32)p->package.elements[0].integer.value; +- ppag->mode = (u32)p->package.elements[1].integer.value; +- ppag->status = AE_OK; +- kfree(buffer.pointer); +- return AE_CTRL_TERMINATE; +-} +- + static int btintel_set_debug_features(struct hci_dev *hdev, + const struct intel_debug_features *features) + { +@@ -2427,10 +2358,13 @@ static int btintel_configure_offload(struct hci_dev *hdev) + + static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) + { +- struct btintel_ppag ppag; + struct sk_buff *skb; + struct hci_ppag_enable_cmd ppag_cmd; + acpi_handle handle; ++ struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; ++ union acpi_object *p, *elements; ++ u32 domain, mode; ++ acpi_status status; + + /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ + switch (ver->cnvr_top & 0xFFF) { +@@ -2448,22 +2382,34 @@ static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver + return; + } + +- memset(&ppag, 0, sizeof(ppag)); +- +- ppag.hdev = hdev; +- ppag.status = AE_NOT_FOUND; +- acpi_walk_namespace(ACPI_TYPE_PACKAGE, handle, 1, NULL, +- btintel_ppag_callback, &ppag, NULL); +- +- if (ACPI_FAILURE(ppag.status)) { +- if (ppag.status == AE_NOT_FOUND) { ++ status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); ++ if (ACPI_FAILURE(status)) { ++ if (status == AE_NOT_FOUND) { + bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); + return; + } ++ bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); ++ return; ++ } ++ ++ p = buffer.pointer; ++ if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { ++ bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", ++ p->type, p->package.count); ++ kfree(buffer.pointer); + return; + } + +- if (ppag.domain != 0x12) { ++ elements = p->package.elements; ++ ++ /* PPAG table is located at element[1] */ ++ p = &elements[1]; ++ ++ domain = (u32)p->package.elements[0].integer.value; ++ mode = (u32)p->package.elements[1].integer.value; ++ kfree(buffer.pointer); ++ ++ if (domain != 0x12) { + bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); + return; + } +@@ -2474,19 +2420,22 @@ static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver + * BIT 1 : 0 Disabled in China + * 1 Enabled in China + */ +- if ((ppag.mode & 0x01) != BIT(0) && (ppag.mode & 0x02) != BIT(1)) { +- bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in CB/BIOS"); ++ mode &= 0x03; ++ ++ if (!mode) { ++ bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); + return; + } + +- ppag_cmd.ppag_enable_flags = cpu_to_le32(ppag.mode); ++ ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); + +- skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), &ppag_cmd, HCI_CMD_TIMEOUT); ++ skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), ++ &ppag_cmd, HCI_CMD_TIMEOUT); + if (IS_ERR(skb)) { + bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); + return; + } +- bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", ppag.mode); ++ bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); + kfree_skb(skb); + } + +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-btintel_pcie-fix-irq-leak.patch b/queue-6.10/bluetooth-btintel_pcie-fix-irq-leak.patch new file mode 100644 index 00000000000..75dffe9a51d --- /dev/null +++ b/queue-6.10/bluetooth-btintel_pcie-fix-irq-leak.patch @@ -0,0 +1,39 @@ +From 0c0c5a0fd426c59927b00d254f8e74c7844fb3c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 15:24:46 +0530 +Subject: Bluetooth: btintel_pcie: Fix irq leak + +From: Kiran K + +[ Upstream commit 041677e7aad6f57020aa271aafd4cb9e2af1536f ] + +Free irq before releasing irq vector. + +Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport") +Signed-off-by: Kiran K +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btintel_pcie.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c +index dd3c0626c72d8..b8120b98a2395 100644 +--- a/drivers/bluetooth/btintel_pcie.c ++++ b/drivers/bluetooth/btintel_pcie.c +@@ -1327,6 +1327,12 @@ static void btintel_pcie_remove(struct pci_dev *pdev) + data = pci_get_drvdata(pdev); + + btintel_pcie_reset_bt(data); ++ for (int i = 0; i < data->alloc_vecs; i++) { ++ struct msix_entry *msix_entry; ++ ++ msix_entry = &data->msix_entries[i]; ++ free_irq(msix_entry->vector, msix_entry); ++ } + + pci_free_irq_vectors(pdev); + +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-btnxpuart-add-handling-for-boot-signature-.patch b/queue-6.10/bluetooth-btnxpuart-add-handling-for-boot-signature-.patch new file mode 100644 index 00000000000..d32ef063646 --- /dev/null +++ b/queue-6.10/bluetooth-btnxpuart-add-handling-for-boot-signature-.patch @@ -0,0 +1,137 @@ +From ab02a9a84181e539df4292917cd9a7d1436956db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 13:53:38 +0530 +Subject: Bluetooth: btnxpuart: Add handling for boot-signature timeout errors + +From: Neeraj Sanjay Kale + +[ Upstream commit 27489364299a2ddb5c54cd9f29a3f41bd8d151ab ] + +This handles the timeout error codes sent by the chip as part of the +bootloader signatures during firmware download process. + +When the bootloader does not receive a response packet from the host +within a specific time, it adds an error code to the bootloader +signature while requesting for the FW chunk from the same offset. + +The host is expected to clear this error code with a NAK, and reply to +only those bootloader signatures which have error code 0. + +However, the driver was ignoring this error code and replying with the +firmware chunks instead, which is apparently ignored by the chip and the +chip resends the same bootloader signature with the error code again. This +happens in a loop until the error code self clears and firmware download +proceeds ahead, adding a couple of milliseconds to the total firmware +download time. + +Commit 689ca16e5232 was an initial implementation which simply printed +the following line during driver debug: +- FW Download received err 0x04 from chip + +This commit adds the expected handling to the error codes. + +This error handling is valid for data_req bootloader signatures for V3 +and future bootloader versions. + +Signed-off-by: Neeraj Sanjay Kale +Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btnxpuart.c | 52 ++++++++++++++++++++++++++++++++--- + 1 file changed, 48 insertions(+), 4 deletions(-) + +diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c +index 9bfa9a6ad56c8..6a863328b8053 100644 +--- a/drivers/bluetooth/btnxpuart.c ++++ b/drivers/bluetooth/btnxpuart.c +@@ -187,6 +187,11 @@ struct btnxpuart_dev { + #define NXP_NAK_V3 0x7b + #define NXP_CRC_ERROR_V3 0x7c + ++/* Bootloader signature error codes */ ++#define NXP_ACK_RX_TIMEOUT 0x0002 /* ACK not received from host */ ++#define NXP_HDR_RX_TIMEOUT 0x0003 /* FW Header chunk not received */ ++#define NXP_DATA_RX_TIMEOUT 0x0004 /* FW Data chunk not received */ ++ + #define HDR_LEN 16 + + #define NXP_RECV_CHIP_VER_V1 \ +@@ -277,6 +282,17 @@ struct nxp_bootloader_cmd { + __be32 crc; + } __packed; + ++struct nxp_v3_rx_timeout_nak { ++ u8 nak; ++ __le32 offset; ++ u8 crc; ++} __packed; ++ ++union nxp_v3_rx_timeout_nak_u { ++ struct nxp_v3_rx_timeout_nak pkt; ++ u8 buf[6]; ++}; ++ + static u8 crc8_table[CRC8_TABLE_SIZE]; + + /* Default configurations */ +@@ -899,6 +915,32 @@ static int nxp_recv_chip_ver_v3(struct hci_dev *hdev, struct sk_buff *skb) + return 0; + } + ++static void nxp_handle_fw_download_error(struct hci_dev *hdev, struct v3_data_req *req) ++{ ++ struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev); ++ __u32 offset = __le32_to_cpu(req->offset); ++ __u16 err = __le16_to_cpu(req->error); ++ union nxp_v3_rx_timeout_nak_u nak_tx_buf; ++ ++ switch (err) { ++ case NXP_ACK_RX_TIMEOUT: ++ case NXP_HDR_RX_TIMEOUT: ++ case NXP_DATA_RX_TIMEOUT: ++ nak_tx_buf.pkt.nak = NXP_NAK_V3; ++ nak_tx_buf.pkt.offset = __cpu_to_le32(offset); ++ nak_tx_buf.pkt.crc = crc8(crc8_table, nak_tx_buf.buf, ++ sizeof(nak_tx_buf) - 1, 0xff); ++ serdev_device_write_buf(nxpdev->serdev, nak_tx_buf.buf, ++ sizeof(nak_tx_buf)); ++ break; ++ default: ++ bt_dev_dbg(hdev, "Unknown bootloader error code: %d", err); ++ break; ++ ++ } ++ ++} ++ + static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb) + { + struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev); +@@ -913,7 +955,12 @@ static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb) + if (!req || !nxpdev->fw) + goto free_skb; + +- nxp_send_ack(NXP_ACK_V3, hdev); ++ if (!req->error) { ++ nxp_send_ack(NXP_ACK_V3, hdev); ++ } else { ++ nxp_handle_fw_download_error(hdev, req); ++ goto free_skb; ++ } + + len = __le16_to_cpu(req->len); + +@@ -940,9 +987,6 @@ static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb) + wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q); + goto free_skb; + } +- if (req->error) +- bt_dev_dbg(hdev, "FW Download received err 0x%02x from chip", +- req->error); + + offset = __le32_to_cpu(req->offset); + if (offset < nxpdev->fw_v3_offset_correction) { +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-fix-usage-of-__hci_cmd_sync_status.patch b/queue-6.10/bluetooth-fix-usage-of-__hci_cmd_sync_status.patch new file mode 100644 index 00000000000..b9cc10fc329 --- /dev/null +++ b/queue-6.10/bluetooth-fix-usage-of-__hci_cmd_sync_status.patch @@ -0,0 +1,83 @@ +From 2201e422192b4d2a9b6900046bd8949c9d1e99b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 12:07:46 -0400 +Subject: Bluetooth: Fix usage of __hci_cmd_sync_status + +From: Luiz Augusto von Dentz + +[ Upstream commit 87be7b189b2c50d4b51512f59e4e97db4eedee8a ] + +__hci_cmd_sync_status shall only be used if hci_req_sync_lock is _not_ +required which is not the case of hci_dev_cmd so it needs to use +hci_cmd_sync_status which uses hci_req_sync_lock internally. + +Fixes: f1a8f402f13f ("Bluetooth: L2CAP: Fix deadlock") +Reported-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index c644b30977bd8..7ae118a6d947b 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -718,8 +718,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg) + + switch (cmd) { + case HCISETAUTH: +- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE, +- 1, &dr.dev_opt, HCI_CMD_TIMEOUT); ++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE, ++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT); + break; + + case HCISETENCRYPT: +@@ -730,23 +730,21 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg) + + if (!test_bit(HCI_AUTH, &hdev->flags)) { + /* Auth must be enabled first */ +- err = __hci_cmd_sync_status(hdev, +- HCI_OP_WRITE_AUTH_ENABLE, +- 1, &dr.dev_opt, +- HCI_CMD_TIMEOUT); ++ err = hci_cmd_sync_status(hdev, ++ HCI_OP_WRITE_AUTH_ENABLE, ++ 1, &dr.dev_opt, ++ HCI_CMD_TIMEOUT); + if (err) + break; + } + +- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE, +- 1, &dr.dev_opt, +- HCI_CMD_TIMEOUT); ++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE, ++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT); + break; + + case HCISETSCAN: +- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE, +- 1, &dr.dev_opt, +- HCI_CMD_TIMEOUT); ++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE, ++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT); + + /* Ensure that the connectable and discoverable states + * get correctly modified as this was a non-mgmt change. +@@ -758,9 +756,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg) + case HCISETLINKPOL: + policy = cpu_to_le16(dr.dev_opt); + +- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, +- 2, &policy, +- HCI_CMD_TIMEOUT); ++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, ++ 2, &policy, HCI_CMD_TIMEOUT); + break; + + case HCISETLINKMODE: +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-hci_bcm4377-use-correct-unit-for-timeouts.patch b/queue-6.10/bluetooth-hci_bcm4377-use-correct-unit-for-timeouts.patch new file mode 100644 index 00000000000..f83a28b5347 --- /dev/null +++ b/queue-6.10/bluetooth-hci_bcm4377-use-correct-unit-for-timeouts.patch @@ -0,0 +1,36 @@ +From 4123f265d65277e8d5291340f00b0e4f3f4e24a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 18:15:02 +0000 +Subject: Bluetooth: hci_bcm4377: Use correct unit for timeouts + +From: Sven Peter + +[ Upstream commit 56c695a823e4ee1e5294a8340d5afe5de73828ec ] + +BCM4377_TIMEOUT is always used to wait for completitions and their API +expects a timeout in jiffies instead of msecs. + +Fixes: 8a06127602de ("Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards") +Signed-off-by: Sven Peter +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm4377.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_bcm4377.c b/drivers/bluetooth/hci_bcm4377.c +index d90858ea2fe59..a77a30fdc630e 100644 +--- a/drivers/bluetooth/hci_bcm4377.c ++++ b/drivers/bluetooth/hci_bcm4377.c +@@ -32,7 +32,7 @@ enum bcm4377_chip { + #define BCM4378_DEVICE_ID 0x5f69 + #define BCM4387_DEVICE_ID 0x5f71 + +-#define BCM4377_TIMEOUT 1000 ++#define BCM4377_TIMEOUT msecs_to_jiffies(1000) + + /* + * These devices only support DMA transactions inside a 32bit window +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-hci_core-hci_sync-cleanup-struct-discovery.patch b/queue-6.10/bluetooth-hci_core-hci_sync-cleanup-struct-discovery.patch new file mode 100644 index 00000000000..06d1916aacb --- /dev/null +++ b/queue-6.10/bluetooth-hci_core-hci_sync-cleanup-struct-discovery.patch @@ -0,0 +1,62 @@ +From 747b82e7d6aefa5546bf25ea59a6ba99c2d4c47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 21:59:32 +0300 +Subject: Bluetooth: hci_core, hci_sync: cleanup struct discovery_state + +From: Dmitry Antipov + +[ Upstream commit da63f331353c9e1e6dc29e49e28f8f4fe5d642fd ] + +After commit 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan +work"), 'scan_start' and 'scan_duration' of 'struct discovery_state' +are still initialized but actually unused. So remove the aforementioned +fields and adjust 'hci_discovery_filter_clear()' and 'le_scan_disable()' +accordingly. Compile tested only. + +Fixes: 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work") +Signed-off-by: Dmitry Antipov +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 4 ---- + net/bluetooth/hci_sync.c | 2 -- + 2 files changed, 6 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index c43716edf2056..b15f51ae3bfd9 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -91,8 +91,6 @@ struct discovery_state { + s8 rssi; + u16 uuid_count; + u8 (*uuids)[16]; +- unsigned long scan_start; +- unsigned long scan_duration; + unsigned long name_resolve_timeout; + }; + +@@ -890,8 +888,6 @@ static inline void hci_discovery_filter_clear(struct hci_dev *hdev) + hdev->discovery.uuid_count = 0; + kfree(hdev->discovery.uuids); + hdev->discovery.uuids = NULL; +- hdev->discovery.scan_start = 0; +- hdev->discovery.scan_duration = 0; + } + + bool hci_discovery_active(struct hci_dev *hdev); +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index eea34e6a236fd..bb704088559fb 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -371,8 +371,6 @@ static void le_scan_disable(struct work_struct *work) + goto _return; + } + +- hdev->discovery.scan_start = 0; +- + /* If we were running LE only scan, change discovery state. If + * we were running both LE and BR/EDR inquiry simultaneously, + * and BR/EDR inquiry is already finished, stop discovery, +-- +2.43.0 + diff --git a/queue-6.10/bluetooth-hci_event-set-qos-encryption-from-biginfo-.patch b/queue-6.10/bluetooth-hci_event-set-qos-encryption-from-biginfo-.patch new file mode 100644 index 00000000000..16e0bec379c --- /dev/null +++ b/queue-6.10/bluetooth-hci_event-set-qos-encryption-from-biginfo-.patch @@ -0,0 +1,42 @@ +From 3897fb58474a9f132928f4af294942a04036c4ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:52:06 +0300 +Subject: Bluetooth: hci_event: Set QoS encryption from BIGInfo report + +From: Iulia Tanasescu + +[ Upstream commit 5a820b13db3988122080f8de2920721f770c37a0 ] + +On a Broadcast Sink, after synchronizing to the PA transimitted by a +Broadcast Source, the BIGInfo advertising reports emitted by the +Controller hold the encryption field, which indicates whether the +Broadcast Source is transmitting encrypted streams. + +This updates the PA sync hcon QoS with the encryption value reported +in the BIGInfo report, so that this information is accurate if the +userspace tries to access the QoS struct via getsockopt. + +Fixes: 1d11d70d1f6b ("Bluetooth: ISO: Pass BIG encryption info through QoS") +Signed-off-by: Iulia Tanasescu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 93f7ac905cece..4611a67d7dcc3 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6988,6 +6988,8 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data, + if (!pa_sync) + goto unlock; + ++ pa_sync->iso_qos.bcast.encryption = ev->encryption; ++ + /* Notify iso layer */ + hci_connect_cfm(pa_sync, 0); + +-- +2.43.0 + diff --git a/queue-6.10/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch b/queue-6.10/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch new file mode 100644 index 00000000000..c9088f25e1c --- /dev/null +++ b/queue-6.10/bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch @@ -0,0 +1,77 @@ +From ca02316c633e46dea8613279368956ef7a0bf253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 10:50:08 +0000 +Subject: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures + +From: Alexey Kodanev + +[ Upstream commit c9741a03dc8e491e57b95fba0058ab46b7e506da ] + +To have enough space to write all possible sprintf() args. Currently +'name' size is 16, but the first '%s' specifier may already need at +least 16 characters, since 'bnad->netdev->name' is used there. + +For '%d' specifiers, assume that they require: + * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8 + * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX + is 16 + +And replace sprintf with snprintf. + +Detected using the static analysis tool - Svace. + +Fixes: 8b230ed8ec96 ("bna: Brocade 10Gb Ethernet device driver") +Signed-off-by: Alexey Kodanev +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/brocade/bna/bna_types.h | 2 +- + drivers/net/ethernet/brocade/bna/bnad.c | 11 ++++++----- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/brocade/bna/bna_types.h b/drivers/net/ethernet/brocade/bna/bna_types.h +index a5ebd7110e073..986f43d277119 100644 +--- a/drivers/net/ethernet/brocade/bna/bna_types.h ++++ b/drivers/net/ethernet/brocade/bna/bna_types.h +@@ -416,7 +416,7 @@ struct bna_ib { + /* Tx object */ + + /* Tx datapath control structure */ +-#define BNA_Q_NAME_SIZE 16 ++#define BNA_Q_NAME_SIZE (IFNAMSIZ + 6) + struct bna_tcb { + /* Fast path */ + void **sw_qpt; +diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c +index fe121d36112d5..ece6f3b483273 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad.c ++++ b/drivers/net/ethernet/brocade/bna/bnad.c +@@ -1534,8 +1534,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info, + + for (i = 0; i < num_txqs; i++) { + vector_num = tx_info->tcb[i]->intr_vector; +- sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name, +- tx_id + tx_info->tcb[i]->id); ++ snprintf(tx_info->tcb[i]->name, BNA_Q_NAME_SIZE, "%s TXQ %d", ++ bnad->netdev->name, ++ tx_id + tx_info->tcb[i]->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_tx, 0, + tx_info->tcb[i]->name, +@@ -1585,9 +1586,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info, + + for (i = 0; i < num_rxps; i++) { + vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; +- sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d", +- bnad->netdev->name, +- rx_id + rx_info->rx_ctrl[i].ccb->id); ++ snprintf(rx_info->rx_ctrl[i].ccb->name, BNA_Q_NAME_SIZE, ++ "%s CQ %d", bnad->netdev->name, ++ rx_id + rx_info->rx_ctrl[i].ccb->id); + err = request_irq(bnad->msix_table[vector_num].vector, + (irq_handler_t)bnad_msix_rx, 0, + rx_info->rx_ctrl[i].ccb->name, +-- +2.43.0 + diff --git a/queue-6.10/bnxt_re-fix-imm_data-endianness.patch b/queue-6.10/bnxt_re-fix-imm_data-endianness.patch new file mode 100644 index 00000000000..f78b3438bd0 --- /dev/null +++ b/queue-6.10/bnxt_re-fix-imm_data-endianness.patch @@ -0,0 +1,105 @@ +From 007804ff5d2e9c03458ad15198a8cfad5b41777a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 14:21:02 +0200 +Subject: bnxt_re: Fix imm_data endianness + +From: Jack Wang + +[ Upstream commit 95b087f87b780daafad1dbb2c84e81b729d5d33f ] + +When map a device between servers with MLX and BCM RoCE nics, RTRS +server complain about unknown imm type, and can't map the device, + +After more debug, it seems bnxt_re wrongly handle the +imm_data, this patch fixed the compat issue with MLX for us. + +In off list discussion, Selvin confirmed HW is working in little endian format +and all data needs to be converted to LE while providing. + +This patch fix the endianness for imm_data + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Signed-off-by: Jack Wang +Link: https://lore.kernel.org/r/20240710122102.37569-1-jinpu.wang@ionos.com +Acked-by: Selvin Xavier +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- + drivers/infiniband/hw/bnxt_re/qplib_fp.h | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index ce9c5bae83bf1..582e83a36ccbe 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -2479,7 +2479,7 @@ static int bnxt_re_build_send_wqe(struct bnxt_re_qp *qp, + break; + case IB_WR_SEND_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_IMM; +- wqe->send.imm_data = wr->ex.imm_data; ++ wqe->send.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_SEND_WITH_INV: + wqe->type = BNXT_QPLIB_SWQE_TYPE_SEND_WITH_INV; +@@ -2509,7 +2509,7 @@ static int bnxt_re_build_rdma_wqe(const struct ib_send_wr *wr, + break; + case IB_WR_RDMA_WRITE_WITH_IMM: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_WRITE_WITH_IMM; +- wqe->rdma.imm_data = wr->ex.imm_data; ++ wqe->rdma.imm_data = be32_to_cpu(wr->ex.imm_data); + break; + case IB_WR_RDMA_READ: + wqe->type = BNXT_QPLIB_SWQE_TYPE_RDMA_READ; +@@ -3581,7 +3581,7 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, + wc->byte_len = orig_cqe->length; + wc->qp = &gsi_qp->ib_qp; + +- wc->ex.imm_data = orig_cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(orig_cqe->immdata)); + wc->src_qp = orig_cqe->src_qp; + memcpy(wc->smac, orig_cqe->smac, ETH_ALEN); + if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) { +@@ -3726,7 +3726,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + (unsigned long)(cqe->qp_handle), + struct bnxt_re_qp, qplib_qp); + wc->qp = &qp->ib_qp; +- wc->ex.imm_data = cqe->immdata; ++ wc->ex.imm_data = cpu_to_be32(le32_to_cpu(cqe->immdata)); + wc->src_qp = cqe->src_qp; + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->port_num = 1; +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +index 7fd4506b3584f..244da20d1181f 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h +@@ -164,7 +164,7 @@ struct bnxt_qplib_swqe { + /* Send, with imm, inval key */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u32 q_key; +@@ -182,7 +182,7 @@ struct bnxt_qplib_swqe { + /* RDMA write, with imm, read */ + struct { + union { +- __be32 imm_data; ++ u32 imm_data; + u32 inv_key; + }; + u64 remote_va; +@@ -389,7 +389,7 @@ struct bnxt_qplib_cqe { + u16 cfa_meta; + u64 wr_id; + union { +- __be32 immdata; ++ __le32 immdata; + u32 invrkey; + }; + u64 qp_handle; +-- +2.43.0 + diff --git a/queue-6.10/bpf-annotate-btf-show-functions-with-__printf.patch b/queue-6.10/bpf-annotate-btf-show-functions-with-__printf.patch new file mode 100644 index 00000000000..c033904e879 --- /dev/null +++ b/queue-6.10/bpf-annotate-btf-show-functions-with-__printf.patch @@ -0,0 +1,56 @@ +From c525d7fbe9e917001e67f2d4b707e0b009d7df4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 19:23:21 +0100 +Subject: bpf: annotate BTF show functions with __printf + +From: Alan Maguire + +[ Upstream commit b3470da314fd8018ee237e382000c4154a942420 ] + +-Werror=suggest-attribute=format warns about two functions +in kernel/bpf/btf.c [1]; add __printf() annotations to silence +these warnings since for CONFIG_WERROR=y they will trigger +build failures. + +[1] https://lore.kernel.org/bpf/a8b20c72-6631-4404-9e1f-0410642d7d20@gmail.com/ + +Fixes: 31d0bc81637d ("bpf: Move to generic BTF show support, apply it to seq files/strings") +Reported-by: Mirsad Todorovac +Signed-off-by: Alan Maguire +Tested-by: Mirsad Todorovac +Link: https://lore.kernel.org/r/20240711182321.963667-1-alan.maguire@oracle.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 821063660d9f9..3a2e55cc13e50 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -7370,8 +7370,8 @@ static void btf_type_show(const struct btf *btf, u32 type_id, void *obj, + btf_type_ops(t)->show(btf, t, type_id, obj, 0, show); + } + +-static void btf_seq_show(struct btf_show *show, const char *fmt, +- va_list args) ++__printf(2, 0) static void btf_seq_show(struct btf_show *show, const char *fmt, ++ va_list args) + { + seq_vprintf((struct seq_file *)show->target, fmt, args); + } +@@ -7404,8 +7404,8 @@ struct btf_show_snprintf { + int len; /* length we would have written */ + }; + +-static void btf_snprintf_show(struct btf_show *show, const char *fmt, +- va_list args) ++__printf(2, 0) static void btf_snprintf_show(struct btf_show *show, const char *fmt, ++ va_list args) + { + struct btf_show_snprintf *ssnprintf = (struct btf_show_snprintf *)show; + int len; +-- +2.43.0 + diff --git a/queue-6.10/bpf-arm64-fix-trampoline-for-bpf_tramp_f_call_orig.patch b/queue-6.10/bpf-arm64-fix-trampoline-for-bpf_tramp_f_call_orig.patch new file mode 100644 index 00000000000..d0de5392a94 --- /dev/null +++ b/queue-6.10/bpf-arm64-fix-trampoline-for-bpf_tramp_f_call_orig.patch @@ -0,0 +1,59 @@ +From 62e8353dcca454ba49f15805be1d53d0eccd86b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:18:38 +0000 +Subject: bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG + +From: Puranjay Mohan + +[ Upstream commit 19d3c179a37730caf600a97fed3794feac2b197b ] + +When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls +__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them +the struct bpf_tramp_image *im pointer as an argument in R0. + +The trampoline generation code uses emit_addr_mov_i64() to emit +instructions for moving the bpf_tramp_image address into R0, but +emit_addr_mov_i64() assumes the address to be in the vmalloc() space +and uses only 48 bits. Because bpf_tramp_image is allocated using +kzalloc(), its address can use more than 48-bits, in this case the +trampoline will pass an invalid address to __bpf_tramp_enter/exit() +causing a kernel crash. + +Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64() +as it can work with addresses that are greater than 48-bits. + +Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") +Signed-off-by: Puranjay Mohan +Signed-off-by: Daniel Borkmann +Closes: https://lore.kernel.org/all/SJ0PR15MB461564D3F7E7A763498CA6A8CBDB2@SJ0PR15MB4615.namprd15.prod.outlook.com/ +Link: https://lore.kernel.org/bpf/20240711151838.43469-1-puranjay@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 720336d288568..1bf483ec971d9 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -2141,7 +2141,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, + emit(A64_STR64I(A64_R(20), A64_SP, regs_off + 8), ctx); + + if (flags & BPF_TRAMP_F_CALL_ORIG) { +- emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); ++ emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + emit_call((const u64)__bpf_tramp_enter, ctx); + } + +@@ -2185,7 +2185,7 @@ static int prepare_trampoline(struct jit_ctx *ctx, struct bpf_tramp_image *im, + + if (flags & BPF_TRAMP_F_CALL_ORIG) { + im->ip_epilogue = ctx->ro_image + ctx->idx; +- emit_addr_mov_i64(A64_R(0), (const u64)im, ctx); ++ emit_a64_mov_i64(A64_R(0), (const u64)im, ctx); + emit_call((const u64)__bpf_tramp_exit, ctx); + } + +-- +2.43.0 + diff --git a/queue-6.10/bpf-change-bpf_session_cookie-return-value-to-__u64.patch b/queue-6.10/bpf-change-bpf_session_cookie-return-value-to-__u64.patch new file mode 100644 index 00000000000..530564b8f22 --- /dev/null +++ b/queue-6.10/bpf-change-bpf_session_cookie-return-value-to-__u64.patch @@ -0,0 +1,66 @@ +From eab2bec90a8d66779c73812f4a4e4bc16406dd0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 10:16:24 +0200 +Subject: bpf: Change bpf_session_cookie return value to __u64 * + +From: Jiri Olsa + +[ Upstream commit 717d6313bba1b3179f0bf1026aaec6b7e26f484e ] + +This reverts [1] and changes return value for bpf_session_cookie +in bpf selftests. Having long * might lead to problems on 32-bit +architectures. + +Fixes: 2b8dd87332cd ("bpf: Make bpf_session_cookie() kfunc return long *") +Suggested-by: Andrii Nakryiko +Signed-off-by: Jiri Olsa +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240619081624.1620152-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 2 +- + tools/testing/selftests/bpf/bpf_kfuncs.h | 2 +- + tools/testing/selftests/bpf/progs/kprobe_multi_session_cookie.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index bc16e21a2a443..d1daeab1bbc14 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -3527,7 +3527,7 @@ __bpf_kfunc bool bpf_session_is_return(void) + return session_ctx->is_return; + } + +-__bpf_kfunc long *bpf_session_cookie(void) ++__bpf_kfunc __u64 *bpf_session_cookie(void) + { + struct bpf_session_run_ctx *session_ctx; + +diff --git a/tools/testing/selftests/bpf/bpf_kfuncs.h b/tools/testing/selftests/bpf/bpf_kfuncs.h +index be91a69193158..3b6675ab40861 100644 +--- a/tools/testing/selftests/bpf/bpf_kfuncs.h ++++ b/tools/testing/selftests/bpf/bpf_kfuncs.h +@@ -77,5 +77,5 @@ extern int bpf_verify_pkcs7_signature(struct bpf_dynptr *data_ptr, + struct bpf_key *trusted_keyring) __ksym; + + extern bool bpf_session_is_return(void) __ksym __weak; +-extern long *bpf_session_cookie(void) __ksym __weak; ++extern __u64 *bpf_session_cookie(void) __ksym __weak; + #endif +diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_session_cookie.c b/tools/testing/selftests/bpf/progs/kprobe_multi_session_cookie.c +index d49070803e221..0835b5edf6858 100644 +--- a/tools/testing/selftests/bpf/progs/kprobe_multi_session_cookie.c ++++ b/tools/testing/selftests/bpf/progs/kprobe_multi_session_cookie.c +@@ -25,7 +25,7 @@ int BPF_PROG(trigger) + + static int check_cookie(__u64 val, __u64 *result) + { +- long *cookie; ++ __u64 *cookie; + + if (bpf_get_current_pid_tgid() >> 32 != pid) + return 1; +-- +2.43.0 + diff --git a/queue-6.10/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch b/queue-6.10/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch new file mode 100644 index 00000000000..53595d9f479 --- /dev/null +++ b/queue-6.10/bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch @@ -0,0 +1,60 @@ +From 554b3d45fcafd970aa115351e1b9cd90ef7afe2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 10:28:59 +0100 +Subject: bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alan Maguire + +[ Upstream commit 2454075f8e2915cebbe52a1195631bc7efe2b7e1 ] + +As reported by Mirsad [1] we still see format warnings in kernel/bpf/btf.o +at W=1 warning level: + + CC kernel/bpf/btf.o +./kernel/bpf/btf.c: In function ‘btf_type_seq_show_flags’: +./kernel/bpf/btf.c:7553:21: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] + 7553 | sseq.showfn = btf_seq_show; + | ^ +./kernel/bpf/btf.c: In function ‘btf_type_snprintf_show’: +./kernel/bpf/btf.c:7604:31: warning: assignment left-hand side might be a candidate for a format attribute [-Wsuggest-attribute=format] + 7604 | ssnprintf.show.showfn = btf_snprintf_show; + | ^ + +Combined with CONFIG_WERROR=y these can halt the build. + +The fix (annotating the structure field with __printf()) +suggested by Mirsad resolves these. Apologies I missed this last time. +No other W=1 warnings were observed in kernel/bpf after this fix. + +[1] https://lore.kernel.org/bpf/92c9d047-f058-400c-9c7d-81d4dc1ef71b@gmail.com/ + +Fixes: b3470da314fd ("bpf: annotate BTF show functions with __printf") +Reported-by: Mirsad Todorovac +Suggested-by: Mirsad Todorovac +Signed-off-by: Alan Maguire +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240712092859.1390960-1-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 3a2e55cc13e50..fe360b5b211d1 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -414,7 +414,7 @@ const char *btf_type_str(const struct btf_type *t) + struct btf_show { + u64 flags; + void *target; /* target of show operation (seq file, buffer) */ +- void (*showfn)(struct btf_show *show, const char *fmt, va_list args); ++ __printf(2, 0) void (*showfn)(struct btf_show *show, const char *fmt, va_list args); + const struct btf *btf; + /* below are used during iteration */ + struct { +-- +2.43.0 + diff --git a/queue-6.10/bpf-fix-atomic-probe-zero-extension.patch b/queue-6.10/bpf-fix-atomic-probe-zero-extension.patch new file mode 100644 index 00000000000..4aa0472fa05 --- /dev/null +++ b/queue-6.10/bpf-fix-atomic-probe-zero-extension.patch @@ -0,0 +1,43 @@ +From 6db4b0df87bf946c5bd3a52f89e8b96b6011a101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 01:40:19 +0200 +Subject: bpf: Fix atomic probe zero-extension + +From: Ilya Leoshkevich + +[ Upstream commit df34ec9db6f521118895f22795da49f2ec01f8cf ] + +Zero-extending results of atomic probe operations fails with: + + verifier bug. zext_dst is set, but no reg is defined + +The problem is that insn_def_regno() handles BPF_ATOMICs, but not +BPF_PROBE_ATOMICs. Fix by adding the missing condition. + +Fixes: d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to x86 JIT") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240701234304.14336-2-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 214a9fa8c6fb7..e1e08e62a2f2f 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3215,7 +3215,8 @@ static int insn_def_regno(const struct bpf_insn *insn) + case BPF_ST: + return -1; + case BPF_STX: +- if (BPF_MODE(insn->code) == BPF_ATOMIC && ++ if ((BPF_MODE(insn->code) == BPF_ATOMIC || ++ BPF_MODE(insn->code) == BPF_PROBE_ATOMIC) && + (insn->imm & BPF_FETCH)) { + if (insn->imm == BPF_CMPXCHG) + return BPF_REG_0; +-- +2.43.0 + diff --git a/queue-6.10/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch b/queue-6.10/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch new file mode 100644 index 00000000000..f317e87bdd9 --- /dev/null +++ b/queue-6.10/bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch @@ -0,0 +1,110 @@ +From fc55a7f5b64e7a2cf6d3908d029df17d7bd87962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 22:58:18 +0800 +Subject: bpf: Fix null pointer dereference in resolve_prog_type() for + BPF_PROG_TYPE_EXT + +From: Tengda Wu + +[ Upstream commit f7866c35873377313ff94398f17d425b28b71de1 ] + +When loading a EXT program without specifying `attr->attach_prog_fd`, +the `prog->aux->dst_prog` will be null. At this time, calling +resolve_prog_type() anywhere will result in a null pointer dereference. + +Example stack trace: + +[ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 +[ 8.108262] Mem abort info: +[ 8.108384] ESR = 0x0000000096000004 +[ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits +[ 8.108722] SET = 0, FnV = 0 +[ 8.108827] EA = 0, S1PTW = 0 +[ 8.108939] FSC = 0x04: level 0 translation fault +[ 8.109102] Data abort info: +[ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +[ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 +[ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 +[ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 8.112783] Modules linked in: +[ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 +[ 8.113230] Hardware name: linux,dummy-virt (DT) +[ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 +[ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 +[ 8.113798] sp : ffff80008283b9f0 +[ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 +[ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 +[ 8.113897] x23: ffff0000c1134000 x22: 000000000001864f x21: ffff0000c1138000 +[ 8.113912] x20: 0000000000000001 x19: ffff0000c12b8000 x18: ffffffffffffffff +[ 8.113929] x17: 0000000000000000 x16: 0000000000000000 x15: 0720072007200720 +[ 8.113944] x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 +[ 8.113958] x11: 0720072007200720 x10: 0000000000f9fca4 x9 : ffff80008021f4e4 +[ 8.113991] x8 : 0101010101010101 x7 : 746f72705f6d656d x6 : 000000001e0e0f5f +[ 8.114006] x5 : 000000000001864f x4 : ffff0000c12b8000 x3 : 000000000000001c +[ 8.114020] x2 : 0000000000000002 x1 : 0000000000000000 x0 : 0000000000000000 +[ 8.114126] Call trace: +[ 8.114159] may_access_direct_pkt_data+0x24/0xa0 +[ 8.114202] bpf_check+0x3bc/0x28c0 +[ 8.114214] bpf_prog_load+0x658/0xa58 +[ 8.114227] __sys_bpf+0xc50/0x2250 +[ 8.114240] __arm64_sys_bpf+0x28/0x40 +[ 8.114254] invoke_syscall.constprop.0+0x54/0xf0 +[ 8.114273] do_el0_svc+0x4c/0xd8 +[ 8.114289] el0_svc+0x3c/0x140 +[ 8.114305] el0t_64_sync_handler+0x134/0x150 +[ 8.114331] el0t_64_sync+0x168/0x170 +[ 8.114477] Code: 7100707f 54000081 f9401c00 f9403800 (b9400403) +[ 8.118672] ---[ end trace 0000000000000000 ]--- + +One way to fix it is by forcing `attach_prog_fd` non-empty when +bpf_prog_load(). But this will lead to `libbpf_probe_bpf_prog_type` +API broken which use verifier log to probe prog type and will log +nothing if we reject invalid EXT prog before bpf_check(). + +Another way is by adding null check in resolve_prog_type(). + +The issue was introduced by commit 4a9c7bbe2ed4 ("bpf: Resolve to +prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") which wanted +to correct type resolution for BPF_PROG_TYPE_TRACING programs. Before +that, the type resolution of BPF_PROG_TYPE_EXT prog actually follows +the logic below: + + prog->aux->dst_prog ? prog->aux->dst_prog->type : prog->type; + +It implies that when EXT program is not yet attached to `dst_prog`, +the prog type should be EXT itself. This code worked fine in the past. +So just keep using it. + +Fix this by returning `prog->type` for BPF_PROG_TYPE_EXT if `dst_prog` +is not present in resolve_prog_type(). + +Fixes: 4a9c7bbe2ed4 ("bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT") +Signed-off-by: Tengda Wu +Signed-off-by: Daniel Borkmann +Acked-by: Daniel Borkmann +Cc: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20240711145819.254178-2-wutengda@huaweicloud.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf_verifier.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index e4070fb02b110..ff2a6cdb1fa3f 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -846,7 +846,7 @@ static inline u32 type_flag(u32 type) + /* only use after check_attach_btf_id() */ + static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog) + { +- return prog->type == BPF_PROG_TYPE_EXT ? ++ return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->dst_prog) ? + prog->aux->dst_prog->type : prog->type; + } + +-- +2.43.0 + diff --git a/queue-6.10/bpf-fix-overflow-check-in-adjust_jmp_off.patch b/queue-6.10/bpf-fix-overflow-check-in-adjust_jmp_off.patch new file mode 100644 index 00000000000..c877316cc71 --- /dev/null +++ b/queue-6.10/bpf-fix-overflow-check-in-adjust_jmp_off.patch @@ -0,0 +1,39 @@ +From 8f6423dbfb8b490ad2cd10270005bf226b2bf21c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 16:01:24 +0800 +Subject: bpf: fix overflow check in adjust_jmp_off() + +From: Shung-Hsi Yu + +[ Upstream commit 4a04b4f0de59dd5c621e78f15803ee0b0544eeb8 ] + +adjust_jmp_off() incorrectly used the insn->imm field for all overflow check, +which is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case, +not the general jump instruction case. Fix it by using insn->off for overflow +check in the general case. + +Fixes: 5337ac4c9b80 ("bpf: Fix the corner case with may_goto and jump to the 1st insn.") +Signed-off-by: Shung-Hsi Yu +Link: https://lore.kernel.org/r/20240712080127.136608-2-shung-hsi.yu@suse.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index e1e08e62a2f2f..6b422c275f78c 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -18768,7 +18768,7 @@ static int adjust_jmp_off(struct bpf_prog *prog, u32 tgt_idx, u32 delta) + } else { + if (i + 1 + insn->off != tgt_idx) + continue; +- if (signed_add16_overflows(insn->imm, delta)) ++ if (signed_add16_overflows(insn->off, delta)) + return -ERANGE; + insn->off += delta; + } +-- +2.43.0 + diff --git a/queue-6.10/bpf-helpers-fix-bpf_wq_set_callback_impl-signature.patch b/queue-6.10/bpf-helpers-fix-bpf_wq_set_callback_impl-signature.patch new file mode 100644 index 00000000000..da7ea3c3341 --- /dev/null +++ b/queue-6.10/bpf-helpers-fix-bpf_wq_set_callback_impl-signature.patch @@ -0,0 +1,45 @@ +From c32cdd3a9c3f0bdaba1ed6b13f2c5bd9b01adeae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 11:52:57 +0200 +Subject: bpf: helpers: fix bpf_wq_set_callback_impl signature + +From: Benjamin Tissoires + +[ Upstream commit f56f4d541eab1ae060a46b56dd6ec9130d6e3a98 ] + +I realized this while having a map containing both a struct bpf_timer and +a struct bpf_wq: the third argument provided to the bpf_wq callback is +not the struct bpf_wq pointer itself, but the pointer to the value in +the map. + +Which means that the users need to double cast the provided "value" as +this is not a struct bpf_wq *. + +This is a change of API, but there doesn't seem to be much users of bpf_wq +right now, so we should be able to go with this right now. + +Fixes: 81f1d7a583fa ("bpf: wq: add bpf_wq_set_callback_impl") +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20240708-fix-wq-v2-1-667e5c9fbd99@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c +index 3243c83ef3e39..7268370600f6e 100644 +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -2786,7 +2786,7 @@ __bpf_kfunc int bpf_wq_start(struct bpf_wq *wq, unsigned int flags) + } + + __bpf_kfunc int bpf_wq_set_callback_impl(struct bpf_wq *wq, +- int (callback_fn)(void *map, int *key, struct bpf_wq *wq), ++ int (callback_fn)(void *map, int *key, void *value), + unsigned int flags, + void *aux__ign) + { +-- +2.43.0 + diff --git a/queue-6.10/bpf-make-bpf_session_cookie-kfunc-return-long.patch b/queue-6.10/bpf-make-bpf_session_cookie-kfunc-return-long.patch new file mode 100644 index 00000000000..70b31f095db --- /dev/null +++ b/queue-6.10/bpf-make-bpf_session_cookie-kfunc-return-long.patch @@ -0,0 +1,45 @@ +From dc88c2abe6fd72c0e5ae96577f09f1710bab4fc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 09:58:30 -0600 +Subject: bpf: Make bpf_session_cookie() kfunc return long * + +From: Daniel Xu + +[ Upstream commit 2b8dd87332cd2782b5b3f0c423bd6693e487ed30 ] + +We will soon be generating kfunc prototypes from BTF. As part of that, +we need to align the manual signatures in bpf_kfuncs.h with the actual +kfunc definitions. There is currently a conflicting signature for +bpf_session_cookie() w.r.t. return type. + +The original intent was to return long * and not __u64 *. You can see +evidence of that intent in a3a5113393cc ("selftests/bpf: Add kprobe +session cookie test"). + +Fix conflict by changing kfunc definition. + +Fixes: 5c919acef851 ("bpf: Add support for kprobe session cookie") +Signed-off-by: Daniel Xu +Link: https://lore.kernel.org/r/7043e1c251ab33151d6e3830f8ea1902ed2604ac.1718207789.git.dxu@dxuuu.xyz +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index d1daeab1bbc14..bc16e21a2a443 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -3527,7 +3527,7 @@ __bpf_kfunc bool bpf_session_is_return(void) + return session_ctx->is_return; + } + +-__bpf_kfunc __u64 *bpf_session_cookie(void) ++__bpf_kfunc long *bpf_session_cookie(void) + { + struct bpf_session_run_ctx *session_ctx; + +-- +2.43.0 + diff --git a/queue-6.10/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch b/queue-6.10/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch new file mode 100644 index 00000000000..b2df66e10af --- /dev/null +++ b/queue-6.10/bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch @@ -0,0 +1,46 @@ +From f547a1483ecbfed0add94c648066fb13bef09bb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 21:11:50 +0800 +Subject: bpftool: Mount bpffs when pinmaps path not under the bpffs + +From: Tao Chen + +[ Upstream commit da5f8fd1f0d393d5eaaba9ad8c22d1c26bb2bf9b ] + +As Quentin said [0], BPF map pinning will fail if the pinmaps path is not +under the bpffs, like: + + libbpf: specified path /home/ubuntu/test/sock_ops_map is not on BPF FS + Error: failed to pin all maps + + [0] https://github.com/libbpf/bpftool/issues/146 + +Fixes: 3767a94b3253 ("bpftool: add pinmaps argument to the load/loadall") +Signed-off-by: Tao Chen +Signed-off-by: Daniel Borkmann +Tested-by: Quentin Monnet +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20240702131150.15622-1-chen.dylane@gmail.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index 1a501cf09e782..40ea743d139fd 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -1813,6 +1813,10 @@ static int load_with_options(int argc, char **argv, bool first_prog_only) + } + + if (pinmaps) { ++ err = create_and_mount_bpffs_dir(pinmaps); ++ if (err) ++ goto err_unpin; ++ + err = bpf_object__pin_maps(obj, pinmaps); + if (err) { + p_err("failed to pin all maps"); +-- +2.43.0 + diff --git a/queue-6.10/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch b/queue-6.10/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch new file mode 100644 index 00000000000..7de9504aaef --- /dev/null +++ b/queue-6.10/bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch @@ -0,0 +1,58 @@ +From 63c2863166a4defa2ba46461b8c35904dda2840e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:51:49 -0700 +Subject: bpftool: Un-const bpf_func_info to fix it for llvm 17 and newer + +From: Ivan Babrou + +[ Upstream commit f4aba3471cfb9ccf69b476463f19b4c50fef6b14 ] + +LLVM 17 started treating const structs as constants: + +* https://github.com/llvm/llvm-project/commit/0b2d5b967d98 + +Combined with pointer laundering via ptr_to_u64, which takes a const ptr, +but in reality treats the underlying memory as mutable, this makes clang +always pass zero to btf__type_by_id, which breaks full name resolution. + +Disassembly before (LLVM 16) and after (LLVM 17): + + - 8b 75 cc mov -0x34(%rbp),%esi + - e8 47 8d 02 00 call 3f5b0 + + 31 f6 xor %esi,%esi + + e8 a9 8c 02 00 call 3f510 + +It's a bigger project to fix this properly (and a question whether LLVM +itself should detect this), but for right now let's just fix bpftool. + +For more information, see this thread in bpf mailing list: + +* https://lore.kernel.org/bpf/CABWYdi0ymezpYsQsPv7qzpx2fWuTkoD1-wG1eT-9x-TSREFrQg@mail.gmail.com/T/ + +Fixes: b662000aff84 ("bpftool: Adding support for BTF program names") +Signed-off-by: Ivan Babrou +Signed-off-by: Andrii Nakryiko +Acked-by: Nick Desaulniers +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20240520225149.5517-1-ivan@cloudflare.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index 958e92acca8e2..9b75639434b81 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -410,7 +410,7 @@ void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd, + { + const char *prog_name = prog_info->name; + const struct btf_type *func_type; +- const struct bpf_func_info finfo = {}; ++ struct bpf_func_info finfo = {}; + struct bpf_prog_info info = {}; + __u32 info_len = sizeof(info); + struct btf *prog_btf = NULL; +-- +2.43.0 + diff --git a/queue-6.10/cgroup-cpuset-fix-remote-root-partition-creation-pro.patch b/queue-6.10/cgroup-cpuset-fix-remote-root-partition-creation-pro.patch new file mode 100644 index 00000000000..fb3802293bf --- /dev/null +++ b/queue-6.10/cgroup-cpuset-fix-remote-root-partition-creation-pro.patch @@ -0,0 +1,174 @@ +From 785cb5d9034228a69ae0bef7cdd060dfd6597ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 10:39:41 -0400 +Subject: cgroup/cpuset: Fix remote root partition creation problem + +From: Waiman Long + +[ Upstream commit ccac8e8de99cbcf5e7f53251ebce917bf7bcc29c ] + +Since commit 181c8e091aae ("cgroup/cpuset: Introduce remote partition"), +a remote partition can be created underneath a non-partition root cpuset +as long as its exclusive_cpus are set to distribute exclusive CPUs down +to its children. The generate_sched_domains() function, however, doesn't +take into account this new behavior and hence will fail to create the +sched domain needed for a remote root (non-isolated) partition. + +There are two issues related to remote partition support. First of +all, generate_sched_domains() has a fast path that is activated if +root_load_balance is true and top_cpuset.nr_subparts is non-zero. The +later condition isn't quite correct for remote partitions as nr_subparts +just shows the number of local child partitions underneath it. There +can be no local child partition under top_cpuset even if there are +remote partitions further down the hierarchy. Fix that by checking +for subpartitions_cpus which contains exclusive CPUs allocated to both +local and remote partitions. + +Secondly, the valid partition check for subtree skipping in the csa[] +generation loop isn't enough as remote partition does not need to +have a partition root parent. Fix this problem by breaking csa[] array +generation loop of generate_sched_domains() into v1 and v2 specific parts +and checking a cpuset's exclusive_cpus before skipping its subtree in +the v2 case. + +Also simplify generate_sched_domains() for cgroup v2 as only +non-isolating partition roots should be included in building the cpuset +array and none of the v1 scheduling attributes other than a different +way to create an isolated partition are supported. + +Fixes: 181c8e091aae ("cgroup/cpuset: Introduce remote partition") +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 55 ++++++++++++++++++++++++++++++++---------- + 1 file changed, 42 insertions(+), 13 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index 73ab45b04c000..a29de57540d71 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -169,7 +169,7 @@ struct cpuset { + /* for custom sched domain */ + int relax_domain_level; + +- /* number of valid sub-partitions */ ++ /* number of valid local child partitions */ + int nr_subparts; + + /* partition root state */ +@@ -957,13 +957,14 @@ static int generate_sched_domains(cpumask_var_t **domains, + int nslot; /* next empty doms[] struct cpumask slot */ + struct cgroup_subsys_state *pos_css; + bool root_load_balance = is_sched_load_balance(&top_cpuset); ++ bool cgrpv2 = cgroup_subsys_on_dfl(cpuset_cgrp_subsys); + + doms = NULL; + dattr = NULL; + csa = NULL; + + /* Special case for the 99% of systems with one, full, sched domain */ +- if (root_load_balance && !top_cpuset.nr_subparts) { ++ if (root_load_balance && cpumask_empty(subpartitions_cpus)) { + single_root_domain: + ndoms = 1; + doms = alloc_sched_domains(ndoms); +@@ -992,16 +993,18 @@ static int generate_sched_domains(cpumask_var_t **domains, + cpuset_for_each_descendant_pre(cp, pos_css, &top_cpuset) { + if (cp == &top_cpuset) + continue; ++ ++ if (cgrpv2) ++ goto v2; ++ + /* ++ * v1: + * Continue traversing beyond @cp iff @cp has some CPUs and + * isn't load balancing. The former is obvious. The + * latter: All child cpusets contain a subset of the + * parent's cpus, so just skip them, and then we call + * update_domain_attr_tree() to calc relax_domain_level of + * the corresponding sched domain. +- * +- * If root is load-balancing, we can skip @cp if it +- * is a subset of the root's effective_cpus. + */ + if (!cpumask_empty(cp->cpus_allowed) && + !(is_sched_load_balance(cp) && +@@ -1009,16 +1012,28 @@ static int generate_sched_domains(cpumask_var_t **domains, + housekeeping_cpumask(HK_TYPE_DOMAIN)))) + continue; + +- if (root_load_balance && +- cpumask_subset(cp->cpus_allowed, top_cpuset.effective_cpus)) +- continue; +- + if (is_sched_load_balance(cp) && + !cpumask_empty(cp->effective_cpus)) + csa[csn++] = cp; + +- /* skip @cp's subtree if not a partition root */ +- if (!is_partition_valid(cp)) ++ /* skip @cp's subtree */ ++ pos_css = css_rightmost_descendant(pos_css); ++ continue; ++ ++v2: ++ /* ++ * Only valid partition roots that are not isolated and with ++ * non-empty effective_cpus will be saved into csn[]. ++ */ ++ if ((cp->partition_root_state == PRS_ROOT) && ++ !cpumask_empty(cp->effective_cpus)) ++ csa[csn++] = cp; ++ ++ /* ++ * Skip @cp's subtree if not a partition root and has no ++ * exclusive CPUs to be granted to child cpusets. ++ */ ++ if (!is_partition_valid(cp) && cpumask_empty(cp->exclusive_cpus)) + pos_css = css_rightmost_descendant(pos_css); + } + rcu_read_unlock(); +@@ -1072,6 +1087,20 @@ static int generate_sched_domains(cpumask_var_t **domains, + dattr = kmalloc_array(ndoms, sizeof(struct sched_domain_attr), + GFP_KERNEL); + ++ /* ++ * Cgroup v2 doesn't support domain attributes, just set all of them ++ * to SD_ATTR_INIT. Also non-isolating partition root CPUs are a ++ * subset of HK_TYPE_DOMAIN housekeeping CPUs. ++ */ ++ if (cgrpv2) { ++ for (i = 0; i < ndoms; i++) { ++ cpumask_copy(doms[i], csa[i]->effective_cpus); ++ if (dattr) ++ dattr[i] = SD_ATTR_INIT; ++ } ++ goto done; ++ } ++ + for (nslot = 0, i = 0; i < csn; i++) { + struct cpuset *a = csa[i]; + struct cpumask *dp; +@@ -1231,7 +1260,7 @@ static void rebuild_sched_domains_locked(void) + * root should be only a subset of the active CPUs. Since a CPU in any + * partition root could be offlined, all must be checked. + */ +- if (top_cpuset.nr_subparts) { ++ if (!cpumask_empty(subpartitions_cpus)) { + rcu_read_lock(); + cpuset_for_each_descendant_pre(cs, pos_css, &top_cpuset) { + if (!is_partition_valid(cs)) { +@@ -4579,7 +4608,7 @@ static void cpuset_handle_hotplug(void) + * In the rare case that hotplug removes all the cpus in + * subpartitions_cpus, we assumed that cpus are updated. + */ +- if (!cpus_updated && top_cpuset.nr_subparts) ++ if (!cpus_updated && !cpumask_empty(subpartitions_cpus)) + cpus_updated = true; + + /* For v1, synchronize cpus_allowed to cpu_active_mask */ +-- +2.43.0 + diff --git a/queue-6.10/cgroup-cpuset-optimize-isolated-partition-only-gener.patch b/queue-6.10/cgroup-cpuset-optimize-isolated-partition-only-gener.patch new file mode 100644 index 00000000000..5c1ba111d80 --- /dev/null +++ b/queue-6.10/cgroup-cpuset-optimize-isolated-partition-only-gener.patch @@ -0,0 +1,51 @@ +From 199b3b8134252a529fb72d7d0f9c5b7733bd008c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 15:38:22 -0400 +Subject: cgroup/cpuset: Optimize isolated partition only + generate_sched_domains() calls + +From: Waiman Long + +[ Upstream commit 1805c1729f52edaa021288473b09f9c7f74fb1ca ] + +If only isolated partitions are being created underneath the cgroup root, +there will only be one sched domain with top_cpuset.effective_cpus. We can +skip the unnecessary sched domains scanning code and save some cycles. + +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Stable-dep-of: ccac8e8de99c ("cgroup/cpuset: Fix remote root partition creation problem") +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index c12b9fdb22a4e..73ab45b04c000 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -964,6 +964,7 @@ static int generate_sched_domains(cpumask_var_t **domains, + + /* Special case for the 99% of systems with one, full, sched domain */ + if (root_load_balance && !top_cpuset.nr_subparts) { ++single_root_domain: + ndoms = 1; + doms = alloc_sched_domains(ndoms); + if (!doms) +@@ -1022,6 +1023,13 @@ static int generate_sched_domains(cpumask_var_t **domains, + } + rcu_read_unlock(); + ++ /* ++ * If there are only isolated partitions underneath the cgroup root, ++ * we can optimize out unneeded sched domains scanning. ++ */ ++ if (root_load_balance && (csn == 1)) ++ goto single_root_domain; ++ + for (i = 0; i < csn; i++) + csa[i]->pn = i; + ndoms = csn; +-- +2.43.0 + diff --git a/queue-6.10/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch b/queue-6.10/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch new file mode 100644 index 00000000000..c1e2490f1c8 --- /dev/null +++ b/queue-6.10/cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch @@ -0,0 +1,96 @@ +From 902cf8e13f876565ae36b0d4cd561c8b2fa4d99d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 01:36:04 +0000 +Subject: cgroup/cpuset: Prevent UAF in proc_cpuset_show() + +From: Chen Ridong + +[ Upstream commit 1be59c97c83ccd67a519d8a49486b3a8a73ca28a ] + +An UAF can happen when /proc/cpuset is read as reported in [1]. + +This can be reproduced by the following methods: +1.add an mdelay(1000) before acquiring the cgroup_lock In the + cgroup_path_ns function. +2.$cat /proc//cpuset repeatly. +3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/ +$umount /sys/fs/cgroup/cpuset/ repeatly. + +The race that cause this bug can be shown as below: + +(umount) | (cat /proc//cpuset) +css_release | proc_cpuset_show +css_release_work_fn | css = task_get_css(tsk, cpuset_cgrp_id); +css_free_rwork_fn | cgroup_path_ns(css->cgroup, ...); +cgroup_destroy_root | mutex_lock(&cgroup_mutex); +rebind_subsystems | +cgroup_free_root | + | // cgrp was freed, UAF + | cgroup_path_ns_locked(cgrp,..); + +When the cpuset is initialized, the root node top_cpuset.css.cgrp +will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will +allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated +&cgroup_root.cgrp. When the umount operation is executed, +top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp. + +The problem is that when rebinding to cgrp_dfl_root, there are cases +where the cgroup_root allocated by setting up the root for cgroup v1 +is cached. This could lead to a Use-After-Free (UAF) if it is +subsequently freed. The descendant cgroups of cgroup v1 can only be +freed after the css is released. However, the css of the root will never +be released, yet the cgroup_root should be freed when it is unmounted. +This means that obtaining a reference to the css of the root does +not guarantee that css.cgrp->root will not be freed. + +Fix this problem by using rcu_read_lock in proc_cpuset_show(). +As cgroup_root is kfree_rcu after commit d23b5c577715 +("cgroup: Make operations on the cgroup root_list RCU safe"), +css->cgroup won't be freed during the critical section. +To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to +replace task_get_css with task_css. + +[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd + +Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces") +Signed-off-by: Chen Ridong +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index a29de57540d71..5e468db958104 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -21,6 +21,7 @@ + * License. See the file COPYING in the main directory of the Linux + * distribution for more details. + */ ++#include "cgroup-internal.h" + + #include + #include +@@ -5088,10 +5089,14 @@ int proc_cpuset_show(struct seq_file *m, struct pid_namespace *ns, + if (!buf) + goto out; + +- css = task_get_css(tsk, cpuset_cgrp_id); +- retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX, +- current->nsproxy->cgroup_ns); +- css_put(css); ++ rcu_read_lock(); ++ spin_lock_irq(&css_set_lock); ++ css = task_css(tsk, cpuset_cgrp_id); ++ retval = cgroup_path_ns_locked(css->cgroup, buf, PATH_MAX, ++ current->nsproxy->cgroup_ns); ++ spin_unlock_irq(&css_set_lock); ++ rcu_read_unlock(); ++ + if (retval == -E2BIG) + retval = -ENAMETOOLONG; + if (retval < 0) +-- +2.43.0 + diff --git a/queue-6.10/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch b/queue-6.10/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch new file mode 100644 index 00000000000..b30e867bce0 --- /dev/null +++ b/queue-6.10/clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch @@ -0,0 +1,88 @@ +From ec8efbdd09251a5c2a8e064cc62e8fbc62cbd93c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:25:49 +0200 +Subject: clk: en7523: fix rate divider for slic and spi clocks + +From: Lorenzo Bianconi + +[ Upstream commit 58c53d43142f222221e5a76a7016c4d8f3b84b97 ] + +Introduce div_offset field in en_clk_desc struct in order to fix rate +divider estimation in en7523_get_div routine for slic and spi fixed +rate clocks. +Moreover, fix base_shift for crypto clock. + +Fixes: 1e6273179190 ("clk: en7523: Add clock driver for Airoha EN7523 SoC") +Signed-off-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/c491bdea05d847f1f1294b94f14725d292eb95d0.1718615934.git.lorenzo@kernel.org +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-en7523.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-en7523.c b/drivers/clk/clk-en7523.c +index ccc3946926712..bdf5cbc12e236 100644 +--- a/drivers/clk/clk-en7523.c ++++ b/drivers/clk/clk-en7523.c +@@ -57,6 +57,7 @@ struct en_clk_desc { + u8 div_shift; + u16 div_val0; + u8 div_step; ++ u8 div_offset; + }; + + struct en_clk_gate { +@@ -90,6 +91,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_EMI, + .name = "emi", +@@ -103,6 +105,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_BUS, + .name = "bus", +@@ -116,6 +119,7 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_SLIC, + .name = "slic", +@@ -156,13 +160,14 @@ static const struct en_clk_desc en7523_base_clks[] = { + .div_bits = 3, + .div_shift = 0, + .div_step = 1, ++ .div_offset = 1, + }, { + .id = EN7523_CLK_CRYPTO, + .name = "crypto", + + .base_reg = REG_CRYPTO_CLKSRC, + .base_bits = 1, +- .base_shift = 8, ++ .base_shift = 0, + .base_values = emi_base, + .n_base_values = ARRAY_SIZE(emi_base), + } +@@ -202,7 +207,7 @@ static u32 en7523_get_div(void __iomem *base, int i) + if (!val && desc->div_val0) + return desc->div_val0; + +- return (val + 1) * desc->div_step; ++ return (val + desc->div_offset) * desc->div_step; + } + + static int en7523_pci_is_enabled(struct clk_hw *hw) +-- +2.43.0 + diff --git a/queue-6.10/clk-meson-s4-fix-fixed_pll_dco-clock.patch b/queue-6.10/clk-meson-s4-fix-fixed_pll_dco-clock.patch new file mode 100644 index 00000000000..ca12340b5d3 --- /dev/null +++ b/queue-6.10/clk-meson-s4-fix-fixed_pll_dco-clock.patch @@ -0,0 +1,40 @@ +From cf7e224f54d4f7119537e45f8616178eaa467c88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 18:04:33 +0800 +Subject: clk: meson: s4: fix fixed_pll_dco clock + +From: Xianwei Zhao + +[ Upstream commit c1380adf2e8680a00dedaf1b25c19beadbbe5bbd ] + +The fixed_pll_dco output frequency is not accurate, +add frac factor for fixed_pll_dco clk to fix it. + +Fixes: 57b55c76aaf1 ("clk: meson: S4: add support for Amlogic S4 SoC peripheral clock controller") +Signed-off-by: Xianwei Zhao +Link: https://lore.kernel.org/r/20240603-s4_fixedpll-v1-1-2b2a98630841@amlogic.com +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/s4-pll.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/clk/meson/s4-pll.c b/drivers/clk/meson/s4-pll.c +index d2650d96400cf..707c107a52918 100644 +--- a/drivers/clk/meson/s4-pll.c ++++ b/drivers/clk/meson/s4-pll.c +@@ -38,6 +38,11 @@ static struct clk_regmap s4_fixed_pll_dco = { + .shift = 0, + .width = 8, + }, ++ .frac = { ++ .reg_off = ANACTRL_FIXPLL_CTRL1, ++ .shift = 0, ++ .width = 17, ++ }, + .n = { + .reg_off = ANACTRL_FIXPLL_CTRL0, + .shift = 10, +-- +2.43.0 + diff --git a/queue-6.10/clk-meson-s4-fix-pwm_j_div-parent-clock.patch b/queue-6.10/clk-meson-s4-fix-pwm_j_div-parent-clock.patch new file mode 100644 index 00000000000..fdd7c619aa0 --- /dev/null +++ b/queue-6.10/clk-meson-s4-fix-pwm_j_div-parent-clock.patch @@ -0,0 +1,36 @@ +From 6df60edafe91f8301e000a7547f8bd5cb18b2f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 15:16:12 +0800 +Subject: clk: meson: s4: fix pwm_j_div parent clock + +From: Xianwei Zhao + +[ Upstream commit c591745831e75b11ef19fb33c5c5a16e4d3f7fbf ] + +Update peripherals pwm_j_div's parent clock to pwm_j_mux + +Fixes: 57b55c76aaf1 ("clk: meson: S4: add support for Amlogic S4 SoC peripheral clock controller") +Signed-off-by: Xianwei Zhao +Link: https://lore.kernel.org/r/20240516071612.2978201-1-xianwei.zhao@amlogic.com +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/s4-peripherals.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/s4-peripherals.c b/drivers/clk/meson/s4-peripherals.c +index 5e17ca50ab091..73340c7e815e7 100644 +--- a/drivers/clk/meson/s4-peripherals.c ++++ b/drivers/clk/meson/s4-peripherals.c +@@ -2978,7 +2978,7 @@ static struct clk_regmap s4_pwm_j_div = { + .name = "pwm_j_div", + .ops = &clk_regmap_divider_ops, + .parent_hws = (const struct clk_hw *[]) { +- &s4_pwm_h_mux.hw ++ &s4_pwm_j_mux.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch b/queue-6.10/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch new file mode 100644 index 00000000000..305c5b752a2 --- /dev/null +++ b/queue-6.10/clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch @@ -0,0 +1,73 @@ +From e0c167387c8fba6ac16f4414b74391dfd8ae2eb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 15:21:42 +0530 +Subject: clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs + +From: Taniya Das + +[ Upstream commit 63aec3e4d987fd43237f557460345bca3b51e530 ] + +Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan +top GDSC is required to be enabled before enabling any other camera GDSCs +and it should be disabled only after all other camera GDSCs are disabled. +Ensure this behavior by marking titan top GDSC as parent of all other +camera GDSCs. + +Fixes: 1daec8cfebc2 ("clk: qcom: camcc: Add camera clock controller driver for SC7280") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240531095142.9688-4-quic_tdas@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7280.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/clk/qcom/camcc-sc7280.c b/drivers/clk/qcom/camcc-sc7280.c +index d89ddb2298e32..582fb3ba9c895 100644 +--- a/drivers/clk/qcom/camcc-sc7280.c ++++ b/drivers/clk/qcom/camcc-sc7280.c +@@ -2260,6 +2260,7 @@ static struct gdsc cam_cc_bps_gdsc = { + .name = "cam_cc_bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = HW_CTRL | RETAIN_FF_ENABLE, + }; + +@@ -2269,6 +2270,7 @@ static struct gdsc cam_cc_ife_0_gdsc = { + .name = "cam_cc_ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2278,6 +2280,7 @@ static struct gdsc cam_cc_ife_1_gdsc = { + .name = "cam_cc_ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2287,6 +2290,7 @@ static struct gdsc cam_cc_ife_2_gdsc = { + .name = "cam_cc_ife_2_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = RETAIN_FF_ENABLE, + }; + +@@ -2296,6 +2300,7 @@ static struct gdsc cam_cc_ipe_0_gdsc = { + .name = "cam_cc_ipe_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &cam_cc_titan_top_gdsc.pd, + .flags = HW_CTRL | RETAIN_FF_ENABLE, + }; + +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gcc-sa8775p-update-the-gdsc-wait_val-fields.patch b/queue-6.10/clk-qcom-gcc-sa8775p-update-the-gdsc-wait_val-fields.patch new file mode 100644 index 00000000000..57ddd65d4ff --- /dev/null +++ b/queue-6.10/clk-qcom-gcc-sa8775p-update-the-gdsc-wait_val-fields.patch @@ -0,0 +1,145 @@ +From 5d8e5bf233532a9ee7600081bccb4bfa7715bb2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 16:38:22 +0530 +Subject: clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags + +From: Taniya Das + +[ Upstream commit be208c0ccf7d861fc6109ca06c1a773512739af9 ] + +Update the GDSC wait_val fields as per the default hardware values as +otherwise they would lead to GDSC FSM state to be stuck and causing +failures to power on/off. Also add the GDSC flags as applicable and +add support to control PCIE GDSC's using collapse vote registers. + +Fixes: 08c51ceb12f7 ("clk: qcom: add the GCC driver for sa8775p") +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/20240612-sa8775p-v2-gcc-gpucc-fixes-v2-2-adcc756a23df@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sa8775p.c | 40 ++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sa8775p.c b/drivers/clk/qcom/gcc-sa8775p.c +index 5bcbfbf52cb9e..9bbc0836fae98 100644 +--- a/drivers/clk/qcom/gcc-sa8775p.c ++++ b/drivers/clk/qcom/gcc-sa8775p.c +@@ -4305,74 +4305,114 @@ static struct clk_branch gcc_video_axi1_clk = { + + static struct gdsc pcie_0_gdsc = { + .gdscr = 0xa9004, ++ .collapse_ctrl = 0x4b104, ++ .collapse_mask = BIT(0), ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "pcie_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc pcie_1_gdsc = { + .gdscr = 0x77004, ++ .collapse_ctrl = 0x4b104, ++ .collapse_mask = BIT(1), ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "pcie_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc ufs_card_gdsc = { + .gdscr = 0x81004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "ufs_card_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc ufs_phy_gdsc = { + .gdscr = 0x83004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "ufs_phy_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc usb20_prim_gdsc = { + .gdscr = 0x1c004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "usb20_prim_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc usb30_prim_gdsc = { + .gdscr = 0x1b004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "usb30_prim_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc usb30_sec_gdsc = { + .gdscr = 0x2f004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "usb30_sec_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc emac0_gdsc = { + .gdscr = 0xb6004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "emac0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct gdsc emac1_gdsc = { + .gdscr = 0xb4004, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "emac1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .flags = RETAIN_FF_ENABLE | POLL_CFG_GDSCR, + }; + + static struct clk_regmap *gcc_sa8775p_clocks[] = { +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch b/queue-6.10/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch new file mode 100644 index 00000000000..f7de5d55ebb --- /dev/null +++ b/queue-6.10/clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch @@ -0,0 +1,41 @@ +From 40b6b3f69ac84682ee59cc7b6f2238347bf94172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 15:21:41 +0530 +Subject: clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock + +From: Taniya Das + +[ Upstream commit f38467b5a920be1473710428a93c4e54b6f8a0c1 ] + +Update the force mem core bit for UFS ICE clock to force the core on signal +to remain active during halt state of the clk. When retention bit of the +clock is set the memories of the subsystem will retain the logic across +power states. + +Fixes: a3cc092196ef ("clk: qcom: Add Global Clock controller (GCC) driver for SC7280") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240531095142.9688-3-quic_tdas@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7280.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sc7280.c b/drivers/clk/qcom/gcc-sc7280.c +index f45a8318900c5..67ea9cf5303fa 100644 +--- a/drivers/clk/qcom/gcc-sc7280.c ++++ b/drivers/clk/qcom/gcc-sc7280.c +@@ -3463,6 +3463,9 @@ static int gcc_sc7280_probe(struct platform_device *pdev) + qcom_branch_set_clk_en(regmap, 0x71004);/* GCC_GPU_CFG_AHB_CLK */ + regmap_update_bits(regmap, 0x7100C, BIT(13), BIT(13)); + ++ /* FORCE_MEM_CORE_ON for ufs phy ice core clocks */ ++ qcom_branch_set_force_mem_core(regmap, gcc_ufs_phy_ice_core_clk, true); ++ + ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks, + ARRAY_SIZE(gcc_dfs_clocks)); + if (ret) +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gcc-x1e80100-fix-halt_check-for-all-pipe-cl.patch b/queue-6.10/clk-qcom-gcc-x1e80100-fix-halt_check-for-all-pipe-cl.patch new file mode 100644 index 00000000000..c592713c270 --- /dev/null +++ b/queue-6.10/clk-qcom-gcc-x1e80100-fix-halt_check-for-all-pipe-cl.patch @@ -0,0 +1,236 @@ +From 616eb3bfa9f0df282b04650310f74666581060b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 11:08:00 +0300 +Subject: clk: qcom: gcc-x1e80100: Fix halt_check for all pipe clocks + +From: Abel Vesa + +[ Upstream commit f27e42c7d3ff8ddfc57273efd1e8642ea89bad90 ] + +In case of all pipe clocks, there is a QMP PHY clock that is feeding them. +If, for whatever reason, the clock from the PHY is not enabled, halt bit +will not get set, and the clock controller driver will assume the clock +is stuck in a specific state. The way this is supposed to be properly +fixed is to defer the checking of the halt bit until after the PHY clock +has been initialized, but doing so complicates the clock controller +driver. In fact, since these pipe clocks are consumed by the PHY, while +the PHY is also the one providing the source, if clock gets stuck, the PHY +driver would be to blame. So instead of checking the halt bit in here, +just skip it and assume the PHY driver is handling the source clock +correctly. + +Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100") +Signed-off-by: Abel Vesa +Reviewed-by: Taniya Das +Link: https://lore.kernel.org/r/20240628-x1e80100-clk-gcc-fix-halt-check-for-usb-phy-pipe-clks-v2-1-db3be54b1143@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-x1e80100.c | 44 ++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-x1e80100.c b/drivers/clk/qcom/gcc-x1e80100.c +index 1404017be9180..7b6c1eb6a61d4 100644 +--- a/drivers/clk/qcom/gcc-x1e80100.c ++++ b/drivers/clk/qcom/gcc-x1e80100.c +@@ -2812,7 +2812,7 @@ static struct clk_branch gcc_pcie_0_mstr_axi_clk = { + + static struct clk_branch gcc_pcie_0_pipe_clk = { + .halt_reg = 0xa0044, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52010, + .enable_mask = BIT(25), +@@ -2901,7 +2901,7 @@ static struct clk_branch gcc_pcie_1_mstr_axi_clk = { + + static struct clk_branch gcc_pcie_1_pipe_clk = { + .halt_reg = 0x2c044, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52020, + .enable_mask = BIT(30), +@@ -2990,7 +2990,7 @@ static struct clk_branch gcc_pcie_2_mstr_axi_clk = { + + static struct clk_branch gcc_pcie_2_pipe_clk = { + .halt_reg = 0x13044, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52020, + .enable_mask = BIT(23), +@@ -3110,7 +3110,7 @@ static struct clk_branch gcc_pcie_3_phy_rchng_clk = { + + static struct clk_branch gcc_pcie_3_pipe_clk = { + .halt_reg = 0x58050, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52020, + .enable_mask = BIT(3), +@@ -3235,7 +3235,7 @@ static struct clk_branch gcc_pcie_4_phy_rchng_clk = { + + static struct clk_branch gcc_pcie_4_pipe_clk = { + .halt_reg = 0x6b044, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52008, + .enable_mask = BIT(4), +@@ -3360,7 +3360,7 @@ static struct clk_branch gcc_pcie_5_phy_rchng_clk = { + + static struct clk_branch gcc_pcie_5_pipe_clk = { + .halt_reg = 0x2f044, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52018, + .enable_mask = BIT(17), +@@ -3498,7 +3498,7 @@ static struct clk_branch gcc_pcie_6a_phy_rchng_clk = { + + static struct clk_branch gcc_pcie_6a_pipe_clk = { + .halt_reg = 0x31050, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52018, + .enable_mask = BIT(26), +@@ -3636,7 +3636,7 @@ static struct clk_branch gcc_pcie_6b_phy_rchng_clk = { + + static struct clk_branch gcc_pcie_6b_pipe_clk = { + .halt_reg = 0x8d050, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52000, + .enable_mask = BIT(30), +@@ -5109,7 +5109,7 @@ static struct clk_branch gcc_usb3_mp_phy_com_aux_clk = { + + static struct clk_branch gcc_usb3_mp_phy_pipe_0_clk = { + .halt_reg = 0x17290, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x17290, + .enable_mask = BIT(0), +@@ -5122,7 +5122,7 @@ static struct clk_branch gcc_usb3_mp_phy_pipe_0_clk = { + + static struct clk_branch gcc_usb3_mp_phy_pipe_1_clk = { + .halt_reg = 0x17298, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x17298, + .enable_mask = BIT(0), +@@ -5186,7 +5186,7 @@ static struct clk_regmap_mux gcc_usb3_prim_phy_pipe_clk_src = { + + static struct clk_branch gcc_usb3_prim_phy_pipe_clk = { + .halt_reg = 0x39068, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0x39068, + .hwcg_bit = 1, + .clkr = { +@@ -5257,7 +5257,7 @@ static struct clk_regmap_mux gcc_usb3_sec_phy_pipe_clk_src = { + + static struct clk_branch gcc_usb3_sec_phy_pipe_clk = { + .halt_reg = 0xa1068, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0xa1068, + .hwcg_bit = 1, + .clkr = { +@@ -5327,7 +5327,7 @@ static struct clk_regmap_mux gcc_usb3_tert_phy_pipe_clk_src = { + + static struct clk_branch gcc_usb3_tert_phy_pipe_clk = { + .halt_reg = 0xa2068, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0xa2068, + .hwcg_bit = 1, + .clkr = { +@@ -5405,7 +5405,7 @@ static struct clk_branch gcc_usb4_0_master_clk = { + + static struct clk_branch gcc_usb4_0_phy_p2rr2p_pipe_clk = { + .halt_reg = 0x9f0d8, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x9f0d8, + .enable_mask = BIT(0), +@@ -5418,7 +5418,7 @@ static struct clk_branch gcc_usb4_0_phy_p2rr2p_pipe_clk = { + + static struct clk_branch gcc_usb4_0_phy_pcie_pipe_clk = { + .halt_reg = 0x9f048, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52010, + .enable_mask = BIT(19), +@@ -5457,7 +5457,7 @@ static struct clk_branch gcc_usb4_0_phy_rx1_clk = { + + static struct clk_branch gcc_usb4_0_phy_usb_pipe_clk = { + .halt_reg = 0x9f0a4, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0x9f0a4, + .hwcg_bit = 1, + .clkr = { +@@ -5582,7 +5582,7 @@ static struct clk_branch gcc_usb4_1_master_clk = { + + static struct clk_branch gcc_usb4_1_phy_p2rr2p_pipe_clk = { + .halt_reg = 0x2b0d8, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x2b0d8, + .enable_mask = BIT(0), +@@ -5595,7 +5595,7 @@ static struct clk_branch gcc_usb4_1_phy_p2rr2p_pipe_clk = { + + static struct clk_branch gcc_usb4_1_phy_pcie_pipe_clk = { + .halt_reg = 0x2b048, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52028, + .enable_mask = BIT(0), +@@ -5634,7 +5634,7 @@ static struct clk_branch gcc_usb4_1_phy_rx1_clk = { + + static struct clk_branch gcc_usb4_1_phy_usb_pipe_clk = { + .halt_reg = 0x2b0a4, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0x2b0a4, + .hwcg_bit = 1, + .clkr = { +@@ -5759,7 +5759,7 @@ static struct clk_branch gcc_usb4_2_master_clk = { + + static struct clk_branch gcc_usb4_2_phy_p2rr2p_pipe_clk = { + .halt_reg = 0x110d8, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x110d8, + .enable_mask = BIT(0), +@@ -5772,7 +5772,7 @@ static struct clk_branch gcc_usb4_2_phy_p2rr2p_pipe_clk = { + + static struct clk_branch gcc_usb4_2_phy_pcie_pipe_clk = { + .halt_reg = 0x11048, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52028, + .enable_mask = BIT(1), +@@ -5811,7 +5811,7 @@ static struct clk_branch gcc_usb4_2_phy_rx1_clk = { + + static struct clk_branch gcc_usb4_2_phy_usb_pipe_clk = { + .halt_reg = 0x110a4, +- .halt_check = BRANCH_HALT_VOTED, ++ .halt_check = BRANCH_HALT_SKIP, + .hwcg_reg = 0x110a4, + .hwcg_bit = 1, + .clkr = { +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gcc-x1e80100-set-parent-rate-for-usb3-sec-a.patch b/queue-6.10/clk-qcom-gcc-x1e80100-set-parent-rate-for-usb3-sec-a.patch new file mode 100644 index 00000000000..61a7602508d --- /dev/null +++ b/queue-6.10/clk-qcom-gcc-x1e80100-set-parent-rate-for-usb3-sec-a.patch @@ -0,0 +1,47 @@ +From c13735275b771fecb922d5893c8f87689fd9134a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 17:05:24 +0300 +Subject: clk: qcom: gcc-x1e80100: Set parent rate for USB3 sec and tert PHY + pipe clks + +From: Abel Vesa + +[ Upstream commit 14539c88972bd984f1f04c9e601c1a2835d3e5d2 ] + +Allow the USB3 second and third GCC PHY pipe clocks to propagate the +rate to the pipe clocks provided by the QMP combo PHYs. The first +instance is already doing that. + +Fixes: 161b7c401f4b ("clk: qcom: Add Global Clock controller (GCC) driver for X1E80100") +Signed-off-by: Abel Vesa +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240530-x1e80100-clk-gcc-usb3-sec-tert-set-parent-rate-v1-1-7b2b04cad545@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-x1e80100.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-x1e80100.c b/drivers/clk/qcom/gcc-x1e80100.c +index 7b6c1eb6a61d4..a263f0c412f5a 100644 +--- a/drivers/clk/qcom/gcc-x1e80100.c ++++ b/drivers/clk/qcom/gcc-x1e80100.c +@@ -5269,6 +5269,7 @@ static struct clk_branch gcc_usb3_sec_phy_pipe_clk = { + &gcc_usb3_sec_phy_pipe_clk_src.clkr.hw, + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -5339,6 +5340,7 @@ static struct clk_branch gcc_usb3_tert_phy_pipe_clk = { + &gcc_usb3_tert_phy_pipe_clk_src.clkr.hw, + }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gpucc-sa8775p-park-rcg-s-clk-source-at-xo-d.patch b/queue-6.10/clk-qcom-gpucc-sa8775p-park-rcg-s-clk-source-at-xo-d.patch new file mode 100644 index 00000000000..39fa3954638 --- /dev/null +++ b/queue-6.10/clk-qcom-gpucc-sa8775p-park-rcg-s-clk-source-at-xo-d.patch @@ -0,0 +1,67 @@ +From 81741d83ed9f4a060b16aa0afb21bab8b9d13d55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 16:38:25 +0530 +Subject: clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable + +From: Taniya Das + +[ Upstream commit dff68b2f74547617dbb75d0d12f404877ec8f8ce ] + +The RCG's clk src has to be parked at XO while disabling as per the +HW recommendation, hence use clk_rcg2_shared_ops to achieve the same. +Also gpu_cc_cb_clk is recommended to be kept always ON, hence use +clk_branch2_aon_ops to keep the clock always ON. + +Fixes: 0afa16afc36d ("clk: qcom: add the GPUCC driver for sa8775p") +Signed-off-by: Taniya Das +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240612-sa8775p-v2-gcc-gpucc-fixes-v2-5-adcc756a23df@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sa8775p.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sa8775p.c b/drivers/clk/qcom/gpucc-sa8775p.c +index f965babf4330d..1f7a02a7503d4 100644 +--- a/drivers/clk/qcom/gpucc-sa8775p.c ++++ b/drivers/clk/qcom/gpucc-sa8775p.c +@@ -161,7 +161,7 @@ static struct clk_rcg2 gpu_cc_ff_clk_src = { + .name = "gpu_cc_ff_clk_src", + .parent_data = gpu_cc_parent_data_0, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -181,7 +181,7 @@ static struct clk_rcg2 gpu_cc_gmu_clk_src = { + .parent_data = gpu_cc_parent_data_1, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -200,7 +200,7 @@ static struct clk_rcg2 gpu_cc_hub_clk_src = { + .name = "gpu_cc_hub_clk_src", + .parent_data = gpu_cc_parent_data_2, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -294,7 +294,7 @@ static struct clk_branch gpu_cc_cb_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_cb_clk", +- .ops = &clk_branch2_ops, ++ .ops = &clk_branch2_aon_ops, + }, + }, + }; +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gpucc-sa8775p-remove-the-clk_is_critical-an.patch b/queue-6.10/clk-qcom-gpucc-sa8775p-remove-the-clk_is_critical-an.patch new file mode 100644 index 00000000000..0bc82671fe9 --- /dev/null +++ b/queue-6.10/clk-qcom-gpucc-sa8775p-remove-the-clk_is_critical-an.patch @@ -0,0 +1,171 @@ +From 82f90dab1b00d9f289de0013c0cdde4ab8e79d9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 16:38:24 +0530 +Subject: clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and ALWAYS_ON + flags + +From: Taniya Das + +[ Upstream commit e69386d4a42afa5da6bfdcd4ac5ec61e1db04c61 ] + +The GPU clocks/GDSCs have been marked critical from the clock driver +but the GPU driver votes on these resources as per the HW requirement. +In the case where these clocks & GDSCs are left enabled, would have +power impact and also cause GPU stability/corruptions. +Fix the same by removing the CLK_IS_CRITICAL for clocks and ALWAYS_ON +flags for the GPU GDSCs. + +Fixes: 0afa16afc36d ("clk: qcom: add the GPUCC driver for sa8775p") +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/20240612-sa8775p-v2-gcc-gpucc-fixes-v2-4-adcc756a23df@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sa8775p.c | 27 +++++++++++---------------- + 1 file changed, 11 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sa8775p.c b/drivers/clk/qcom/gpucc-sa8775p.c +index 1167c42da39db..f965babf4330d 100644 +--- a/drivers/clk/qcom/gpucc-sa8775p.c ++++ b/drivers/clk/qcom/gpucc-sa8775p.c +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2022, 2024, Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2023, Linaro Limited + */ + +@@ -280,7 +280,7 @@ static struct clk_branch gpu_cc_ahb_clk = { + &gpu_cc_hub_ahb_div_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -294,7 +294,6 @@ static struct clk_branch gpu_cc_cb_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_cb_clk", +- .flags = CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +@@ -312,7 +311,7 @@ static struct clk_branch gpu_cc_crc_ahb_clk = { + &gpu_cc_hub_ahb_div_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -330,7 +329,7 @@ static struct clk_branch gpu_cc_cx_ff_clk = { + &gpu_cc_ff_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -348,7 +347,7 @@ static struct clk_branch gpu_cc_cx_gmu_clk = { + &gpu_cc_gmu_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_aon_ops, + }, + }, +@@ -362,7 +361,6 @@ static struct clk_branch gpu_cc_cx_snoc_dvm_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_cx_snoc_dvm_clk", +- .flags = CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +@@ -380,7 +378,7 @@ static struct clk_branch gpu_cc_cxo_aon_clk = { + &gpu_cc_xo_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -398,7 +396,7 @@ static struct clk_branch gpu_cc_cxo_clk = { + &gpu_cc_xo_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, + }, + }, +@@ -416,7 +414,7 @@ static struct clk_branch gpu_cc_demet_clk = { + &gpu_cc_demet_div_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_aon_ops, + }, + }, +@@ -430,7 +428,6 @@ static struct clk_branch gpu_cc_hlos1_vote_gpu_smmu_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_hlos1_vote_gpu_smmu_clk", +- .flags = CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +@@ -448,7 +445,7 @@ static struct clk_branch gpu_cc_hub_aon_clk = { + &gpu_cc_hub_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_aon_ops, + }, + }, +@@ -466,7 +463,7 @@ static struct clk_branch gpu_cc_hub_cx_int_clk = { + &gpu_cc_hub_cx_int_div_clk_src.clkr.hw, + }, + .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, ++ .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_aon_ops, + }, + }, +@@ -480,7 +477,6 @@ static struct clk_branch gpu_cc_memnoc_gfx_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_memnoc_gfx_clk", +- .flags = CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +@@ -494,7 +490,6 @@ static struct clk_branch gpu_cc_sleep_clk = { + .enable_mask = BIT(0), + .hw.init = &(const struct clk_init_data){ + .name = "gpu_cc_sleep_clk", +- .flags = CLK_IS_CRITICAL, + .ops = &clk_branch2_ops, + }, + }, +@@ -533,7 +528,7 @@ static struct gdsc cx_gdsc = { + .name = "cx_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, +- .flags = VOTABLE | RETAIN_FF_ENABLE | ALWAYS_ON, ++ .flags = VOTABLE | RETAIN_FF_ENABLE, + }; + + static struct gdsc gx_gdsc = { +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gpucc-sa8775p-update-wait_val-fields-for-gp.patch b/queue-6.10/clk-qcom-gpucc-sa8775p-update-wait_val-fields-for-gp.patch new file mode 100644 index 00000000000..eb1e7c5239b --- /dev/null +++ b/queue-6.10/clk-qcom-gpucc-sa8775p-update-wait_val-fields-for-gp.patch @@ -0,0 +1,50 @@ +From d9ef2de6d853a6eb7efdf167e0c2a210d3965eec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 16:38:26 +0530 +Subject: clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's + +From: Taniya Das + +[ Upstream commit 211681998d706d1e0fff6b62f89efcdf29c24978 ] + +Update wait_val fields as per the default hardware values of the GDSC as +otherwise it would lead to GDSC FSM state stuck causing power on/off +failures of the GSDC. + +Fixes: 0afa16afc36d ("clk: qcom: add the GPUCC driver for sa8775p") +Signed-off-by: Taniya Das +Acked-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240612-sa8775p-v2-gcc-gpucc-fixes-v2-6-adcc756a23df@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sa8775p.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/qcom/gpucc-sa8775p.c b/drivers/clk/qcom/gpucc-sa8775p.c +index 1f7a02a7503d4..3deabf8333883 100644 +--- a/drivers/clk/qcom/gpucc-sa8775p.c ++++ b/drivers/clk/qcom/gpucc-sa8775p.c +@@ -523,6 +523,9 @@ static struct clk_regmap *gpu_cc_sa8775p_clocks[] = { + + static struct gdsc cx_gdsc = { + .gdscr = 0x9108, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .gds_hw_ctrl = 0x953c, + .pd = { + .name = "cx_gdsc", +@@ -533,6 +536,9 @@ static struct gdsc cx_gdsc = { + + static struct gdsc gx_gdsc = { + .gdscr = 0x905c, ++ .en_rest_wait_val = 0x2, ++ .en_few_wait_val = 0x2, ++ .clk_dis_wait_val = 0xf, + .pd = { + .name = "gx_gdsc", + .power_on = gdsc_gx_do_nothing_enable, +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch b/queue-6.10/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch new file mode 100644 index 00000000000..202b17bff09 --- /dev/null +++ b/queue-6.10/clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch @@ -0,0 +1,56 @@ +From 5c6e0028856f7272169d21371311645b664830aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 17:34:23 +0530 +Subject: clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable + +From: Taniya Das + +[ Upstream commit 313e2909023bef36ef7b6d1d9ff2d98febcaa28d ] + +The RCG's clk src has to be parked at XO while disabling as per the +HW recommendation, hence use clk_rcg2_shared_ops to achieve the same. + +Fixes: 160758b05ab1 ("clk: qcom: add support for SM8350 GPUCC") +Signed-off-by: Taniya Das +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov # SM8350-HDK +Link: https://lore.kernel.org/r/20240621-sm8350-gpucc-fixes-v1-1-22db60c7c5d3@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sm8350.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sm8350.c b/drivers/clk/qcom/gpucc-sm8350.c +index 38505d1388b67..8d9dcff40dd0b 100644 +--- a/drivers/clk/qcom/gpucc-sm8350.c ++++ b/drivers/clk/qcom/gpucc-sm8350.c +@@ -2,6 +2,7 @@ + /* + * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved. + * Copyright (c) 2022, Linaro Limited ++ * Copyright (c) 2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #include +@@ -147,7 +148,7 @@ static struct clk_rcg2 gpu_cc_gmu_clk_src = { + .parent_data = gpu_cc_parent_data_0, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_0), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -169,7 +170,7 @@ static struct clk_rcg2 gpu_cc_hub_clk_src = { + .parent_data = gpu_cc_parent_data_1, + .num_parents = ARRAY_SIZE(gpu_cc_parent_data_1), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-kpss-xcc-return-of_clk_add_hw_provider-to-t.patch b/queue-6.10/clk-qcom-kpss-xcc-return-of_clk_add_hw_provider-to-t.patch new file mode 100644 index 00000000000..35f06a07d70 --- /dev/null +++ b/queue-6.10/clk-qcom-kpss-xcc-return-of_clk_add_hw_provider-to-t.patch @@ -0,0 +1,41 @@ +From 823b16f98a40ba8dc05c722b098523bd7adb598e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 15:36:06 +0800 +Subject: clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer the + error + +From: Chen Ni + +[ Upstream commit 9db4585eca22fcd0422a94ac792f87dcbf74b643 ] + +Return of_clk_add_hw_provider() in order to transfer the error if it +fails. + +Fixes: 09be1a39e685 ("clk: qcom: kpss-xcc: register it as clk provider") +Signed-off-by: Chen Ni +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240704073606.1976936-1-nichen@iscas.ac.cn +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/kpss-xcc.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/kpss-xcc.c b/drivers/clk/qcom/kpss-xcc.c +index 23b0b11f00077..e7cfa8d22044e 100644 +--- a/drivers/clk/qcom/kpss-xcc.c ++++ b/drivers/clk/qcom/kpss-xcc.c +@@ -58,9 +58,7 @@ static int kpss_xcc_driver_probe(struct platform_device *pdev) + if (IS_ERR(hw)) + return PTR_ERR(hw); + +- of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw); +- +- return 0; ++ return of_clk_add_hw_provider(dev->of_node, of_clk_hw_simple_get, hw); + } + + static struct platform_driver kpss_xcc_driver = { +-- +2.43.0 + diff --git a/queue-6.10/clk-qcom-park-shared-rcgs-upon-registration.patch b/queue-6.10/clk-qcom-park-shared-rcgs-upon-registration.patch new file mode 100644 index 00000000000..7e09aba7433 --- /dev/null +++ b/queue-6.10/clk-qcom-park-shared-rcgs-upon-registration.patch @@ -0,0 +1,185 @@ +From 3b5a95238774fce26384901743874cfd06b34374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2024 15:47:02 -0700 +Subject: clk: qcom: Park shared RCGs upon registration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stephen Boyd + +[ Upstream commit 01a0a6cc8cfd9952e72677d48d56cf6bc4e3a561 ] + +There's two problems with shared RCGs. + +The first problem is that they incorrectly report the parent after +commit 703db1f5da1e ("clk: qcom: rcg2: Cache CFG register updates for +parked RCGs"). That's because the cached CFG register value needs to be +populated when the clk is registered. clk_rcg2_shared_enable() writes +the cached CFG register value 'parked_cfg'. This value is initially zero +due to static initializers. If a driver calls clk_enable() before +setting a rate or parent, it will set the parent to '0' which is +(almost?) always XO, and may not reflect the parent at registration. In +the worst case, this switches the RCG from sourcing a fast PLL to the +slow crystal speed. + +The second problem is that the force enable bit isn't cleared. The force +enable bit is only used during parking and unparking of shared RCGs. +Otherwise it shouldn't be set because it keeps the RCG enabled even when +all the branches on the output of the RCG are disabled (the hardware has +a feedback mechanism so that any child branches keep the RCG enabled +when the branch enable bit is set). This problem wastes power if the clk +is unused, and is harmful in the case that the clk framework disables +the parent of the force enabled RCG. In the latter case, the GDSC the +shared RCG is associated with will get wedged if the RCG's source clk is +disabled and the GDSC tries to enable the RCG to do "housekeeping" while +powering on. + +Both of these problems combined with incorrect runtime PM usage in the +display driver lead to a black screen on Qualcomm sc7180 Trogdor +chromebooks. What happens is that the bootloader leaves the +'disp_cc_mdss_rot_clk' enabled and the 'disp_cc_mdss_rot_clk_src' force +enabled and parented to 'disp_cc_pll0'. The mdss driver probes and +runtime suspends, disabling the mdss_gdsc which uses the +'disp_cc_mdss_rot_clk_src' for "housekeeping". The +'disp_cc_mdss_rot_clk' is disabled during late init because the clk is +unused, but the parent 'disp_cc_mdss_rot_clk_src' is still force enabled +because the force enable bit was never cleared. Then 'disp_cc_pll0' is +disabled because it is also unused. That's because the clk framework +believes the parent of the RCG is XO when it isn't. A child device of +the mdss device (e.g. DSI) runtime resumes mdss which powers on the +mdss_gdsc. This wedges the GDSC because 'disp_cc_mdss_rot_clk_src' is +parented to 'disp_cc_pll0' and that PLL is off. With the GDSC wedged, +mdss_runtime_resume() tries to enable 'disp_cc_mdss_mdp_clk' but it +can't because the GDSC has wedged all the clks associated with the GDSC +causing clks to stay stuck off. + +This leads to the following warning seen at boot and a black screen +because the display driver fails to probe. + + disp_cc_mdss_mdp_clk status stuck at 'off' + WARNING: CPU: 1 PID: 81 at drivers/clk/qcom/clk-branch.c:87 clk_branch_toggle+0x114/0x168 + Modules linked in: + CPU: 1 PID: 81 Comm: kworker/u16:4 Not tainted 6.7.0-g0dd3ee311255 #1 f5757d475795053fd2ad52247a070cd50dd046f2 + Hardware name: Google Lazor (rev1 - 2) with LTE (DT) + Workqueue: events_unbound deferred_probe_work_func + pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : clk_branch_toggle+0x114/0x168 + lr : clk_branch_toggle+0x110/0x168 + sp : ffffffc08084b670 + pmr_save: 00000060 + x29: ffffffc08084b680 x28: ffffff808006de00 x27: 0000000000000001 + x26: ffffff8080dbd4f4 x25: 0000000000000000 x24: 0000000000000000 + x23: 0000000000000000 x22: ffffffd838461198 x21: ffffffd838007997 + x20: ffffffd837541d5c x19: 0000000000000001 x18: 0000000000000004 + x17: 0000000000000000 x16: 0000000000000010 x15: ffffffd837070fac + x14: 0000000000000003 x13: 0000000000000004 x12: 0000000000000001 + x11: c0000000ffffdfff x10: ffffffd838347aa0 x9 : 08dadf92e516c000 + x8 : 08dadf92e516c000 x7 : 0000000000000000 x6 : 0000000000000027 + x5 : ffffffd8385a61f2 x4 : 0000000000000000 x3 : ffffffc08084b398 + x2 : ffffffc08084b3a0 x1 : 00000000ffffdfff x0 : 00000000fffffff0 + Call trace: + clk_branch_toggle+0x114/0x168 + clk_branch2_enable+0x24/0x30 + clk_core_enable+0x5c/0x1c8 + clk_enable+0x38/0x58 + clk_bulk_enable+0x40/0xb0 + mdss_runtime_resume+0x68/0x258 + pm_generic_runtime_resume+0x30/0x44 + __genpd_runtime_resume+0x30/0x80 + genpd_runtime_resume+0x124/0x214 + __rpm_callback+0x7c/0x15c + rpm_callback+0x30/0x88 + rpm_resume+0x390/0x4d8 + rpm_resume+0x43c/0x4d8 + __pm_runtime_resume+0x54/0x98 + __device_attach+0xe0/0x170 + device_initial_probe+0x1c/0x28 + bus_probe_device+0x48/0xa4 + device_add+0x52c/0x6fc + mipi_dsi_device_register_full+0x104/0x1a8 + devm_mipi_dsi_device_register_full+0x28/0x78 + ti_sn_bridge_probe+0x1dc/0x2bc + auxiliary_bus_probe+0x4c/0x94 + really_probe+0xf8/0x270 + __driver_probe_device+0xa8/0x130 + driver_probe_device+0x44/0x104 + __device_attach_driver+0xa4/0xcc + bus_for_each_drv+0x94/0xe8 + __device_attach+0xf8/0x170 + device_initial_probe+0x1c/0x28 + bus_probe_device+0x48/0xa4 + deferred_probe_work_func+0x9c/0xd8 + +Fix these problems by parking shared RCGs at boot. This will properly +initialize the parked_cfg struct member so that the parent is reported +properly and ensure that the clk won't get stuck on or off because the +RCG is parented to the safe source (XO). + +Fixes: 703db1f5da1e ("clk: qcom: rcg2: Cache CFG register updates for parked RCGs") +Reported-by: Stephen Boyd +Closes: https://lore.kernel.org/r/1290a5a0f7f584fcce722eeb2a1fd898.sboyd@kernel.org +Closes: https://issuetracker.google.com/319956935 +Reported-by: Laura Nao +Closes: https://lore.kernel.org/r/20231218091806.7155-1-laura.nao@collabora.com +Cc: Bjorn Andersson +Cc: Dmitry Baryshkov +Cc: Douglas Anderson +Cc: Taniya Das +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20240502224703.103150-1-swboyd@chromium.org +Reviewed-by: Douglas Anderson +Tested-by: Nícolas F. R. A. Prado +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-rcg2.c | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index 9b3aaa7f20ac2..30b19bd39d087 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -1304,7 +1304,39 @@ clk_rcg2_shared_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + return clk_rcg2_recalc_rate(hw, parent_rate); + } + ++static int clk_rcg2_shared_init(struct clk_hw *hw) ++{ ++ /* ++ * This does a few things: ++ * ++ * 1. Sets rcg->parked_cfg to reflect the value at probe so that the ++ * proper parent is reported from clk_rcg2_shared_get_parent(). ++ * ++ * 2. Clears the force enable bit of the RCG because we rely on child ++ * clks (branches) to turn the RCG on/off with a hardware feedback ++ * mechanism and only set the force enable bit in the RCG when we ++ * want to make sure the clk stays on for parent switches or ++ * parking. ++ * ++ * 3. Parks shared RCGs on the safe source at registration because we ++ * can't be certain that the parent clk will stay on during boot, ++ * especially if the parent is shared. If this RCG is enabled at ++ * boot, and the parent is turned off, the RCG will get stuck on. A ++ * GDSC can wedge if is turned on and the RCG is stuck on because ++ * the GDSC's controller will hang waiting for the clk status to ++ * toggle on when it never does. ++ * ++ * The safest option here is to "park" the RCG at init so that the clk ++ * can never get stuck on or off. This ensures the GDSC can't get ++ * wedged. ++ */ ++ clk_rcg2_shared_disable(hw); ++ ++ return 0; ++} ++ + const struct clk_ops clk_rcg2_shared_ops = { ++ .init = clk_rcg2_shared_init, + .enable = clk_rcg2_shared_enable, + .disable = clk_rcg2_shared_disable, + .get_parent = clk_rcg2_shared_get_parent, +-- +2.43.0 + diff --git a/queue-6.10/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch b/queue-6.10/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch new file mode 100644 index 00000000000..d32cc24caf7 --- /dev/null +++ b/queue-6.10/coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch @@ -0,0 +1,45 @@ +From 04af5bcd2049475fa53ecd7c74dd47abb87dc01e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 14:36:26 +0100 +Subject: coresight: Fix ref leak when of_coresight_parse_endpoint() fails + +From: James Clark + +[ Upstream commit 7fcb9cb2fe47294e16067c3cfd25332c8662a115 ] + +of_graph_get_next_endpoint() releases the reference to the previous +endpoint on each iteration, but when parsing fails the loop exits +early meaning the last reference is never dropped. + +Fix it by dropping the refcount in the exit condition. + +Fixes: d375b356e687 ("coresight: Fix support for sparsely populated ports") +Signed-off-by: James Clark +Reported-by: Laurent Pinchart +Reviewed-by: Laurent Pinchart +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20240529133626.90080-1-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-platform.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-platform.c b/drivers/hwtracing/coresight/coresight-platform.c +index 9d550f5697fa8..57a009552cc5c 100644 +--- a/drivers/hwtracing/coresight/coresight-platform.c ++++ b/drivers/hwtracing/coresight/coresight-platform.c +@@ -297,8 +297,10 @@ static int of_get_coresight_platform_data(struct device *dev, + continue; + + ret = of_coresight_parse_endpoint(dev, ep, pdata); +- if (ret) ++ if (ret) { ++ of_node_put(ep); + return ret; ++ } + } + + return 0; +-- +2.43.0 + diff --git a/queue-6.10/cpufreq-amd-pstate-fix-the-scaling_max_freq-setting-.patch b/queue-6.10/cpufreq-amd-pstate-fix-the-scaling_max_freq-setting-.patch new file mode 100644 index 00000000000..bdc3cd38774 --- /dev/null +++ b/queue-6.10/cpufreq-amd-pstate-fix-the-scaling_max_freq-setting-.patch @@ -0,0 +1,105 @@ +From 74b5acabbb52e324868c906f9b351d5e7b79438c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 08:14:14 +0000 +Subject: cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory + CPPC systems + +From: Dhananjay Ugwekar + +[ Upstream commit 738d7d03571c7e38565bd245c0815a2c74665018 ] + +On shared memory CPPC systems, with amd_pstate=active mode, the change +in scaling_max_freq doesn't get written to the shared memory +region. Due to this, the writes to the scaling_max_freq sysfs file +don't take effect. Fix this by propagating the scaling_max_freq +changes to the shared memory region. + +Fixes: ffa5096a7c33 ("cpufreq: amd-pstate: implement Pstate EPP support for the AMD processors") +Reported-by: David Arcari +Signed-off-by: Dhananjay Ugwekar +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20240702081413.5688-3-Dhananjay.Ugwekar@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate.c | 43 +++++++++++++++++++----------------- + 1 file changed, 23 insertions(+), 20 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate.c b/drivers/cpufreq/amd-pstate.c +index 9ad62dbe8bfbf..a092b13ffbc2f 100644 +--- a/drivers/cpufreq/amd-pstate.c ++++ b/drivers/cpufreq/amd-pstate.c +@@ -247,6 +247,26 @@ static int amd_pstate_get_energy_pref_index(struct amd_cpudata *cpudata) + return index; + } + ++static void pstate_update_perf(struct amd_cpudata *cpudata, u32 min_perf, ++ u32 des_perf, u32 max_perf, bool fast_switch) ++{ ++ if (fast_switch) ++ wrmsrl(MSR_AMD_CPPC_REQ, READ_ONCE(cpudata->cppc_req_cached)); ++ else ++ wrmsrl_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ, ++ READ_ONCE(cpudata->cppc_req_cached)); ++} ++ ++DEFINE_STATIC_CALL(amd_pstate_update_perf, pstate_update_perf); ++ ++static inline void amd_pstate_update_perf(struct amd_cpudata *cpudata, ++ u32 min_perf, u32 des_perf, ++ u32 max_perf, bool fast_switch) ++{ ++ static_call(amd_pstate_update_perf)(cpudata, min_perf, des_perf, ++ max_perf, fast_switch); ++} ++ + static int amd_pstate_set_epp(struct amd_cpudata *cpudata, u32 epp) + { + int ret; +@@ -263,6 +283,9 @@ static int amd_pstate_set_epp(struct amd_cpudata *cpudata, u32 epp) + if (!ret) + cpudata->epp_cached = epp; + } else { ++ amd_pstate_update_perf(cpudata, cpudata->min_limit_perf, 0U, ++ cpudata->max_limit_perf, false); ++ + perf_ctrls.energy_perf = epp; + ret = cppc_set_epp_perf(cpudata->cpu, &perf_ctrls, 1); + if (ret) { +@@ -452,16 +475,6 @@ static inline int amd_pstate_init_perf(struct amd_cpudata *cpudata) + return static_call(amd_pstate_init_perf)(cpudata); + } + +-static void pstate_update_perf(struct amd_cpudata *cpudata, u32 min_perf, +- u32 des_perf, u32 max_perf, bool fast_switch) +-{ +- if (fast_switch) +- wrmsrl(MSR_AMD_CPPC_REQ, READ_ONCE(cpudata->cppc_req_cached)); +- else +- wrmsrl_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ, +- READ_ONCE(cpudata->cppc_req_cached)); +-} +- + static void cppc_update_perf(struct amd_cpudata *cpudata, + u32 min_perf, u32 des_perf, + u32 max_perf, bool fast_switch) +@@ -475,16 +488,6 @@ static void cppc_update_perf(struct amd_cpudata *cpudata, + cppc_set_perf(cpudata->cpu, &perf_ctrls); + } + +-DEFINE_STATIC_CALL(amd_pstate_update_perf, pstate_update_perf); +- +-static inline void amd_pstate_update_perf(struct amd_cpudata *cpudata, +- u32 min_perf, u32 des_perf, +- u32 max_perf, bool fast_switch) +-{ +- static_call(amd_pstate_update_perf)(cpudata, min_perf, des_perf, +- max_perf, fast_switch); +-} +- + static inline bool amd_pstate_sample(struct amd_cpudata *cpudata) + { + u64 aperf, mperf, tsc; +-- +2.43.0 + diff --git a/queue-6.10/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch b/queue-6.10/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch new file mode 100644 index 00000000000..8b7bc0437f6 --- /dev/null +++ b/queue-6.10/cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch @@ -0,0 +1,73 @@ +From 3810ca3fe89dbe0e2c0a304fa1a14cab855c895b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 08:14:13 +0000 +Subject: cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons + +From: Dhananjay Ugwekar + +[ Upstream commit f21ab5ed4e8758b06230900f44b9dcbcfdc0c3ae ] + +cpudata->nominal_freq being in MHz whereas other frequencies being in +KHz breaks the amd-pstate-ut frequency sanity check. This fixes it. + +Fixes: e4731baaf294 ("cpufreq: amd-pstate: Fix the inconsistency in max frequency units") +Reported-by: David Arcari +Signed-off-by: Dhananjay Ugwekar +Reviewed-by: Mario Limonciello +Reviewed-by: Gautham R. Shenoy +Link: https://lore.kernel.org/r/20240702081413.5688-2-Dhananjay.Ugwekar@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd-pstate-ut.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c +index fc275d41d51e9..66b73c308ce67 100644 +--- a/drivers/cpufreq/amd-pstate-ut.c ++++ b/drivers/cpufreq/amd-pstate-ut.c +@@ -202,6 +202,7 @@ static void amd_pstate_ut_check_freq(u32 index) + int cpu = 0; + struct cpufreq_policy *policy = NULL; + struct amd_cpudata *cpudata = NULL; ++ u32 nominal_freq_khz; + + for_each_possible_cpu(cpu) { + policy = cpufreq_cpu_get(cpu); +@@ -209,13 +210,14 @@ static void amd_pstate_ut_check_freq(u32 index) + break; + cpudata = policy->driver_data; + +- if (!((cpudata->max_freq >= cpudata->nominal_freq) && +- (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) && ++ nominal_freq_khz = cpudata->nominal_freq*1000; ++ if (!((cpudata->max_freq >= nominal_freq_khz) && ++ (nominal_freq_khz > cpudata->lowest_nonlinear_freq) && + (cpudata->lowest_nonlinear_freq > cpudata->min_freq) && + (cpudata->min_freq > 0))) { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d max=%d >= nominal=%d > lowest_nonlinear=%d > min=%d > 0, the formula is incorrect!\n", +- __func__, cpu, cpudata->max_freq, cpudata->nominal_freq, ++ __func__, cpu, cpudata->max_freq, nominal_freq_khz, + cpudata->lowest_nonlinear_freq, cpudata->min_freq); + goto skip_test; + } +@@ -229,13 +231,13 @@ static void amd_pstate_ut_check_freq(u32 index) + + if (cpudata->boost_supported) { + if ((policy->max == cpudata->max_freq) || +- (policy->max == cpudata->nominal_freq)) ++ (policy->max == nominal_freq_khz)) + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS; + else { + amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL; + pr_err("%s cpu%d policy_max=%d should be equal cpu_max=%d or cpu_nominal=%d !\n", + __func__, cpu, policy->max, cpudata->max_freq, +- cpudata->nominal_freq); ++ nominal_freq_khz); + goto skip_test; + } + } else { +-- +2.43.0 + diff --git a/queue-6.10/cpufreq-sun50i-fix-memory-leak-in-dt_has_supported_h.patch b/queue-6.10/cpufreq-sun50i-fix-memory-leak-in-dt_has_supported_h.patch new file mode 100644 index 00000000000..f2a7ccb843a --- /dev/null +++ b/queue-6.10/cpufreq-sun50i-fix-memory-leak-in-dt_has_supported_h.patch @@ -0,0 +1,50 @@ +From 696d4aa2ce58532112d51dc6f31c00fdf21a1a5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 19:52:32 +0200 +Subject: cpufreq: sun50i: fix memory leak in dt_has_supported_hw() + +From: Javier Carrasco + +[ Upstream commit 6282fba6abd7c3c8896c239cc8aa9ec45edcb97b ] + +The for_each_child_of_node() loop does not decrement the child node +refcount before the break instruction, even though the node is no +longer required. + +This can be avoided with the new for_each_child_of_node_scoped() macro +that removes the need for any of_node_put(). + +Fixes: fa5aec9561cf ("cpufreq: sun50i: Add support for opp_supported_hw") +Signed-off-by: Javier Carrasco +Reviewed-by: Andre Przywara +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index 0b882765cd66f..ef83e4bf26391 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -131,7 +131,7 @@ static const struct of_device_id cpu_opp_match_list[] = { + static bool dt_has_supported_hw(void) + { + bool has_opp_supported_hw = false; +- struct device_node *np, *opp; ++ struct device_node *np; + struct device *cpu_dev; + + cpu_dev = get_cpu_device(0); +@@ -142,7 +142,7 @@ static bool dt_has_supported_hw(void) + if (!np) + return false; + +- for_each_child_of_node(np, opp) { ++ for_each_child_of_node_scoped(np, opp) { + if (of_find_property(opp, "opp-supported-hw", NULL)) { + has_opp_supported_hw = true; + break; +-- +2.43.0 + diff --git a/queue-6.10/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch b/queue-6.10/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch new file mode 100644 index 00000000000..61d33100225 --- /dev/null +++ b/queue-6.10/cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch @@ -0,0 +1,36 @@ +From 10f958a46d1de27588d7f4b35dd88ec783879330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 08:58:47 +0200 +Subject: cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe() + +From: Primoz Fiser + +[ Upstream commit 101388b8ef1027be72e399beeb97293cce67bb24 ] + +Handle deferred probing gracefully by using dev_err_probe() to not +spam console with unnecessary error messages. + +Fixes: f88d152dc739 ("cpufreq: ti: Migrate to dev_pm_opp_set_config()") +Signed-off-by: Primoz Fiser +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/ti-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c +index 714ed53753fa5..5af85c4cbad0c 100644 +--- a/drivers/cpufreq/ti-cpufreq.c ++++ b/drivers/cpufreq/ti-cpufreq.c +@@ -417,7 +417,7 @@ static int ti_cpufreq_probe(struct platform_device *pdev) + + ret = dev_pm_opp_set_config(opp_data->cpu_dev, &config); + if (ret < 0) { +- dev_err(opp_data->cpu_dev, "Failed to set OPP config\n"); ++ dev_err_probe(opp_data->cpu_dev, ret, "Failed to set OPP config\n"); + goto fail_put_node; + } + +-- +2.43.0 + diff --git a/queue-6.10/crypto-atmel-sha204a-fix-negated-return-value.patch b/queue-6.10/crypto-atmel-sha204a-fix-negated-return-value.patch new file mode 100644 index 00000000000..39998aa5833 --- /dev/null +++ b/queue-6.10/crypto-atmel-sha204a-fix-negated-return-value.patch @@ -0,0 +1,38 @@ +From f1f19a3531ab870dee2b30edceb55adcf077a8e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 May 2024 10:31:28 +0000 +Subject: crypto: atmel-sha204a - fix negated return value + +From: Lothar Rubusch + +[ Upstream commit aabbf2135f9a9526991f17cb0c78cf1ec878f1c2 ] + +Fix negated variable return value. + +Fixes: e05ce444e9e5 ("crypto: atmel-sha204a - add reading from otp zone") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-crypto/34cd4179-090e-479d-b459-8d0d35dd327d@moroto.mountain/ +Signed-off-by: Lothar Rubusch +Reviewed-by: Dan Carpenter +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/atmel-sha204a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c +index 24ffdf5050235..2034f60315183 100644 +--- a/drivers/crypto/atmel-sha204a.c ++++ b/drivers/crypto/atmel-sha204a.c +@@ -106,7 +106,7 @@ static int atmel_sha204a_otp_read(struct i2c_client *client, u16 addr, u8 *otp) + + if (cmd.data[0] == 0xff) { + dev_err(&client->dev, "failed, device not ready\n"); +- return -ret; ++ return -EINVAL; + } + + memcpy(otp, cmd.data+1, 4); +-- +2.43.0 + diff --git a/queue-6.10/crypto-mxs-dcp-ensure-payload-is-zero-when-using-key.patch b/queue-6.10/crypto-mxs-dcp-ensure-payload-is-zero-when-using-key.patch new file mode 100644 index 00000000000..8568cf753ec --- /dev/null +++ b/queue-6.10/crypto-mxs-dcp-ensure-payload-is-zero-when-using-key.patch @@ -0,0 +1,44 @@ +From 54227e4ed9b28b7255c76deac5fede8f83ead644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 14:49:58 +0200 +Subject: crypto: mxs-dcp - Ensure payload is zero when using key slot + +From: David Gstir + +[ Upstream commit dd52b5eeb0f70893f762da7254e923fd23fd1379 ] + +We could leak stack memory through the payload field when running +AES with a key from one of the hardware's key slots. Fix this by +ensuring the payload field is set to 0 in such cases. + +This does not affect the common use case when the key is supplied +from main memory via the descriptor payload. + +Signed-off-by: David Gstir +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202405270146.Y9tPoil8-lkp@intel.com/ +Fixes: 3d16af0b4cfa ("crypto: mxs-dcp: Add support for hardware-bound keys") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxs-dcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 057d73c370b73..c82775dbb557a 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -225,7 +225,8 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) + static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + struct skcipher_request *req, int init) + { +- dma_addr_t key_phys, src_phys, dst_phys; ++ dma_addr_t key_phys = 0; ++ dma_addr_t src_phys, dst_phys; + struct dcp *sdcp = global_sdcp; + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; + struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req); +-- +2.43.0 + diff --git a/queue-6.10/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch b/queue-6.10/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch new file mode 100644 index 00000000000..eb2556193b1 --- /dev/null +++ b/queue-6.10/crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch @@ -0,0 +1,52 @@ +From 955972263718e3ac96a74494fc6f3ff8aebd9b3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 15:38:50 +0100 +Subject: crypto: qat - extend scope of lock in adf_cfg_add_key_value_param() + +From: Nivas Varadharajan Mugunthakumar + +[ Upstream commit 6424da7d8b938fe66e7e771eaa949bc7b6c29c00 ] + +The function adf_cfg_add_key_value_param() attempts to access and modify +the key value store of the driver without locking. + +Extend the scope of cfg->lock to avoid a potential race condition. + +Fixes: 92bf269fbfe9 ("crypto: qat - change behaviour of adf_cfg_add_key_value_param()") +Signed-off-by: Nivas Varadharajan Mugunthakumar +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/intel/qat/qat_common/adf_cfg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/intel/qat/qat_common/adf_cfg.c b/drivers/crypto/intel/qat/qat_common/adf_cfg.c +index 8836f015c39c4..2cf102ad4ca82 100644 +--- a/drivers/crypto/intel/qat/qat_common/adf_cfg.c ++++ b/drivers/crypto/intel/qat/qat_common/adf_cfg.c +@@ -290,17 +290,19 @@ int adf_cfg_add_key_value_param(struct adf_accel_dev *accel_dev, + * 3. if the key exists with the same value, then return without doing + * anything (the newly created key_val is freed). + */ ++ down_write(&cfg->lock); + if (!adf_cfg_key_val_get(accel_dev, section_name, key, temp_val)) { + if (strncmp(temp_val, key_val->val, sizeof(temp_val))) { + adf_cfg_keyval_remove(key, section); + } else { + kfree(key_val); +- return 0; ++ goto out; + } + } + +- down_write(&cfg->lock); + adf_cfg_keyval_add(key_val, section); ++ ++out: + up_write(&cfg->lock); + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/crypto-tegra-remove-an-incorrect-iommu_fwspec_free-c.patch b/queue-6.10/crypto-tegra-remove-an-incorrect-iommu_fwspec_free-c.patch new file mode 100644 index 00000000000..983a5ee7536 --- /dev/null +++ b/queue-6.10/crypto-tegra-remove-an-incorrect-iommu_fwspec_free-c.patch @@ -0,0 +1,43 @@ +From de5a9d7e1c5d6db57f13dfa994b411c2373034bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 May 2024 17:14:35 +0200 +Subject: crypto: tegra - Remove an incorrect iommu_fwspec_free() call in + tegra_se_remove() + +From: Christophe JAILLET + +[ Upstream commit 8d7c52cb4184d3dc26dde62b4f5acd48de0768ae ] + +The only iommu function call in this driver is a +tegra_dev_iommu_get_stream_id() which does not allocate anything and does +not take any reference. + +So there is no point in calling iommu_fwspec_free() in the remove function. + +Remove this incorrect function call. + +Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") +Signed-off-by: Christophe JAILLET +Tested-by: Akhil R +Acked-by: Akhil R +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/tegra/tegra-se-main.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c +index 9955874b3dc37..f94c0331b148c 100644 +--- a/drivers/crypto/tegra/tegra-se-main.c ++++ b/drivers/crypto/tegra/tegra-se-main.c +@@ -326,7 +326,6 @@ static void tegra_se_remove(struct platform_device *pdev) + + crypto_engine_stop(se->engine); + crypto_engine_exit(se->engine); +- iommu_fwspec_free(se->dev); + host1x_client_unregister(&se->client); + } + +-- +2.43.0 + diff --git a/queue-6.10/dm-call-dm_revalidate_zones-after-setting-the-queue-.patch b/queue-6.10/dm-call-dm_revalidate_zones-after-setting-the-queue-.patch new file mode 100644 index 00000000000..d93e5fd70ee --- /dev/null +++ b/queue-6.10/dm-call-dm_revalidate_zones-after-setting-the-queue-.patch @@ -0,0 +1,142 @@ +From 0248a97a7ecf45ee8087df28dde66d1c160cec4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 11:36:37 +0900 +Subject: dm: Call dm_revalidate_zones() after setting the queue limits + +From: Damien Le Moal + +[ Upstream commit 7f91ccd8a608dbe39b97a6e43d635378d493f77e ] + +dm_revalidate_zones() is called from dm_set_zone_restrictions() when the +mapped device queue limits are not yet set. However, +dm_revalidate_zones() calls blk_revalidate_disk_zones() and this +function consults and modifies the mapped device queue limits. Thus, +currently, blk_revalidate_disk_zones() operates on limits that are not +yet initialized. + +Fix this by moving the call to dm_revalidate_zones() out of +dm_set_zone_restrictions() and into dm_table_set_restrictions() after +executing queue_limits_set(). + +To further cleanup dm_set_zones_restrictions(), the message about the +type of zone append (native or emulated) is also moved inside +dm_revalidate_zones(). + +Fixes: 1c0e720228ad ("dm: use queue_limits_set") +Signed-off-by: Damien Le Moal +Reviewed-by: Christoph Hellwig +Reviewed-by: Benjamin Marzinski +Reviewed-by: Niklas Cassel +Link: https://lore.kernel.org/r/20240611023639.89277-3-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/dm-table.c | 15 +++++++++++---- + drivers/md/dm-zone.c | 25 ++++++++++--------------- + drivers/md/dm.h | 1 + + 3 files changed, 22 insertions(+), 19 deletions(-) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index b2d5246cff210..2fc847af254de 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -2028,10 +2028,7 @@ int dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + dm_table_any_dev_attr(t, device_is_not_random, NULL)) + blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, q); + +- /* +- * For a zoned target, setup the zones related queue attributes +- * and resources necessary for zone append emulation if necessary. +- */ ++ /* For a zoned table, setup the zone related queue attributes. */ + if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) && limits->zoned) { + r = dm_set_zones_restrictions(t, q, limits); + if (r) +@@ -2042,6 +2039,16 @@ int dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + if (r) + return r; + ++ /* ++ * Now that the limits are set, check the zones mapped by the table ++ * and setup the resources for zone append emulation if necessary. ++ */ ++ if (IS_ENABLED(CONFIG_BLK_DEV_ZONED) && limits->zoned) { ++ r = dm_revalidate_zones(t, q); ++ if (r) ++ return r; ++ } ++ + dm_update_crypto_profile(q, t); + + /* +diff --git a/drivers/md/dm-zone.c b/drivers/md/dm-zone.c +index 5d66d916730ef..75d0019a0649d 100644 +--- a/drivers/md/dm-zone.c ++++ b/drivers/md/dm-zone.c +@@ -166,14 +166,22 @@ static int dm_check_zoned_cb(struct blk_zone *zone, unsigned int idx, + * blk_revalidate_disk_zones() function here as the mapped device is suspended + * (this is called from __bind() context). + */ +-static int dm_revalidate_zones(struct mapped_device *md, struct dm_table *t) ++int dm_revalidate_zones(struct dm_table *t, struct request_queue *q) + { ++ struct mapped_device *md = t->md; + struct gendisk *disk = md->disk; + int ret; + ++ if (!get_capacity(disk)) ++ return 0; ++ + /* Revalidate only if something changed. */ +- if (!disk->nr_zones || disk->nr_zones != md->nr_zones) ++ if (!disk->nr_zones || disk->nr_zones != md->nr_zones) { ++ DMINFO("%s using %s zone append", ++ disk->disk_name, ++ queue_emulates_zone_append(q) ? "emulated" : "native"); + md->nr_zones = 0; ++ } + + if (md->nr_zones) + return 0; +@@ -240,9 +248,6 @@ int dm_set_zones_restrictions(struct dm_table *t, struct request_queue *q, + lim->max_zone_append_sectors = 0; + } + +- if (!get_capacity(md->disk)) +- return 0; +- + /* + * Count conventional zones to check that the mapped device will indeed + * have sequential write required zones. +@@ -269,16 +274,6 @@ int dm_set_zones_restrictions(struct dm_table *t, struct request_queue *q, + return 0; + } + +- if (!md->disk->nr_zones) { +- DMINFO("%s using %s zone append", +- md->disk->disk_name, +- queue_emulates_zone_append(q) ? "emulated" : "native"); +- } +- +- ret = dm_revalidate_zones(md, t); +- if (ret < 0) +- return ret; +- + if (!static_key_enabled(&zoned_enabled.key)) + static_branch_enable(&zoned_enabled); + return 0; +diff --git a/drivers/md/dm.h b/drivers/md/dm.h +index 53ef8207fe2c1..c984ecb64b1e8 100644 +--- a/drivers/md/dm.h ++++ b/drivers/md/dm.h +@@ -103,6 +103,7 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t); + */ + int dm_set_zones_restrictions(struct dm_table *t, struct request_queue *q, + struct queue_limits *lim); ++int dm_revalidate_zones(struct dm_table *t, struct request_queue *q); + void dm_zone_endio(struct dm_io *io, struct bio *clone); + #ifdef CONFIG_BLK_DEV_ZONED + int dm_blk_report_zones(struct gendisk *disk, sector_t sector, +-- +2.43.0 + diff --git a/queue-6.10/dm-raid-fix-warn_on_once-check-for-sync_thread-in-ra.patch b/queue-6.10/dm-raid-fix-warn_on_once-check-for-sync_thread-in-ra.patch new file mode 100644 index 00000000000..245d1e4613a --- /dev/null +++ b/queue-6.10/dm-raid-fix-warn_on_once-check-for-sync_thread-in-ra.patch @@ -0,0 +1,53 @@ +From 760db9ad4b2e824acb697d09022f81991c27ef83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 17:02:48 +0200 +Subject: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume + +From: Benjamin Marzinski + +[ Upstream commit 3199a34bfaf7561410e0be1e33a61eba870768fc ] + +rm-raid devices will occasionally trigger the following warning when +being resumed after a table load because DM_RECOVERY_RUNNING is set: + +WARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid] + +The failing check is: +WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)); + +This check is designed to make sure that the sync thread isn't +registered, but md_check_recovery can set MD_RECOVERY_RUNNING without +the sync_thread ever getting registered. Instead of checking if +MD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL. + +Fixes: 16c4770c75b1 ("dm-raid: really frozen sync_thread during suspend") +Suggested-by: Yu Kuai +Signed-off-by: Benjamin Marzinski +Reviewed-by: Yu Kuai +Signed-off-by: Mikulas Patocka +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index abe88d1e67358..b149ac46a990e 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -4101,10 +4101,11 @@ static void raid_resume(struct dm_target *ti) + if (mddev->delta_disks < 0) + rs_set_capacity(rs); + ++ mddev_lock_nointr(mddev); + WARN_ON_ONCE(!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)); +- WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)); ++ WARN_ON_ONCE(rcu_dereference_protected(mddev->sync_thread, ++ lockdep_is_held(&mddev->reconfig_mutex))); + clear_bit(RT_FLAG_RS_FROZEN, &rs->runtime_flags); +- mddev_lock_nointr(mddev); + mddev->ro = 0; + mddev->in_sync = 0; + md_unfrozen_sync_thread(mddev); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-add-null-check-before-access-structs.patch b/queue-6.10/drm-amd-display-add-null-check-before-access-structs.patch new file mode 100644 index 00000000000..f42272a5c60 --- /dev/null +++ b/queue-6.10/drm-amd-display-add-null-check-before-access-structs.patch @@ -0,0 +1,37 @@ +From eaf71f8abde8aa89b48b65ea108522ab5d4f8548 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 21:06:50 +0800 +Subject: drm/amd/display: Add null check before access structs + +From: Ma Ke + +[ Upstream commit c96140000915b610d86f941450e15ca552de154a ] + +In enable_phantom_plane, we should better check null pointer before +accessing various structs. + +Fixes: 09a4ec5da92c ("drm/amd/display: Refactor dc_state interface") +Signed-off-by: Ma Ke +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c +index 282d70e2b18ab..3d29169dd6bbf 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_mall_phantom.c +@@ -750,6 +750,8 @@ static void enable_phantom_plane(struct dml2_context *ctx, + ctx->config.svp_pstate.callbacks.dc, + state, + curr_pipe->plane_state); ++ if (!phantom_plane) ++ return; + } + + memcpy(&phantom_plane->address, &curr_pipe->plane_state->address, sizeof(phantom_plane->address)); +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-dynamically-allocate-dml2_configurat.patch b/queue-6.10/drm-amd-display-dynamically-allocate-dml2_configurat.patch new file mode 100644 index 00000000000..e04eed2abb3 --- /dev/null +++ b/queue-6.10/drm-amd-display-dynamically-allocate-dml2_configurat.patch @@ -0,0 +1,109 @@ +From bc4825ca576a42403a3f0ae97d22ca149272c884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 13:51:18 +0200 +Subject: drm/amd/display: dynamically allocate dml2_configuration_options + structures + +From: Arnd Bergmann + +[ Upstream commit 88c61827cedc14cd305d4266dc18ff0fdb3f8d4c ] + +This structure is too large to fit on a stack, as shown by the +newly introduced warnings from a recent code change: + +drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c: In function 'dcn32_update_bw_bounding_box': +drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2019:1: error: the frame size of 1180 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] +drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn321/dcn321_resource.c: In function 'dcn321_update_bw_bounding_box': +drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn321/dcn321_resource.c:1597:1: error: the frame size of 1180 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_state.c: In function 'dc_state_create': +drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_state.c:219:1: error: the frame size of 1184 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] + +Instead of open-coding the assignment of a large structure to a stack +variable, use an explicit kmemdup() in each case to move it off the stack. + +Fixes: e779f4587f61 ("drm/amd/display: Add handling for DC power mode") +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/resource/dcn32/dcn32_resource.c | 16 +++++++++++----- + .../display/dc/resource/dcn321/dcn321_resource.c | 16 +++++++++++----- + 2 files changed, 22 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +index abd76345d1e43..957002967d691 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +@@ -2006,21 +2006,27 @@ void dcn32_calculate_wm_and_dlg(struct dc *dc, struct dc_state *context, + + static void dcn32_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params) + { +- struct dml2_configuration_options dml2_opt = dc->dml2_options; ++ struct dml2_configuration_options *dml2_opt; ++ ++ dml2_opt = kmemdup(&dc->dml2_options, sizeof(dc->dml2_options), GFP_KERNEL); ++ if (!dml2_opt) ++ return; + + DC_FP_START(); + + dcn32_update_bw_bounding_box_fpu(dc, bw_params); + +- dml2_opt.use_clock_dc_limits = false; ++ dml2_opt->use_clock_dc_limits = false; + if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2) +- dml2_reinit(dc, &dml2_opt, &dc->current_state->bw_ctx.dml2); ++ dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2); + +- dml2_opt.use_clock_dc_limits = true; ++ dml2_opt->use_clock_dc_limits = true; + if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2_dc_power_source) +- dml2_reinit(dc, &dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); ++ dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); + + DC_FP_END(); ++ ++ kfree(dml2_opt); + } + + static struct resource_funcs dcn32_res_pool_funcs = { +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +index e4b360d89b3be..07ca6f58447d6 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +@@ -1581,21 +1581,27 @@ static struct dc_cap_funcs cap_funcs = { + + static void dcn321_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params) + { +- struct dml2_configuration_options dml2_opt = dc->dml2_options; ++ struct dml2_configuration_options *dml2_opt; ++ ++ dml2_opt = kmemdup(&dc->dml2_options, sizeof(dc->dml2_options), GFP_KERNEL); ++ if (!dml2_opt) ++ return; + + DC_FP_START(); + + dcn321_update_bw_bounding_box_fpu(dc, bw_params); + +- dml2_opt.use_clock_dc_limits = false; ++ dml2_opt->use_clock_dc_limits = false; + if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2) +- dml2_reinit(dc, &dml2_opt, &dc->current_state->bw_ctx.dml2); ++ dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2); + +- dml2_opt.use_clock_dc_limits = true; ++ dml2_opt->use_clock_dc_limits = true; + if (dc->debug.using_dml2 && dc->current_state && dc->current_state->bw_ctx.dml2_dc_power_source) +- dml2_reinit(dc, &dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); ++ dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); + + DC_FP_END(); ++ ++ kfree(dml2_opt); + } + + static struct resource_funcs dcn321_res_pool_funcs = { +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-fix-graphics_object_id-size.patch b/queue-6.10/drm-amd-display-fix-graphics_object_id-size.patch new file mode 100644 index 00000000000..15ecba4befe --- /dev/null +++ b/queue-6.10/drm-amd-display-fix-graphics_object_id-size.patch @@ -0,0 +1,46 @@ +From e15b11bb22e02af06329c43248f0b279030ab967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 13:51:19 +0200 +Subject: drm/amd/display: fix graphics_object_id size + +From: Arnd Bergmann + +[ Upstream commit 6d438caaeaa1a7fae7b523e7bc4cee262b9f101a ] + +The graphics_object_id structure is meant to fit into 32 bits, as it's +passed by value in and out of functions. A recent change increased +the size to 128 bits, so it's now always passed by reference, which +is clearly not intended and ends up producing a compile-time warning: + +drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c: In function 'construct_phy': +drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:743:1: error: the frame size of 1040 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] + +Add back the bitfields to revert to the original size, while keeping +the 'enum' type change. + +Fixes: fec85f995a4b ("drm/amd/display: Fix compiler redefinition warnings for certain configs") +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/include/grph_object_id.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/include/grph_object_id.h b/drivers/gpu/drm/amd/display/include/grph_object_id.h +index 08ee0350b31fb..54e33062b3c02 100644 +--- a/drivers/gpu/drm/amd/display/include/grph_object_id.h ++++ b/drivers/gpu/drm/amd/display/include/grph_object_id.h +@@ -226,8 +226,8 @@ enum dp_alt_mode { + + struct graphics_object_id { + uint32_t id:8; +- enum object_enum_id enum_id; +- enum object_type type; ++ enum object_enum_id enum_id :4; ++ enum object_type type :4; + uint32_t reserved:16; /* for padding. total size should be u32 */ + }; + +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-move-struct-scaler_data-off-stack.patch b/queue-6.10/drm-amd-display-move-struct-scaler_data-off-stack.patch new file mode 100644 index 00000000000..4b292d931b8 --- /dev/null +++ b/queue-6.10/drm-amd-display-move-struct-scaler_data-off-stack.patch @@ -0,0 +1,144 @@ +From 0a9655300f07f9ac07319f1bacd3a62714f8d861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 13:51:21 +0200 +Subject: drm/amd/display: Move 'struct scaler_data' off stack + +From: Arnd Bergmann + +[ Upstream commit f8718c482572181ca364ffca3c27365cc83cfe9e ] + +The scaler_data structure is implicitly copied onto the stack twice by +being returned from a function. This is usually a bad idea, but it +was not flagged by the compiler until a recent addition that pushed +it over the 1024 byte function stack limit: + +drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_translation_helper.c: In function 'populate_dml_plane_cfg_from_plane_state': +drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_translation_helper.c:1075:1: error: the frame size of 1032 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] + +Use an explicit kzalloc() and memcpy() instead here to keep it off the +stack. + +Fixes: 00c391102abc ("drm/amd/display: Add misc DC changes for DCN401") +Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2") +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/dml2/dml2_translation_helper.c | 56 ++++++++++--------- + 1 file changed, 31 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +index 8ecc972dbffde..edff6b447680c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c ++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c +@@ -804,7 +804,7 @@ static void populate_dml_surface_cfg_from_plane_state(enum dml_project_id dml2_p + } + } + +-static struct scaler_data get_scaler_data_for_plane(const struct dc_plane_state *in, struct dc_state *context) ++static void get_scaler_data_for_plane(const struct dc_plane_state *in, struct dc_state *context, struct scaler_data *out) + { + int i; + struct pipe_ctx *temp_pipe = &context->res_ctx.temp_pipe; +@@ -825,7 +825,7 @@ static struct scaler_data get_scaler_data_for_plane(const struct dc_plane_state + } + + ASSERT(i < MAX_PIPES); +- return temp_pipe->plane_res.scl_data; ++ memcpy(out, &temp_pipe->plane_res.scl_data, sizeof(*out)); + } + + static void populate_dummy_dml_plane_cfg(struct dml_plane_cfg_st *out, unsigned int location, const struct dc_stream_state *in) +@@ -884,27 +884,31 @@ static void populate_dummy_dml_plane_cfg(struct dml_plane_cfg_st *out, unsigned + + static void populate_dml_plane_cfg_from_plane_state(struct dml_plane_cfg_st *out, unsigned int location, const struct dc_plane_state *in, struct dc_state *context) + { +- const struct scaler_data scaler_data = get_scaler_data_for_plane(in, context); ++ struct scaler_data *scaler_data = kzalloc(sizeof(*scaler_data), GFP_KERNEL); ++ if (!scaler_data) ++ return; ++ ++ get_scaler_data_for_plane(in, context, scaler_data); + + out->CursorBPP[location] = dml_cur_32bit; + out->CursorWidth[location] = 256; + + out->GPUVMMinPageSizeKBytes[location] = 256; + +- out->ViewportWidth[location] = scaler_data.viewport.width; +- out->ViewportHeight[location] = scaler_data.viewport.height; +- out->ViewportWidthChroma[location] = scaler_data.viewport_c.width; +- out->ViewportHeightChroma[location] = scaler_data.viewport_c.height; +- out->ViewportXStart[location] = scaler_data.viewport.x; +- out->ViewportYStart[location] = scaler_data.viewport.y; +- out->ViewportXStartC[location] = scaler_data.viewport_c.x; +- out->ViewportYStartC[location] = scaler_data.viewport_c.y; ++ out->ViewportWidth[location] = scaler_data->viewport.width; ++ out->ViewportHeight[location] = scaler_data->viewport.height; ++ out->ViewportWidthChroma[location] = scaler_data->viewport_c.width; ++ out->ViewportHeightChroma[location] = scaler_data->viewport_c.height; ++ out->ViewportXStart[location] = scaler_data->viewport.x; ++ out->ViewportYStart[location] = scaler_data->viewport.y; ++ out->ViewportXStartC[location] = scaler_data->viewport_c.x; ++ out->ViewportYStartC[location] = scaler_data->viewport_c.y; + out->ViewportStationary[location] = false; + +- out->ScalerEnabled[location] = scaler_data.ratios.horz.value != dc_fixpt_one.value || +- scaler_data.ratios.horz_c.value != dc_fixpt_one.value || +- scaler_data.ratios.vert.value != dc_fixpt_one.value || +- scaler_data.ratios.vert_c.value != dc_fixpt_one.value; ++ out->ScalerEnabled[location] = scaler_data->ratios.horz.value != dc_fixpt_one.value || ++ scaler_data->ratios.horz_c.value != dc_fixpt_one.value || ++ scaler_data->ratios.vert.value != dc_fixpt_one.value || ++ scaler_data->ratios.vert_c.value != dc_fixpt_one.value; + + /* Current driver code base uses LBBitPerPixel as 57. There is a discrepancy + * from the HW/DML teams about this value. Initialize LBBitPerPixel with the +@@ -920,25 +924,25 @@ static void populate_dml_plane_cfg_from_plane_state(struct dml_plane_cfg_st *out + out->VRatioChroma[location] = 1; + } else { + /* Follow the original dml_wrapper.c code direction to fix scaling issues */ +- out->HRatio[location] = (dml_float_t)scaler_data.ratios.horz.value / (1ULL << 32); +- out->HRatioChroma[location] = (dml_float_t)scaler_data.ratios.horz_c.value / (1ULL << 32); +- out->VRatio[location] = (dml_float_t)scaler_data.ratios.vert.value / (1ULL << 32); +- out->VRatioChroma[location] = (dml_float_t)scaler_data.ratios.vert_c.value / (1ULL << 32); ++ out->HRatio[location] = (dml_float_t)scaler_data->ratios.horz.value / (1ULL << 32); ++ out->HRatioChroma[location] = (dml_float_t)scaler_data->ratios.horz_c.value / (1ULL << 32); ++ out->VRatio[location] = (dml_float_t)scaler_data->ratios.vert.value / (1ULL << 32); ++ out->VRatioChroma[location] = (dml_float_t)scaler_data->ratios.vert_c.value / (1ULL << 32); + } + +- if (!scaler_data.taps.h_taps) { ++ if (!scaler_data->taps.h_taps) { + out->HTaps[location] = 1; + out->HTapsChroma[location] = 1; + } else { +- out->HTaps[location] = scaler_data.taps.h_taps; +- out->HTapsChroma[location] = scaler_data.taps.h_taps_c; ++ out->HTaps[location] = scaler_data->taps.h_taps; ++ out->HTapsChroma[location] = scaler_data->taps.h_taps_c; + } +- if (!scaler_data.taps.v_taps) { ++ if (!scaler_data->taps.v_taps) { + out->VTaps[location] = 1; + out->VTapsChroma[location] = 1; + } else { +- out->VTaps[location] = scaler_data.taps.v_taps; +- out->VTapsChroma[location] = scaler_data.taps.v_taps_c; ++ out->VTaps[location] = scaler_data->taps.v_taps; ++ out->VTapsChroma[location] = scaler_data->taps.v_taps_c; + } + + out->SourceScan[location] = (enum dml_rotation_angle)in->rotation; +@@ -949,6 +953,8 @@ static void populate_dml_plane_cfg_from_plane_state(struct dml_plane_cfg_st *out + out->DynamicMetadataTransmittedBytes[location] = 0; + + out->NumberOfCursors[location] = 1; ++ ++ kfree(scaler_data); + } + + static unsigned int map_stream_to_dml_display_cfg(const struct dml2_context *dml2, +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-display-use-pre-allocated-temp-structure-for.patch b/queue-6.10/drm-amd-display-use-pre-allocated-temp-structure-for.patch new file mode 100644 index 00000000000..547bff11462 --- /dev/null +++ b/queue-6.10/drm-amd-display-use-pre-allocated-temp-structure-for.patch @@ -0,0 +1,111 @@ +From b39aa49a0a6d14a06ff6e91d18a8cc4792499d0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 11:46:04 -0400 +Subject: drm/amd/display: use pre-allocated temp structure for bounding box + +From: Alex Deucher + +[ Upstream commit afe9555e79fcd0d758e3796ad00fd6292d99361b ] + +This mirrors what the driver does for older DCN generations. + +Should fix: + +BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306 +in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 449, name: kworker/u64:8 +preempt_count: 2, expected: 0 +RCU nest depth: 0, expected: 0 +Preemption disabled at: +ffffffffc0ce1580>] dc_fpu_begin+0x30/0xd0 [amdgpu] +CPU: 5 PID: 449 Comm: kworker/u64:8 Tainted: G W 6.8.0+ #35 +Hardware name: System manufacturer System Product Name/ROG STRIX X570-E GAMING WIFI II, BIOS 4204 02/24/2022 +Workqueue: events_unbound async_run_entry_fn + +v2: drop extra memcpy + +Fixes: 88c61827cedc ("drm/amd/display: dynamically allocate dml2_configuration_options structures") +Reviewed-by: Harry Wentland +Tested-by: George Zhang (v1) +Suggested-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Cc: George Zhang +Cc: Arnd Bergmann +Cc: harry.wentland@amd.com +Cc: sunpeng.li@amd.com +Cc: Rodrigo.Siqueira@amd.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dc.h | 1 + + .../drm/amd/display/dc/resource/dcn32/dcn32_resource.c | 8 ++------ + .../drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 8 ++------ + 3 files changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h +index 3c33c3bcbe2cb..4362fca1f15ad 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc.h ++++ b/drivers/gpu/drm/amd/display/dc/dc.h +@@ -1392,6 +1392,7 @@ struct dc { + } scratch; + + struct dml2_configuration_options dml2_options; ++ struct dml2_configuration_options dml2_tmp; + enum dc_acpi_cm_power_state power_state; + + }; +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +index 957002967d691..d84c8e0e5c2f0 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c +@@ -2006,11 +2006,9 @@ void dcn32_calculate_wm_and_dlg(struct dc *dc, struct dc_state *context, + + static void dcn32_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params) + { +- struct dml2_configuration_options *dml2_opt; ++ struct dml2_configuration_options *dml2_opt = &dc->dml2_tmp; + +- dml2_opt = kmemdup(&dc->dml2_options, sizeof(dc->dml2_options), GFP_KERNEL); +- if (!dml2_opt) +- return; ++ memcpy(dml2_opt, &dc->dml2_options, sizeof(dc->dml2_options)); + + DC_FP_START(); + +@@ -2025,8 +2023,6 @@ static void dcn32_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw + dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); + + DC_FP_END(); +- +- kfree(dml2_opt); + } + + static struct resource_funcs dcn32_res_pool_funcs = { +diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +index 07ca6f58447d6..9a3cc0514a36e 100644 +--- a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c +@@ -1581,11 +1581,9 @@ static struct dc_cap_funcs cap_funcs = { + + static void dcn321_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params) + { +- struct dml2_configuration_options *dml2_opt; ++ struct dml2_configuration_options *dml2_opt = &dc->dml2_tmp; + +- dml2_opt = kmemdup(&dc->dml2_options, sizeof(dc->dml2_options), GFP_KERNEL); +- if (!dml2_opt) +- return; ++ memcpy(dml2_opt, &dc->dml2_options, sizeof(dc->dml2_options)); + + DC_FP_START(); + +@@ -1600,8 +1598,6 @@ static void dcn321_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b + dml2_reinit(dc, dml2_opt, &dc->current_state->bw_ctx.dml2_dc_power_source); + + DC_FP_END(); +- +- kfree(dml2_opt); + } + + static struct resource_funcs dcn321_res_pool_funcs = { +-- +2.43.0 + diff --git a/queue-6.10/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch b/queue-6.10/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch new file mode 100644 index 00000000000..ba7bc3065f3 --- /dev/null +++ b/queue-6.10/drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch @@ -0,0 +1,39 @@ +From e9397873ebb3cc91ed195674be4ec29a98a238e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 14:14:10 +0530 +Subject: drm/amd/pm: Fix aldebaran pcie speed reporting + +From: Lijo Lazar + +[ Upstream commit b6420021e17e262c57bb289d0556ee181b014f9c ] + +Fix the field definitions for LC_CURRENT_DATA_RATE. + +Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)") +Signed-off-by: Lijo Lazar +Reviewed-by: Asad Kamal +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +index a8d34adc7d3f1..b63ad9cb24bfd 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -79,8 +79,8 @@ MODULE_FIRMWARE("amdgpu/smu_13_0_10.bin"); + #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD_MASK 0x00000070L + #define PCIE_LC_LINK_WIDTH_CNTL__LC_LINK_WIDTH_RD__SHIFT 0x4 + #define smnPCIE_LC_SPEED_CNTL 0x11140290 +-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xC000 +-#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0xE ++#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK 0xE0 ++#define PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE__SHIFT 0x5 + + #define ENABLE_IMU_ARG_GFXOFF_ENABLE 1 + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch b/queue-6.10/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch new file mode 100644 index 00000000000..b5c0770d939 --- /dev/null +++ b/queue-6.10/drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch @@ -0,0 +1,43 @@ +From 81b4d9b8909ea5b289415745304010cf7b18428b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 09:06:38 +0200 +Subject: drm/amdgpu: Check if NBIO funcs are NULL in amdgpu_device_baco_exit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Friedrich Vock + +[ Upstream commit 0cdb3f9740844b9d95ca413e3fcff11f81223ecf ] + +The special case for VM passthrough doesn't check adev->nbio.funcs +before dereferencing it. If GPUs that don't have an NBIO block are +passed through, this leads to a NULL pointer dereference on startup. + +Signed-off-by: Friedrich Vock +Fixes: 1bece222eabe ("drm/amdgpu: Clear doorbell interrupt status for Sienna Cichlid") +Cc: Alex Deucher +Cc: Christian König +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 33f791d92ddf3..ee7df1d84e028 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -6173,7 +6173,7 @@ int amdgpu_device_baco_exit(struct drm_device *dev) + adev->nbio.funcs->enable_doorbell_interrupt) + adev->nbio.funcs->enable_doorbell_interrupt(adev, true); + +- if (amdgpu_passthrough(adev) && ++ if (amdgpu_passthrough(adev) && adev->nbio.funcs && + adev->nbio.funcs->clear_doorbell_interrupt) + adev->nbio.funcs->clear_doorbell_interrupt(adev); + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-memory-range-calculation.patch b/queue-6.10/drm-amdgpu-fix-memory-range-calculation.patch new file mode 100644 index 00000000000..106228ebb30 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-memory-range-calculation.patch @@ -0,0 +1,42 @@ +From 7259fdac6d01e2a2345a19503371ccb57c5ce97a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 13:30:34 +0530 +Subject: drm/amdgpu: Fix memory range calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lijo Lazar + +[ Upstream commit ce798376ef6764de51d8f4684ae525b55df295fa ] + +Consider the 16M reserved region also before range calculation for GMC +9.4.3 SOCs. + +Fixes: a433f1f59484 ("drm/amdgpu: Initialize memory ranges for GC 9.4.3") +Signed-off-by: Lijo Lazar +Acked-by: Christian König +Reviewed-by: Le Ma +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index c4ec1358f3aa6..f7f4924751020 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -1910,7 +1910,7 @@ gmc_v9_0_init_sw_mem_ranges(struct amdgpu_device *adev, + break; + } + +- size = adev->gmc.real_vram_size >> AMDGPU_GPU_PAGE_SHIFT; ++ size = (adev->gmc.real_vram_size + SZ_16M) >> AMDGPU_GPU_PAGE_SHIFT; + size /= adev->gmc.num_mem_partitions; + + for (i = 0; i < adev->gmc.num_mem_partitions; ++i) { +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-snprintf-usage-in-amdgpu_gfx_kiq_init.patch b/queue-6.10/drm-amdgpu-fix-snprintf-usage-in-amdgpu_gfx_kiq_init.patch new file mode 100644 index 00000000000..729e930c0eb --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-snprintf-usage-in-amdgpu_gfx_kiq_init.patch @@ -0,0 +1,68 @@ +From 2e91780a79761a8a34d1eb18c7348c70d05ec905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 10:03:37 +0530 +Subject: drm/amdgpu: Fix snprintf usage in amdgpu_gfx_kiq_init_ring +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit 0ea55445554209913a72eab86b60f5788776c4d6 ] + +This commit fixes a format truncation issue arosed by the snprintf +function potentially writing more characters into the ring->name buffer +than it can hold, in the amdgpu_gfx_kiq_init_ring function + +The issue occurred because the '%d' format specifier could write between +1 and 10 bytes into a region of size between 0 and 8, depending on the +values of xcc_id, ring->me, ring->pipe, and ring->queue. The snprintf +function could output between 12 and 41 bytes into a destination of size +16, leading to potential truncation. + +To resolve this, the snprintf line was modified to use the '%hhu' format +specifier for xcc_id, ring->me, ring->pipe, and ring->queue. The '%hhu' +specifier is used for unsigned char variables and ensures that these +values are printed as unsigned decimal integers. + +Fixes the below with gcc W=1: +drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c: In function ‘amdgpu_gfx_kiq_init_ring’: +drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:61: warning: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size between 0 and 8 [-Wformat-truncation=] + 332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d", + | ^~ +drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:50: note: directive argument in the range [0, 2147483647] + 332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d", + | ^~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:332:9: note: ‘snprintf’ output between 12 and 41 bytes into a destination of size 16 + 332 | snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 333 | xcc_id, ring->me, ring->pipe, ring->queue); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 345a36c4f1ba ("drm/amdgpu: prefer snprintf over sprintf") +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Srinivasan Shanmugam +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 1d955652f3ba6..2cb8ab86efae8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -329,7 +329,7 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, int xcc_id) + + ring->eop_gpu_addr = kiq->eop_gpu_addr; + ring->no_scheduler = true; +- snprintf(ring->name, sizeof(ring->name), "kiq_%d.%d.%d.%d", ++ snprintf(ring->name, sizeof(ring->name), "kiq_%hhu.%hhu.%hhu.%hhu", + xcc_id, ring->me, ring->pipe, ring->queue); + r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0, + AMDGPU_RING_PRIO_DEFAULT, NULL); +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-fix-type-mismatch-in-amdgpu_gfx_kiq_init_.patch b/queue-6.10/drm-amdgpu-fix-type-mismatch-in-amdgpu_gfx_kiq_init_.patch new file mode 100644 index 00000000000..d329da704e1 --- /dev/null +++ b/queue-6.10/drm-amdgpu-fix-type-mismatch-in-amdgpu_gfx_kiq_init_.patch @@ -0,0 +1,75 @@ +From 06d8e6172996b8e87339d86b3804145a3550b012 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 May 2024 07:39:01 +0530 +Subject: drm/amdgpu: Fix type mismatch in amdgpu_gfx_kiq_init_ring +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Srinivasan Shanmugam + +[ Upstream commit 745f7170db4ffd2f2e9751a2c719a97c9a5fc438 ] + +This commit fixes a type mismatch in the amdgpu_gfx_kiq_init_ring +function triggered by the snprintf function expecting unsigned char +arguments due to the '%hhu' format specifier, but receiving int and u32 +arguments. + +The issue occurred because the arguments xcc_id, ring->me, ring->pipe, +and ring->queue were of type int and u32, not unsigned char. This led to +a type mismatch when these arguments were passed to snprintf. + +To resolve this, the snprintf line was modified to cast these arguments +to unsigned char. This ensures that the arguments are of the correct +type for the '%hhu' format specifier and resolves the warning. + +Fixes the below: +>> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:4: warning: format +>> specifies type 'unsigned char' but the argument has type 'int' +>> [-Wformat] + xcc_id, ring->me, ring->pipe, ring->queue); + ^~~~~~ +>> drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:12: warning: format +>> specifies type 'unsigned char' but the argument has type 'u32' (aka +>> 'unsigned int') [-Wformat] + xcc_id, ring->me, ring->pipe, ring->queue); + ^~~~~~~~ + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:22: warning: format specifies type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') [-Wformat] + xcc_id, ring->me, ring->pipe, ring->queue); + ^~~~~~~~~~ + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c:333:34: warning: format specifies type 'unsigned char' but the argument has type 'u32' (aka 'unsigned int') [-Wformat] + xcc_id, ring->me, ring->pipe, ring->queue); + ^~~~~~~~~~~ + 4 warnings generated. + +Fixes: 0ea554455542 ("drm/amdgpu: Fix snprintf usage in amdgpu_gfx_kiq_init_ring") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202405250446.XeaWe66u-lkp@intel.com/ +Cc: Lijo Lazar +Cc: Alex Deucher +Cc: Christian König +Signed-off-by: Srinivasan Shanmugam +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 2cb8ab86efae8..e92bdc9a39d35 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -330,7 +330,8 @@ int amdgpu_gfx_kiq_init_ring(struct amdgpu_device *adev, int xcc_id) + ring->eop_gpu_addr = kiq->eop_gpu_addr; + ring->no_scheduler = true; + snprintf(ring->name, sizeof(ring->name), "kiq_%hhu.%hhu.%hhu.%hhu", +- xcc_id, ring->me, ring->pipe, ring->queue); ++ (unsigned char)xcc_id, (unsigned char)ring->me, ++ (unsigned char)ring->pipe, (unsigned char)ring->queue); + r = amdgpu_ring_init(adev, ring, 1024, irq, AMDGPU_CP_KIQ_IRQ_DRIVER0, + AMDGPU_RING_PRIO_DEFAULT, NULL); + if (r) +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch b/queue-6.10/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch new file mode 100644 index 00000000000..a72c30cd307 --- /dev/null +++ b/queue-6.10/drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch @@ -0,0 +1,41 @@ +From 615ef042e151831332044bf348fd697fcc0fe07e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 11:57:25 -0600 +Subject: drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 + +From: Tim Van Patten + +[ Upstream commit 1446226d32a45bb7c4f63195a59be8c08defe658 ] + +The following commit updated gmc->noretry from 0 to 1 for GC HW IP +9.3.0: + + commit 5f3854f1f4e2 ("drm/amdgpu: add more cases to noretry=1") + +This causes the device to hang when a page fault occurs, until the +device is rebooted. Instead, revert back to gmc->noretry=0 so the device +is still responsive. + +Fixes: 5f3854f1f4e2 ("drm/amdgpu: add more cases to noretry=1") +Signed-off-by: Tim Van Patten +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +index 08b9dfb653355..86b096ad0319c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -878,7 +878,6 @@ void amdgpu_gmc_noretry_set(struct amdgpu_device *adev) + struct amdgpu_gmc *gmc = &adev->gmc; + uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0); + bool noretry_default = (gc_ver == IP_VERSION(9, 0, 1) || +- gc_ver == IP_VERSION(9, 3, 0) || + gc_ver == IP_VERSION(9, 4, 0) || + gc_ver == IP_VERSION(9, 4, 1) || + gc_ver == IP_VERSION(9, 4, 2) || +-- +2.43.0 + diff --git a/queue-6.10/drm-amdkfd-fix-cu-masking-for-gfx-9.4.3.patch b/queue-6.10/drm-amdkfd-fix-cu-masking-for-gfx-9.4.3.patch new file mode 100644 index 00000000000..a40b2037904 --- /dev/null +++ b/queue-6.10/drm-amdkfd-fix-cu-masking-for-gfx-9.4.3.patch @@ -0,0 +1,39 @@ +From d03616ea0b01cc6784142e41f88cbb01e5e0df8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:29:25 -0400 +Subject: drm/amdkfd: Fix CU Masking for GFX 9.4.3 + +From: Mukul Joshi + +[ Upstream commit 85cf43c554e438e2e12b0fe109688c9533e4d93f ] + +We are incorrectly passing the first XCC's MQD when +updating CU masks for other XCCs in the partition. Fix +this by passing the MQD for the XCC currently being +updated with CU mask to update_cu_mask function. + +Fixes: fc6efed2c728 ("drm/amdkfd: Update CU masking for GFX 9.4.3") +Signed-off-by: Mukul Joshi +Reviewed-by: Harish Kasiviswanathan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +index 6bddc16808d7a..8ec136eba54a9 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c +@@ -713,7 +713,7 @@ static void update_mqd_v9_4_3(struct mqd_manager *mm, void *mqd, + m = get_mqd(mqd + size * xcc); + update_mqd(mm, m, q, minfo); + +- update_cu_mask(mm, mqd, minfo, xcc); ++ update_cu_mask(mm, m, minfo, xcc); + + if (q->format == KFD_QUEUE_FORMAT_AQL) { + switch (xcc) { +-- +2.43.0 + diff --git a/queue-6.10/drm-arm-komeda-fix-komeda-probe-failing-if-there-are.patch b/queue-6.10/drm-arm-komeda-fix-komeda-probe-failing-if-there-are.patch new file mode 100644 index 00000000000..6f799ec02a3 --- /dev/null +++ b/queue-6.10/drm-arm-komeda-fix-komeda-probe-failing-if-there-are.patch @@ -0,0 +1,114 @@ +From 740c10c9c656891513cdebc820e0fa4b4c3a49c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 15:39:13 +0530 +Subject: drm/arm/komeda: Fix komeda probe failing if there are no links in the + secondary pipeline + +From: Faiz Abbas + +[ Upstream commit 9054c46d479b55768adae31031a1afa1b7d62228 ] + +Since commit 4cfe5cc02e3f ("drm/arm/komeda: Remove component framework and +add a simple encoder"), the devm_drm_of_get_bridge() call happens +regardless of whether any remote nodes are available on the pipeline. Fix +this by moving the bridge attach to its own function and calling it +conditional on there being an output link. + +Fixes: 4cfe5cc02e3f ("drm/arm/komeda: Remove component framework and add a simple encoder") +Signed-off-by: Faiz Abbas +[Corrected Commit-id of the fixed patch to match mainline] +Signed-off-by: Liviu Dudau +Acked-by: Liviu Dudau +Link: https://patchwork.freedesktop.org/patch/msgid/20240219100915.192475-2-faiz.abbas@arm.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/arm/display/komeda/komeda_crtc.c | 43 ++++++++++++++----- + 1 file changed, 32 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +index 2c661f28410ed..b645c5998230b 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_crtc.c +@@ -5,6 +5,7 @@ + * + */ + #include ++#include + #include + #include + +@@ -610,12 +611,34 @@ get_crtc_primary(struct komeda_kms_dev *kms, struct komeda_crtc *crtc) + return NULL; + } + ++static int komeda_attach_bridge(struct device *dev, ++ struct komeda_pipeline *pipe, ++ struct drm_encoder *encoder) ++{ ++ struct drm_bridge *bridge; ++ int err; ++ ++ bridge = devm_drm_of_get_bridge(dev, pipe->of_node, ++ KOMEDA_OF_PORT_OUTPUT, 0); ++ if (IS_ERR(bridge)) ++ return dev_err_probe(dev, PTR_ERR(bridge), "remote bridge not found for pipe: %s\n", ++ of_node_full_name(pipe->of_node)); ++ ++ err = drm_bridge_attach(encoder, bridge, NULL, 0); ++ if (err) ++ dev_err(dev, "bridge_attach() failed for pipe: %s\n", ++ of_node_full_name(pipe->of_node)); ++ ++ return err; ++} ++ + static int komeda_crtc_add(struct komeda_kms_dev *kms, + struct komeda_crtc *kcrtc) + { + struct drm_crtc *crtc = &kcrtc->base; + struct drm_device *base = &kms->base; +- struct drm_bridge *bridge; ++ struct komeda_pipeline *pipe = kcrtc->master; ++ struct drm_encoder *encoder = &kcrtc->encoder; + int err; + + err = drm_crtc_init_with_planes(base, crtc, +@@ -626,27 +649,25 @@ static int komeda_crtc_add(struct komeda_kms_dev *kms, + + drm_crtc_helper_add(crtc, &komeda_crtc_helper_funcs); + +- crtc->port = kcrtc->master->of_output_port; ++ crtc->port = pipe->of_output_port; + + /* Construct an encoder for each pipeline and attach it to the remote + * bridge + */ + kcrtc->encoder.possible_crtcs = drm_crtc_mask(crtc); +- err = drm_simple_encoder_init(base, &kcrtc->encoder, +- DRM_MODE_ENCODER_TMDS); ++ err = drm_simple_encoder_init(base, encoder, DRM_MODE_ENCODER_TMDS); + if (err) + return err; + +- bridge = devm_drm_of_get_bridge(base->dev, kcrtc->master->of_node, +- KOMEDA_OF_PORT_OUTPUT, 0); +- if (IS_ERR(bridge)) +- return PTR_ERR(bridge); +- +- err = drm_bridge_attach(&kcrtc->encoder, bridge, NULL, 0); ++ if (pipe->of_output_links[0]) { ++ err = komeda_attach_bridge(base->dev, pipe, encoder); ++ if (err) ++ return err; ++ } + + drm_crtc_enable_color_mgmt(crtc, 0, true, KOMEDA_COLOR_LUT_SIZE); + +- return err; ++ return 0; + } + + int komeda_kms_add_crtcs(struct komeda_kms_dev *kms, struct komeda_dev *mdev) +-- +2.43.0 + diff --git a/queue-6.10/drm-bridge-adv7511-fix-intermittent-edid-failures.patch b/queue-6.10/drm-bridge-adv7511-fix-intermittent-edid-failures.patch new file mode 100644 index 00000000000..62e7149bff5 --- /dev/null +++ b/queue-6.10/drm-bridge-adv7511-fix-intermittent-edid-failures.patch @@ -0,0 +1,166 @@ +From ad23f00beee26d5887cf29af2e5c9f5954bfd205 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jun 2024 17:19:31 -0500 +Subject: drm/bridge: adv7511: Fix Intermittent EDID failures + +From: Adam Ford + +[ Upstream commit 91f9f4a37124044089debb02a3965c59b5b10c21 ] + +In the process of adding support for shared IRQ pins, a scenario +was accidentally created where adv7511_irq_process returned +prematurely causing the EDID to fail randomly. + +Since the interrupt handler is broken up into two main helper functions, +update both of them to treat the helper functions as IRQ handlers. These +IRQ routines process their respective tasks as before, but if they +determine that actual work was done, mark the respective IRQ status +accordingly, and delay the check until everything has been processed. + +This should guarantee the helper functions don't return prematurely +while still returning proper values of either IRQ_HANDLED or IRQ_NONE. + +Reported-by: Liu Ying +Fixes: f3d9683346d6 ("drm/bridge: adv7511: Allow IRQ to share GPIO pins") +Signed-off-by: Adam Ford +Tested-by: Liu Ying # i.MX8MP EVK ADV7535 EDID retrieval w/o IRQ +Reviewed-by: Dmitry Baryshkov +Link: https://patchwork.freedesktop.org/patch/msgid/20240630221931.1650565-1-aford173@gmail.com +Signed-off-by: Dmitry Baryshkov + +V3: Remove unnecessary declaration of ret by evaluating the return + code of regmap_read directly. + +V2: Fix uninitialized cec_status + Cut back a little on error handling to return either IRQ_NONE or + IRQ_HANDLED. +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511.h | 2 +- + drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 13 ++++++++---- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 22 ++++++++++++-------- + 3 files changed, 23 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h +index ea271f62b214d..ec0b7f3d889c4 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h +@@ -401,7 +401,7 @@ struct adv7511 { + + #ifdef CONFIG_DRM_I2C_ADV7511_CEC + int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511); +-void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1); ++int adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1); + #else + static inline int adv7511_cec_init(struct device *dev, struct adv7511 *adv7511) + { +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +index 44451a9658a32..2e9c88a2b5ed4 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_cec.c +@@ -119,7 +119,7 @@ static void adv7511_cec_rx(struct adv7511 *adv7511, int rx_buf) + cec_received_msg(adv7511->cec_adap, &msg); + } + +-void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1) ++int adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1) + { + unsigned int offset = adv7511->info->reg_cec_offset; + const u32 irq_tx_mask = ADV7511_INT1_CEC_TX_READY | +@@ -131,16 +131,19 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1) + unsigned int rx_status; + int rx_order[3] = { -1, -1, -1 }; + int i; ++ int irq_status = IRQ_NONE; + +- if (irq1 & irq_tx_mask) ++ if (irq1 & irq_tx_mask) { + adv_cec_tx_raw_status(adv7511, irq1); ++ irq_status = IRQ_HANDLED; ++ } + + if (!(irq1 & irq_rx_mask)) +- return; ++ return irq_status; + + if (regmap_read(adv7511->regmap_cec, + ADV7511_REG_CEC_RX_STATUS + offset, &rx_status)) +- return; ++ return irq_status; + + /* + * ADV7511_REG_CEC_RX_STATUS[5:0] contains the reception order of RX +@@ -172,6 +175,8 @@ void adv7511_cec_irq_process(struct adv7511 *adv7511, unsigned int irq1) + + adv7511_cec_rx(adv7511, rx_buf); + } ++ ++ return IRQ_HANDLED; + } + + static int adv7511_cec_adap_enable(struct cec_adapter *adap, bool enable) +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 66ccb61e2a660..c8d2c4a157b24 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -469,6 +469,8 @@ static int adv7511_irq_process(struct adv7511 *adv7511, bool process_hpd) + { + unsigned int irq0, irq1; + int ret; ++ int cec_status = IRQ_NONE; ++ int irq_status = IRQ_NONE; + + ret = regmap_read(adv7511->regmap, ADV7511_REG_INT(0), &irq0); + if (ret < 0) +@@ -478,29 +480,31 @@ static int adv7511_irq_process(struct adv7511 *adv7511, bool process_hpd) + if (ret < 0) + return ret; + +- /* If there is no IRQ to handle, exit indicating no IRQ data */ +- if (!(irq0 & (ADV7511_INT0_HPD | ADV7511_INT0_EDID_READY)) && +- !(irq1 & ADV7511_INT1_DDC_ERROR)) +- return -ENODATA; +- + regmap_write(adv7511->regmap, ADV7511_REG_INT(0), irq0); + regmap_write(adv7511->regmap, ADV7511_REG_INT(1), irq1); + +- if (process_hpd && irq0 & ADV7511_INT0_HPD && adv7511->bridge.encoder) ++ if (process_hpd && irq0 & ADV7511_INT0_HPD && adv7511->bridge.encoder) { + schedule_work(&adv7511->hpd_work); ++ irq_status = IRQ_HANDLED; ++ } + + if (irq0 & ADV7511_INT0_EDID_READY || irq1 & ADV7511_INT1_DDC_ERROR) { + adv7511->edid_read = true; + + if (adv7511->i2c_main->irq) + wake_up_all(&adv7511->wq); ++ irq_status = IRQ_HANDLED; + } + + #ifdef CONFIG_DRM_I2C_ADV7511_CEC +- adv7511_cec_irq_process(adv7511, irq1); ++ cec_status = adv7511_cec_irq_process(adv7511, irq1); + #endif + +- return 0; ++ /* If there is no IRQ to handle, exit indicating no IRQ data */ ++ if (irq_status == IRQ_HANDLED || cec_status == IRQ_HANDLED) ++ return IRQ_HANDLED; ++ ++ return IRQ_NONE; + } + + static irqreturn_t adv7511_irq_handler(int irq, void *devid) +@@ -509,7 +513,7 @@ static irqreturn_t adv7511_irq_handler(int irq, void *devid) + int ret; + + ret = adv7511_irq_process(adv7511, true); +- return ret < 0 ? IRQ_NONE : IRQ_HANDLED; ++ return ret < 0 ? IRQ_NONE : ret; + } + + /* ----------------------------------------------------------------------------- +-- +2.43.0 + diff --git a/queue-6.10/drm-bridge-it6505-fix-hibernate-to-resume-no-display.patch b/queue-6.10/drm-bridge-it6505-fix-hibernate-to-resume-no-display.patch new file mode 100644 index 00000000000..e4ca040b112 --- /dev/null +++ b/queue-6.10/drm-bridge-it6505-fix-hibernate-to-resume-no-display.patch @@ -0,0 +1,162 @@ +From ee1068b3c5f39c9ac9fc7d842c82eb45f735a923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 14:55:28 +0800 +Subject: drm/bridge: it6505: fix hibernate to resume no display issue + +From: Kuro Chung + +[ Upstream commit 484436ec5c2bffe8f346a09ae1cbc4cbf5e50005 ] + +When the system power resumes, the TTL input of IT6505 may experience +some noise before the video signal stabilizes, necessitating a video +reset. This patch is implemented to prevent a loop of video error +interrupts, which can occur when a video reset in the video FIFO error +interrupt triggers another such interrupt. The patch processes the SCDT +and FIFO error interrupts simultaneously and ignores any video FIFO +error interrupts caused by a video reset. + +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Signed-off-by: Kuro Chung +Signed-off-by: Hermes Wu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240522065528.1053439-1-kuro.chung@ite.com.tw +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ite-it6505.c | 73 +++++++++++++++++++---------- + 1 file changed, 49 insertions(+), 24 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c +index 3f68c82888c2c..cf59347d3d605 100644 +--- a/drivers/gpu/drm/bridge/ite-it6505.c ++++ b/drivers/gpu/drm/bridge/ite-it6505.c +@@ -1307,9 +1307,15 @@ static void it6505_video_reset(struct it6505 *it6505) + it6505_link_reset_step_train(it6505); + it6505_set_bits(it6505, REG_DATA_MUTE_CTRL, EN_VID_MUTE, EN_VID_MUTE); + it6505_set_bits(it6505, REG_INFOFRAME_CTRL, EN_VID_CTRL_PKT, 0x00); +- it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, VIDEO_RESET); ++ ++ it6505_set_bits(it6505, REG_VID_BUS_CTRL1, TX_FIFO_RESET, TX_FIFO_RESET); ++ it6505_set_bits(it6505, REG_VID_BUS_CTRL1, TX_FIFO_RESET, 0x00); ++ + it6505_set_bits(it6505, REG_501_FIFO_CTRL, RST_501_FIFO, RST_501_FIFO); + it6505_set_bits(it6505, REG_501_FIFO_CTRL, RST_501_FIFO, 0x00); ++ ++ it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, VIDEO_RESET); ++ usleep_range(1000, 2000); + it6505_set_bits(it6505, REG_RESET_CTRL, VIDEO_RESET, 0x00); + } + +@@ -2245,12 +2251,11 @@ static void it6505_link_training_work(struct work_struct *work) + if (ret) { + it6505->auto_train_retry = AUTO_TRAIN_RETRY; + it6505_link_train_ok(it6505); +- return; + } else { + it6505->auto_train_retry--; ++ it6505_dump(it6505); + } + +- it6505_dump(it6505); + } + + static void it6505_plugged_status_to_codec(struct it6505 *it6505) +@@ -2471,31 +2476,53 @@ static void it6505_irq_link_train_fail(struct it6505 *it6505) + schedule_work(&it6505->link_works); + } + +-static void it6505_irq_video_fifo_error(struct it6505 *it6505) ++static bool it6505_test_bit(unsigned int bit, const unsigned int *addr) + { +- struct device *dev = it6505->dev; +- +- DRM_DEV_DEBUG_DRIVER(dev, "video fifo overflow interrupt"); +- it6505->auto_train_retry = AUTO_TRAIN_RETRY; +- flush_work(&it6505->link_works); +- it6505_stop_hdcp(it6505); +- it6505_video_reset(it6505); ++ return 1 & (addr[bit / BITS_PER_BYTE] >> (bit % BITS_PER_BYTE)); + } + +-static void it6505_irq_io_latch_fifo_overflow(struct it6505 *it6505) ++static void it6505_irq_video_handler(struct it6505 *it6505, const int *int_status) + { + struct device *dev = it6505->dev; ++ int reg_0d, reg_int03; + +- DRM_DEV_DEBUG_DRIVER(dev, "IO latch fifo overflow interrupt"); +- it6505->auto_train_retry = AUTO_TRAIN_RETRY; +- flush_work(&it6505->link_works); +- it6505_stop_hdcp(it6505); +- it6505_video_reset(it6505); +-} ++ /* ++ * When video SCDT change with video not stable, ++ * Or video FIFO error, need video reset ++ */ + +-static bool it6505_test_bit(unsigned int bit, const unsigned int *addr) +-{ +- return 1 & (addr[bit / BITS_PER_BYTE] >> (bit % BITS_PER_BYTE)); ++ if ((!it6505_get_video_status(it6505) && ++ (it6505_test_bit(INT_SCDT_CHANGE, (unsigned int *)int_status))) || ++ (it6505_test_bit(BIT_INT_IO_FIFO_OVERFLOW, ++ (unsigned int *)int_status)) || ++ (it6505_test_bit(BIT_INT_VID_FIFO_ERROR, ++ (unsigned int *)int_status))) { ++ it6505->auto_train_retry = AUTO_TRAIN_RETRY; ++ flush_work(&it6505->link_works); ++ it6505_stop_hdcp(it6505); ++ it6505_video_reset(it6505); ++ ++ usleep_range(10000, 11000); ++ ++ /* ++ * Clear FIFO error IRQ to prevent fifo error -> reset loop ++ * HW will trigger SCDT change IRQ again when video stable ++ */ ++ ++ reg_int03 = it6505_read(it6505, INT_STATUS_03); ++ reg_0d = it6505_read(it6505, REG_SYSTEM_STS); ++ ++ reg_int03 &= (BIT(INT_VID_FIFO_ERROR) | BIT(INT_IO_LATCH_FIFO_OVERFLOW)); ++ it6505_write(it6505, INT_STATUS_03, reg_int03); ++ ++ DRM_DEV_DEBUG_DRIVER(dev, "reg08 = 0x%02x", reg_int03); ++ DRM_DEV_DEBUG_DRIVER(dev, "reg0D = 0x%02x", reg_0d); ++ ++ return; ++ } ++ ++ if (it6505_test_bit(INT_SCDT_CHANGE, (unsigned int *)int_status)) ++ it6505_irq_scdt(it6505); + } + + static irqreturn_t it6505_int_threaded_handler(int unused, void *data) +@@ -2508,15 +2535,12 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) + } irq_vec[] = { + { BIT_INT_HPD, it6505_irq_hpd }, + { BIT_INT_HPD_IRQ, it6505_irq_hpd_irq }, +- { BIT_INT_SCDT, it6505_irq_scdt }, + { BIT_INT_HDCP_FAIL, it6505_irq_hdcp_fail }, + { BIT_INT_HDCP_DONE, it6505_irq_hdcp_done }, + { BIT_INT_AUX_CMD_FAIL, it6505_irq_aux_cmd_fail }, + { BIT_INT_HDCP_KSV_CHECK, it6505_irq_hdcp_ksv_check }, + { BIT_INT_AUDIO_FIFO_ERROR, it6505_irq_audio_fifo_error }, + { BIT_INT_LINK_TRAIN_FAIL, it6505_irq_link_train_fail }, +- { BIT_INT_VID_FIFO_ERROR, it6505_irq_video_fifo_error }, +- { BIT_INT_IO_FIFO_OVERFLOW, it6505_irq_io_latch_fifo_overflow }, + }; + int int_status[3], i; + +@@ -2546,6 +2570,7 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) + if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status)) + irq_vec[i].handler(it6505); + } ++ it6505_irq_video_handler(it6505, (unsigned int *)int_status); + } + + pm_runtime_put_sync(dev); +-- +2.43.0 + diff --git a/queue-6.10/drm-bridge-samsung-dsim-set-p-divider-based-on-min-m.patch b/queue-6.10/drm-bridge-samsung-dsim-set-p-divider-based-on-min-m.patch new file mode 100644 index 00000000000..de3446d4bc1 --- /dev/null +++ b/queue-6.10/drm-bridge-samsung-dsim-set-p-divider-based-on-min-m.patch @@ -0,0 +1,60 @@ +From 16a6f851359cff65b446aeb8c2859f9316039a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jun 2024 09:41:01 -0500 +Subject: drm/bridge: samsung-dsim: Set P divider based on min/max of fin pll + +From: Adam Ford + +[ Upstream commit 78c4c0011bb577a29906d8ca135795af2293c49e ] + +The P divider should be set based on the min and max values of +the fin pll which may vary between different platforms. +These ranges are defined per platform, but hard-coded values +were used instead which resulted in a smaller range available +on the i.MX8M[MNP] than what was possible. + +As noted by Frieder, there are descripencies between the reference +manuals of the Mini, Nano and Plus, so I reached out to my NXP +rep and got the following response regarding the varing notes +in the documentation. + +"Yes it is definitely wrong, the one that is part of the NOTE in +MIPI_DPHY_M_PLLPMS register table against PMS_P, PMS_M and PMS_S is +not correct. I will report this to Doc team, the one customer should +be take into account is the Table 13-40 DPHY PLL Parameters and the +Note above." + +With this patch, the clock rates now match the values used in NXP's +downstream kernel. + +Fixes: 846307185f0f ("drm/bridge: samsung-dsim: update PLL reference clock") +Signed-off-by: Adam Ford +Reviewed-by: Frieder Schrempf +Tested-by: Frieder Schrempf +Reviewed-by: Marek Vasut +Tested-by: Marek Szyprowski +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20240601144103.198299-1-aford173@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/samsung-dsim.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c +index 95fedc68b0ae5..8476650c477c2 100644 +--- a/drivers/gpu/drm/bridge/samsung-dsim.c ++++ b/drivers/gpu/drm/bridge/samsung-dsim.c +@@ -574,8 +574,8 @@ static unsigned long samsung_dsim_pll_find_pms(struct samsung_dsim *dsi, + u16 _m, best_m; + u8 _s, best_s; + +- p_min = DIV_ROUND_UP(fin, (12 * MHZ)); +- p_max = fin / (6 * MHZ); ++ p_min = DIV_ROUND_UP(fin, (driver_data->pll_fin_max * MHZ)); ++ p_max = fin / (driver_data->pll_fin_min * MHZ); + + for (_p = p_min; _p <= p_max; ++_p) { + for (_s = 0; _s <= 5; ++_s) { +-- +2.43.0 + diff --git a/queue-6.10/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch b/queue-6.10/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch new file mode 100644 index 00000000000..f67d0a9dd30 --- /dev/null +++ b/queue-6.10/drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch @@ -0,0 +1,42 @@ +From 86382e0ce313fc021a3401882be14c825f91f10f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 19:11:06 +0200 +Subject: drm/etnaviv: fix DMA direction handling for cached RW buffers + +From: Lucas Stach + +[ Upstream commit 58979ad6330a70450ed78837be3095107d022ea9 ] + +The dma sync operation needs to be done with DMA_BIDIRECTIONAL when +the BO is prepared for both read and write operations. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Reviewed-by: Christian Gmeiner +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 71a6d2b1c80f5..5c0c9d4e3be18 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -355,9 +355,11 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) + { +- if (op & ETNA_PREP_READ) ++ op &= ETNA_PREP_READ | ETNA_PREP_WRITE; ++ ++ if (op == ETNA_PREP_READ) + return DMA_FROM_DEVICE; +- else if (op & ETNA_PREP_WRITE) ++ else if (op == ETNA_PREP_WRITE) + return DMA_TO_DEVICE; + else + return DMA_BIDIRECTIONAL; +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-display-do-not-print-psr-enabled-for-on-pan.patch b/queue-6.10/drm-i915-display-do-not-print-psr-enabled-for-on-pan.patch new file mode 100644 index 00000000000..b9dd6d1b5fa --- /dev/null +++ b/queue-6.10/drm-i915-display-do-not-print-psr-enabled-for-on-pan.patch @@ -0,0 +1,42 @@ +From 43e824fb908b54c82057815e8249bac9b7b8815c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 12:38:13 +0300 +Subject: drm/i915/display: Do not print "psr: enabled" for on Panel Replay +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit d07a578703dbf839ea39bffc425fba2321f45543 ] + +After setting has_psr for panel replay as well crtc state dump is +improperly printing "psr: enabled" for Panel Replay as well. Fix this by +checking also has_panel_replay. + +Fixes: 5afa6e496098 ("drm/i915/psr: Set intel_crtc_state->has_psr on panel replay as well") +Signed-off-by: Jouni Högander +Reviewed-by: Animesh Manna +Link: https://patchwork.freedesktop.org/patch/msgid/20240510093823.3146455-3-jouni.hogander@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_crtc_state_dump.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +index 1da4c122c52ec..bddcc9edeab42 100644 +--- a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c ++++ b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +@@ -252,7 +252,8 @@ void intel_crtc_state_dump(const struct intel_crtc_state *pipe_config, + str_enabled_disabled(pipe_config->sdp_split_enable)); + + drm_printf(&p, "psr: %s, selective update: %s, panel replay: %s, selective fetch: %s\n", +- str_enabled_disabled(pipe_config->has_psr), ++ str_enabled_disabled(pipe_config->has_psr && ++ !pipe_config->has_panel_replay), + str_enabled_disabled(pipe_config->has_sel_update), + str_enabled_disabled(pipe_config->has_panel_replay), + str_enabled_disabled(pipe_config->enable_psr2_sel_fetch)); +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-display-skip-panel-replay-on-pipe-compariso.patch b/queue-6.10/drm-i915-display-skip-panel-replay-on-pipe-compariso.patch new file mode 100644 index 00000000000..e5b66b17d2d --- /dev/null +++ b/queue-6.10/drm-i915-display-skip-panel-replay-on-pipe-compariso.patch @@ -0,0 +1,43 @@ +From 52af276c25b9e7b90c8a563c931fee2931cd6a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:49:08 +0300 +Subject: drm/i915/display: Skip Panel Replay on pipe comparison if no active + planes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 955446ed6e822b86751993bd69022d347b43a99e ] + +Panel Replay is not enabled if there are no active planes. Do not compare +it on pipe comparison. Otherwise we get pipe mismatch. + +Fixes: ac9ef327327b ("drm/i915/psr: Panel replay has to be enabled before link training") +Signed-off-by: Jouni Högander +Reviewed-by: Animesh Manna +Link: https://patchwork.freedesktop.org/patch/msgid/20240607134917.1327574-5-jouni.hogander@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 0ae18b07ac87d..e53d3e900b3e4 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -5318,7 +5318,9 @@ intel_pipe_config_compare(const struct intel_crtc_state *current_config, + * Panel replay has to be enabled before link training. PSR doesn't have + * this requirement -> check these only if using panel replay + */ +- if (current_config->has_panel_replay || pipe_config->has_panel_replay) { ++ if (current_config->active_planes && ++ (current_config->has_panel_replay || ++ pipe_config->has_panel_replay)) { + PIPE_CONF_CHECK_BOOL(has_psr); + PIPE_CONF_CHECK_BOOL(has_sel_update); + PIPE_CONF_CHECK_BOOL(enable_psr2_sel_fetch); +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-psr-print-panel-replay-status-instead-of-fr.patch b/queue-6.10/drm-i915-psr-print-panel-replay-status-instead-of-fr.patch new file mode 100644 index 00000000000..423fdc9a8b7 --- /dev/null +++ b/queue-6.10/drm-i915-psr-print-panel-replay-status-instead-of-fr.patch @@ -0,0 +1,71 @@ +From 0145fa793cca3edfd235defd15bbb71b03eb2a72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:49:13 +0300 +Subject: drm/i915/psr: Print Panel Replay status instead of frame lock status +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 51ee1f29a9aceb8a52037ba4759d44c70e966fe5 ] + +Currently Panel Replay status printout is printing frame lock status. It +should print Panel Replay status instead. Panel Replay status register +field follows PSR status register field. Use existing PSR code for that. + +Fixes: ef75c25e8fed ("drm/i915/panelreplay: Debugfs support for panel replay") +Signed-off-by: Jouni Högander +Reviewed-by: Animesh Manna +Link: https://patchwork.freedesktop.org/patch/msgid/20240607134917.1327574-10-jouni.hogander@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 22 +++++----------------- + 1 file changed, 5 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index 58769197a1277..2b4512bd5b595 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -3694,16 +3694,9 @@ static int i915_psr_sink_status_show(struct seq_file *m, void *data) + "reserved", + "sink internal error", + }; +- static const char * const panel_replay_status[] = { +- "Sink device frame is locked to the Source device", +- "Sink device is coasting, using the VTotal target", +- "Sink device is governing the frame rate (frame rate unlock is granted)", +- "Sink device in the process of re-locking with the Source device", +- }; + const char *str; + int ret; + u8 status, error_status; +- u32 idx; + + if (!(CAN_PSR(intel_dp) || CAN_PANEL_REPLAY(intel_dp))) { + seq_puts(m, "PSR/Panel-Replay Unsupported\n"); +@@ -3717,16 +3710,11 @@ static int i915_psr_sink_status_show(struct seq_file *m, void *data) + if (ret) + return ret; + +- str = "unknown"; +- if (intel_dp->psr.panel_replay_enabled) { +- idx = (status & DP_SINK_FRAME_LOCKED_MASK) >> DP_SINK_FRAME_LOCKED_SHIFT; +- if (idx < ARRAY_SIZE(panel_replay_status)) +- str = panel_replay_status[idx]; +- } else if (intel_dp->psr.enabled) { +- idx = status & DP_PSR_SINK_STATE_MASK; +- if (idx < ARRAY_SIZE(sink_status)) +- str = sink_status[idx]; +- } ++ status &= DP_PSR_SINK_STATE_MASK; ++ if (status < ARRAY_SIZE(sink_status)) ++ str = sink_status[status]; ++ else ++ str = "unknown"; + + seq_printf(m, "Sink %s status: 0x%x [%s]\n", psr_mode_str(intel_dp), status, str); + +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-psr-rename-has_psr2-as-has_sel_update.patch b/queue-6.10/drm-i915-psr-rename-has_psr2-as-has_sel_update.patch new file mode 100644 index 00000000000..14d520b7422 --- /dev/null +++ b/queue-6.10/drm-i915-psr-rename-has_psr2-as-has_sel_update.patch @@ -0,0 +1,152 @@ +From 0b1b5015050cb97686425ee74b349035fb5b1ec5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 12:38:12 +0300 +Subject: drm/i915/psr: Rename has_psr2 as has_sel_update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 1e52db8a439b147f314681129f9ee33f16900767 ] + +We are going to reuse has_psr2 for panel_replay as well. Rename it +as has_sel_update to avoid confusion. + +v3: do not add has_psr check into psr2 case in intel_dp_compute_vsc_sdp +v2: Rebase + +Signed-off-by: Jouni Högander +Reviewed-by: Animesh Manna +Link: https://patchwork.freedesktop.org/patch/msgid/20240510093823.3146455-2-jouni.hogander@intel.com +Stable-dep-of: d07a578703db ("drm/i915/display: Do not print "psr: enabled" for on Panel Replay") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_crtc_state_dump.c | 4 ++-- + drivers/gpu/drm/i915/display/intel_display.c | 2 +- + drivers/gpu/drm/i915/display/intel_display_types.h | 2 +- + drivers/gpu/drm/i915/display/intel_dp.c | 2 +- + drivers/gpu/drm/i915/display/intel_fbc.c | 2 +- + drivers/gpu/drm/i915/display/intel_psr.c | 10 +++++----- + 6 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +index ccaa4cb2809b0..1da4c122c52ec 100644 +--- a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c ++++ b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c +@@ -251,9 +251,9 @@ void intel_crtc_state_dump(const struct intel_crtc_state *pipe_config, + drm_printf(&p, "sdp split: %s\n", + str_enabled_disabled(pipe_config->sdp_split_enable)); + +- drm_printf(&p, "psr: %s, psr2: %s, panel replay: %s, selective fetch: %s\n", ++ drm_printf(&p, "psr: %s, selective update: %s, panel replay: %s, selective fetch: %s\n", + str_enabled_disabled(pipe_config->has_psr), +- str_enabled_disabled(pipe_config->has_psr2), ++ str_enabled_disabled(pipe_config->has_sel_update), + str_enabled_disabled(pipe_config->has_panel_replay), + str_enabled_disabled(pipe_config->enable_psr2_sel_fetch)); + } +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 273323f30ae29..0ae18b07ac87d 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -5320,7 +5320,7 @@ intel_pipe_config_compare(const struct intel_crtc_state *current_config, + */ + if (current_config->has_panel_replay || pipe_config->has_panel_replay) { + PIPE_CONF_CHECK_BOOL(has_psr); +- PIPE_CONF_CHECK_BOOL(has_psr2); ++ PIPE_CONF_CHECK_BOOL(has_sel_update); + PIPE_CONF_CHECK_BOOL(enable_psr2_sel_fetch); + PIPE_CONF_CHECK_BOOL(enable_psr2_su_region_et); + PIPE_CONF_CHECK_BOOL(has_panel_replay); +diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h +index 62f7a30c37dcf..6747c10da298e 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_types.h ++++ b/drivers/gpu/drm/i915/display/intel_display_types.h +@@ -1189,7 +1189,7 @@ struct intel_crtc_state { + + /* PSR is supported but might not be enabled due the lack of enabled planes */ + bool has_psr; +- bool has_psr2; ++ bool has_sel_update; + bool enable_psr2_sel_fetch; + bool enable_psr2_su_region_et; + bool req_psr2_sdp_prior_scanline; +diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c +index 5b3b6ae1e3d71..6ae6ba92dd9e1 100644 +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -2664,7 +2664,7 @@ static void intel_dp_compute_vsc_sdp(struct intel_dp *intel_dp, + if (intel_dp_needs_vsc_sdp(crtc_state, conn_state)) { + intel_dp_compute_vsc_colorimetry(crtc_state, conn_state, + vsc); +- } else if (crtc_state->has_psr2) { ++ } else if (crtc_state->has_sel_update) { + /* + * [PSR2 without colorimetry] + * Prepare VSC Header for SU as per eDP 1.4 spec, Table 6-11 +diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c +index 151dcd0c45b60..984f13d8c0c88 100644 +--- a/drivers/gpu/drm/i915/display/intel_fbc.c ++++ b/drivers/gpu/drm/i915/display/intel_fbc.c +@@ -1251,7 +1251,7 @@ static int intel_fbc_check_plane(struct intel_atomic_state *state, + * Recommendation is to keep this combination disabled + * Bspec: 50422 HSD: 14010260002 + */ +- if (IS_DISPLAY_VER(i915, 12, 14) && crtc_state->has_psr2) { ++ if (IS_DISPLAY_VER(i915, 12, 14) && crtc_state->has_sel_update) { + plane_state->no_fbc_reason = "PSR2 enabled"; + return 0; + } +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index f5b33335a9ae0..a2f7d998d3420 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -651,7 +651,7 @@ void intel_psr_enable_sink(struct intel_dp *intel_dp, + struct drm_i915_private *dev_priv = dp_to_i915(intel_dp); + u8 dpcd_val = DP_PSR_ENABLE; + +- if (crtc_state->has_psr2) { ++ if (crtc_state->has_sel_update) { + /* Enable ALPM at sink for psr2 */ + if (!crtc_state->has_panel_replay) { + drm_dp_dpcd_writeb(&intel_dp->aux, +@@ -1639,7 +1639,7 @@ void intel_psr_compute_config(struct intel_dp *intel_dp, + if (!crtc_state->has_psr) + return; + +- crtc_state->has_psr2 = intel_psr2_config_valid(intel_dp, crtc_state); ++ crtc_state->has_sel_update = intel_psr2_config_valid(intel_dp, crtc_state); + } + + void intel_psr_get_config(struct intel_encoder *encoder, +@@ -1672,7 +1672,7 @@ void intel_psr_get_config(struct intel_encoder *encoder, + pipe_config->has_psr = true; + } + +- pipe_config->has_psr2 = intel_dp->psr.psr2_enabled; ++ pipe_config->has_sel_update = intel_dp->psr.psr2_enabled; + pipe_config->infoframes.enable |= intel_hdmi_infoframe_enable(DP_SDP_VSC); + + if (!intel_dp->psr.psr2_enabled) +@@ -1960,7 +1960,7 @@ static void intel_psr_enable_locked(struct intel_dp *intel_dp, + + drm_WARN_ON(&dev_priv->drm, intel_dp->psr.enabled); + +- intel_dp->psr.psr2_enabled = crtc_state->has_psr2; ++ intel_dp->psr.psr2_enabled = crtc_state->has_sel_update; + intel_dp->psr.panel_replay_enabled = crtc_state->has_panel_replay; + intel_dp->psr.busy_frontbuffer_bits = 0; + intel_dp->psr.pipe = to_intel_crtc(crtc_state->uapi.crtc)->pipe; +@@ -2688,7 +2688,7 @@ void intel_psr_pre_plane_update(struct intel_atomic_state *state, + needs_to_disable |= intel_crtc_needs_modeset(new_crtc_state); + needs_to_disable |= !new_crtc_state->has_psr; + needs_to_disable |= !new_crtc_state->active_planes; +- needs_to_disable |= new_crtc_state->has_psr2 != psr->psr2_enabled; ++ needs_to_disable |= new_crtc_state->has_sel_update != psr->psr2_enabled; + needs_to_disable |= DISPLAY_VER(i915) < 11 && + new_crtc_state->wm_level_disabled; + +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-psr-set-su-area-width-as-pipe-src-width.patch b/queue-6.10/drm-i915-psr-set-su-area-width-as-pipe-src-width.patch new file mode 100644 index 00000000000..9203a3a0d3d --- /dev/null +++ b/queue-6.10/drm-i915-psr-set-su-area-width-as-pipe-src-width.patch @@ -0,0 +1,41 @@ +From 77b4fe8b065c6ceddf848d16aa578a773ad361e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 08:30:18 +0300 +Subject: drm/i915/psr: Set SU area width as pipe src width +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 97db7348640ececd60a0bfd85b6c0a3a0f81459a ] + +Currently SU area width is set as MAX_INT. This is causing +problems. Instead set it as pipe src width. + +Fixes: 86b26b6aeac7 ("drm/i915/psr: Carry su area in crtc_state") + +Signed-off-by: Jouni Högander +Reviewed-by: Mika Kahola +Link: https://patchwork.freedesktop.org/patch/msgid/20240618053026.3268759-2-jouni.hogander@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index 2b4512bd5b595..3c7da862222bf 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -2484,7 +2484,7 @@ int intel_psr2_sel_fetch_update(struct intel_atomic_state *state, + + crtc_state->psr2_su_area.x1 = 0; + crtc_state->psr2_su_area.y1 = -1; +- crtc_state->psr2_su_area.x2 = INT_MAX; ++ crtc_state->psr2_su_area.x2 = drm_rect_width(&crtc_state->pipe_src); + crtc_state->psr2_su_area.y2 = -1; + + /* +-- +2.43.0 + diff --git a/queue-6.10/drm-i915-psr-use-enable-boolean-from-intel_crtc_stat.patch b/queue-6.10/drm-i915-psr-use-enable-boolean-from-intel_crtc_stat.patch new file mode 100644 index 00000000000..52bdd2ff0b9 --- /dev/null +++ b/queue-6.10/drm-i915-psr-use-enable-boolean-from-intel_crtc_stat.patch @@ -0,0 +1,42 @@ +From 266180379b7140fbf73c834e565ba8f8b6a11b4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 12:38:46 +0300 +Subject: drm/i915/psr: Use enable boolean from intel_crtc_state for Early + Transport +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 0a8c581ce01c84214b8221fcc5d52b45c09d0007 ] + +When enabling Early Transport use +intel_crtc_state->enable_psr2_su_region_et instead of +psr2_su_region_et_valid. + +Reviewed-by: Animesh Manna +Fixes: 467e4e061c44 ("drm/i915/psr: Enable psr2 early transport as possible") +Signed-off-by: Jouni Högander +Link: https://patchwork.freedesktop.org/patch/msgid/20240529093849.1016172-4-jouni.hogander@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index a2f7d998d3420..58769197a1277 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -659,7 +659,7 @@ void intel_psr_enable_sink(struct intel_dp *intel_dp, + DP_ALPM_ENABLE | + DP_ALPM_LOCK_ERROR_IRQ_HPD_ENABLE); + +- if (psr2_su_region_et_valid(intel_dp)) ++ if (crtc_state->enable_psr2_su_region_et) + dpcd_val |= DP_PSR_ENABLE_SU_REGION_ET; + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-add-drm_mode_rotate_0-to-rotation-prope.patch b/queue-6.10/drm-mediatek-add-drm_mode_rotate_0-to-rotation-prope.patch new file mode 100644 index 00000000000..65831263f12 --- /dev/null +++ b/queue-6.10/drm-mediatek-add-drm_mode_rotate_0-to-rotation-prope.patch @@ -0,0 +1,95 @@ +From 3e4673184bd648b7f80ea70398b4df33367b7d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:48 +0800 +Subject: drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property + +From: Hsiao Chien Sung + +[ Upstream commit 74608d8feefd1675388f23362aac8df4ac3af931 ] + +Always add DRM_MODE_ROTATE_0 to rotation property to meet +IGT's (Intel GPU Tools) requirement. + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-8-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_ddp_comp.h | 6 +++++- + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 17 +++++------------ + drivers/gpu/drm/mediatek/mtk_plane.c | 2 +- + 3 files changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h +index 26236691ce4c2..f7fe2e08dc8e2 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h ++++ b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h +@@ -192,7 +192,11 @@ unsigned int mtk_ddp_comp_supported_rotations(struct mtk_ddp_comp *comp) + if (comp->funcs && comp->funcs->supported_rotations) + return comp->funcs->supported_rotations(comp->dev); + +- return 0; ++ /* ++ * In order to pass IGT tests, DRM_MODE_ROTATE_0 is required when ++ * rotation is not supported. ++ */ ++ return DRM_MODE_ROTATE_0; + } + + static inline unsigned int mtk_ddp_comp_layer_nr(struct mtk_ddp_comp *comp) +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index 693560fa34e8b..26b598b9f71f2 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -305,27 +305,20 @@ int mtk_ovl_layer_check(struct device *dev, unsigned int idx, + struct mtk_plane_state *mtk_state) + { + struct drm_plane_state *state = &mtk_state->base; +- unsigned int rotation = 0; + +- rotation = drm_rotation_simplify(state->rotation, +- DRM_MODE_ROTATE_0 | +- DRM_MODE_REFLECT_X | +- DRM_MODE_REFLECT_Y); +- rotation &= ~DRM_MODE_ROTATE_0; +- +- /* We can only do reflection, not rotation */ +- if ((rotation & DRM_MODE_ROTATE_MASK) != 0) ++ /* check if any unsupported rotation is set */ ++ if (state->rotation & ~mtk_ovl_supported_rotations(dev)) + return -EINVAL; + + /* + * TODO: Rotating/reflecting YUV buffers is not supported at this time. + * Only RGB[AX] variants are supported. ++ * Since DRM_MODE_ROTATE_0 means "no rotation", we should not ++ * reject layers with this property. + */ +- if (state->fb->format->is_yuv && rotation != 0) ++ if (state->fb->format->is_yuv && (state->rotation & ~DRM_MODE_ROTATE_0)) + return -EINVAL; + +- state->rotation = rotation; +- + return 0; + } + +diff --git a/drivers/gpu/drm/mediatek/mtk_plane.c b/drivers/gpu/drm/mediatek/mtk_plane.c +index a74b26d359857..1723d4333f371 100644 +--- a/drivers/gpu/drm/mediatek/mtk_plane.c ++++ b/drivers/gpu/drm/mediatek/mtk_plane.c +@@ -338,7 +338,7 @@ int mtk_plane_init(struct drm_device *dev, struct drm_plane *plane, + return err; + } + +- if (supported_rotations & ~DRM_MODE_ROTATE_0) { ++ if (supported_rotations) { + err = drm_plane_create_rotation_property(plane, + DRM_MODE_ROTATE_0, + supported_rotations); +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-add-missing-plane-settings-when-async-u.patch b/queue-6.10/drm-mediatek-add-missing-plane-settings-when-async-u.patch new file mode 100644 index 00000000000..cde2bda9fa1 --- /dev/null +++ b/queue-6.10/drm-mediatek-add-missing-plane-settings-when-async-u.patch @@ -0,0 +1,41 @@ +From e52308fe838c1f2d27195368bf9e954ac3c0547d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:41 +0800 +Subject: drm/mediatek: Add missing plane settings when async update + +From: Hsiao Chien Sung + +[ Upstream commit 86b89dc669c400576dc23aa923bcf302f99e8e3a ] + +Fix an issue that plane coordinate was not saved when +calling async update. + +Fixes: 920fffcc8912 ("drm/mediatek: update cursors by using async atomic update") + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-1-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_plane.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_plane.c b/drivers/gpu/drm/mediatek/mtk_plane.c +index 4625deb21d406..a74b26d359857 100644 +--- a/drivers/gpu/drm/mediatek/mtk_plane.c ++++ b/drivers/gpu/drm/mediatek/mtk_plane.c +@@ -227,6 +227,8 @@ static void mtk_plane_atomic_async_update(struct drm_plane *plane, + plane->state->src_y = new_state->src_y; + plane->state->src_h = new_state->src_h; + plane->state->src_w = new_state->src_w; ++ plane->state->dst.x1 = new_state->dst.x1; ++ plane->state->dst.y1 = new_state->dst.y1; + + mtk_plane_update_new_state(new_state, new_plane_state); + swap(plane->state->fb, new_state->fb); +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch b/queue-6.10/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch new file mode 100644 index 00000000000..0281258d0e5 --- /dev/null +++ b/queue-6.10/drm-mediatek-add-ovl-compatible-name-for-mt8195.patch @@ -0,0 +1,39 @@ +From 362a47cd3c4c5d46ef20160252c3b2187cb98ddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:47 +0800 +Subject: drm/mediatek: Add OVL compatible name for MT8195 + +From: Hsiao Chien Sung + +[ Upstream commit 6fb7a0985fd16868b5d72eb3e3de7524a6000e6e ] + +Add OVL compatible name for MT8195. +Without this commit, DRM won't work after modifying the device tree. + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-7-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index de811e2265da7..8c403bf566856 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -743,6 +743,8 @@ static const struct of_device_id mtk_ddp_comp_dt_ids[] = { + .data = (void *)MTK_DISP_OVL }, + { .compatible = "mediatek,mt8192-disp-ovl", + .data = (void *)MTK_DISP_OVL }, ++ { .compatible = "mediatek,mt8195-disp-ovl", ++ .data = (void *)MTK_DISP_OVL }, + { .compatible = "mediatek,mt8183-disp-ovl-2l", + .data = (void *)MTK_DISP_OVL_2L }, + { .compatible = "mediatek,mt8192-disp-ovl-2l", +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-dp-fix-spurious-kfree.patch b/queue-6.10/drm-mediatek-dp-fix-spurious-kfree.patch new file mode 100644 index 00000000000..6540bef1ebc --- /dev/null +++ b/queue-6.10/drm-mediatek-dp-fix-spurious-kfree.patch @@ -0,0 +1,49 @@ +From 0b6d84518a0a92cd296476ea9d77c150cf1915a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 10:33:37 +0200 +Subject: drm/mediatek/dp: Fix spurious kfree() + +From: Michael Walle + +[ Upstream commit 8ad49a92cff4bab13eb2f2725243f5f31eff3f3b ] + +drm_edid_to_sad() might return an error or just zero. If that is the +case, we must not free the SADs because there was no allocation in +the first place. + +Fixes: dab12fa8d2bd ("drm/mediatek/dp: fix memory leak on ->get_edid callback audio detection") +Signed-off-by: Michael Walle +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Jani Nikula +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20240604083337.1879188-1-mwalle@kernel.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dp.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c +index 536366956447a..ada12927bbacf 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dp.c ++++ b/drivers/gpu/drm/mediatek/mtk_dp.c +@@ -2073,9 +2073,15 @@ static const struct drm_edid *mtk_dp_edid_read(struct drm_bridge *bridge, + */ + const struct edid *edid = drm_edid_raw(drm_edid); + struct cea_sad *sads; ++ int ret; + +- audio_caps->sad_count = drm_edid_to_sad(edid, &sads); +- kfree(sads); ++ ret = drm_edid_to_sad(edid, &sads); ++ /* Ignore any errors */ ++ if (ret < 0) ++ ret = 0; ++ if (ret) ++ kfree(sads); ++ audio_caps->sad_count = ret; + + /* + * FIXME: This should use connector->display_info.has_audio from +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-dpi-dsi-fix-possible_crtcs-calculation.patch b/queue-6.10/drm-mediatek-dpi-dsi-fix-possible_crtcs-calculation.patch new file mode 100644 index 00000000000..bef0c8f3030 --- /dev/null +++ b/queue-6.10/drm-mediatek-dpi-dsi-fix-possible_crtcs-calculation.patch @@ -0,0 +1,222 @@ +From 0f5cd76074ac9fb6724e90da49bc2e0728836a35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 11:21:22 +0200 +Subject: drm/mediatek: dpi/dsi: Fix possible_crtcs calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Walle + +[ Upstream commit 9ff6df49e6cbcc9834865870d7c4f3059b0891d3 ] + +mtk_find_possible_crtcs() assumes that the main path will always have +the CRTC with id 0, the ext id 1 and the third id 2. This is only true +if the paths are all available. But paths are optional (see also +comment in mtk_drm_kms_init()), e.g. the main path might not be enabled +or available at all. Then the CRTC IDs will shift one up, e.g. ext will +be 0 and the third path will be 1. + +To fix that, dynamically calculate the IDs by the presence of the paths. + +While at it, make the return code a signed one and return -ENODEV if no +path is found and handle the error in the callers. + +Fixes: 5aa8e7647676 ("drm/mediatek: dpi/dsi: Change the getting possible_crtc way") +Suggested-by: Nícolas F. R. A. Prado +Signed-off-by: Michael Walle +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240606092122.2026313-1-mwalle@kernel.org/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_ddp_comp.c | 107 ++++++++++++++++-------- + drivers/gpu/drm/mediatek/mtk_ddp_comp.h | 2 +- + drivers/gpu/drm/mediatek/mtk_dpi.c | 5 +- + drivers/gpu/drm/mediatek/mtk_dsi.c | 5 +- + 4 files changed, 80 insertions(+), 39 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_ddp_comp.c +index a66e46d0b45eb..be66d94be3613 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_ddp_comp.c +@@ -514,29 +514,42 @@ static bool mtk_ddp_comp_find(struct device *dev, + return false; + } + +-static unsigned int mtk_ddp_comp_find_in_route(struct device *dev, +- const struct mtk_drm_route *routes, +- unsigned int num_routes, +- struct mtk_ddp_comp *ddp_comp) ++static int mtk_ddp_comp_find_in_route(struct device *dev, ++ const struct mtk_drm_route *routes, ++ unsigned int num_routes, ++ struct mtk_ddp_comp *ddp_comp) + { +- int ret; + unsigned int i; + +- if (!routes) { +- ret = -EINVAL; +- goto err; +- } ++ if (!routes) ++ return -EINVAL; + + for (i = 0; i < num_routes; i++) + if (dev == ddp_comp[routes[i].route_ddp].dev) + return BIT(routes[i].crtc_id); + +- ret = -ENODEV; +-err: ++ return -ENODEV; ++} + +- DRM_INFO("Failed to find comp in ddp table, ret = %d\n", ret); ++static bool mtk_ddp_path_available(const unsigned int *path, ++ unsigned int path_len, ++ struct device_node **comp_node) ++{ ++ unsigned int i; + +- return 0; ++ if (!path || !path_len) ++ return false; ++ ++ for (i = 0U; i < path_len; i++) { ++ /* OVL_ADAPTOR doesn't have a device node */ ++ if (path[i] == DDP_COMPONENT_DRM_OVL_ADAPTOR) ++ continue; ++ ++ if (!comp_node[path[i]]) ++ return false; ++ } ++ ++ return true; + } + + int mtk_ddp_comp_get_id(struct device_node *node, +@@ -554,31 +567,53 @@ int mtk_ddp_comp_get_id(struct device_node *node, + return -EINVAL; + } + +-unsigned int mtk_find_possible_crtcs(struct drm_device *drm, struct device *dev) ++int mtk_find_possible_crtcs(struct drm_device *drm, struct device *dev) + { + struct mtk_drm_private *private = drm->dev_private; +- unsigned int ret = 0; +- +- if (mtk_ddp_comp_find(dev, +- private->data->main_path, +- private->data->main_len, +- private->ddp_comp)) +- ret = BIT(0); +- else if (mtk_ddp_comp_find(dev, +- private->data->ext_path, +- private->data->ext_len, +- private->ddp_comp)) +- ret = BIT(1); +- else if (mtk_ddp_comp_find(dev, +- private->data->third_path, +- private->data->third_len, +- private->ddp_comp)) +- ret = BIT(2); +- else +- ret = mtk_ddp_comp_find_in_route(dev, +- private->data->conn_routes, +- private->data->num_conn_routes, +- private->ddp_comp); ++ const struct mtk_mmsys_driver_data *data; ++ struct mtk_drm_private *priv_n; ++ int i = 0, j; ++ int ret; ++ ++ for (j = 0; j < private->data->mmsys_dev_num; j++) { ++ priv_n = private->all_drm_private[j]; ++ data = priv_n->data; ++ ++ if (mtk_ddp_path_available(data->main_path, data->main_len, ++ priv_n->comp_node)) { ++ if (mtk_ddp_comp_find(dev, data->main_path, ++ data->main_len, ++ priv_n->ddp_comp)) ++ return BIT(i); ++ i++; ++ } ++ ++ if (mtk_ddp_path_available(data->ext_path, data->ext_len, ++ priv_n->comp_node)) { ++ if (mtk_ddp_comp_find(dev, data->ext_path, ++ data->ext_len, ++ priv_n->ddp_comp)) ++ return BIT(i); ++ i++; ++ } ++ ++ if (mtk_ddp_path_available(data->third_path, data->third_len, ++ priv_n->comp_node)) { ++ if (mtk_ddp_comp_find(dev, data->third_path, ++ data->third_len, ++ priv_n->ddp_comp)) ++ return BIT(i); ++ i++; ++ } ++ } ++ ++ ret = mtk_ddp_comp_find_in_route(dev, ++ private->data->conn_routes, ++ private->data->num_conn_routes, ++ private->ddp_comp); ++ ++ if (ret < 0) ++ DRM_INFO("Failed to find comp in ddp table, ret = %d\n", ret); + + return ret; + } +diff --git a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h +index f7fe2e08dc8e2..ecf6dc283cd7c 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h ++++ b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h +@@ -330,7 +330,7 @@ static inline void mtk_ddp_comp_encoder_index_set(struct mtk_ddp_comp *comp) + + int mtk_ddp_comp_get_id(struct device_node *node, + enum mtk_ddp_comp_type comp_type); +-unsigned int mtk_find_possible_crtcs(struct drm_device *drm, struct device *dev); ++int mtk_find_possible_crtcs(struct drm_device *drm, struct device *dev); + int mtk_ddp_comp_init(struct device_node *comp_node, struct mtk_ddp_comp *comp, + unsigned int comp_id); + enum mtk_ddp_comp_type mtk_ddp_comp_get_type(unsigned int comp_id); +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index bfe8653005dbf..a08d206549543 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -805,7 +805,10 @@ static int mtk_dpi_bind(struct device *dev, struct device *master, void *data) + return ret; + } + +- dpi->encoder.possible_crtcs = mtk_find_possible_crtcs(drm_dev, dpi->dev); ++ ret = mtk_find_possible_crtcs(drm_dev, dpi->dev); ++ if (ret < 0) ++ goto err_cleanup; ++ dpi->encoder.possible_crtcs = ret; + + ret = drm_bridge_attach(&dpi->encoder, &dpi->bridge, NULL, + DRM_BRIDGE_ATTACH_NO_CONNECTOR); +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index c255559cc56ed..b6e3c011a12d8 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -837,7 +837,10 @@ static int mtk_dsi_encoder_init(struct drm_device *drm, struct mtk_dsi *dsi) + return ret; + } + +- dsi->encoder.possible_crtcs = mtk_find_possible_crtcs(drm, dsi->host.dev); ++ ret = mtk_find_possible_crtcs(drm, dsi->host.dev); ++ if (ret < 0) ++ goto err_cleanup_encoder; ++ dsi->encoder.possible_crtcs = ret; + + ret = drm_bridge_attach(&dsi->encoder, &dsi->bridge, NULL, + DRM_BRIDGE_ATTACH_NO_CONNECTOR); +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-fix-destination-alpha-error-in-ovl.patch b/queue-6.10/drm-mediatek-fix-destination-alpha-error-in-ovl.patch new file mode 100644 index 00000000000..7c18db62cfc --- /dev/null +++ b/queue-6.10/drm-mediatek-fix-destination-alpha-error-in-ovl.patch @@ -0,0 +1,70 @@ +From e13abf8116f979f3e57e56a2e0c37041959db5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:45 +0800 +Subject: drm/mediatek: Fix destination alpha error in OVL + +From: Hsiao Chien Sung + +[ Upstream commit 31c0fbf67c8c0bb38d7fb21d404ea3dbd619d99e ] + +The formula of Coverage alpha blending is: +dst.a = dst.a * (0xff - src.a * SCA / 0xff) / 0xff + + src.a * SCA / 0xff + +dst.a: destination alpha +src.a: pixel alpha +SCA : plane alpha + +When SCA = 0xff, the formula becomes: +dst.a = dst.a * (0xff - src.a) + src.a + +This patch is to set the destination alpha (background) to 0xff: +- When dst.a = 0 (before), dst.a = src.a +- When dst.a = 0xff (after) , dst.a = 0xff * (0xff - src.a) + src.a + +According to the fomula above: +- When src.a = 0 , dst.a = 0 +- When src.a = 0xff, dst.a = 0xff +This two cases are just still correct. But when src.a is +between 0 and 0xff, the difference starts to appear + +Fixes: 616443ca577e ("drm/mediatek: Move cmdq_reg info from struct mtk_ddp_comp to sub driver private data") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-5-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index bd00e5e85deba..693560fa34e8b 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -72,6 +72,8 @@ + #define OVL_CON_VIRT_FLIP BIT(9) + #define OVL_CON_HORZ_FLIP BIT(10) + ++#define OVL_COLOR_ALPHA GENMASK(31, 24) ++ + static const u32 mt8173_formats[] = { + DRM_FORMAT_XRGB8888, + DRM_FORMAT_ARGB8888, +@@ -274,7 +276,13 @@ void mtk_ovl_config(struct device *dev, unsigned int w, + if (w != 0 && h != 0) + mtk_ddp_write_relaxed(cmdq_pkt, h << 16 | w, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_ROI_SIZE); +- mtk_ddp_write_relaxed(cmdq_pkt, 0x0, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_ROI_BGCLR); ++ ++ /* ++ * The background color must be opaque black (ARGB), ++ * otherwise the alpha blending will have no effect ++ */ ++ mtk_ddp_write_relaxed(cmdq_pkt, OVL_COLOR_ALPHA, &ovl->cmdq_reg, ++ ovl->regs, DISP_REG_OVL_ROI_BGCLR); + + mtk_ddp_write(cmdq_pkt, 0x1, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_RST); + mtk_ddp_write(cmdq_pkt, 0x0, &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_RST); +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-mixer.patch b/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-mixer.patch new file mode 100644 index 00000000000..6f13ebc7574 --- /dev/null +++ b/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-mixer.patch @@ -0,0 +1,56 @@ +From 0d7acbbc6867e68b97f638e2ce855de4d6729d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:44 +0800 +Subject: drm/mediatek: Fix XRGB setting error in Mixer + +From: Hsiao Chien Sung + +[ Upstream commit 8e418bee401b7cfd0bc40d187afea2c6b08b44ec ] + +Although the alpha channel in XRGB formats can be ignored, ALPHA_CON +must be configured accordingly when using XRGB formats or it will still +affects CRC generation. + +Fixes: d886c0009bd0 ("drm/mediatek: Add ETHDR support for MT8195") +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-4-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_ethdr.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_ethdr.c b/drivers/gpu/drm/mediatek/mtk_ethdr.c +index d7d16482c9473..5c52e514ae301 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ethdr.c ++++ b/drivers/gpu/drm/mediatek/mtk_ethdr.c +@@ -153,6 +153,7 @@ void mtk_ethdr_layer_config(struct device *dev, unsigned int idx, + unsigned int offset = (pending->x & 1) << 31 | pending->y << 16 | pending->x; + unsigned int align_width = ALIGN_DOWN(pending->width, 2); + unsigned int alpha_con = 0; ++ bool replace_src_a = false; + + dev_dbg(dev, "%s+ idx:%d", __func__, idx); + +@@ -167,7 +168,15 @@ void mtk_ethdr_layer_config(struct device *dev, unsigned int idx, + if (state->base.fb && state->base.fb->format->has_alpha) + alpha_con = MIXER_ALPHA_AEN | MIXER_ALPHA; + +- mtk_mmsys_mixer_in_config(priv->mmsys_dev, idx + 1, alpha_con ? false : true, ++ if (state->base.fb && !state->base.fb->format->has_alpha) { ++ /* ++ * Mixer doesn't support CONST_BLD mode, ++ * use a trick to make the output equivalent ++ */ ++ replace_src_a = true; ++ } ++ ++ mtk_mmsys_mixer_in_config(priv->mmsys_dev, idx + 1, replace_src_a, + MIXER_ALPHA, + pending->x & 1 ? MIXER_INX_MODE_EVEN_EXTEND : + MIXER_INX_MODE_BYPASS, align_width / 2 - 1, cmdq_pkt); +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-ovl.patch b/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-ovl.patch new file mode 100644 index 00000000000..91aa437f7f9 --- /dev/null +++ b/queue-6.10/drm-mediatek-fix-xrgb-setting-error-in-ovl.patch @@ -0,0 +1,73 @@ +From 502209f3a27101102ef6d6e414e6f2bc17dc56d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:43 +0800 +Subject: drm/mediatek: Fix XRGB setting error in OVL + +From: Hsiao Chien Sung + +[ Upstream commit 765f284f1fe172573021056f7e337ee53f252969 ] + +CONST_BLD must be enabled for XRGB formats although the alpha channel +can be ignored, or OVL will still read the value from memory. +This error only affects CRC generation. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-3-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index b552a02d7eae7..bd00e5e85deba 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -38,6 +38,7 @@ + #define DISP_REG_OVL_PITCH_MSB(n) (0x0040 + 0x20 * (n)) + #define OVL_PITCH_MSB_2ND_SUBBUF BIT(16) + #define DISP_REG_OVL_PITCH(n) (0x0044 + 0x20 * (n)) ++#define OVL_CONST_BLEND BIT(28) + #define DISP_REG_OVL_RDMA_CTRL(n) (0x00c0 + 0x20 * (n)) + #define DISP_REG_OVL_RDMA_GMC(n) (0x00c8 + 0x20 * (n)) + #define DISP_REG_OVL_ADDR_MT2701 0x0040 +@@ -407,6 +408,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + unsigned int fmt = pending->format; + unsigned int offset = (pending->y << 16) | pending->x; + unsigned int src_size = (pending->height << 16) | pending->width; ++ unsigned int ignore_pixel_alpha = 0; + unsigned int con; + bool is_afbc = pending->modifier != DRM_FORMAT_MOD_LINEAR; + union overlay_pitch { +@@ -428,6 +430,14 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + if (state->base.fb && state->base.fb->format->has_alpha) + con |= OVL_CON_AEN | OVL_CON_ALPHA; + ++ /* CONST_BLD must be enabled for XRGB formats although the alpha channel ++ * can be ignored, or OVL will still read the value from memory. ++ * For RGB888 related formats, whether CONST_BLD is enabled or not won't ++ * affect the result. Therefore we use !has_alpha as the condition. ++ */ ++ if (state->base.fb && !state->base.fb->format->has_alpha) ++ ignore_pixel_alpha = OVL_CONST_BLEND; ++ + if (pending->rotation & DRM_MODE_REFLECT_Y) { + con |= OVL_CON_VIRT_FLIP; + addr += (pending->height - 1) * pending->pitch; +@@ -443,8 +453,8 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx, + + mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_CON(idx)); +- mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb, &ovl->cmdq_reg, ovl->regs, +- DISP_REG_OVL_PITCH(idx)); ++ mtk_ddp_write_relaxed(cmdq_pkt, overlay_pitch.split_pitch.lsb | ignore_pixel_alpha, ++ &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx)); + mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs, + DISP_REG_OVL_SRC_SIZE(idx)); + mtk_ddp_write_relaxed(cmdq_pkt, offset, &ovl->cmdq_reg, ovl->regs, +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-remove-less-than-zero-comparison-of-an-.patch b/queue-6.10/drm-mediatek-remove-less-than-zero-comparison-of-an-.patch new file mode 100644 index 00000000000..d22b2b6d92b --- /dev/null +++ b/queue-6.10/drm-mediatek-remove-less-than-zero-comparison-of-an-.patch @@ -0,0 +1,38 @@ +From c0cf4186470d35b87e481875b0e5febfff979a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 11:49:37 +0800 +Subject: drm/mediatek: Remove less-than-zero comparison of an unsigned value + +From: Hsiao Chien Sung + +[ Upstream commit 4ed9dd7fde22ed614384c03f8049723cbe7e6a58 ] + +Fix a Coverity error that less-than-zero comparison of an unsigned value +is never true. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240614034937.23978-1-shawn.sung@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_ddp_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_ddp_comp.c +index 17b0364112922..a66e46d0b45eb 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_ddp_comp.c +@@ -593,7 +593,7 @@ int mtk_ddp_comp_init(struct device_node *node, struct mtk_ddp_comp *comp, + int ret; + #endif + +- if (comp_id < 0 || comp_id >= DDP_COMPONENT_DRM_ID_MAX) ++ if (comp_id >= DDP_COMPONENT_DRM_ID_MAX) + return -EINVAL; + + type = mtk_ddp_matches[comp_id].type; +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-set-drm-mode-configs-accordingly.patch b/queue-6.10/drm-mediatek-set-drm-mode-configs-accordingly.patch new file mode 100644 index 00000000000..25acb3fd932 --- /dev/null +++ b/queue-6.10/drm-mediatek-set-drm-mode-configs-accordingly.patch @@ -0,0 +1,110 @@ +From acdee743483e31a2f52fee74020f0a34be35eeff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:50 +0800 +Subject: drm/mediatek: Set DRM mode configs accordingly + +From: Hsiao Chien Sung + +[ Upstream commit a4c9410b31cac463599898edb5111ca9bc0810bd ] + +Set DRM mode configs limitation according to the hardware capabilities +and pass the IGT checks as below: + +- The test "graphics.IgtKms.kms_plane" requires a frame buffer with + width of 4512 pixels (> 4096). +- The test "graphics.IgtKms.kms_cursor_crc" checks if the cursor size is + defined, and run the test with cursor size from 1x1 to 512x512. + +Please notice that the test conditions may change as IGT is updated. + +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-10-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 22 ++++++++++++++++++++++ + drivers/gpu/drm/mediatek/mtk_drm_drv.h | 4 ++++ + 2 files changed, 26 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 8c403bf566856..56f409ad7f390 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -294,6 +294,9 @@ static const struct mtk_mmsys_driver_data mt8188_vdosys0_driver_data = { + .conn_routes = mt8188_mtk_ddp_main_routes, + .num_conn_routes = ARRAY_SIZE(mt8188_mtk_ddp_main_routes), + .mmsys_dev_num = 2, ++ .max_width = 8191, ++ .min_width = 1, ++ .min_height = 1, + }; + + static const struct mtk_mmsys_driver_data mt8192_mmsys_driver_data = { +@@ -308,6 +311,9 @@ static const struct mtk_mmsys_driver_data mt8195_vdosys0_driver_data = { + .main_path = mt8195_mtk_ddp_main, + .main_len = ARRAY_SIZE(mt8195_mtk_ddp_main), + .mmsys_dev_num = 2, ++ .max_width = 8191, ++ .min_width = 1, ++ .min_height = 1, + }; + + static const struct mtk_mmsys_driver_data mt8195_vdosys1_driver_data = { +@@ -315,6 +321,9 @@ static const struct mtk_mmsys_driver_data mt8195_vdosys1_driver_data = { + .ext_len = ARRAY_SIZE(mt8195_mtk_ddp_ext), + .mmsys_id = 1, + .mmsys_dev_num = 2, ++ .max_width = 8191, ++ .min_width = 2, /* 2-pixel align when ethdr is bypassed */ ++ .min_height = 1, + }; + + static const struct of_device_id mtk_drm_of_ids[] = { +@@ -493,6 +502,15 @@ static int mtk_drm_kms_init(struct drm_device *drm) + for (j = 0; j < private->data->mmsys_dev_num; j++) { + priv_n = private->all_drm_private[j]; + ++ if (priv_n->data->max_width) ++ drm->mode_config.max_width = priv_n->data->max_width; ++ ++ if (priv_n->data->min_width) ++ drm->mode_config.min_width = priv_n->data->min_width; ++ ++ if (priv_n->data->min_height) ++ drm->mode_config.min_height = priv_n->data->min_height; ++ + if (i == CRTC_MAIN && priv_n->data->main_len) { + ret = mtk_crtc_create(drm, priv_n->data->main_path, + priv_n->data->main_len, j, +@@ -520,6 +538,10 @@ static int mtk_drm_kms_init(struct drm_device *drm) + } + } + ++ /* IGT will check if the cursor size is configured */ ++ drm->mode_config.cursor_width = drm->mode_config.max_width; ++ drm->mode_config.cursor_height = drm->mode_config.max_height; ++ + /* Use OVL device for all DMA memory allocations */ + crtc = drm_crtc_from_index(drm, 0); + if (crtc) +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.h b/drivers/gpu/drm/mediatek/mtk_drm_drv.h +index 78d698ede1bf8..ce897984de51e 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.h ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.h +@@ -46,6 +46,10 @@ struct mtk_mmsys_driver_data { + bool shadow_register; + unsigned int mmsys_id; + unsigned int mmsys_dev_num; ++ ++ u16 max_width; ++ u16 min_width; ++ u16 min_height; + }; + + struct mtk_drm_private { +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-turn-off-the-layers-with-zero-width-or-.patch b/queue-6.10/drm-mediatek-turn-off-the-layers-with-zero-width-or-.patch new file mode 100644 index 00000000000..3a9b1827456 --- /dev/null +++ b/queue-6.10/drm-mediatek-turn-off-the-layers-with-zero-width-or-.patch @@ -0,0 +1,61 @@ +From 2052d5db8249e8cbc5b8ef49b01462886120c5da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:46 +0800 +Subject: drm/mediatek: Turn off the layers with zero width or height + +From: Hsiao Chien Sung + +[ Upstream commit 6b9946f4550d8dad8bc1af2db97286ca449af786 ] + +We found that IGT (Intel GPU Tool) will try to commit layers with +zero width or height and lead to undefined behaviors in hardware. +Disable the layers in such a situation. + +Fixes: 453c3364632a ("drm/mediatek: Add ovl_adaptor support for MT8195") +Fixes: d886c0009bd0 ("drm/mediatek: Add ETHDR support for MT8195") +Reviewed-by: CK Hu +Reviewed-by: AngeloGioacchino Del Regno +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-6-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 2 +- + drivers/gpu/drm/mediatek/mtk_ethdr.c | 7 ++++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c +index 02dd7dcdfedb2..2b62d64759181 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c +@@ -158,7 +158,7 @@ void mtk_ovl_adaptor_layer_config(struct device *dev, unsigned int idx, + merge = ovl_adaptor->ovl_adaptor_comp[OVL_ADAPTOR_MERGE0 + idx]; + ethdr = ovl_adaptor->ovl_adaptor_comp[OVL_ADAPTOR_ETHDR0]; + +- if (!pending->enable) { ++ if (!pending->enable || !pending->width || !pending->height) { + mtk_merge_stop_cmdq(merge, cmdq_pkt); + mtk_mdp_rdma_stop(rdma_l, cmdq_pkt); + mtk_mdp_rdma_stop(rdma_r, cmdq_pkt); +diff --git a/drivers/gpu/drm/mediatek/mtk_ethdr.c b/drivers/gpu/drm/mediatek/mtk_ethdr.c +index 5c52e514ae301..bf5826b7e7760 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ethdr.c ++++ b/drivers/gpu/drm/mediatek/mtk_ethdr.c +@@ -160,7 +160,12 @@ void mtk_ethdr_layer_config(struct device *dev, unsigned int idx, + if (idx >= 4) + return; + +- if (!pending->enable) { ++ if (!pending->enable || !pending->width || !pending->height) { ++ /* ++ * instead of disabling layer with MIX_SRC_CON directly ++ * set the size to 0 to avoid screen shift due to mixer ++ * mode switch (hardware behavior) ++ */ + mtk_ddp_write(cmdq_pkt, 0, &mixer->cmdq_base, mixer->regs, MIX_L_SRC_SIZE(idx)); + return; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-use-8-bit-alpha-in-ethdr.patch b/queue-6.10/drm-mediatek-use-8-bit-alpha-in-ethdr.patch new file mode 100644 index 00000000000..9b22851bec6 --- /dev/null +++ b/queue-6.10/drm-mediatek-use-8-bit-alpha-in-ethdr.patch @@ -0,0 +1,48 @@ +From 54500ac5c9ca942752fb8fcb747584e6693c0b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 00:38:42 +0800 +Subject: drm/mediatek: Use 8-bit alpha in ETHDR + +From: Hsiao Chien Sung + +[ Upstream commit 231c020141cb150a59f5b28379cad82ff7bad899 ] + +9-bit alpha (max=0x100) is designed for special HDR related +calculation, which should be disabled by default. +Change the alpha value from 0x100 to 0xff in 8-bit form. + +Fixes: d886c0009bd0 ("drm/mediatek: Add ETHDR support for MT8195") +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: CK Hu +Signed-off-by: Hsiao Chien Sung +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240620-igt-v3-2-a9d62d2e2c7e@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_ethdr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_ethdr.c b/drivers/gpu/drm/mediatek/mtk_ethdr.c +index 156c6ff547e86..d7d16482c9473 100644 +--- a/drivers/gpu/drm/mediatek/mtk_ethdr.c ++++ b/drivers/gpu/drm/mediatek/mtk_ethdr.c +@@ -50,7 +50,6 @@ + + #define MIXER_INX_MODE_BYPASS 0 + #define MIXER_INX_MODE_EVEN_EXTEND 1 +-#define DEFAULT_9BIT_ALPHA 0x100 + #define MIXER_ALPHA_AEN BIT(8) + #define MIXER_ALPHA 0xff + #define ETHDR_CLK_NUM 13 +@@ -169,7 +168,7 @@ void mtk_ethdr_layer_config(struct device *dev, unsigned int idx, + alpha_con = MIXER_ALPHA_AEN | MIXER_ALPHA; + + mtk_mmsys_mixer_in_config(priv->mmsys_dev, idx + 1, alpha_con ? false : true, +- DEFAULT_9BIT_ALPHA, ++ MIXER_ALPHA, + pending->x & 1 ? MIXER_INX_MODE_EVEN_EXTEND : + MIXER_INX_MODE_BYPASS, align_width / 2 - 1, cmdq_pkt); + +-- +2.43.0 + diff --git a/queue-6.10/drm-meson-fix-canvas-release-in-bind-function.patch b/queue-6.10/drm-meson-fix-canvas-release-in-bind-function.patch new file mode 100644 index 00000000000..ebbb5ddaa96 --- /dev/null +++ b/queue-6.10/drm-meson-fix-canvas-release-in-bind-function.patch @@ -0,0 +1,106 @@ +From 004356011d919c2b2b77477033e578353cf88935 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 15:58:27 +0000 +Subject: drm/meson: fix canvas release in bind function + +From: Yao Zi + +[ Upstream commit a695949b2e9bb6b6700a764c704731a306c4bebf ] + +Allocated canvases may not be released on the error exit path of +meson_drv_bind_master(), leading to resource leaking. Rewrite exit path +to release canvases on error. + +Fixes: 2bf6b5b0e374 ("drm/meson: exclusively use the canvas provider module") +Signed-off-by: Yao Zi +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240703155826.10385-2-ziyao@disroot.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240703155826.10385-2-ziyao@disroot.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 37 +++++++++++++++---------------- + 1 file changed, 18 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 17a5cca007e29..4bd0baa2a4f55 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -250,29 +250,20 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + if (ret) + goto free_drm; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_0); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_osd1; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_1); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_vd1_0; + ret = meson_canvas_alloc(priv->canvas, &priv->canvas_id_vd1_2); +- if (ret) { +- meson_canvas_free(priv->canvas, priv->canvas_id_osd1); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); +- meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1); +- goto free_drm; +- } ++ if (ret) ++ goto free_canvas_vd1_1; + + priv->vsync_irq = platform_get_irq(pdev, 0); + + ret = drm_vblank_init(drm, 1); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + + /* Assign limits per soc revision/package */ + for (i = 0 ; i < ARRAY_SIZE(meson_drm_soc_attrs) ; ++i) { +@@ -288,11 +279,11 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + */ + ret = drm_aperture_remove_framebuffers(&meson_driver); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + + ret = drmm_mode_config_init(drm); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + drm->mode_config.max_width = 3840; + drm->mode_config.max_height = 2160; + drm->mode_config.funcs = &meson_mode_config_funcs; +@@ -307,7 +298,7 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + if (priv->afbcd.ops) { + ret = priv->afbcd.ops->init(priv); + if (ret) +- goto free_drm; ++ goto free_canvas_vd1_2; + } + + /* Encoder Initialization */ +@@ -371,6 +362,14 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + exit_afbcd: + if (priv->afbcd.ops) + priv->afbcd.ops->exit(priv); ++free_canvas_vd1_2: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_2); ++free_canvas_vd1_1: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_1); ++free_canvas_vd1_0: ++ meson_canvas_free(priv->canvas, priv->canvas_id_vd1_0); ++free_canvas_osd1: ++ meson_canvas_free(priv->canvas, priv->canvas_id_osd1); + free_drm: + drm_dev_put(drm); + +-- +2.43.0 + diff --git a/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch b/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch new file mode 100644 index 00000000000..f5a7d98d5d3 --- /dev/null +++ b/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch @@ -0,0 +1,78 @@ +From 3072f92e8d0dacc6fd6ba7b969134eafaaf1d138 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 10:20:51 -0700 +Subject: drm/mipi-dsi: Fix theoretical int overflow in + mipi_dsi_dcs_write_seq() + +From: Douglas Anderson + +[ Upstream commit 0b03829fdece47beba9ecb7dbcbde4585ee3663e ] + +The mipi_dsi_dcs_write_seq() macro makes a call to +mipi_dsi_dcs_write_buffer() which returns a type ssize_t. The macro +then stores it in an int and checks to see if it's negative. This +could theoretically be a problem if "ssize_t" is larger than "int". + +To see the issue, imagine that "ssize_t" is 32-bits and "int" is +16-bits, you could see a problem if there was some code out there that +looked like: + + mipi_dsi_dcs_write_seq(dsi, cmd, <32767 bytes as arguments>); + +...since we'd get back that 32768 bytes were transferred and 32768 +stored in a 16-bit int would look negative. + +Though there are no callsites where we'd actually hit this (even if +"int" was only 16-bit), it's cleaner to make the types match so let's +fix it. + +Fixes: 2a9e9daf7523 ("drm/mipi-dsi: Introduce mipi_dsi_dcs_write_seq macro") +Reviewed-by: Neil Armstrong +Reviewed-by: Linus Walleij +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240514102056.v5.1.I30fa4c8348ea316c886ef8a522a52fed617f930d@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240514102056.v5.1.I30fa4c8348ea316c886ef8a522a52fed617f930d@changeid +Signed-off-by: Sasha Levin +--- + include/drm/drm_mipi_dsi.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 82b1cc434ea3f..70ce0b8cbc68e 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -333,18 +333,18 @@ int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + * @cmd: Command + * @seq: buffer containing data to be transmitted + */ +-#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) \ +- do { \ +- static const u8 d[] = { cmd, seq }; \ +- struct device *dev = &dsi->dev; \ +- int ret; \ +- ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ +- if (ret < 0) { \ +- dev_err_ratelimited( \ +- dev, "sending command %#02x failed: %d\n", \ +- cmd, ret); \ +- return ret; \ +- } \ ++#define mipi_dsi_dcs_write_seq(dsi, cmd, seq...) \ ++ do { \ ++ static const u8 d[] = { cmd, seq }; \ ++ struct device *dev = &dsi->dev; \ ++ ssize_t ret; \ ++ ret = mipi_dsi_dcs_write_buffer(dsi, d, ARRAY_SIZE(d)); \ ++ if (ret < 0) { \ ++ dev_err_ratelimited( \ ++ dev, "sending command %#02x failed: %zd\n", \ ++ cmd, ret); \ ++ return ret; \ ++ } \ + } while (0) + + /** +-- +2.43.0 + diff --git a/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch-622 b/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch-622 new file mode 100644 index 00000000000..50bb1fc8d81 --- /dev/null +++ b/queue-6.10/drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch-622 @@ -0,0 +1,76 @@ +From e8fb1a7b5c49fb02156bda899c9497d1467b1226 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 10:20:52 -0700 +Subject: drm/mipi-dsi: Fix theoretical int overflow in + mipi_dsi_generic_write_seq() + +From: Douglas Anderson + +[ Upstream commit 24acbcce5cc673886c2f4f9b3f6f89a9c6a53b7e ] + +The mipi_dsi_generic_write_seq() macro makes a call to +mipi_dsi_generic_write() which returns a type ssize_t. The macro then +stores it in an int and checks to see if it's negative. This could +theoretically be a problem if "ssize_t" is larger than "int". + +To see the issue, imagine that "ssize_t" is 32-bits and "int" is +16-bits, you could see a problem if there was some code out there that +looked like: + + mipi_dsi_generic_write_seq(dsi, <32768 bytes as arguments>); + +...since we'd get back that 32768 bytes were transferred and 32768 +stored in a 16-bit int would look negative. + +Though there are no callsites where we'd actually hit this (even if +"int" was only 16-bit), it's cleaner to make the types match so let's +fix it. + +Fixes: a9015ce59320 ("drm/mipi-dsi: Add a mipi_dsi_dcs_write_seq() macro") +Reviewed-by: Neil Armstrong +Reviewed-by: Linus Walleij +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240514102056.v5.2.Iadb65b8add19ed3ae3ed6425011beb97e380a912@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240514102056.v5.2.Iadb65b8add19ed3ae3ed6425011beb97e380a912@changeid +Signed-off-by: Sasha Levin +--- + include/drm/drm_mipi_dsi.h | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 70ce0b8cbc68e..e0f56564bf975 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -314,17 +314,17 @@ int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + * @dsi: DSI peripheral device + * @seq: buffer containing the payload + */ +-#define mipi_dsi_generic_write_seq(dsi, seq...) \ +- do { \ +- static const u8 d[] = { seq }; \ +- struct device *dev = &dsi->dev; \ +- int ret; \ +- ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d)); \ +- if (ret < 0) { \ +- dev_err_ratelimited(dev, "transmit data failed: %d\n", \ +- ret); \ +- return ret; \ +- } \ ++#define mipi_dsi_generic_write_seq(dsi, seq...) \ ++ do { \ ++ static const u8 d[] = { seq }; \ ++ struct device *dev = &dsi->dev; \ ++ ssize_t ret; \ ++ ret = mipi_dsi_generic_write(dsi, d, ARRAY_SIZE(d)); \ ++ if (ret < 0) { \ ++ dev_err_ratelimited(dev, "transmit data failed: %zd\n", \ ++ ret); \ ++ return ret; \ ++ } \ + } while (0) + + /** +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-a6xx-fix-a702-ubwc-mode.patch b/queue-6.10/drm-msm-a6xx-fix-a702-ubwc-mode.patch new file mode 100644 index 00000000000..ffd4a437bb4 --- /dev/null +++ b/queue-6.10/drm-msm-a6xx-fix-a702-ubwc-mode.patch @@ -0,0 +1,41 @@ +From c416ef008d01b1e12588bb09c725f88ed74682b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:10:49 +0200 +Subject: drm/msm/a6xx: Fix A702 UBWC mode + +From: Konrad Dybcio + +[ Upstream commit 593f1dd4c81f6932042508a80186dbdea90312a5 ] + +UBWC_MODE is a one-bit-wide field, so a value of 2 is obviously bogus. + +Replace it with the correct value (0). + +Fixes: 18397519cb62 ("drm/msm/adreno: Add A702 support") +Reported-by: Connor Abbott +Closes: https://lore.kernel.org/linux-arm-msm/CACu1E7FTN=kwaDJMNiTmFspALzj2+Q-nvsN5ugi=vz4RdUGvGw@mail.gmail.com/ +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/597359/ +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index 973872ad0474e..5383aff848300 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -1409,7 +1409,7 @@ static void a6xx_calc_ubwc_config(struct adreno_gpu *gpu) + if (adreno_is_a702(gpu)) { + gpu->ubwc_config.highest_bank_bit = 14; + gpu->ubwc_config.min_acc_len = 1; +- gpu->ubwc_config.ubwc_mode = 2; ++ gpu->ubwc_config.ubwc_mode = 0; + } + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-a6xx-use-__unused__-to-fix-compiler-warnings.patch b/queue-6.10/drm-msm-a6xx-use-__unused__-to-fix-compiler-warnings.patch new file mode 100644 index 00000000000..7c5dc79fef9 --- /dev/null +++ b/queue-6.10/drm-msm-a6xx-use-__unused__-to-fix-compiler-warnings.patch @@ -0,0 +1,91 @@ +From 5a12ef09cbd1c102a4cfb032eb71d6391be9d162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 11:34:15 -0700 +Subject: drm/msm/a6xx: use __unused__ to fix compiler warnings for gen7_* + includes + +From: Abhinav Kumar + +[ Upstream commit 71d9b458b2bfe79197194d914aa9bada46fb9e14 ] + +GCC diagnostic pragma method throws below warnings in some of the versions + +drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c:16:9: warning: unknown +option after '#pragma GCC diagnostic' kind [-Wpragmas] + #pragma GCC diagnostic ignored "-Wunused-const-variable" + ^ +In file included from drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c:18:0: +drivers/gpu/drm/msm/adreno/adreno_gen7_0_0_snapshot.h:924:19: warning: +'gen7_0_0_external_core_regs' defined but not used [-Wunused-variable] + static const u32 *gen7_0_0_external_core_regs[] = { + ^ +In file included from drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c:19:0: +drivers/gpu/drm/msm/adreno/adreno_gen7_2_0_snapshot.h:748:19: warning: +'gen7_2_0_external_core_regs' defined but not used [-Wunused-variable] + static const u32 *gen7_2_0_external_core_regs[] = { + ^ +In file included from drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c:20:0: +drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h:1188:43: warning: +'gen7_9_0_sptp_clusters' defined but not used [-Wunused-variable] + static struct gen7_sptp_cluster_registers gen7_9_0_sptp_clusters[] = { + ^ +drivers/gpu/drm/msm/adreno/adreno_gen7_9_0_snapshot.h:1438:19: warning: +'gen7_9_0_external_core_regs' defined but not used [-Wunused-variable] + static const u32 *gen7_9_0_external_core_regs[] = { + +Remove GCC version dependency by using __unused__ for the unused gen7_* includes. + +Changes in v2: + - Fix the warnings in the commit text + - Use __attribute((__unused__)) instead of local assignment + +changes in v3: + - drop the Link from the auto add + +changes in v4: + - replace __attribute((__unused__)) with __always_unused + +Fixes: 64d6255650d4 ("drm/msm: More fully implement devcoredump for a7xx") +Suggested-by: Rob Clark +Signed-off-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/597265/ +[Add gen7_9_0_cx_debugbus_blocks as well] +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index 0a7717a4fc2fd..789a11416f7a4 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -8,19 +8,16 @@ + #include "a6xx_gpu_state.h" + #include "a6xx_gmu.xml.h" + +-/* Ignore diagnostics about register tables that we aren't using yet. We don't +- * want to modify these headers too much from their original source. +- */ +-#pragma GCC diagnostic push +-#pragma GCC diagnostic ignored "-Wunused-variable" +-#pragma GCC diagnostic ignored "-Wunused-const-variable" ++static const unsigned int *gen7_0_0_external_core_regs[] __always_unused; ++static const unsigned int *gen7_2_0_external_core_regs[] __always_unused; ++static const unsigned int *gen7_9_0_external_core_regs[] __always_unused; ++static struct gen7_sptp_cluster_registers gen7_9_0_sptp_clusters[] __always_unused; ++static const u32 gen7_9_0_cx_debugbus_blocks[] __always_unused; + + #include "adreno_gen7_0_0_snapshot.h" + #include "adreno_gen7_2_0_snapshot.h" + #include "adreno_gen7_9_0_snapshot.h" + +-#pragma GCC diagnostic pop +- + struct a6xx_gpu_state_obj { + const void *handle; + u32 *data; +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dp-fix-runtime_pm-handling-in-dp_wait_hpd_as.patch b/queue-6.10/drm-msm-dp-fix-runtime_pm-handling-in-dp_wait_hpd_as.patch new file mode 100644 index 00000000000..9ffebda7298 --- /dev/null +++ b/queue-6.10/drm-msm-dp-fix-runtime_pm-handling-in-dp_wait_hpd_as.patch @@ -0,0 +1,49 @@ +From be497a9b70f68cb20812c067d7b7e8d894295dde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 00:34:45 +0200 +Subject: drm/msm/dp: fix runtime_pm handling in dp_wait_hpd_asserted + +From: Dmitry Baryshkov + +[ Upstream commit aeacc39e2088a15ee31c8af4f68c84981fa08eb7 ] + +The function dp_wait_hpd_asserted() uses pm_runtime_get_sync() and +doesn't care about the return value. Potentially this can lead to +unclocked access if for some reason resuming of the DP controller fails. + +Change the function to use pm_runtime_resume_and_get() and return an +error if resume fails. + +Fixes: e2969ee30252 ("drm/msm/dp: move of_dp_aux_populate_bus() to eDP probe()") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Reviewed-by: Stephen Boyd +Patchwork: https://patchwork.freedesktop.org/patch/580137/ +Link: https://lore.kernel.org/r/20240226223446.4194079-1-dmitry.baryshkov@linaro.org +[quic_abhinavk@quicinc.com: resolved trivial conflict while rebase] +Signed-off-by: Abhinav Kumar +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_aux.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_aux.c b/drivers/gpu/drm/msm/dp/dp_aux.c +index da46a433bf747..00dfafbebe0e5 100644 +--- a/drivers/gpu/drm/msm/dp/dp_aux.c ++++ b/drivers/gpu/drm/msm/dp/dp_aux.c +@@ -513,7 +513,10 @@ static int dp_wait_hpd_asserted(struct drm_dp_aux *dp_aux, + + aux = container_of(dp_aux, struct dp_aux_private, dp_aux); + +- pm_runtime_get_sync(aux->dev); ++ ret = pm_runtime_resume_and_get(aux->dev); ++ if (ret) ++ return ret; ++ + ret = dp_catalog_aux_wait_for_hpd_connect_state(aux->catalog, wait_us); + pm_runtime_put_sync(aux->dev); + +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dpu-drop-duplicate-drm-formats-from-wb2_form.patch b/queue-6.10/drm-msm-dpu-drop-duplicate-drm-formats-from-wb2_form.patch new file mode 100644 index 00000000000..6708e069e11 --- /dev/null +++ b/queue-6.10/drm-msm-dpu-drop-duplicate-drm-formats-from-wb2_form.patch @@ -0,0 +1,63 @@ +From 245a59f0d050fbb30aca1c799bbfd910413da5cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 23:01:12 +0800 +Subject: drm/msm/dpu: drop duplicate drm formats from wb2_formats arrays + +From: Junhao Xie + +[ Upstream commit 6ed817592638348e83facfe6a4deedb8d5e83357 ] + +There are duplicate items in wb2_formats_rgb and wb2_formats_rgb_yuv, +which cause weston assertions failed. + +weston: libweston/drm-formats.c:131: weston_drm_format_array_add_format: +Assertion `!weston_drm_format_array_find_format(formats, format)' failed. + +Signed-off-by: Junhao Xie +Reviewed-by: Konrad Dybcio +Fixes: 8c16b988ba2d ("drm/msm/dpu: introduce separate wb2_format arrays for rgb and yuv") +Fixes: 53324b99bd7b ("drm/msm/dpu: add writeback blocks to the sm8250 DPU catalog") +Reviewed-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/596847/ +Link: https://lore.kernel.org/r/20240524150128.1878297-2-bigfoot@classfun.cn +Signed-off-by: Abhinav Kumar +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +index f2b6eac7601dd..9b72977feafa4 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +@@ -220,12 +220,9 @@ static const u32 wb2_formats_rgb[] = { + DRM_FORMAT_RGBA4444, + DRM_FORMAT_RGBX4444, + DRM_FORMAT_XRGB4444, +- DRM_FORMAT_BGR565, + DRM_FORMAT_BGR888, +- DRM_FORMAT_ABGR8888, + DRM_FORMAT_BGRA8888, + DRM_FORMAT_BGRX8888, +- DRM_FORMAT_XBGR8888, + DRM_FORMAT_ABGR1555, + DRM_FORMAT_BGRA5551, + DRM_FORMAT_XBGR1555, +@@ -254,12 +251,9 @@ static const u32 wb2_formats_rgb_yuv[] = { + DRM_FORMAT_RGBA4444, + DRM_FORMAT_RGBX4444, + DRM_FORMAT_XRGB4444, +- DRM_FORMAT_BGR565, + DRM_FORMAT_BGR888, +- DRM_FORMAT_ABGR8888, + DRM_FORMAT_BGRA8888, + DRM_FORMAT_BGRX8888, +- DRM_FORMAT_XBGR8888, + DRM_FORMAT_ABGR1555, + DRM_FORMAT_BGRA5551, + DRM_FORMAT_XBGR1555, +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch b/queue-6.10/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch new file mode 100644 index 00000000000..f29b8c59368 --- /dev/null +++ b/queue-6.10/drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch @@ -0,0 +1,84 @@ +From 24e6e7f6256530dfb8761def52dd368e198b0396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 13:17:30 -0700 +Subject: drm/msm/dpu: drop validity checks for clear_pending_flush() ctl op + +From: Abhinav Kumar + +[ Upstream commit 3d68e3dedd4b48f0358bdc187277e3315d8aa559 ] + +clear_pending_flush() ctl op is always assigned irrespective of the DPU +hardware revision. Hence there is no needed to check whether the op has +been assigned before calling it. + +Drop the checks across the driver for clear_pending_flush() and also +update its documentation that it is always expected to be assigned. + +changes in v2: + - instead of adding more validity checks just drop the one for clear_pending_flush + - update the documentation for clear_pending_flush() ctl op + - update the commit text reflecting these changes + +changes in v3: + - simplify the documentation of clear_pending_flush + +Fixes: d7d0e73f7de3 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/464fbd84-0d1c-43c3-a40b-31656ac06456@moroto.mountain/T/ +Signed-off-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/600241/ +Link: https://lore.kernel.org/r/20240620201731.3694593-1-quic_abhinavk@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 3 +-- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 3 +-- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h | 3 ++- + 3 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 708657598cce4..697ad4a640516 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -1743,8 +1743,7 @@ void dpu_encoder_trigger_kickoff_pending(struct drm_encoder *drm_enc) + phys = dpu_enc->phys_encs[i]; + + ctl = phys->hw_ctl; +- if (ctl->ops.clear_pending_flush) +- ctl->ops.clear_pending_flush(ctl); ++ ctl->ops.clear_pending_flush(ctl); + + /* update only for command mode primary ctl */ + if ((phys == dpu_enc->cur_master) && +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index 356dca5e5ea94..882c717859cec 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -538,8 +538,7 @@ static void dpu_encoder_phys_wb_disable(struct dpu_encoder_phys *phys_enc) + } + + /* reset h/w before final flush */ +- if (phys_enc->hw_ctl->ops.clear_pending_flush) +- phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl); ++ phys_enc->hw_ctl->ops.clear_pending_flush(phys_enc->hw_ctl); + + /* + * New CTL reset sequence from 5.0 MDP onwards. +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h +index ef56280bea932..4401fdc0f3e4f 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.h +@@ -83,7 +83,8 @@ struct dpu_hw_ctl_ops { + + /** + * Clear the value of the cached pending_flush_mask +- * No effect on hardware ++ * No effect on hardware. ++ * Required to be implemented. + * @ctx : ctl path ctx pointer + */ + void (*clear_pending_flush)(struct dpu_hw_ctl *ctx); +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dpu-fix-encoder-irq-wait-skip.patch b/queue-6.10/drm-msm-dpu-fix-encoder-irq-wait-skip.patch new file mode 100644 index 00000000000..e850e1927d9 --- /dev/null +++ b/queue-6.10/drm-msm-dpu-fix-encoder-irq-wait-skip.patch @@ -0,0 +1,45 @@ +From 9297583868daab450bba1d2930136dd3ec4dcfcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 21:40:41 +0200 +Subject: drm/msm/dpu: fix encoder irq wait skip +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Czémán + +[ Upstream commit e42d518511871ae625b5ff699853a05af1ccccf7 ] + +The irq_idx is unsigned so it cannot be lower than zero, better +to change the condition to check if it is equal with zero. +It could not cause any issue because a valid irq index starts from one. + +Fixes: 5a9d50150c2c ("drm/msm/dpu: shift IRQ indices by 1") +Signed-off-by: Barnabás Czémán +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/596853/ +Link: https://lore.kernel.org/r/20240509-irq_wait-v2-1-b8b687b22cc4@gmail.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 119f3ea50a7c6..cf7d769ab3b95 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -428,7 +428,7 @@ int dpu_encoder_helper_wait_for_irq(struct dpu_encoder_phys *phys_enc, + return -EWOULDBLOCK; + } + +- if (irq_idx < 0) { ++ if (irq_idx == 0) { + DRM_DEBUG_KMS("skip irq wait id=%u, callback=%ps\n", + DRMID(phys_enc->parent), func); + return 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dsi-set-video-mode-widebus-enable-bit-when-w.patch b/queue-6.10/drm-msm-dsi-set-video-mode-widebus-enable-bit-when-w.patch new file mode 100644 index 00000000000..e4186ff76fb --- /dev/null +++ b/queue-6.10/drm-msm-dsi-set-video-mode-widebus-enable-bit-when-w.patch @@ -0,0 +1,55 @@ +From c648af7d4a2e21aabcb5ae779d17413b51729c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 13:56:48 +0800 +Subject: drm/msm/dsi: set video mode widebus enable bit when widebus is + enabled + +From: Jonathan Marek + +[ Upstream commit 007870b8eaf54739c7b417ddaf90bf364b7e4bc8 ] + +The value returned by msm_dsi_wide_bus_enabled() doesn't match what the +driver is doing in video mode. Fix that by actually enabling widebus for +video mode. + +Fixes: efcbd6f9cdeb ("drm/msm/dsi: Enable widebus for DSI") +Signed-off-by: Jonathan Marek +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Marijn Suijten +Reviewed-by: Jessica Zhang +Signed-off-by: Jun Nie +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Patchwork: https://patchwork.freedesktop.org/patch/596232/ +Link: https://lore.kernel.org/r/20240530-msm-drm-dsc-dsi-video-upstream-4-v6-4-2ab1d334c657@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index a50f4dda59410..47f5858334f61 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -754,6 +754,8 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host, + data |= DSI_VID_CFG0_TRAFFIC_MODE(dsi_get_traffic_mode(flags)); + data |= DSI_VID_CFG0_DST_FORMAT(dsi_get_vid_fmt(mipi_fmt)); + data |= DSI_VID_CFG0_VIRT_CHANNEL(msm_host->channel); ++ if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base)) ++ data |= DSI_VID_CFG0_DATABUS_WIDEN; + dsi_write(msm_host, REG_DSI_VID_CFG0, data); + + /* Do not swap RGB colors */ +@@ -778,7 +780,6 @@ static void dsi_ctrl_enable(struct msm_dsi_host *msm_host, + if (cfg_hnd->minor >= MSM_DSI_6G_VER_MINOR_V1_3) + data |= DSI_CMD_MODE_MDP_CTRL2_BURST_MODE; + +- /* TODO: Allow for video-mode support once tested/fixed */ + if (msm_dsi_host_is_wide_bus_enabled(&msm_host->base)) + data |= DSI_CMD_MODE_MDP_CTRL2_DATABUS_WIDEN; + +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch b/queue-6.10/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch new file mode 100644 index 00000000000..1edab45f790 --- /dev/null +++ b/queue-6.10/drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch @@ -0,0 +1,59 @@ +From d13fec6781917ce7713d160b18b70055729f207b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 13:56:49 +0800 +Subject: drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC + +From: Jonathan Marek + +[ Upstream commit 9ecd0ddd223b68b4603e4766a1d51f6c6cda346e ] + +Video mode DSC won't work if this field is not set correctly. Set it to fix +video mode DSC (for slice_per_pkt==1 cases at least). + +Fixes: 08802f515c3c ("drm/msm/dsi: Add support for DSC configuration") +Signed-off-by: Jonathan Marek +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jun Nie +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Reviewed-by: Jessica Zhang +Patchwork: https://patchwork.freedesktop.org/patch/596234/ +Link: https://lore.kernel.org/r/20240530-msm-drm-dsc-dsi-video-upstream-4-v6-5-2ab1d334c657@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index 47f5858334f61..7252d36687e61 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -857,6 +857,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + u32 slice_per_intf, total_bytes_per_intf; + u32 pkt_per_line; + u32 eol_byte_num; ++ u32 bytes_per_pkt; + + /* first calculate dsc parameters and then program + * compress mode registers +@@ -864,6 +865,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + slice_per_intf = msm_dsc_get_slices_per_intf(dsc, hdisplay); + + total_bytes_per_intf = dsc->slice_chunk_size * slice_per_intf; ++ bytes_per_pkt = dsc->slice_chunk_size; /* * slice_per_pkt; */ + + eol_byte_num = total_bytes_per_intf % 3; + +@@ -901,6 +903,7 @@ static void dsi_update_dsc_timing(struct msm_dsi_host *msm_host, bool is_cmd_mod + dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL, reg_ctrl); + dsi_write(msm_host, REG_DSI_COMMAND_COMPRESSION_MODE_CTRL2, reg_ctrl2); + } else { ++ reg |= DSI_VIDEO_COMPRESSION_MODE_CTRL_WC(bytes_per_pkt); + dsi_write(msm_host, REG_DSI_VIDEO_COMPRESSION_MODE_CTRL, reg); + } + } +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch b/queue-6.10/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch new file mode 100644 index 00000000000..d5e1faac1bc --- /dev/null +++ b/queue-6.10/drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch @@ -0,0 +1,49 @@ +From aaf1555f218ee3d0cf07c73396d7780fb0cc6bf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:38 -0700 +Subject: drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare() + +From: Douglas Anderson + +[ Upstream commit 6320b9199dd99622668649c234d4e8a99e44a9c8 ] + +The mipi_dsi_dcs_nop() function returns an error but we weren't +checking it in boe_panel_prepare(). Add a check. This is highly +unlikely to matter in practice. If the NOP failed then likely later +MIPI commands would fail too. + +Found by code inspection. + +Fixes: 812562b8d881 ("drm/panel: boe-tv101wum-nl6: Fine tune the panel power sequence") +Signed-off-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.3.Ibffbaa5b4999ac0e55f43bf353144433b099d727@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.3.Ibffbaa5b4999ac0e55f43bf353144433b099d727@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index ce7b4f5ce3fae..83c604ba3ee1c 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -1507,7 +1507,11 @@ static int boe_panel_prepare(struct drm_panel *panel) + usleep_range(10000, 11000); + + if (boe->desc->lp11_before_reset) { +- mipi_dsi_dcs_nop(boe->dsi); ++ ret = mipi_dsi_dcs_nop(boe->dsi); ++ if (ret < 0) { ++ dev_err(&boe->dsi->dev, "Failed to send NOP: %d\n", ret); ++ goto poweroff; ++ } + usleep_range(1000, 2000); + } + gpiod_set_value(boe->enable_gpio, 1); +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch b/queue-6.10/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch new file mode 100644 index 00000000000..1a3e2e21edf --- /dev/null +++ b/queue-6.10/drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch @@ -0,0 +1,48 @@ +From 64c93fa0656c52ef20d107f4c56cb8dddc65e25f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:37 -0700 +Subject: drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before + regulators + +From: Douglas Anderson + +[ Upstream commit 587c48f622374e5d47b1d515c6006a4df4dee882 ] + +The enable GPIO should clearly be set low before turning off +regulators. That matches both the inverse order that things were +enabled and also the order in unprepare(). + +Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.2.Ieac346cd0f1606948ba39ceea06b55359fe972b6@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.2.Ieac346cd0f1606948ba39ceea06b55359fe972b6@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +index 0ffe8f8c01de8..ce7b4f5ce3fae 100644 +--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c ++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c +@@ -1528,13 +1528,13 @@ static int boe_panel_prepare(struct drm_panel *panel) + return 0; + + poweroff: ++ gpiod_set_value(boe->enable_gpio, 0); + regulator_disable(boe->avee); + poweroffavdd: + regulator_disable(boe->avdd); + poweroff1v8: + usleep_range(5000, 7000); + regulator_disable(boe->pp1800); +- gpiod_set_value(boe->enable_gpio, 0); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-himax-hx8394-handle-errors-from-mipi_dsi_d.patch b/queue-6.10/drm-panel-himax-hx8394-handle-errors-from-mipi_dsi_d.patch new file mode 100644 index 00000000000..caf8f4d84b3 --- /dev/null +++ b/queue-6.10/drm-panel-himax-hx8394-handle-errors-from-mipi_dsi_d.patch @@ -0,0 +1,50 @@ +From a9eea68a9c81dd1d4bf0990b4b6a2440c8292ce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:36 -0700 +Subject: drm/panel: himax-hx8394: Handle errors from + mipi_dsi_dcs_set_display_on() better + +From: Douglas Anderson + +[ Upstream commit cc2db2ef8d9eebc0df03808ac0dadbdb96733499 ] + +If mipi_dsi_dcs_set_display_on() returned an error then we'd store +that in the "ret" variable and jump to error handling. We'd then +attempt an orderly poweroff. Unfortunately we then blew away the value +stored in "ret". That means that if the orderly poweroff actually +worked then we're return 0 (no error) from hx8394_enable() even though +the panel wasn't enabled. + +Fix this by not blowing away "ret". + +Found by code inspection. + +Fixes: 65dc9360f741 ("drm: panel: Add Himax HX8394 panel controller driver") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.1.I0a6836fffd8d7620f353becb3df2370d2898f803@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.1.I0a6836fffd8d7620f353becb3df2370d2898f803@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-himax-hx8394.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-himax-hx8394.c b/drivers/gpu/drm/panel/panel-himax-hx8394.c +index ff0dc08b98297..cb9f46e853de4 100644 +--- a/drivers/gpu/drm/panel/panel-himax-hx8394.c ++++ b/drivers/gpu/drm/panel/panel-himax-hx8394.c +@@ -370,8 +370,7 @@ static int hx8394_enable(struct drm_panel *panel) + + sleep_in: + /* This will probably fail, but let's try orderly power off anyway. */ +- ret = mipi_dsi_dcs_enter_sleep_mode(dsi); +- if (!ret) ++ if (!mipi_dsi_dcs_enter_sleep_mode(dsi)) + msleep(50); + + return ret; +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-ilitek-ili9882t-check-for-errors-on-the-no.patch b/queue-6.10/drm-panel-ilitek-ili9882t-check-for-errors-on-the-no.patch new file mode 100644 index 00000000000..8c9abca9bda --- /dev/null +++ b/queue-6.10/drm-panel-ilitek-ili9882t-check-for-errors-on-the-no.patch @@ -0,0 +1,48 @@ +From 77aea8a79ab84139f19beaa6b75df1271d6d17f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:40 -0700 +Subject: drm/panel: ilitek-ili9882t: Check for errors on the NOP in prepare() + +From: Douglas Anderson + +[ Upstream commit 6a7bd6cde73f0fb7e5faa964dbdeb45b55c64698 ] + +The mipi_dsi_dcs_nop() function returns an error but we weren't +checking it in ili9882t_prepare(). Add a check. This is highly +unlikely to matter in practice. If the NOP failed then likely later +MIPI commands would fail too. + +Found by code inspection. + +Fixes: e2450d32e5fb ("drm/panel: ili9882t: Break out as separate driver") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.5.I323476ba9fa8cc7a5adee4c1ec95202785cc5686@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.5.I323476ba9fa8cc7a5adee4c1ec95202785cc5686@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c b/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +index 5762eba73955c..35ea5494e0eb8 100644 +--- a/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c ++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +@@ -560,7 +560,11 @@ static int ili9882t_prepare(struct drm_panel *panel) + usleep_range(10000, 11000); + + // MIPI needs to keep the LP11 state before the lcm_reset pin is pulled high +- mipi_dsi_dcs_nop(ili->dsi); ++ ret = mipi_dsi_dcs_nop(ili->dsi); ++ if (ret < 0) { ++ dev_err(&ili->dsi->dev, "Failed to send NOP: %d\n", ret); ++ goto poweroff; ++ } + usleep_range(1000, 2000); + + gpiod_set_value(ili->enable_gpio, 1); +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-ilitek-ili9882t-if-prepare-fails-disable-g.patch b/queue-6.10/drm-panel-ilitek-ili9882t-if-prepare-fails-disable-g.patch new file mode 100644 index 00000000000..f94b78ef251 --- /dev/null +++ b/queue-6.10/drm-panel-ilitek-ili9882t-if-prepare-fails-disable-g.patch @@ -0,0 +1,48 @@ +From d735d8b6ed5e21bb26e0357719020f19f8471c60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:36:39 -0700 +Subject: drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO before + regulators + +From: Douglas Anderson + +[ Upstream commit 554c00181968d43426bfe68c86541b89265075de ] + +The enable GPIO should clearly be set low before turning off +regulators. That matches both the inverse order that things were +enabled and also the order in unprepare(). + +Fixes: e2450d32e5fb ("drm/panel: ili9882t: Break out as separate driver") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240517143643.4.Ieb0179065847972a0f13e9a8574a80a5f65f3338@changeid +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240517143643.4.Ieb0179065847972a0f13e9a8574a80a5f65f3338@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-ilitek-ili9882t.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c b/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +index 267a5307041c9..5762eba73955c 100644 +--- a/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c ++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9882t.c +@@ -579,13 +579,13 @@ static int ili9882t_prepare(struct drm_panel *panel) + return 0; + + poweroff: ++ gpiod_set_value(ili->enable_gpio, 0); + regulator_disable(ili->avee); + poweroffavdd: + regulator_disable(ili->avdd); + poweroff1v8: + usleep_range(5000, 7000); + regulator_disable(ili->pp1800); +- gpiod_set_value(ili->enable_gpio, 0); + + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-lg-sw43408-add-missing-error-handling.patch b/queue-6.10/drm-panel-lg-sw43408-add-missing-error-handling.patch new file mode 100644 index 00000000000..d96ca020832 --- /dev/null +++ b/queue-6.10/drm-panel-lg-sw43408-add-missing-error-handling.patch @@ -0,0 +1,98 @@ +From ae298f2d804a10720996f73ecc999edba40bbaae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 May 2024 02:00:18 +0300 +Subject: drm/panel: lg-sw43408: add missing error handling + +From: Dmitry Baryshkov + +[ Upstream commit 51f9183e4af8c7f00e81180cbb9ee4a98a0f0aa1 ] + +Add missing error handling for the mipi_dsi_ functions that actually +return error code instead of silently ignoring it. + +Fixes: 069a6c0e94f9 ("drm: panel: Add LG sw43408 panel driver") +Reviewed-by: Douglas Anderson +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240512-dsi-panels-upd-api-v2-1-e31ca14d102e@linaro.org +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20240512-dsi-panels-upd-api-v2-1-e31ca14d102e@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-lg-sw43408.c | 33 +++++++++++++++++++----- + 1 file changed, 27 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-lg-sw43408.c b/drivers/gpu/drm/panel/panel-lg-sw43408.c +index 2b3a73696dcec..67a98ac508f87 100644 +--- a/drivers/gpu/drm/panel/panel-lg-sw43408.c ++++ b/drivers/gpu/drm/panel/panel-lg-sw43408.c +@@ -62,16 +62,25 @@ static int sw43408_program(struct drm_panel *panel) + { + struct sw43408_panel *ctx = to_panel_info(panel); + struct drm_dsc_picture_parameter_set pps; ++ int ret; + + mipi_dsi_dcs_write_seq(ctx->link, MIPI_DCS_SET_GAMMA_CURVE, 0x02); + +- mipi_dsi_dcs_set_tear_on(ctx->link, MIPI_DSI_DCS_TEAR_MODE_VBLANK); ++ ret = mipi_dsi_dcs_set_tear_on(ctx->link, MIPI_DSI_DCS_TEAR_MODE_VBLANK); ++ if (ret < 0) { ++ dev_err(panel->dev, "Failed to set tearing: %d\n", ret); ++ return ret; ++ } + + mipi_dsi_dcs_write_seq(ctx->link, 0x53, 0x0c, 0x30); + mipi_dsi_dcs_write_seq(ctx->link, 0x55, 0x00, 0x70, 0xdf, 0x00, 0x70, 0xdf); + mipi_dsi_dcs_write_seq(ctx->link, 0xf7, 0x01, 0x49, 0x0c); + +- mipi_dsi_dcs_exit_sleep_mode(ctx->link); ++ ret = mipi_dsi_dcs_exit_sleep_mode(ctx->link); ++ if (ret < 0) { ++ dev_err(panel->dev, "Failed to exit sleep mode: %d\n", ret); ++ return ret; ++ } + + msleep(135); + +@@ -97,14 +106,22 @@ static int sw43408_program(struct drm_panel *panel) + mipi_dsi_dcs_write_seq(ctx->link, 0x55, 0x04, 0x61, 0xdb, 0x04, 0x70, 0xdb); + mipi_dsi_dcs_write_seq(ctx->link, 0xb0, 0xca); + +- mipi_dsi_dcs_set_display_on(ctx->link); ++ ret = mipi_dsi_dcs_set_display_on(ctx->link); ++ if (ret < 0) { ++ dev_err(panel->dev, "Failed to set display on: %d\n", ret); ++ return ret; ++ } + + msleep(50); + + ctx->link->mode_flags &= ~MIPI_DSI_MODE_LPM; + + drm_dsc_pps_payload_pack(&pps, ctx->link->dsc); +- mipi_dsi_picture_parameter_set(ctx->link, &pps); ++ ret = mipi_dsi_picture_parameter_set(ctx->link, &pps); ++ if (ret < 0) { ++ dev_err(panel->dev, "Failed to set PPS: %d\n", ret); ++ return ret; ++ } + + ctx->link->mode_flags |= MIPI_DSI_MODE_LPM; + +@@ -113,8 +130,12 @@ static int sw43408_program(struct drm_panel *panel) + * PPS 1 if pps_identifier is 0 + * PPS 2 if pps_identifier is 1 + */ +- mipi_dsi_compression_mode_ext(ctx->link, true, +- MIPI_DSI_COMPRESSION_DSC, 1); ++ ret = mipi_dsi_compression_mode_ext(ctx->link, true, ++ MIPI_DSI_COMPRESSION_DSC, 1); ++ if (ret < 0) { ++ dev_err(panel->dev, "Failed to set compression mode: %d\n", ret); ++ return ret; ++ } + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/drm-panic-depends-on-vt_console.patch b/queue-6.10/drm-panic-depends-on-vt_console.patch new file mode 100644 index 00000000000..fda1b2e683e --- /dev/null +++ b/queue-6.10/drm-panic-depends-on-vt_console.patch @@ -0,0 +1,44 @@ +From d4f6a876d41b462b878c4ce88c7adba272fbb350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 17:40:16 +0200 +Subject: drm/panic: depends on !VT_CONSOLE + +From: Jocelyn Falempe + +[ Upstream commit 1ac6ac9ec069ed0cfdb1c207ae23f6c40ac57437 ] + +The race condition between fbcon and drm_panic can only occurs if +VT_CONSOLE is set. So update drm_panic dependency accordingly. +This will make it easier for Linux distributions to enable drm_panic +by disabling VT_CONSOLE, and keeping fbcon terminal. +The only drawback is that fbcon won't display the boot kmsg, so it +should rely on userspace to do that. +At least plymouth already handle this case with +https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/224 + +Suggested-by: Daniel Vetter +Signed-off-by: Jocelyn Falempe +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20240613154041.325964-1-jfalempe@redhat.com +Stable-dep-of: e044e707fc97 ("drm/panic: Do not select DRM_KMS_HELPER") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index d0aa277fc3bff..3e286236aa430 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -106,7 +106,7 @@ config DRM_KMS_HELPER + + config DRM_PANIC + bool "Display a user-friendly message when a kernel panic occurs" +- depends on DRM && !FRAMEBUFFER_CONSOLE ++ depends on DRM && !(FRAMEBUFFER_CONSOLE && VT_CONSOLE) + select DRM_KMS_HELPER + select FONT_SUPPORT + help +-- +2.43.0 + diff --git a/queue-6.10/drm-panic-do-not-select-drm_kms_helper.patch b/queue-6.10/drm-panic-do-not-select-drm_kms_helper.patch new file mode 100644 index 00000000000..46b4e7e564d --- /dev/null +++ b/queue-6.10/drm-panic-do-not-select-drm_kms_helper.patch @@ -0,0 +1,55 @@ +From 0282f6934231b19151b7c34d0be3c9ced0545e50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 10:41:44 +0200 +Subject: drm/panic: Do not select DRM_KMS_HELPER + +From: Geert Uytterhoeven + +[ Upstream commit e044e707fc97dac693691178cdf41fe1a8da928f ] + +DRM core code cannot call into DRM helper code, as this would lead to +circular references in the modular case. Hence drop the selection of +DRM_KMS_HELPER. It was unused anyway, as v10 switched from using +the DRM format helpers to its own color format conversion, cfr. commit +9544309775c3 ("drm/panic: Add support for color format conversion"). + +Remove the unneeded include of . + +Fixes: bf9fb17c6672 ("drm/panic: Add a drm panic handler") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Jocelyn Falempe +Signed-off-by: Jocelyn Falempe +Link: https://patchwork.freedesktop.org/patch/msgid/60155f8c939ed286e324a7c12a1daa69fe49fcf6.1719391132.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/Kconfig | 1 - + drivers/gpu/drm/drm_panic.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 3e286236aa430..359b68adafc1b 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -107,7 +107,6 @@ config DRM_KMS_HELPER + config DRM_PANIC + bool "Display a user-friendly message when a kernel panic occurs" + depends on DRM && !(FRAMEBUFFER_CONSOLE && VT_CONSOLE) +- select DRM_KMS_HELPER + select FONT_SUPPORT + help + Enable a drm panic handler, which will display a user-friendly message +diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c +index e1c4796685692..831b214975a51 100644 +--- a/drivers/gpu/drm/drm_panic.c ++++ b/drivers/gpu/drm/drm_panic.c +@@ -15,7 +15,6 @@ + #include + + #include +-#include + #include + #include + #include +-- +2.43.0 + diff --git a/queue-6.10/drm-panic-fix-off-by-one-logo-size-checks.patch b/queue-6.10/drm-panic-fix-off-by-one-logo-size-checks.patch new file mode 100644 index 00000000000..1bb24509572 --- /dev/null +++ b/queue-6.10/drm-panic-fix-off-by-one-logo-size-checks.patch @@ -0,0 +1,38 @@ +From fc791007d46f01863795c6a08a3db0582c534ca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 21:18:00 +0200 +Subject: drm/panic: Fix off-by-one logo size checks + +From: Geert Uytterhoeven + +[ Upstream commit 94ff11d3bd32506710ca43569d38420e7fc790c1 ] + +Logos that are either just as wide or just as high as the display work +fine. + +Fixes: bf9fb17c6672868d ("drm/panic: Add a drm panic handler") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Jocelyn Falempe +Signed-off-by: Jocelyn Falempe +Link: https://patchwork.freedesktop.org/patch/msgid/1c9d02463cef3eac22cfac3ac6d1adad369f367b.1718305355.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c +index 056494ae1edef..e1c4796685692 100644 +--- a/drivers/gpu/drm/drm_panic.c ++++ b/drivers/gpu/drm/drm_panic.c +@@ -439,7 +439,7 @@ static void draw_panic_static(struct drm_scanout_buffer *sb) + bg_color, sb->format->cpp[0]); + + if ((r_msg.x1 >= drm_rect_width(&r_logo) || r_msg.y1 >= drm_rect_height(&r_logo)) && +- drm_rect_width(&r_logo) < sb->width && drm_rect_height(&r_logo) < sb->height) { ++ drm_rect_width(&r_logo) <= sb->width && drm_rect_height(&r_logo) <= sb->height) { + draw_txt_rectangle(sb, font, logo, logo_lines, false, &r_logo, fg_color); + } + draw_txt_rectangle(sb, font, panic_msg, msg_lines, true, &r_msg, fg_color); +-- +2.43.0 + diff --git a/queue-6.10/drm-panic-only-draw-the-foreground-color-in-drm_pani.patch b/queue-6.10/drm-panic-only-draw-the-foreground-color-in-drm_pani.patch new file mode 100644 index 00000000000..ff0f06918d2 --- /dev/null +++ b/queue-6.10/drm-panic-only-draw-the-foreground-color-in-drm_pani.patch @@ -0,0 +1,182 @@ +From c965ec5e3b35f0dcf2d7f1218b323175869931ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 11:47:25 +0200 +Subject: drm/panic: only draw the foreground color in drm_panic_blit() + +From: Jocelyn Falempe + +[ Upstream commit eef5a55af31792fc7a2082dbebac68a7df4d7643 ] + +The whole framebuffer is cleared, so it's useless to rewrite the +background colored pixels. It allows to simplify the drawing +functions, and prepare the work for the set_pixel() callback. + +v2: + * keep fg16/fg24/fg32 as variable name for the blit function. + * add drm_panic_is_pixel_fg() to avoid code duplication. + both suggested by Javier Martinez Canillas + +Signed-off-by: Jocelyn Falempe +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20240603095343.39588-2-jfalempe@redhat.com +Stable-dep-of: 94ff11d3bd32 ("drm/panic: Fix off-by-one logo size checks") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panic.c | 67 +++++++++++++++++-------------------- + 1 file changed, 31 insertions(+), 36 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panic.c b/drivers/gpu/drm/drm_panic.c +index 7ece67086cecb..056494ae1edef 100644 +--- a/drivers/gpu/drm/drm_panic.c ++++ b/drivers/gpu/drm/drm_panic.c +@@ -194,40 +194,42 @@ static u32 convert_from_xrgb8888(u32 color, u32 format) + /* + * Blit & Fill + */ ++/* check if the pixel at coord x,y is 1 (foreground) or 0 (background) */ ++static bool drm_panic_is_pixel_fg(const u8 *sbuf8, unsigned int spitch, int x, int y) ++{ ++ return (sbuf8[(y * spitch) + x / 8] & (0x80 >> (x % 8))) != 0; ++} ++ + static void drm_panic_blit16(struct iosys_map *dmap, unsigned int dpitch, + const u8 *sbuf8, unsigned int spitch, + unsigned int height, unsigned int width, +- u16 fg16, u16 bg16) ++ u16 fg16) + { + unsigned int y, x; +- u16 val16; + +- for (y = 0; y < height; y++) { +- for (x = 0; x < width; x++) { +- val16 = (sbuf8[(y * spitch) + x / 8] & (0x80 >> (x % 8))) ? fg16 : bg16; +- iosys_map_wr(dmap, y * dpitch + x * sizeof(u16), u16, val16); +- } +- } ++ for (y = 0; y < height; y++) ++ for (x = 0; x < width; x++) ++ if (drm_panic_is_pixel_fg(sbuf8, spitch, x, y)) ++ iosys_map_wr(dmap, y * dpitch + x * sizeof(u16), u16, fg16); + } + + static void drm_panic_blit24(struct iosys_map *dmap, unsigned int dpitch, + const u8 *sbuf8, unsigned int spitch, + unsigned int height, unsigned int width, +- u32 fg32, u32 bg32) ++ u32 fg32) + { + unsigned int y, x; +- u32 val32; + + for (y = 0; y < height; y++) { + for (x = 0; x < width; x++) { + u32 off = y * dpitch + x * 3; + +- val32 = (sbuf8[(y * spitch) + x / 8] & (0x80 >> (x % 8))) ? fg32 : bg32; +- +- /* write blue-green-red to output in little endianness */ +- iosys_map_wr(dmap, off, u8, (val32 & 0x000000FF) >> 0); +- iosys_map_wr(dmap, off + 1, u8, (val32 & 0x0000FF00) >> 8); +- iosys_map_wr(dmap, off + 2, u8, (val32 & 0x00FF0000) >> 16); ++ if (drm_panic_is_pixel_fg(sbuf8, spitch, x, y)) { ++ /* write blue-green-red to output in little endianness */ ++ iosys_map_wr(dmap, off, u8, (fg32 & 0x000000FF) >> 0); ++ iosys_map_wr(dmap, off + 1, u8, (fg32 & 0x0000FF00) >> 8); ++ iosys_map_wr(dmap, off + 2, u8, (fg32 & 0x00FF0000) >> 16); ++ } + } + } + } +@@ -235,17 +237,14 @@ static void drm_panic_blit24(struct iosys_map *dmap, unsigned int dpitch, + static void drm_panic_blit32(struct iosys_map *dmap, unsigned int dpitch, + const u8 *sbuf8, unsigned int spitch, + unsigned int height, unsigned int width, +- u32 fg32, u32 bg32) ++ u32 fg32) + { + unsigned int y, x; +- u32 val32; + +- for (y = 0; y < height; y++) { +- for (x = 0; x < width; x++) { +- val32 = (sbuf8[(y * spitch) + x / 8] & (0x80 >> (x % 8))) ? fg32 : bg32; +- iosys_map_wr(dmap, y * dpitch + x * sizeof(u32), u32, val32); +- } +- } ++ for (y = 0; y < height; y++) ++ for (x = 0; x < width; x++) ++ if (drm_panic_is_pixel_fg(sbuf8, spitch, x, y)) ++ iosys_map_wr(dmap, y * dpitch + x * sizeof(u32), u32, fg32); + } + + /* +@@ -257,7 +256,6 @@ static void drm_panic_blit32(struct iosys_map *dmap, unsigned int dpitch, + * @height: height of the image to copy, in pixels + * @width: width of the image to copy, in pixels + * @fg_color: foreground color, in destination format +- * @bg_color: background color, in destination format + * @pixel_width: pixel width in bytes. + * + * This can be used to draw a font character, which is a monochrome image, to a +@@ -266,21 +264,20 @@ static void drm_panic_blit32(struct iosys_map *dmap, unsigned int dpitch, + static void drm_panic_blit(struct iosys_map *dmap, unsigned int dpitch, + const u8 *sbuf8, unsigned int spitch, + unsigned int height, unsigned int width, +- u32 fg_color, u32 bg_color, +- unsigned int pixel_width) ++ u32 fg_color, unsigned int pixel_width) + { + switch (pixel_width) { + case 2: + drm_panic_blit16(dmap, dpitch, sbuf8, spitch, +- height, width, fg_color, bg_color); ++ height, width, fg_color); + break; + case 3: + drm_panic_blit24(dmap, dpitch, sbuf8, spitch, +- height, width, fg_color, bg_color); ++ height, width, fg_color); + break; + case 4: + drm_panic_blit32(dmap, dpitch, sbuf8, spitch, +- height, width, fg_color, bg_color); ++ height, width, fg_color); + break; + default: + WARN_ONCE(1, "Can't blit with pixel width %d\n", pixel_width); +@@ -381,8 +378,7 @@ static void draw_txt_rectangle(struct drm_scanout_buffer *sb, + unsigned int msg_lines, + bool centered, + struct drm_rect *clip, +- u32 fg_color, +- u32 bg_color) ++ u32 color) + { + int i, j; + const u8 *src; +@@ -404,8 +400,7 @@ static void draw_txt_rectangle(struct drm_scanout_buffer *sb, + for (j = 0; j < line_len; j++) { + src = get_char_bitmap(font, msg[i].txt[j], font_pitch); + drm_panic_blit(&dst, sb->pitch[0], src, font_pitch, +- font->height, font->width, +- fg_color, bg_color, px_width); ++ font->height, font->width, color, px_width); + iosys_map_incr(&dst, font->width * px_width); + } + } +@@ -445,9 +440,9 @@ static void draw_panic_static(struct drm_scanout_buffer *sb) + + if ((r_msg.x1 >= drm_rect_width(&r_logo) || r_msg.y1 >= drm_rect_height(&r_logo)) && + drm_rect_width(&r_logo) < sb->width && drm_rect_height(&r_logo) < sb->height) { +- draw_txt_rectangle(sb, font, logo, logo_lines, false, &r_logo, fg_color, bg_color); ++ draw_txt_rectangle(sb, font, logo, logo_lines, false, &r_logo, fg_color); + } +- draw_txt_rectangle(sb, font, panic_msg, msg_lines, true, &r_msg, fg_color, bg_color); ++ draw_txt_rectangle(sb, font, panic_msg, msg_lines, true, &r_msg, fg_color); + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/drm-panthor-record-devfreq-busy-as-soon-as-a-job-is-.patch b/queue-6.10/drm-panthor-record-devfreq-busy-as-soon-as-a-job-is-.patch new file mode 100644 index 00000000000..0665d3fb04d --- /dev/null +++ b/queue-6.10/drm-panthor-record-devfreq-busy-as-soon-as-a-job-is-.patch @@ -0,0 +1,44 @@ +From ccc934e9be4881f00c5e194d188f1e2990632f8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 16:56:46 +0100 +Subject: drm/panthor: Record devfreq busy as soon as a job is started + +From: Steven Price + +[ Upstream commit 896868eded124059023be0af92d68cdaf9b4de70 ] + +If a queue is already assigned to the hardware, then a newly submitted +job can start straight away without waiting for the tick. However in +this case the devfreq infrastructure isn't notified that the GPU is +busy. By the time the tick happens the job might well have finished and +no time will be accounted for the GPU being busy. + +Fix this by recording the GPU as busy directly in queue_run_job() in the +case where there is a CSG assigned and therefore we just ring the +doorbell. + +Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") +Signed-off-by: Steven Price +Reviewed-by: Boris Brezillon +Reviewed-by: Liviu Dudau +Link: https://patchwork.freedesktop.org/patch/msgid/20240703155646.80928-1-steven.price@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panthor/panthor_sched.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c +index 9a0ff48f7061d..463bcd3cf00f3 100644 +--- a/drivers/gpu/drm/panthor/panthor_sched.c ++++ b/drivers/gpu/drm/panthor/panthor_sched.c +@@ -2939,6 +2939,7 @@ queue_run_job(struct drm_sched_job *sched_job) + pm_runtime_get(ptdev->base.dev); + sched->pm.has_ref = true; + } ++ panthor_devfreq_record_busy(sched->ptdev); + } + + /* Update the last fence. */ +-- +2.43.0 + diff --git a/queue-6.10/drm-qxl-add-check-for-drm_cvt_mode.patch b/queue-6.10/drm-qxl-add-check-for-drm_cvt_mode.patch new file mode 100644 index 00000000000..5bafe68db97 --- /dev/null +++ b/queue-6.10/drm-qxl-add-check-for-drm_cvt_mode.patch @@ -0,0 +1,39 @@ +From 6008e2734f09c19509133b5f1ba04e7fea0fe812 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 15:10:31 +0800 +Subject: drm/qxl: Add check for drm_cvt_mode + +From: Chen Ni + +[ Upstream commit 7bd09a2db0f617377027a2bb0b9179e6959edff3 ] + +Add check for the return value of drm_cvt_mode() and return the error if +it fails in order to avoid NULL pointer dereference. + +Fixes: 1b043677d4be ("drm/qxl: add qxl_add_mode helper function") +Signed-off-by: Chen Ni +Reviewed-by: Heng Qi +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240621071031.1987974-1-nichen@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index c6d35c33d5d63..86a5dea710c0f 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -236,6 +236,9 @@ static int qxl_add_mode(struct drm_connector *connector, + return 0; + + mode = drm_cvt_mode(dev, width, height, 60, false, false, false); ++ if (!mode) ++ return 0; ++ + if (preferred) + mode->type |= DRM_MODE_TYPE_PREFERRED; + mode->hdisplay = width; +-- +2.43.0 + diff --git a/queue-6.10/drm-qxl-pin-buffer-objects-for-internal-mappings.patch b/queue-6.10/drm-qxl-pin-buffer-objects-for-internal-mappings.patch new file mode 100644 index 00000000000..3156f0de38b --- /dev/null +++ b/queue-6.10/drm-qxl-pin-buffer-objects-for-internal-mappings.patch @@ -0,0 +1,179 @@ +From ef48f8bcbbd4af3a6abac302a926baaf4d2f24f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 16:21:37 +0200 +Subject: drm/qxl: Pin buffer objects for internal mappings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +[ Upstream commit c537fb4e3d36e7cd1a0837dd577cd30d3d64f1bc ] + +Add qxl_bo_pin_and_vmap() that pins and vmaps a buffer object in one +step. Update callers of the regular qxl_bo_vmap(). Fixes a bug where +qxl accesses an unpinned buffer object while it is being moved; such +as with the monitor-description BO. An typical error is shown below. + +[ 4.303586] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1 wrong: 65376256x16777216+0+0 +[ 4.586883] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1 wrong: 65376256x16777216+0+0 +[ 4.904036] [drm:drm_atomic_helper_commit_planes] *ERROR* head 1 wrong: 65335296x16777216+0+0 +[ 5.374347] [drm:qxl_release_from_id_locked] *ERROR* failed to find id in release_idr + +Commit b33651a5c98d ("drm/qxl: Do not pin buffer objects for vmap") +removed the implicit pin operation from qxl's vmap code. This is the +correct behavior for GEM and PRIME interfaces, but the pin is still +needed for qxl internal operation. + +Also add a corresponding function qxl_bo_vunmap_and_unpin() and remove +the old qxl_bo_vmap() helpers. + +Future directions: BOs should not be pinned or vmapped unnecessarily. +The pin-and-vmap operation should be removed from the driver and a +temporary mapping should be established with a vmap_local-like helper. +See the client helper drm_client_buffer_vmap_local() for semantics. + +v2: +- unreserve BO on errors in qxl_bo_pin_and_vmap() (Dmitry) + +Signed-off-by: Thomas Zimmermann +Fixes: b33651a5c98d ("drm/qxl: Do not pin buffer objects for vmap") +Reported-by: David Kaplan +Closes: https://lore.kernel.org/dri-devel/ab0fb17d-0f96-4ee6-8b21-65d02bb02655@suse.de/ +Tested-by: David Kaplan +Reviewed-by: Daniel Vetter +Cc: Thomas Zimmermann +Cc: Dmitry Osipenko +Cc: Christian König +Cc: Zack Rusin +Cc: Dave Airlie +Cc: Gerd Hoffmann +Cc: virtualization@lists.linux.dev +Cc: spice-devel@lists.freedesktop.org +Reviewed-by: Dmitry Osipenko +Reviewed-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20240708142208.194361-1-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_display.c | 14 +++++++------- + drivers/gpu/drm/qxl/qxl_object.c | 13 +++++++++++-- + drivers/gpu/drm/qxl/qxl_object.h | 4 ++-- + 3 files changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index 86a5dea710c0f..bc24af08dfcd5 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -584,11 +584,11 @@ static struct qxl_bo *qxl_create_cursor(struct qxl_device *qdev, + if (ret) + goto err; + +- ret = qxl_bo_vmap(cursor_bo, &cursor_map); ++ ret = qxl_bo_pin_and_vmap(cursor_bo, &cursor_map); + if (ret) + goto err_unref; + +- ret = qxl_bo_vmap(user_bo, &user_map); ++ ret = qxl_bo_pin_and_vmap(user_bo, &user_map); + if (ret) + goto err_unmap; + +@@ -614,12 +614,12 @@ static struct qxl_bo *qxl_create_cursor(struct qxl_device *qdev, + user_map.vaddr, size); + } + +- qxl_bo_vunmap(user_bo); +- qxl_bo_vunmap(cursor_bo); ++ qxl_bo_vunmap_and_unpin(user_bo); ++ qxl_bo_vunmap_and_unpin(cursor_bo); + return cursor_bo; + + err_unmap: +- qxl_bo_vunmap(cursor_bo); ++ qxl_bo_vunmap_and_unpin(cursor_bo); + err_unref: + qxl_bo_unpin(cursor_bo); + qxl_bo_unref(&cursor_bo); +@@ -1205,7 +1205,7 @@ int qxl_create_monitors_object(struct qxl_device *qdev) + } + qdev->monitors_config_bo = gem_to_qxl_bo(gobj); + +- ret = qxl_bo_vmap(qdev->monitors_config_bo, &map); ++ ret = qxl_bo_pin_and_vmap(qdev->monitors_config_bo, &map); + if (ret) + return ret; + +@@ -1236,7 +1236,7 @@ int qxl_destroy_monitors_object(struct qxl_device *qdev) + qdev->monitors_config = NULL; + qdev->ram_header->monitors_config = 0; + +- ret = qxl_bo_vunmap(qdev->monitors_config_bo); ++ ret = qxl_bo_vunmap_and_unpin(qdev->monitors_config_bo); + if (ret) + return ret; + +diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c +index 5893e27a7ae50..66635c55cf857 100644 +--- a/drivers/gpu/drm/qxl/qxl_object.c ++++ b/drivers/gpu/drm/qxl/qxl_object.c +@@ -182,7 +182,7 @@ int qxl_bo_vmap_locked(struct qxl_bo *bo, struct iosys_map *map) + return 0; + } + +-int qxl_bo_vmap(struct qxl_bo *bo, struct iosys_map *map) ++int qxl_bo_pin_and_vmap(struct qxl_bo *bo, struct iosys_map *map) + { + int r; + +@@ -190,7 +190,15 @@ int qxl_bo_vmap(struct qxl_bo *bo, struct iosys_map *map) + if (r) + return r; + ++ r = qxl_bo_pin_locked(bo); ++ if (r) { ++ qxl_bo_unreserve(bo); ++ return r; ++ } ++ + r = qxl_bo_vmap_locked(bo, map); ++ if (r) ++ qxl_bo_unpin_locked(bo); + qxl_bo_unreserve(bo); + return r; + } +@@ -241,7 +249,7 @@ void qxl_bo_vunmap_locked(struct qxl_bo *bo) + ttm_bo_vunmap(&bo->tbo, &bo->map); + } + +-int qxl_bo_vunmap(struct qxl_bo *bo) ++int qxl_bo_vunmap_and_unpin(struct qxl_bo *bo) + { + int r; + +@@ -250,6 +258,7 @@ int qxl_bo_vunmap(struct qxl_bo *bo) + return r; + + qxl_bo_vunmap_locked(bo); ++ qxl_bo_unpin_locked(bo); + qxl_bo_unreserve(bo); + return 0; + } +diff --git a/drivers/gpu/drm/qxl/qxl_object.h b/drivers/gpu/drm/qxl/qxl_object.h +index 1cf5bc7591016..875f63221074c 100644 +--- a/drivers/gpu/drm/qxl/qxl_object.h ++++ b/drivers/gpu/drm/qxl/qxl_object.h +@@ -59,9 +59,9 @@ extern int qxl_bo_create(struct qxl_device *qdev, + u32 priority, + struct qxl_surface *surf, + struct qxl_bo **bo_ptr); +-int qxl_bo_vmap(struct qxl_bo *bo, struct iosys_map *map); ++int qxl_bo_pin_and_vmap(struct qxl_bo *bo, struct iosys_map *map); + int qxl_bo_vmap_locked(struct qxl_bo *bo, struct iosys_map *map); +-int qxl_bo_vunmap(struct qxl_bo *bo); ++int qxl_bo_vunmap_and_unpin(struct qxl_bo *bo); + void qxl_bo_vunmap_locked(struct qxl_bo *bo); + void *qxl_bo_kmap_atomic_page(struct qxl_device *qdev, struct qxl_bo *bo, int page_offset); + void qxl_bo_kunmap_atomic_page(struct qxl_device *qdev, struct qxl_bo *bo, void *map); +-- +2.43.0 + diff --git a/queue-6.10/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch b/queue-6.10/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch new file mode 100644 index 00000000000..cf11e4252f3 --- /dev/null +++ b/queue-6.10/drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch @@ -0,0 +1,38 @@ +From 5f794d82ebb72bc299b5eec396caaa3b53f77e8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 18:19:05 +0800 +Subject: drm/rockchip: vop2: Fix the port mux of VP2 + +From: Andy Yan + +[ Upstream commit 2bdb481bf7a93c22b9fea8daefa2834aab23a70f ] + +The port mux of VP2 should be RK3568_OVL_PORT_SET__PORT2_MUX. + +Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") +Signed-off-by: Andy Yan +Acked-by: Sascha Hauer +Tested-by: Heiko Stuebner +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20240422101905.32703-2-andyshrk@163.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +index 62ebbdb16253d..9873172e3fd33 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +@@ -2344,7 +2344,7 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp) + port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX, + (vp2->nlayers + vp1->nlayers + vp0->nlayers - 1)); + else +- port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT1_MUX, 8); ++ port_sel |= FIELD_PREP(RK3568_OVL_PORT_SET__PORT2_MUX, 8); + + layer_sel = vop2_readl(vop2, RK3568_OVL_LAYER_SEL); + +-- +2.43.0 + diff --git a/queue-6.10/drm-ttm-tests-fix-a-warning-in-ttm_bo_unreserve_bulk.patch b/queue-6.10/drm-ttm-tests-fix-a-warning-in-ttm_bo_unreserve_bulk.patch new file mode 100644 index 00000000000..85d49fb5a67 --- /dev/null +++ b/queue-6.10/drm-ttm-tests-fix-a-warning-in-ttm_bo_unreserve_bulk.patch @@ -0,0 +1,365 @@ +From d1f063002931db6f6a131965c46875fdc6bee574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 14:02:55 +0200 +Subject: drm/ttm/tests: Fix a warning in ttm_bo_unreserve_bulk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Karolina Stolarek + +[ Upstream commit 588c4c8d58c413b52c68193bdb741cfbf1040a77 ] + +BOs in a bulk move have to share the same reservation object. That is +not the case in the ttm_bo_unreserve_bulk subtest. Update +ttm_bo_kunit_init() helper to accept dma_resv object so we can define +buffer objects that share the same resv. Update calls to that helper +accordingly. + +Fixes: 995279d280d1 ("drm/ttm/tests: Add tests for ttm_bo functions") +Suggested-by: Christian König +Signed-off-by: Karolina Stolarek +Reviewed-by: Thomas Hellström +Signed-off-by: Arunpravin Paneer Selvam +Link: https://patchwork.freedesktop.org/patch/msgid/c5bd2df114781b4eb5c1e8295b2ae4ac2c30a179.1718192625.git.karolina.stolarek@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 40 +++++++++++-------- + drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c | 7 +++- + drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.h | 3 +- + drivers/gpu/drm/ttm/tests/ttm_pool_test.c | 4 +- + drivers/gpu/drm/ttm/tests/ttm_resource_test.c | 2 +- + drivers/gpu/drm/ttm/tests/ttm_tt_test.c | 20 +++++----- + 6 files changed, 45 insertions(+), 31 deletions(-) + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +index 9cc367a795341..801bb139075f3 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +@@ -62,7 +62,7 @@ static void ttm_bo_reserve_optimistic_no_ticket(struct kunit *test) + struct ttm_buffer_object *bo; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_bo_reserve(bo, params->interruptible, params->no_wait, NULL); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -77,7 +77,7 @@ static void ttm_bo_reserve_locked_no_sleep(struct kunit *test) + bool no_wait = true; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + /* Let's lock it beforehand */ + dma_resv_lock(bo->base.resv, NULL); +@@ -98,7 +98,7 @@ static void ttm_bo_reserve_no_wait_ticket(struct kunit *test) + + ww_acquire_init(&ctx, &reservation_ww_class); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_bo_reserve(bo, interruptible, no_wait, &ctx); + KUNIT_ASSERT_EQ(test, err, -EBUSY); +@@ -116,7 +116,7 @@ static void ttm_bo_reserve_double_resv(struct kunit *test) + + ww_acquire_init(&ctx, &reservation_ww_class); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_bo_reserve(bo, interruptible, no_wait, &ctx); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -144,8 +144,8 @@ static void ttm_bo_reserve_deadlock(struct kunit *test) + bool no_wait = false; + int err; + +- bo1 = ttm_bo_kunit_init(test, test->priv, BO_SIZE); +- bo2 = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo1 = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); ++ bo2 = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + ww_acquire_init(&ctx1, &reservation_ww_class); + ww_mutex_base_lock(&bo2->base.resv->lock.base); +@@ -214,7 +214,7 @@ static void ttm_bo_reserve_interrupted(struct kunit *test) + struct task_struct *task; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + task = kthread_create(threaded_ttm_bo_reserve, bo, "ttm-bo-reserve"); + +@@ -255,7 +255,7 @@ static void ttm_bo_unreserve_basic(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + bo->priority = bo_prio; + + err = ttm_resource_alloc(bo, place, &res1); +@@ -294,7 +294,7 @@ static void ttm_bo_unreserve_pinned(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + place = ttm_place_kunit_init(test, mem_type, 0); + + dma_resv_lock(bo->base.resv, NULL); +@@ -327,6 +327,7 @@ static void ttm_bo_unreserve_bulk(struct kunit *test) + struct ttm_resource *res1, *res2; + struct ttm_device *ttm_dev; + struct ttm_place *place; ++ struct dma_resv *resv; + uint32_t mem_type = TTM_PL_SYSTEM; + unsigned int bo_priority = 0; + int err; +@@ -338,12 +339,17 @@ static void ttm_bo_unreserve_bulk(struct kunit *test) + ttm_dev = kunit_kzalloc(test, sizeof(*ttm_dev), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, ttm_dev); + ++ resv = kunit_kzalloc(test, sizeof(*resv), GFP_KERNEL); ++ KUNIT_ASSERT_NOT_NULL(test, ttm_dev); ++ + err = ttm_device_kunit_init(priv, ttm_dev, false, false); + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo1 = ttm_bo_kunit_init(test, test->priv, BO_SIZE); +- bo2 = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ dma_resv_init(resv); ++ ++ bo1 = ttm_bo_kunit_init(test, test->priv, BO_SIZE, resv); ++ bo2 = ttm_bo_kunit_init(test, test->priv, BO_SIZE, resv); + + dma_resv_lock(bo1->base.resv, NULL); + ttm_bo_set_bulk_move(bo1, &lru_bulk_move); +@@ -369,6 +375,8 @@ static void ttm_bo_unreserve_bulk(struct kunit *test) + + ttm_resource_free(bo1, &res1); + ttm_resource_free(bo2, &res2); ++ ++ dma_resv_fini(resv); + } + + static void ttm_bo_put_basic(struct kunit *test) +@@ -390,7 +398,7 @@ static void ttm_bo_put_basic(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + bo->type = ttm_bo_type_device; + + err = ttm_resource_alloc(bo, place, &res); +@@ -451,7 +459,7 @@ static void ttm_bo_put_shared_resv(struct kunit *test) + + dma_fence_signal(fence); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + bo->type = ttm_bo_type_device; + bo->base.resv = external_resv; + +@@ -473,7 +481,7 @@ static void ttm_bo_pin_basic(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + for (int i = 0; i < no_pins; i++) { + dma_resv_lock(bo->base.resv, NULL); +@@ -508,7 +516,7 @@ static void ttm_bo_pin_unpin_resource(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_resource_alloc(bo, place, &res); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -559,7 +567,7 @@ static void ttm_bo_multiple_pin_one_unpin(struct kunit *test) + KUNIT_ASSERT_EQ(test, err, 0); + priv->ttm_dev = ttm_dev; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_resource_alloc(bo, place, &res); + KUNIT_ASSERT_EQ(test, err, 0); +diff --git a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c +index 7b7c1fa805fcb..5be317a0af56b 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c +@@ -51,7 +51,8 @@ EXPORT_SYMBOL_GPL(ttm_device_kunit_init); + + struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test, + struct ttm_test_devices *devs, +- size_t size) ++ size_t size, ++ struct dma_resv *obj) + { + struct drm_gem_object gem_obj = { }; + struct ttm_buffer_object *bo; +@@ -61,6 +62,10 @@ struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test, + KUNIT_ASSERT_NOT_NULL(test, bo); + + bo->base = gem_obj; ++ ++ if (obj) ++ bo->base.resv = obj; ++ + err = drm_gem_object_init(devs->drm, &bo->base, size); + KUNIT_ASSERT_EQ(test, err, 0); + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.h b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.h +index 2f51c833a5367..c83d31b23c9aa 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.h ++++ b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.h +@@ -28,7 +28,8 @@ int ttm_device_kunit_init(struct ttm_test_devices *priv, + bool use_dma32); + struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test, + struct ttm_test_devices *devs, +- size_t size); ++ size_t size, ++ struct dma_resv *obj); + struct ttm_place *ttm_place_kunit_init(struct kunit *test, + uint32_t mem_type, uint32_t flags); + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_pool_test.c b/drivers/gpu/drm/ttm/tests/ttm_pool_test.c +index 0a3fede84da92..4643f91c6bd59 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_pool_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_pool_test.c +@@ -57,7 +57,7 @@ static struct ttm_tt *ttm_tt_kunit_init(struct kunit *test, + struct ttm_tt *tt; + int err; + +- bo = ttm_bo_kunit_init(test, priv->devs, size); ++ bo = ttm_bo_kunit_init(test, priv->devs, size, NULL); + KUNIT_ASSERT_NOT_NULL(test, bo); + priv->mock_bo = bo; + +@@ -209,7 +209,7 @@ static void ttm_pool_alloc_basic_dma_addr(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, devs, size); ++ bo = ttm_bo_kunit_init(test, devs, size, NULL); + KUNIT_ASSERT_NOT_NULL(test, bo); + + err = ttm_sg_tt_init(tt, bo, 0, caching); +diff --git a/drivers/gpu/drm/ttm/tests/ttm_resource_test.c b/drivers/gpu/drm/ttm/tests/ttm_resource_test.c +index 029e1f094bb08..67584058dadbc 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_resource_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_resource_test.c +@@ -54,7 +54,7 @@ static void ttm_init_test_mocks(struct kunit *test, + /* Make sure we have what we need for a good BO mock */ + KUNIT_ASSERT_NOT_NULL(test, priv->devs->ttm_dev); + +- priv->bo = ttm_bo_kunit_init(test, priv->devs, size); ++ priv->bo = ttm_bo_kunit_init(test, priv->devs, size, NULL); + priv->place = ttm_place_kunit_init(test, mem_type, flags); + } + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_tt_test.c b/drivers/gpu/drm/ttm/tests/ttm_tt_test.c +index fd4502c18de67..67bf51723c92f 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_tt_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_tt_test.c +@@ -63,7 +63,7 @@ static void ttm_tt_init_basic(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, params->size); ++ bo = ttm_bo_kunit_init(test, test->priv, params->size, NULL); + + err = ttm_tt_init(tt, bo, page_flags, caching, extra_pages); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -89,7 +89,7 @@ static void ttm_tt_init_misaligned(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, size); ++ bo = ttm_bo_kunit_init(test, test->priv, size, NULL); + + /* Make the object size misaligned */ + bo->base.size += 1; +@@ -110,7 +110,7 @@ static void ttm_tt_fini_basic(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_tt_init(tt, bo, 0, caching, 0); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -130,7 +130,7 @@ static void ttm_tt_fini_sg(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_sg_tt_init(tt, bo, 0, caching); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -151,7 +151,7 @@ static void ttm_tt_fini_shmem(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_tt_init(tt, bo, 0, caching, 0); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -168,7 +168,7 @@ static void ttm_tt_create_basic(struct kunit *test) + struct ttm_buffer_object *bo; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + bo->type = ttm_bo_type_device; + + dma_resv_lock(bo->base.resv, NULL); +@@ -187,7 +187,7 @@ static void ttm_tt_create_invalid_bo_type(struct kunit *test) + struct ttm_buffer_object *bo; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + bo->type = ttm_bo_type_sg + 1; + + dma_resv_lock(bo->base.resv, NULL); +@@ -208,7 +208,7 @@ static void ttm_tt_create_ttm_exists(struct kunit *test) + tt = kunit_kzalloc(test, sizeof(*tt), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, tt); + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + err = ttm_tt_init(tt, bo, 0, caching, 0); + KUNIT_ASSERT_EQ(test, err, 0); +@@ -239,7 +239,7 @@ static void ttm_tt_create_failed(struct kunit *test) + struct ttm_buffer_object *bo; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + /* Update ttm_device_funcs so we don't alloc ttm_tt */ + devs->ttm_dev->funcs = &ttm_dev_empty_funcs; +@@ -257,7 +257,7 @@ static void ttm_tt_destroy_basic(struct kunit *test) + struct ttm_buffer_object *bo; + int err; + +- bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE); ++ bo = ttm_bo_kunit_init(test, test->priv, BO_SIZE, NULL); + + dma_resv_lock(bo->base.resv, NULL); + err = ttm_tt_create(bo, false); +-- +2.43.0 + diff --git a/queue-6.10/drm-ttm-tests-let-ttm_bo_test-consider-different-ww_.patch b/queue-6.10/drm-ttm-tests-let-ttm_bo_test-consider-different-ww_.patch new file mode 100644 index 00000000000..7857f6ca61d --- /dev/null +++ b/queue-6.10/drm-ttm-tests-let-ttm_bo_test-consider-different-ww_.patch @@ -0,0 +1,63 @@ +From 29c4cbbd9e4b95a321d71746e7343b777cc5b637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 16:46:30 +0200 +Subject: drm/ttm/tests: Let ttm_bo_test consider different ww_mutex + implementation. + +From: Sebastian Andrzej Siewior + +[ Upstream commit f85376c890ef470b64a7fea22eea5af18822f05c ] + +PREEMPT_RT has a different locking implementation for ww_mutex. The +base mutex of struct ww_mutex is declared as struct WW_MUTEX_BASE. The +latter is defined as `mutex' for non-PREEMPT_RT builds and `rt_mutex' +for PREEMPT_RT builds. + +Using mutex_lock() directly on the base mutex in +ttm_bo_reserve_deadlock() leads to compile error on PREEMPT_RT. + +The locking-selftest has its own defines to deal with this and it is +probably best to defines the needed one within the test program since +their usefulness is limited outside of well known selftests. + +Provide ww_mutex_base_lock() which points to the correct function for +PREEMPT_RT and non-PREEMPT_RT builds. + +Fixes: 995279d280d1e ("drm/ttm/tests: Add tests for ttm_bo functions") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20240619144630.4DliKOmr@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/tests/ttm_bo_test.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +index 1f8a4f8adc929..9cc367a795341 100644 +--- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c ++++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c +@@ -18,6 +18,12 @@ + + #define BO_SIZE SZ_8K + ++#ifdef CONFIG_PREEMPT_RT ++#define ww_mutex_base_lock(b) rt_mutex_lock(b) ++#else ++#define ww_mutex_base_lock(b) mutex_lock(b) ++#endif ++ + struct ttm_bo_test_case { + const char *description; + bool interruptible; +@@ -142,7 +148,7 @@ static void ttm_bo_reserve_deadlock(struct kunit *test) + bo2 = ttm_bo_kunit_init(test, test->priv, BO_SIZE); + + ww_acquire_init(&ctx1, &reservation_ww_class); +- mutex_lock(&bo2->base.resv->lock.base); ++ ww_mutex_base_lock(&bo2->base.resv->lock.base); + + /* The deadlock will be caught by WW mutex, don't warn about it */ + lock_release(&bo2->base.resv->lock.base.dep_map, 1); +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-display-xe_hdcp_gsc-free-arbiter-on-driver-re.patch b/queue-6.10/drm-xe-display-xe_hdcp_gsc-free-arbiter-on-driver-re.patch new file mode 100644 index 00000000000..85e22689de2 --- /dev/null +++ b/queue-6.10/drm-xe-display-xe_hdcp_gsc-free-arbiter-on-driver-re.patch @@ -0,0 +1,54 @@ +From 8e2e7e9d8252b00cd18625bf08d13c1155fc9076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 14:59:18 +0200 +Subject: drm/xe/display/xe_hdcp_gsc: Free arbiter on driver removal + +From: Nirmoy Das + +[ Upstream commit 609458abd5a10180f513ca364d6c0ae30128c821 ] + +Free arbiter allocated in intel_hdcp_gsc_init(). + +Fixes: 152f2df954d8 ("drm/xe/hdcp: Enable HDCP for XE") +Cc: Suraj Kandpal +Cc: Arun R Murthy +Cc: Lucas De Marchi +Cc: Rodrigo Vivi +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20240708125918.23573-1-nirmoy.das@intel.com +Signed-off-by: Nirmoy Das +(cherry picked from commit 33891539f9d6f245e93a76e3fb5791338180374f) +Signed-off-by: Lucas De Marchi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/display/xe_hdcp_gsc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c b/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c +index d46f87a039f20..b3d3c065dd9d8 100644 +--- a/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c ++++ b/drivers/gpu/drm/xe/display/xe_hdcp_gsc.c +@@ -159,12 +159,16 @@ void intel_hdcp_gsc_fini(struct xe_device *xe) + { + struct intel_hdcp_gsc_message *hdcp_message = + xe->display.hdcp.hdcp_message; ++ struct i915_hdcp_arbiter *arb = xe->display.hdcp.arbiter; + +- if (!hdcp_message) +- return; ++ if (hdcp_message) { ++ xe_bo_unpin_map_no_vm(hdcp_message->hdcp_bo); ++ kfree(hdcp_message); ++ xe->display.hdcp.hdcp_message = NULL; ++ } + +- xe_bo_unpin_map_no_vm(hdcp_message->hdcp_bo); +- kfree(hdcp_message); ++ kfree(arb); ++ xe->display.hdcp.arbiter = NULL; + } + + static int xe_gsc_send_sync(struct xe_device *xe, +-- +2.43.0 + diff --git a/queue-6.10/drm-zynqmp_dpsub-fix-an-error-handling-path-in-zynqm.patch b/queue-6.10/drm-zynqmp_dpsub-fix-an-error-handling-path-in-zynqm.patch new file mode 100644 index 00000000000..4a411b88fa9 --- /dev/null +++ b/queue-6.10/drm-zynqmp_dpsub-fix-an-error-handling-path-in-zynqm.patch @@ -0,0 +1,38 @@ +From c737a5a15519c8ebe3b7c9122d652a89ddaf4c4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 11:40:37 +0200 +Subject: drm: zynqmp_dpsub: Fix an error handling path in zynqmp_dpsub_probe() + +From: Christophe JAILLET + +[ Upstream commit 4ea3deda1341fef7b923ad9cfe5dd46b1b51bfa8 ] + +If zynqmp_dpsub_drm_init() fails, we must undo the previous +drm_bridge_add() call. + +Fixes: be3f3042391d ("drm: zynqmp_dpsub: Always register bridge") +Signed-off-by: Christophe JAILLET +Reviewed-by: Sean Anderson +Reviewed-by: Laurent Pinchart +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/974d1b062d7c61ee6db00d16fa7c69aa1218ee02.1716198025.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +index face8d6b2a6fb..f5781939de9c3 100644 +--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c +@@ -269,6 +269,7 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev) + return 0; + + err_disp: ++ drm_bridge_remove(dpsub->bridge); + zynqmp_disp_remove(dpsub); + err_dp: + zynqmp_dp_remove(dpsub); +-- +2.43.0 + diff --git a/queue-6.10/drm-zynqmp_kms-fix-aux-bus-not-getting-unregistered.patch b/queue-6.10/drm-zynqmp_kms-fix-aux-bus-not-getting-unregistered.patch new file mode 100644 index 00000000000..b5d2a24d425 --- /dev/null +++ b/queue-6.10/drm-zynqmp_kms-fix-aux-bus-not-getting-unregistered.patch @@ -0,0 +1,78 @@ +From 0195b39a9ec48e4f0629ca82c22f2a713e818639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 15:29:13 -0400 +Subject: drm: zynqmp_kms: Fix AUX bus not getting unregistered + +From: Sean Anderson + +[ Upstream commit 0743dafefd3f2b92116213f2225ea355001b7948 ] + +drm_encoder_cleanup is responsible for calling drm_bridge_detach for +each bridge attached to the encoder. zynqmp_dp_bridge_detach is in turn +responsible for unregistering the AUX bus. However, we never ended up +calling drm_encoder_cleanup in the remove or error paths, so the AUX bus +would stick around after the rest of the driver had been removed. + +I don't really understand why drm_mode_config_cleanup doesn't call +drm_encoder_cleanup for us. It will call destroy (which for +simple_encoder is drm_encoder_cleanup) on encoders in the mode_config's +encoder_list. + +Should drm_encoder_cleanup get called before or after +drm_atomic_helper_shutdown? + +Fixes: 2dfd045c8435 ("drm: xlnx: zynqmp_dpsub: Register AUX bus at bridge attach time") +Signed-off-by: Sean Anderson +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20240503192922.2172314-2-sean.anderson@linux.dev +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xlnx/zynqmp_kms.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xlnx/zynqmp_kms.c b/drivers/gpu/drm/xlnx/zynqmp_kms.c +index 43bf416b33d5c..f25583ce92e60 100644 +--- a/drivers/gpu/drm/xlnx/zynqmp_kms.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c +@@ -433,23 +433,28 @@ static int zynqmp_dpsub_kms_init(struct zynqmp_dpsub *dpsub) + DRM_BRIDGE_ATTACH_NO_CONNECTOR); + if (ret) { + dev_err(dpsub->dev, "failed to attach bridge to encoder\n"); +- return ret; ++ goto err_encoder; + } + + /* Create the connector for the chain of bridges. */ + connector = drm_bridge_connector_init(&dpsub->drm->dev, encoder); + if (IS_ERR(connector)) { + dev_err(dpsub->dev, "failed to created connector\n"); +- return PTR_ERR(connector); ++ ret = PTR_ERR(connector); ++ goto err_encoder; + } + + ret = drm_connector_attach_encoder(connector, encoder); + if (ret < 0) { + dev_err(dpsub->dev, "failed to attach connector to encoder\n"); +- return ret; ++ goto err_encoder; + } + + return 0; ++ ++err_encoder: ++ drm_encoder_cleanup(encoder); ++ return ret; + } + + static void zynqmp_dpsub_drm_release(struct drm_device *drm, void *res) +@@ -529,5 +534,6 @@ void zynqmp_dpsub_drm_cleanup(struct zynqmp_dpsub *dpsub) + + drm_dev_unregister(drm); + drm_atomic_helper_shutdown(drm); ++ drm_encoder_cleanup(&dpsub->drm->encoder); + drm_kms_helper_poll_fini(drm); + } +-- +2.43.0 + diff --git a/queue-6.10/edac-i10nm-make-skx_common.o-a-separate-module.patch b/queue-6.10/edac-i10nm-make-skx_common.o-a-separate-module.patch new file mode 100644 index 00000000000..ddb371fba4f --- /dev/null +++ b/queue-6.10/edac-i10nm-make-skx_common.o-a-separate-module.patch @@ -0,0 +1,190 @@ +From 88cebf9d45b0e79054aa9f67f4dfc843c87f43c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:51:11 +0200 +Subject: EDAC, i10nm: make skx_common.o a separate module + +From: Arnd Bergmann + +[ Upstream commit 123b158635505c89ed0d3ef45c5845ff9030a466 ] + +Commit 598afa050403 ("kbuild: warn objects shared among multiple modules") +was added to track down cases where the same object is linked into +multiple modules. This can cause serious problems if some modules are +builtin while others are not. + +That test triggers this warning: + +scripts/Makefile.build:236: drivers/edac/Makefile: skx_common.o is added to multiple modules: i10nm_edac skx_edac + +Make this a separate module instead. + +[Tony: Added more background details to commit message] + +Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors") +Signed-off-by: Arnd Bergmann +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20240529095132.1929397-1-arnd@kernel.org/ +Signed-off-by: Sasha Levin +--- + drivers/edac/Makefile | 10 ++++++---- + drivers/edac/skx_common.c | 21 +++++++++++++++++++-- + drivers/edac/skx_common.h | 4 ++-- + 3 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile +index 9c09893695b7e..4edfb83ffbeef 100644 +--- a/drivers/edac/Makefile ++++ b/drivers/edac/Makefile +@@ -54,11 +54,13 @@ obj-$(CONFIG_EDAC_MPC85XX) += mpc85xx_edac_mod.o + layerscape_edac_mod-y := fsl_ddr_edac.o layerscape_edac.o + obj-$(CONFIG_EDAC_LAYERSCAPE) += layerscape_edac_mod.o + +-skx_edac-y := skx_common.o skx_base.o +-obj-$(CONFIG_EDAC_SKX) += skx_edac.o ++skx_edac_common-y := skx_common.o + +-i10nm_edac-y := skx_common.o i10nm_base.o +-obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o ++skx_edac-y := skx_base.o ++obj-$(CONFIG_EDAC_SKX) += skx_edac.o skx_edac_common.o ++ ++i10nm_edac-y := i10nm_base.o ++obj-$(CONFIG_EDAC_I10NM) += i10nm_edac.o skx_edac_common.o + + obj-$(CONFIG_EDAC_CELL) += cell_edac.o + obj-$(CONFIG_EDAC_PPC4XX) += ppc4xx_edac.o +diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c +index 27996b7924c82..8d18099fd528c 100644 +--- a/drivers/edac/skx_common.c ++++ b/drivers/edac/skx_common.c +@@ -48,7 +48,7 @@ static u64 skx_tolm, skx_tohm; + static LIST_HEAD(dev_edac_list); + static bool skx_mem_cfg_2lm; + +-int __init skx_adxl_get(void) ++int skx_adxl_get(void) + { + const char * const *names; + int i, j; +@@ -110,12 +110,14 @@ int __init skx_adxl_get(void) + + return -ENODEV; + } ++EXPORT_SYMBOL_GPL(skx_adxl_get); + +-void __exit skx_adxl_put(void) ++void skx_adxl_put(void) + { + kfree(adxl_values); + kfree(adxl_msg); + } ++EXPORT_SYMBOL_GPL(skx_adxl_put); + + static bool skx_adxl_decode(struct decoded_addr *res, bool error_in_1st_level_mem) + { +@@ -187,12 +189,14 @@ void skx_set_mem_cfg(bool mem_cfg_2lm) + { + skx_mem_cfg_2lm = mem_cfg_2lm; + } ++EXPORT_SYMBOL_GPL(skx_set_mem_cfg); + + void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log) + { + driver_decode = decode; + skx_show_retry_rd_err_log = show_retry_log; + } ++EXPORT_SYMBOL_GPL(skx_set_decode); + + int skx_get_src_id(struct skx_dev *d, int off, u8 *id) + { +@@ -206,6 +210,7 @@ int skx_get_src_id(struct skx_dev *d, int off, u8 *id) + *id = GET_BITFIELD(reg, 12, 14); + return 0; + } ++EXPORT_SYMBOL_GPL(skx_get_src_id); + + int skx_get_node_id(struct skx_dev *d, u8 *id) + { +@@ -219,6 +224,7 @@ int skx_get_node_id(struct skx_dev *d, u8 *id) + *id = GET_BITFIELD(reg, 0, 2); + return 0; + } ++EXPORT_SYMBOL_GPL(skx_get_node_id); + + static int get_width(u32 mtr) + { +@@ -284,6 +290,7 @@ int skx_get_all_bus_mappings(struct res_config *cfg, struct list_head **list) + *list = &dev_edac_list; + return ndev; + } ++EXPORT_SYMBOL_GPL(skx_get_all_bus_mappings); + + int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm) + { +@@ -323,6 +330,7 @@ int skx_get_hi_lo(unsigned int did, int off[], u64 *tolm, u64 *tohm) + pci_dev_put(pdev); + return -ENODEV; + } ++EXPORT_SYMBOL_GPL(skx_get_hi_lo); + + static int skx_get_dimm_attr(u32 reg, int lobit, int hibit, int add, + int minval, int maxval, const char *name) +@@ -394,6 +402,7 @@ int skx_get_dimm_info(u32 mtr, u32 mcmtr, u32 amap, struct dimm_info *dimm, + + return 1; + } ++EXPORT_SYMBOL_GPL(skx_get_dimm_info); + + int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc, + int chan, int dimmno, const char *mod_str) +@@ -442,6 +451,7 @@ int skx_get_nvdimm_info(struct dimm_info *dimm, struct skx_imc *imc, + + return (size == 0 || size == ~0ull) ? 0 : 1; + } ++EXPORT_SYMBOL_GPL(skx_get_nvdimm_info); + + int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, + const char *ctl_name, const char *mod_str, +@@ -512,6 +522,7 @@ int skx_register_mci(struct skx_imc *imc, struct pci_dev *pdev, + imc->mci = NULL; + return rc; + } ++EXPORT_SYMBOL_GPL(skx_register_mci); + + static void skx_unregister_mci(struct skx_imc *imc) + { +@@ -688,6 +699,7 @@ int skx_mce_check_error(struct notifier_block *nb, unsigned long val, + mce->kflags |= MCE_HANDLED_EDAC; + return NOTIFY_DONE; + } ++EXPORT_SYMBOL_GPL(skx_mce_check_error); + + void skx_remove(void) + { +@@ -725,3 +737,8 @@ void skx_remove(void) + kfree(d); + } + } ++EXPORT_SYMBOL_GPL(skx_remove); ++ ++MODULE_LICENSE("GPL v2"); ++MODULE_AUTHOR("Tony Luck"); ++MODULE_DESCRIPTION("MC Driver for Intel server processors"); +diff --git a/drivers/edac/skx_common.h b/drivers/edac/skx_common.h +index b6d3607dffe27..11faf1db4fa48 100644 +--- a/drivers/edac/skx_common.h ++++ b/drivers/edac/skx_common.h +@@ -231,8 +231,8 @@ typedef int (*get_dimm_config_f)(struct mem_ctl_info *mci, + typedef bool (*skx_decode_f)(struct decoded_addr *res); + typedef void (*skx_show_retry_log_f)(struct decoded_addr *res, char *msg, int len, bool scrub_err); + +-int __init skx_adxl_get(void); +-void __exit skx_adxl_put(void); ++int skx_adxl_get(void); ++void skx_adxl_put(void); + void skx_set_decode(skx_decode_f decode, skx_show_retry_log_f show_retry_log); + void skx_set_mem_cfg(bool mem_cfg_2lm); + +-- +2.43.0 + diff --git a/queue-6.10/eeprom-ee1004-call-i2c_new_scanned_device-to-instant.patch b/queue-6.10/eeprom-ee1004-call-i2c_new_scanned_device-to-instant.patch new file mode 100644 index 00000000000..ee83886e8e9 --- /dev/null +++ b/queue-6.10/eeprom-ee1004-call-i2c_new_scanned_device-to-instant.patch @@ -0,0 +1,62 @@ +From b74dd6010971c621fb73aef0a83a50c6093b81a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jun 2024 10:37:15 -0700 +Subject: eeprom: ee1004: Call i2c_new_scanned_device to instantiate thermal + sensor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit 249b4deaff71cfc6ac9a8e436af876be6d84052b ] + +Instantiating a device by calling i2c_new_client_device() assumes that the +device is not already instantiated. If that is not the case, it will return +an error and generate a misleading kernel log message. + +i2c i2c-0: Failed to register i2c client jc42 at 0x18 (-16) + +This can be reproduced by unloading the ee1004 driver and loading it again. + +Avoid this by calling i2c_new_scanned_device() instead, which returns +silently if a device is already instantiated or does not exist. + +Fixes: 393bd1000f81 ("eeprom: ee1004: add support for temperature sensor") +Cc: Heiner Kallweit +Cc: Thomas Weißschuh +Signed-off-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240629173716.20389-1-linux@roeck-us.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/ee1004.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/misc/eeprom/ee1004.c b/drivers/misc/eeprom/ee1004.c +index 21feebc3044c3..71ca66d1df82c 100644 +--- a/drivers/misc/eeprom/ee1004.c ++++ b/drivers/misc/eeprom/ee1004.c +@@ -185,6 +185,8 @@ BIN_ATTRIBUTE_GROUPS(ee1004); + static void ee1004_probe_temp_sensor(struct i2c_client *client) + { + struct i2c_board_info info = { .type = "jc42" }; ++ unsigned short addr = 0x18 | (client->addr & 7); ++ unsigned short addr_list[] = { addr, I2C_CLIENT_END }; + u8 byte14; + int ret; + +@@ -193,9 +195,7 @@ static void ee1004_probe_temp_sensor(struct i2c_client *client) + if (ret != 1 || !(byte14 & BIT(7))) + return; + +- info.addr = 0x18 | (client->addr & 7); +- +- i2c_new_client_device(client->adapter, &info); ++ i2c_new_scanned_device(client->adapter, &info, addr_list, NULL); + } + + static void ee1004_cleanup(int idx, struct ee1004_bus_data *bd) +-- +2.43.0 + diff --git a/queue-6.10/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch b/queue-6.10/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch new file mode 100644 index 00000000000..8f28411d7c7 --- /dev/null +++ b/queue-6.10/ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch @@ -0,0 +1,46 @@ +From aed1488e93361b231257a7f952021ede1d8d2504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 17:02:34 +0200 +Subject: ext4: avoid writing unitialized memory to disk in EA inodes + +From: Jan Kara + +[ Upstream commit 65121eff3e4c8c90f8126debf3c369228691c591 ] + +If the extended attribute size is not a multiple of block size, the last +block in the EA inode will have uninitialized tail which will get +written to disk. We will never expose the data to userspace but still +this is not a good practice so just zero out the tail of the block as it +isn't going to cause a noticeable performance overhead. + +Fixes: e50e5129f384 ("ext4: xattr-in-inode support") +Reported-by: syzbot+9c1fe13fcb51574b249b@syzkaller.appspotmail.com +Reported-by: Hugh Dickins +Signed-off-by: Jan Kara +Link: https://patch.msgid.link/20240613150234.25176-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/xattr.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 6460879b9fcbb..46ce2f21fef9d 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1433,6 +1433,12 @@ static int ext4_xattr_inode_write(handle_t *handle, struct inode *ea_inode, + goto out; + + memcpy(bh->b_data, buf, csize); ++ /* ++ * Zero out block tail to avoid writing uninitialized memory ++ * to disk. ++ */ ++ if (csize < blocksize) ++ memset(bh->b_data + csize, 0, blocksize - csize); + set_buffer_uptodate(bh); + ext4_handle_dirty_metadata(handle, ea_inode, bh); + +-- +2.43.0 + diff --git a/queue-6.10/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch b/queue-6.10/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch new file mode 100644 index 00000000000..aba320ecacf --- /dev/null +++ b/queue-6.10/ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch @@ -0,0 +1,49 @@ +From 0cff50b6ac32de249e9112bae6fd00e9fb87d4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 15:43:12 +0100 +Subject: ext4: don't track ranges in fast_commit if inode has inlined data + +From: Luis Henriques (SUSE) + +[ Upstream commit 7882b0187bbeb647967a7b5998ce4ad26ef68a9a ] + +When fast-commit needs to track ranges, it has to handle inodes that have +inlined data in a different way because ext4_fc_write_inode_data(), in the +actual commit path, will attempt to map the required blocks for the range. +However, inodes that have inlined data will have it's data stored in +inode->i_block and, eventually, in the extended attribute space. + +Unfortunately, because fast commit doesn't currently support extended +attributes, the solution is to mark this commit as ineligible. + +Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039883 +Signed-off-by: Luis Henriques (SUSE) +Tested-by: Ben Hutchings +Fixes: 9725958bb75c ("ext4: fast commit may miss tracking unwritten range during ftruncate") +Link: https://patch.msgid.link/20240618144312.17786-1-luis.henriques@linux.dev +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/fast_commit.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index 87c009e0c59a5..d3a67bc06d109 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -649,6 +649,12 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star + if (ext4_test_mount_flag(inode->i_sb, EXT4_MF_FC_INELIGIBLE)) + return; + ++ if (ext4_has_inline_data(inode)) { ++ ext4_fc_mark_ineligible(inode->i_sb, EXT4_FC_REASON_XATTR, ++ handle); ++ return; ++ } ++ + args.start = start; + args.end = end; + +-- +2.43.0 + diff --git a/queue-6.10/ext4-fix-infinite-loop-when-replaying-fast_commit.patch b/queue-6.10/ext4-fix-infinite-loop-when-replaying-fast_commit.patch new file mode 100644 index 00000000000..10c434f97f9 --- /dev/null +++ b/queue-6.10/ext4-fix-infinite-loop-when-replaying-fast_commit.patch @@ -0,0 +1,48 @@ +From 7463d7ac8f35e1fdab67ebcf4db4a08565ad64f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 09:28:57 +0100 +Subject: ext4: fix infinite loop when replaying fast_commit + +From: Luis Henriques (SUSE) + +[ Upstream commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 ] + +When doing fast_commit replay an infinite loop may occur due to an +uninitialized extent_status struct. ext4_ext_determine_insert_hole() does +not detect the replay and calls ext4_es_find_extent_range(), which will +return immediately without initializing the 'es' variable. + +Because 'es' contains garbage, an integer overflow may happen causing an +infinite loop in this function, easily reproducible using fstest generic/039. + +This commit fixes this issue by unconditionally initializing the structure +in function ext4_es_find_extent_range(). + +Thanks to Zhang Yi, for figuring out the real problem! + +Fixes: 8016e29f4362 ("ext4: fast commit recovery path") +Signed-off-by: Luis Henriques (SUSE) +Reviewed-by: Zhang Yi +Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents_status.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c +index 4a00e2f019d93..3a53dbb85e15b 100644 +--- a/fs/ext4/extents_status.c ++++ b/fs/ext4/extents_status.c +@@ -310,6 +310,8 @@ void ext4_es_find_extent_range(struct inode *inode, + ext4_lblk_t lblk, ext4_lblk_t end, + struct extent_status *es) + { ++ es->es_lblk = es->es_len = es->es_pblk = 0; ++ + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) + return; + +-- +2.43.0 + diff --git a/queue-6.10/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch b/queue-6.10/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch new file mode 100644 index 00000000000..9d409e0897c --- /dev/null +++ b/queue-6.10/firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch @@ -0,0 +1,50 @@ +From ab77b2ca8e9d61c7a0bc164ee1362744cc903277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:10 +0200 +Subject: firmware: turris-mox-rwtm: Do not complete if there are no waiters +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 0bafb172b111ab27251af0eb684e7bde9570ce4c ] + +Do not complete the "command done" completion if there are no waiters. +This can happen if a wait_for_completion() timed out or was interrupted. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Marek Behún +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index 31d962cdd6eb2..f1f9160c4195f 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -2,7 +2,7 @@ + /* + * Turris Mox rWTM firmware driver + * +- * Copyright (C) 2019 Marek Behún ++ * Copyright (C) 2019, 2024 Marek Behún + */ + + #include +@@ -174,6 +174,9 @@ static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data) + struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev); + struct armada_37xx_rwtm_rx_msg *msg = data; + ++ if (completion_done(&rwtm->cmd_done)) ++ return; ++ + rwtm->reply = *msg; + complete(&rwtm->cmd_done); + } +-- +2.43.0 + diff --git a/queue-6.10/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch b/queue-6.10/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch new file mode 100644 index 00000000000..1ff1292ed9d --- /dev/null +++ b/queue-6.10/firmware-turris-mox-rwtm-fix-checking-return-value-o.patch @@ -0,0 +1,70 @@ +From 0ff6934f877f30d418802c76ea4b444f5b2e38ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:11 +0200 +Subject: firmware: turris-mox-rwtm: Fix checking return value of + wait_for_completion_timeout() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 8467cfe821ac3526f7598682ad5f90689fa8cc49 ] + +The wait_for_completion_timeout() function returns 0 if timed out, and a +positive value if completed. Fix the usage of this function. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Fixes: 2eab59cf0d20 ("firmware: turris-mox-rwtm: fail probing when firmware does not support hwrng") +Signed-off-by: Marek Behún +Reviewed-by: Ilpo Järvinen +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index f1f9160c4195f..3f4758e03c818 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -202,9 +202,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval); + if (ret == -ENODATA) { +@@ -238,9 +237,8 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval); + if (ret == -ENODATA) { +@@ -277,9 +275,8 @@ static int check_get_random_support(struct mox_rwtm *rwtm) + if (ret < 0) + return ret; + +- ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); +- if (ret < 0) +- return ret; ++ if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) ++ return -ETIMEDOUT; + + return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval); + } +-- +2.43.0 + diff --git a/queue-6.10/firmware-turris-mox-rwtm-initialize-completion-befor.patch b/queue-6.10/firmware-turris-mox-rwtm-initialize-completion-befor.patch new file mode 100644 index 00000000000..8778a8c37bc --- /dev/null +++ b/queue-6.10/firmware-turris-mox-rwtm-initialize-completion-befor.patch @@ -0,0 +1,47 @@ +From 1cfc747b2e64b27364197957cd69ef62c9f21a8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:59:12 +0200 +Subject: firmware: turris-mox-rwtm: Initialize completion before mailbox +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 49e24c80d3c81c43e2a56101449e1eea32fcf292 ] + +Initialize the completion before the mailbox channel is requested. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Marek Behún +Reviewed-by: Andy Shevchenko +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index 3f4758e03c818..3e7f186d239a2 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -499,6 +499,7 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, rwtm); + + mutex_init(&rwtm->busy); ++ init_completion(&rwtm->cmd_done); + + rwtm->mbox_client.dev = dev; + rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback; +@@ -512,8 +513,6 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) + goto remove_files; + } + +- init_completion(&rwtm->cmd_done); +- + ret = mox_get_board_info(rwtm); + if (ret < 0) + dev_warn(dev, "Cannot read board information: %i\n", ret); +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch b/queue-6.10/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch new file mode 100644 index 00000000000..ea6030d5971 --- /dev/null +++ b/queue-6.10/fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch @@ -0,0 +1,36 @@ +From 38cb0a7de70da3de15efefc6024ddb34a411e2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 09:58:13 +0300 +Subject: fs/ntfs3: Add missing .dirty_folio in address_space_operations + +From: Konstantin Komarov + +[ Upstream commit 0f9579d9e0331b6255132ac06bdf2c0a01cceb90 ] + +After switching from pages to folio [1], it became evident that +the initialization of .dirty_folio for page cache operations was missed for +compressed files. + +[1] https://lore.kernel.org/ntfs3/20240422193203.3534108-1-willy@infradead.org + +Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 8521238f5448e..bef3b4a36b750 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -2133,5 +2133,6 @@ const struct address_space_operations ntfs_aops = { + const struct address_space_operations ntfs_aops_cmpr = { + .read_folio = ntfs_read_folio, + .readahead = ntfs_readahead, ++ .dirty_folio = block_dirty_folio, + }; + // clang-format on +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-correct-undo-if-ntfs_create_inode-failed.patch b/queue-6.10/fs-ntfs3-correct-undo-if-ntfs_create_inode-failed.patch new file mode 100644 index 00000000000..b6c310fb8ad --- /dev/null +++ b/queue-6.10/fs-ntfs3-correct-undo-if-ntfs_create_inode-failed.patch @@ -0,0 +1,50 @@ +From 42ba77c3c9ceee4a092d54552cec414f7d727dd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 10:59:13 +0300 +Subject: fs/ntfs3: Correct undo if ntfs_create_inode failed + +From: Konstantin Komarov + +[ Upstream commit f28d0866d8ff798aa497971f93d0cc58f442d946 ] + +Clusters allocated for Extended Attributes, must be freed +when rolling back inode creation. + +Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/inode.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index bef3b4a36b750..9559d72f86606 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1668,7 +1668,9 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + * The packed size of extended attribute is stored in direntry too. + * 'fname' here points to inside new_de. + */ +- ntfs_save_wsl_perm(inode, &fname->dup.ea_size); ++ err = ntfs_save_wsl_perm(inode, &fname->dup.ea_size); ++ if (err) ++ goto out6; + + /* + * update ea_size in file_name attribute too. +@@ -1712,6 +1714,12 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + goto out2; + + out6: ++ attr = ni_find_attr(ni, NULL, NULL, ATTR_EA, NULL, 0, NULL, NULL); ++ if (attr && attr->non_res) { ++ /* Delete ATTR_EA, if non-resident. */ ++ attr_set_size(ni, ATTR_EA, NULL, 0, NULL, 0, NULL, false, NULL); ++ } ++ + if (rp_inserted) + ntfs_remove_reparse(sbi, IO_REPARSE_TAG_SYMLINK, &new_de->ref); + +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-deny-getting-attr-data-block-in-compressed-.patch b/queue-6.10/fs-ntfs3-deny-getting-attr-data-block-in-compressed-.patch new file mode 100644 index 00000000000..928ba60ec60 --- /dev/null +++ b/queue-6.10/fs-ntfs3-deny-getting-attr-data-block-in-compressed-.patch @@ -0,0 +1,46 @@ +From 6a6f445202f75d00888c8805738c2d88df7b1a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:07:44 +0300 +Subject: fs/ntfs3: Deny getting attr data block in compressed frame + +From: Konstantin Komarov + +[ Upstream commit 69943484b95267c94331cba41e9e64ba7b24f136 ] + +Attempting to retrieve an attribute data block in a compressed frame +is ignored. + +Fixes: be71b5cba2e64 ("fs/ntfs3: Add attrib operations") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 8638248d80d93..7918ab1a3f354 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -975,6 +975,19 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, + if (err) + goto out; + ++ /* Check for compressed frame. */ ++ err = attr_is_frame_compressed(ni, attr, vcn >> NTFS_LZNT_CUNIT, &hint); ++ if (err) ++ goto out; ++ ++ if (hint) { ++ /* if frame is compressed - don't touch it. */ ++ *lcn = COMPRESSED_LCN; ++ *len = hint; ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ + if (!*len) { + if (run_lookup_entry(run, vcn, lcn, len, NULL)) { + if (*lcn != SPARSE_LCN || !new) +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-drop-stray-backslash-in-formatting-string.patch b/queue-6.10/fs-ntfs3-drop-stray-backslash-in-formatting-string.patch new file mode 100644 index 00000000000..912b1320830 --- /dev/null +++ b/queue-6.10/fs-ntfs3-drop-stray-backslash-in-formatting-string.patch @@ -0,0 +1,38 @@ +From 540a9fb873fe80dfc0f48e507700444206c96e5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2024 00:01:01 +0300 +Subject: fs/ntfs3: Drop stray '\' (backslash) in formatting string + +From: Andy Shevchenko + +[ Upstream commit b366809dd151e8abb29decda02fd6a78b498831f ] + +CHECK /home/andy/prj/linux-topic-uart/fs/ntfs3/super.c +fs/ntfs3/super.c:471:23: warning: unknown escape sequence: '\%' + +Drop stray '\' (backslash) in formatting string. + +Fixes: d27e202b9ac4 ("fs/ntfs3: Add more info into /proc/fs/ntfs3//volinfo") +Signed-off-by: Andy Shevchenko +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 27fbde2701b63..24a134eeb45a2 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -468,7 +468,7 @@ static int ntfs3_volinfo(struct seq_file *m, void *o) + struct super_block *sb = m->private; + struct ntfs_sb_info *sbi = sb->s_fs_info; + +- seq_printf(m, "ntfs%d.%d\n%u\n%zu\n\%zu\n%zu\n%s\n%s\n", ++ seq_printf(m, "ntfs%d.%d\n%u\n%zu\n%zu\n%zu\n%s\n%s\n", + sbi->volume.major_ver, sbi->volume.minor_ver, + sbi->cluster_size, sbi->used.bitmap.nbits, + sbi->mft.bitmap.nbits, +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch b/queue-6.10/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch new file mode 100644 index 00000000000..30b3d56824c --- /dev/null +++ b/queue-6.10/fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch @@ -0,0 +1,84 @@ +From 9373df09019c424f7665e43d0e3f6772ad93891e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 15:13:09 +0300 +Subject: fs/ntfs3: Fix field-spanning write in INDEX_HDR + +From: Konstantin Komarov + +[ Upstream commit 2f3e176fee66ac86ae387787bf06457b101d9f7a ] + +Fields flags and res[3] replaced with one 4 byte flags. + +Fixes: 4534a70b7056 ("fs/ntfs3: Add headers and misc files") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/index.c | 4 ++-- + fs/ntfs3/ntfs.h | 9 +++++---- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index d0f15bbf78f6c..9089c58a005ce 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -978,7 +978,7 @@ static struct indx_node *indx_new(struct ntfs_index *indx, + hdr->used = + cpu_to_le32(eo + sizeof(struct NTFS_DE) + sizeof(u64)); + de_set_vbn_le(e, *sub_vbn); +- hdr->flags = 1; ++ hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES; + } else { + e->size = cpu_to_le16(sizeof(struct NTFS_DE)); + hdr->used = cpu_to_le32(eo + sizeof(struct NTFS_DE)); +@@ -1683,7 +1683,7 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, + e->size = cpu_to_le16(sizeof(struct NTFS_DE) + sizeof(u64)); + e->flags = NTFS_IE_HAS_SUBNODES | NTFS_IE_LAST; + +- hdr->flags = 1; ++ hdr->flags = NTFS_INDEX_HDR_HAS_SUBNODES; + hdr->used = hdr->total = + cpu_to_le32(new_root_size - offsetof(struct INDEX_ROOT, ihdr)); + +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 1f2cdb0dbbe1d..e1889ad092304 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -693,14 +693,15 @@ static inline bool de_has_vcn_ex(const struct NTFS_DE *e) + offsetof(struct ATTR_FILE_NAME, name) + \ + NTFS_NAME_LEN * sizeof(short), 8) + ++#define NTFS_INDEX_HDR_HAS_SUBNODES cpu_to_le32(1) ++ + struct INDEX_HDR { + __le32 de_off; // 0x00: The offset from the start of this structure + // to the first NTFS_DE. + __le32 used; // 0x04: The size of this structure plus all + // entries (quad-word aligned). + __le32 total; // 0x08: The allocated size of for this structure plus all entries. +- u8 flags; // 0x0C: 0x00 = Small directory, 0x01 = Large directory. +- u8 res[3]; ++ __le32 flags; // 0x0C: 0x00 = Small directory, 0x01 = Large directory. + + // + // de_off + used <= total +@@ -748,7 +749,7 @@ static inline struct NTFS_DE *hdr_next_de(const struct INDEX_HDR *hdr, + + static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr) + { +- return hdr->flags & 1; ++ return hdr->flags & NTFS_INDEX_HDR_HAS_SUBNODES; + } + + struct INDEX_BUFFER { +@@ -768,7 +769,7 @@ static inline bool ib_is_empty(const struct INDEX_BUFFER *ib) + + static inline bool ib_is_leaf(const struct INDEX_BUFFER *ib) + { +- return !(ib->ihdr.flags & 1); ++ return !(ib->ihdr.flags & NTFS_INDEX_HDR_HAS_SUBNODES); + } + + /* Index root structure ( 0x90 ). */ +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-fix-getting-file-type.patch b/queue-6.10/fs-ntfs3-fix-getting-file-type.patch new file mode 100644 index 00000000000..87daeb80c87 --- /dev/null +++ b/queue-6.10/fs-ntfs3-fix-getting-file-type.patch @@ -0,0 +1,36 @@ +From 0dd6c3e4e97a405d003d42b0a1308f109b7fb48d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 10:41:39 +0300 +Subject: fs/ntfs3: Fix getting file type + +From: Konstantin Komarov + +[ Upstream commit 24c5100aceedcd47af89aaa404d4c96cd2837523 ] + +An additional condition causes the mft record to be read from disk +and get the file type dt_type. + +Fixes: 22457c047ed97 ("fs/ntfs3: Modified fix directory element type detection") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c +index 1937e8e612f87..858efe255f6f3 100644 +--- a/fs/ntfs3/dir.c ++++ b/fs/ntfs3/dir.c +@@ -326,7 +326,8 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni, + * It does additional locks/reads just to get the type of name. + * Should we use additional mount option to enable branch below? + */ +- if ((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) && ++ if (((fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT) || ++ fname->dup.ea_size) && + ino != ni->mi.rno) { + struct inode *inode = ntfs_iget5(sbi->sb, &e->ref, NULL); + if (!IS_ERR_OR_NULL(inode)) { +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-fix-the-format-of-the-nocase-mount-option.patch b/queue-6.10/fs-ntfs3-fix-the-format-of-the-nocase-mount-option.patch new file mode 100644 index 00000000000..09d0c76710a --- /dev/null +++ b/queue-6.10/fs-ntfs3-fix-the-format-of-the-nocase-mount-option.patch @@ -0,0 +1,36 @@ +From be46be1cebfa5adb5d963bfbaf275470810990ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 09:57:33 +0300 +Subject: fs/ntfs3: Fix the format of the "nocase" mount option + +From: Konstantin Komarov + +[ Upstream commit d392e85fd1e8d58e460c17ca7d0d5c157848d9c1 ] + +The 'nocase' option was mistakenly added as fsparam_flag_no +with the 'no' prefix, causing the case-insensitive mode to require +the 'nonocase' option to be enabled. + +Fixes: a3a956c78efa ("fs/ntfs3: Add option "nocase"") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 24a134eeb45a2..02b6f51ce6503 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -275,7 +275,7 @@ static const struct fs_parameter_spec ntfs_fs_parameters[] = { + fsparam_flag_no("acl", Opt_acl), + fsparam_string("iocharset", Opt_iocharset), + fsparam_flag_no("prealloc", Opt_prealloc), +- fsparam_flag_no("nocase", Opt_nocase), ++ fsparam_flag_no("case", Opt_nocase), + {} + }; + // clang-format on +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch b/queue-6.10/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch new file mode 100644 index 00000000000..2282a8ccfef --- /dev/null +++ b/queue-6.10/fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch @@ -0,0 +1,56 @@ +From e63a8615dbdf6a3a90e5ff7a12b0d4f597c78fdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 01:10:01 +0300 +Subject: fs/ntfs3: Fix transform resident to nonresident for compressed files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Konstantin Komarov + +[ Upstream commit 25610ff98d4a34e6a85cbe4fd8671be6b0829f8f ] + +Сorrected calculation of required space len (in clusters) +for attribute data storage in case of compression. + +Fixes: be71b5cba2e64 ("fs/ntfs3: Add attrib operations") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 9ccec45190749..8638248d80d93 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -231,7 +231,7 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + struct ntfs_sb_info *sbi; + struct ATTRIB *attr_s; + struct MFT_REC *rec; +- u32 used, asize, rsize, aoff, align; ++ u32 used, asize, rsize, aoff; + bool is_data; + CLST len, alen; + char *next; +@@ -252,10 +252,13 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + rsize = le32_to_cpu(attr->res.data_size); + is_data = attr->type == ATTR_DATA && !attr->name_len; + +- align = sbi->cluster_size; +- if (is_attr_compressed(attr)) +- align <<= NTFS_LZNT_CUNIT; +- len = (rsize + align - 1) >> sbi->cluster_bits; ++ /* len - how many clusters required to store 'rsize' bytes */ ++ if (is_attr_compressed(attr)) { ++ u8 shift = sbi->cluster_bits + NTFS_LZNT_CUNIT; ++ len = ((rsize + (1u << shift) - 1) >> shift) << NTFS_LZNT_CUNIT; ++ } else { ++ len = bytes_to_cluster(sbi, rsize); ++ } + + run_init(run); + +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch b/queue-6.10/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch new file mode 100644 index 00000000000..eeee3f434b8 --- /dev/null +++ b/queue-6.10/fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch @@ -0,0 +1,36 @@ +From 229bc1a5c72b02d03ae84c25e5080043e174dd8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 17:11:37 +0300 +Subject: fs/ntfs3: Keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP + +From: Konstantin Komarov + +[ Upstream commit eb95678ee930d67d79fc83f0a700245ae7230455 ] + +We skip the run_truncate_head call also for $MFT::$ATTR_BITMAP. +Otherwise wnd_map()/run_lookup_entry will not find the disk position for the bitmap parts. + +Fixes: 0e5b044cbf3a ("fs/ntfs3: Refactoring attr_set_size to restore after errors") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 0d13da5523b1a..a810ef547501d 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -673,7 +673,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, + goto undo_2; + } + +- if (!is_mft) ++ /* keep runs for $MFT::$ATTR_DATA and $MFT::$ATTR_BITMAP. */ ++ if (ni->mi.rno != MFT_REC_MFT) + run_truncate_head(run, evcn + 1); + + svcn = le64_to_cpu(attr->nres.svcn); +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch b/queue-6.10/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch new file mode 100644 index 00000000000..78108026e93 --- /dev/null +++ b/queue-6.10/fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch @@ -0,0 +1,94 @@ +From 56694605e3b50308db7f5e5ae5ff4474884bd649 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2024 00:41:02 +0300 +Subject: fs/ntfs3: Merge synonym COMPRESSION_UNIT and NTFS_LZNT_CUNIT + +From: Konstantin Komarov + +[ Upstream commit 487f8d482a7e51a640b8f955a398f906a4f83951 ] + +COMPRESSION_UNIT and NTFS_LZNT_CUNIT mean the same thing +(1u< +Stable-dep-of: 25610ff98d4a ("fs/ntfs3: Fix transform resident to nonresident for compressed files") +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 2 +- + fs/ntfs3/frecord.c | 2 +- + fs/ntfs3/fslog.c | 2 +- + fs/ntfs3/inode.c | 2 +- + fs/ntfs3/ntfs.h | 3 --- + 5 files changed, 4 insertions(+), 7 deletions(-) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 8e6bcdf99770f..9ccec45190749 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -254,7 +254,7 @@ int attr_make_nonresident(struct ntfs_inode *ni, struct ATTRIB *attr, + + align = sbi->cluster_size; + if (is_attr_compressed(attr)) +- align <<= COMPRESSION_UNIT; ++ align <<= NTFS_LZNT_CUNIT; + len = (rsize + align - 1) >> sbi->cluster_bits; + + run_init(run); +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 0008670939a4a..4822cfd6351c2 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -1501,7 +1501,7 @@ int ni_insert_nonresident(struct ntfs_inode *ni, enum ATTR_TYPE type, + + if (is_ext) { + if (flags & ATTR_FLAG_COMPRESSED) +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + attr->nres.total_size = attr->nres.alloc_size; + } + +diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c +index 40926bf392d28..e47c2105a24e9 100644 +--- a/fs/ntfs3/fslog.c ++++ b/fs/ntfs3/fslog.c +@@ -2996,7 +2996,7 @@ static struct ATTRIB *attr_create_nonres_log(struct ntfs_sb_info *sbi, + if (is_ext) { + attr->name_off = SIZEOF_NONRESIDENT_EX_LE; + if (is_attr_compressed(attr)) +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + + attr->nres.run_off = + cpu_to_le16(SIZEOF_NONRESIDENT_EX + name_size); +diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c +index 0f1664db94ad9..8521238f5448e 100644 +--- a/fs/ntfs3/inode.c ++++ b/fs/ntfs3/inode.c +@@ -1508,7 +1508,7 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, + attr->size = cpu_to_le32(SIZEOF_NONRESIDENT_EX + 8); + attr->name_off = SIZEOF_NONRESIDENT_EX_LE; + attr->flags = ATTR_FLAG_COMPRESSED; +- attr->nres.c_unit = COMPRESSION_UNIT; ++ attr->nres.c_unit = NTFS_LZNT_CUNIT; + asize = SIZEOF_NONRESIDENT_EX + 8; + } else { + attr->size = cpu_to_le32(SIZEOF_NONRESIDENT + 8); +diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h +index 3d6143c7abc03..1f2cdb0dbbe1d 100644 +--- a/fs/ntfs3/ntfs.h ++++ b/fs/ntfs3/ntfs.h +@@ -82,9 +82,6 @@ typedef u32 CLST; + #define RESIDENT_LCN ((CLST)-2) + #define COMPRESSED_LCN ((CLST)-3) + +-#define COMPRESSION_UNIT 4 +-#define COMPRESS_MAX_CLUSTER 0x1000 +- + enum RECORD_NUM { + MFT_REC_MFT = 0, + MFT_REC_MIRR = 1, +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-missed-error-return.patch b/queue-6.10/fs-ntfs3-missed-error-return.patch new file mode 100644 index 00000000000..4cf8759d735 --- /dev/null +++ b/queue-6.10/fs-ntfs3-missed-error-return.patch @@ -0,0 +1,32 @@ +From 4dad9179cd7508148c8c308904ad1ddbd887f54b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 13:43:09 +0300 +Subject: fs/ntfs3: Missed error return + +From: Konstantin Komarov + +[ Upstream commit 2cbbd96820255fff4f0ad1533197370c9ccc570b ] + +Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/bitmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c +index c9eb01ccee51b..cf4fe21a50399 100644 +--- a/fs/ntfs3/bitmap.c ++++ b/fs/ntfs3/bitmap.c +@@ -1382,7 +1382,7 @@ int wnd_extend(struct wnd_bitmap *wnd, size_t new_bits) + + err = ntfs_vbo_to_lbo(sbi, &wnd->run, vbo, &lbo, &bytes); + if (err) +- break; ++ return err; + + bh = ntfs_bread(sb, lbo >> sb->s_blocksize_bits); + if (!bh) +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-missed-ni_flag_update_parent-setting.patch b/queue-6.10/fs-ntfs3-missed-ni_flag_update_parent-setting.patch new file mode 100644 index 00000000000..cba5a3b253c --- /dev/null +++ b/queue-6.10/fs-ntfs3-missed-ni_flag_update_parent-setting.patch @@ -0,0 +1,31 @@ +From e811eb039ddf7f74c7c6c207c0d086b6bec99e39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:36:03 +0300 +Subject: fs/ntfs3: Missed NI_FLAG_UPDATE_PARENT setting + +From: Konstantin Komarov + +[ Upstream commit 1c308ace1fd6de93bd0b7e1a5e8963ab27e2c016 ] + +Fixes: be71b5cba2e64 ("fs/ntfs3: Add attrib operations") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/attrib.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c +index 7918ab1a3f354..0d13da5523b1a 100644 +--- a/fs/ntfs3/attrib.c ++++ b/fs/ntfs3/attrib.c +@@ -1738,6 +1738,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, + + attr_b->nres.total_size = cpu_to_le64(total_size); + inode_set_bytes(&ni->vfs_inode, total_size); ++ ni->ni_flags |= NI_FLAG_UPDATE_PARENT; + + mi_b->dirty = true; + mark_inode_dirty(&ni->vfs_inode); +-- +2.43.0 + diff --git a/queue-6.10/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch b/queue-6.10/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch new file mode 100644 index 00000000000..454e1c1e937 --- /dev/null +++ b/queue-6.10/fs-ntfs3-replace-inode_trylock-with-inode_lock.patch @@ -0,0 +1,37 @@ +From e6273e057ddea53b4530aebd376fe8999e30147c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 10:54:07 +0300 +Subject: fs/ntfs3: Replace inode_trylock with inode_lock + +From: Konstantin Komarov + +[ Upstream commit 69505fe98f198ee813898cbcaf6770949636430b ] + +The issue was detected due to xfstest 465 failing. + +Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/file.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c +index 2f903b6ce1570..9ae202901f3c0 100644 +--- a/fs/ntfs3/file.c ++++ b/fs/ntfs3/file.c +@@ -299,10 +299,7 @@ static int ntfs_file_mmap(struct file *file, struct vm_area_struct *vma) + } + + if (ni->i_valid < to) { +- if (!inode_trylock(inode)) { +- err = -EAGAIN; +- goto out; +- } ++ inode_lock(inode); + err = ntfs_extend_initialized_size(file, ni, + ni->i_valid, to); + inode_unlock(inode); +-- +2.43.0 + diff --git a/queue-6.10/fs-proc-task_mmu-don-t-indicate-pm_mmap_exclusive-wi.patch b/queue-6.10/fs-proc-task_mmu-don-t-indicate-pm_mmap_exclusive-wi.patch new file mode 100644 index 00000000000..39271d9894b --- /dev/null +++ b/queue-6.10/fs-proc-task_mmu-don-t-indicate-pm_mmap_exclusive-wi.patch @@ -0,0 +1,94 @@ +From 32347de7c139a1b74c1c7655ab4cb720146b053b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 14:23:53 +0200 +Subject: fs/proc/task_mmu: don't indicate PM_MMAP_EXCLUSIVE without PM_PRESENT + +From: David Hildenbrand + +[ Upstream commit da7f31ed0f4df8f61e8195e527aa83dd54896ba3 ] + +Relying on the mapcount for non-present PTEs that reference pages doesn't +make any sense: they are not accounted in the mapcount, so page_mapcount() +== 1 won't return the result we actually want to know. + +While we don't check the mapcount for migration entries already, we could +end up checking it for swap, hwpoison, device exclusive, ... entries, +which we really shouldn't. + +There is one exception: device private entries, which we consider +fake-present (e.g., incremented the mapcount). But we won't care about +that for now for PM_MMAP_EXCLUSIVE, because indicating PM_SWAP for them +although they are fake-present already sounds suspiciously wrong. + +Let's never indicate PM_MMAP_EXCLUSIVE without PM_PRESENT. + +Link: https://lkml.kernel.org/r/20240607122357.115423-3-david@redhat.com +Signed-off-by: David Hildenbrand +Reviewed-by: Oscar Salvador +Cc: Alexey Dobriyan +Cc: Jonathan Corbet +Cc: Kirill A. Shutemov +Cc: Lance Yang +Signed-off-by: Andrew Morton +Stable-dep-of: 2c1f057e5be6 ("fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped THPs") +Signed-off-by: Sasha Levin +--- + fs/proc/task_mmu.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 76ad35df3b1ee..22892cdb74cef 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1418,7 +1418,6 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, + { + u64 frame = 0, flags = 0; + struct page *page = NULL; +- bool migration = false; + + if (pte_present(pte)) { + if (pm->show_pfn) +@@ -1450,7 +1449,6 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, + (offset << MAX_SWAPFILES_SHIFT); + } + flags |= PM_SWAP; +- migration = is_migration_entry(entry); + if (is_pfn_swap_entry(entry)) + page = pfn_swap_entry_to_page(entry); + if (pte_marker_entry_uffd_wp(entry)) +@@ -1459,7 +1457,7 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, + + if (page && !PageAnon(page)) + flags |= PM_FILE; +- if (page && !migration && page_mapcount(page) == 1) ++ if (page && (flags & PM_PRESENT) && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + if (vma->vm_flags & VM_SOFTDIRTY) + flags |= PM_SOFT_DIRTY; +@@ -1476,7 +1474,6 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + pte_t *pte, *orig_pte; + int err = 0; + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +- bool migration = false; + + ptl = pmd_trans_huge_lock(pmdp, vma); + if (ptl) { +@@ -1520,14 +1517,13 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + if (pmd_swp_uffd_wp(pmd)) + flags |= PM_UFFD_WP; + VM_BUG_ON(!is_pmd_migration_entry(pmd)); +- migration = is_migration_entry(entry); + page = pfn_swap_entry_to_page(entry); + } + #endif + + if (page && !PageAnon(page)) + flags |= PM_FILE; +- if (page && !migration && page_mapcount(page) == 1) ++ if (page && (flags & PM_PRESENT) && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + + for (; addr != end; addr += PAGE_SIZE) { +-- +2.43.0 + diff --git a/queue-6.10/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch b/queue-6.10/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch new file mode 100644 index 00000000000..18ae366e903 --- /dev/null +++ b/queue-6.10/fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch @@ -0,0 +1,65 @@ +From 574e22dba91580ddc5b9c3c37927c55d1207eb80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 14:23:52 +0200 +Subject: fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP + +From: David Hildenbrand + +[ Upstream commit 3f9f022e975d930709848a86a1c79775b0585202 ] + +Patch series "fs/proc: move page_mapcount() to fs/proc/internal.h". + +With all other page_mapcount() users in the tree gone, move +page_mapcount() to fs/proc/internal.h, rename it and extend the +documentation to prevent future (ab)use. + +... of course, I find some issues while working on that code that I sort +first ;) + +We'll now only end up calling page_mapcount() [now +folio_precise_page_mapcount()] on pages mapped via present page table +entries. Except for /proc/kpagecount, that still does questionable +things, but we'll leave that legacy interface as is for now. + +Did a quick sanity check. Likely we would want some better selfestest for +/proc/$/pagemap + smaps. I'll see if I can find some time to write some +more. + +This patch (of 6): + +Looks like we never taught pagemap_pmd_range() about the existence of +PMD-mapped file THPs. Seems to date back to the times when we first added +support for non-anon THPs in the form of shmem THP. + +Link: https://lkml.kernel.org/r/20240607122357.115423-1-david@redhat.com +Link: https://lkml.kernel.org/r/20240607122357.115423-2-david@redhat.com +Signed-off-by: David Hildenbrand +Fixes: 800d8c63b2e9 ("shmem: add huge pages support") +Acked-by: Kirill A. Shutemov +Reviewed-by: Lance Yang +Reviewed-by: Oscar Salvador +Cc: David Hildenbrand +Cc: Jonathan Corbet +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/proc/task_mmu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 71e5039d940dc..76ad35df3b1ee 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1525,6 +1525,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + } + #endif + ++ if (page && !PageAnon(page)) ++ flags |= PM_FILE; + if (page && !migration && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + +-- +2.43.0 + diff --git a/queue-6.10/fs-proc-task_mmu-properly-detect-pm_mmap_exclusive-p.patch b/queue-6.10/fs-proc-task_mmu-properly-detect-pm_mmap_exclusive-p.patch new file mode 100644 index 00000000000..1913a3e97dd --- /dev/null +++ b/queue-6.10/fs-proc-task_mmu-properly-detect-pm_mmap_exclusive-p.patch @@ -0,0 +1,99 @@ +From 2f709ad717bb0fa47d58977c697e1207a1a37d4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 14:23:54 +0200 +Subject: fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of + PMD-mapped THPs + +From: David Hildenbrand + +[ Upstream commit 2c1f057e5be63e890f2dd89e4c25ab5eef084a91 ] + +We added PM_MMAP_EXCLUSIVE in 2015 via commit 77bb499bb60f ("pagemap: add +mmap-exclusive bit for marking pages mapped only here"), when THPs could +not be partially mapped and page_mapcount() returned something that was +true for all pages of the THP. + +In 2016, we added support for partially mapping THPs via commit +53f9263baba6 ("mm: rework mapcount accounting to enable 4k mapping of +THPs") but missed to determine PM_MMAP_EXCLUSIVE as well per page. + +Checking page_mapcount() on the head page does not tell the whole story. + +We should check each individual page. In a future without per-page +mapcounts it will be different, but we'll change that to be consistent +with PTE-mapped THPs once we deal with that. + +Link: https://lkml.kernel.org/r/20240607122357.115423-4-david@redhat.com +Fixes: 53f9263baba6 ("mm: rework mapcount accounting to enable 4k mapping of THPs") +Signed-off-by: David Hildenbrand +Reviewed-by: Oscar Salvador +Cc: Kirill A. Shutemov +Cc: Alexey Dobriyan +Cc: Jonathan Corbet +Cc: Lance Yang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/proc/task_mmu.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 22892cdb74cef..a45f2da0ada0d 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1477,6 +1477,7 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + + ptl = pmd_trans_huge_lock(pmdp, vma); + if (ptl) { ++ unsigned int idx = (addr & ~PMD_MASK) >> PAGE_SHIFT; + u64 flags = 0, frame = 0; + pmd_t pmd = *pmdp; + struct page *page = NULL; +@@ -1493,8 +1494,7 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + if (pmd_uffd_wp(pmd)) + flags |= PM_UFFD_WP; + if (pm->show_pfn) +- frame = pmd_pfn(pmd) + +- ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ frame = pmd_pfn(pmd) + idx; + } + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { +@@ -1503,11 +1503,9 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + + if (pm->show_pfn) { + if (is_pfn_swap_entry(entry)) +- offset = swp_offset_pfn(entry); ++ offset = swp_offset_pfn(entry) + idx; + else +- offset = swp_offset(entry); +- offset = offset + +- ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ offset = swp_offset(entry) + idx; + frame = swp_type(entry) | + (offset << MAX_SWAPFILES_SHIFT); + } +@@ -1523,12 +1521,16 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + + if (page && !PageAnon(page)) + flags |= PM_FILE; +- if (page && (flags & PM_PRESENT) && page_mapcount(page) == 1) +- flags |= PM_MMAP_EXCLUSIVE; + +- for (; addr != end; addr += PAGE_SIZE) { +- pagemap_entry_t pme = make_pme(frame, flags); ++ for (; addr != end; addr += PAGE_SIZE, idx++) { ++ unsigned long cur_flags = flags; ++ pagemap_entry_t pme; ++ ++ if (page && (flags & PM_PRESENT) && ++ page_mapcount(page + idx) == 1) ++ cur_flags |= PM_MMAP_EXCLUSIVE; + ++ pme = make_pme(frame, cur_flags); + err = add_to_pagemap(&pme, pm); + if (err) + break; +-- +2.43.0 + diff --git a/queue-6.10/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch b/queue-6.10/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch new file mode 100644 index 00000000000..9b49b86ab6f --- /dev/null +++ b/queue-6.10/gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch @@ -0,0 +1,38 @@ +From 76fcdb8369e357ec86b9419768cca3f9663b8882 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2024 14:50:08 +0800 +Subject: gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey + +From: Gaosheng Cui + +[ Upstream commit a3123341dc358952ce2bf8067fbdfb7eaadf71bb ] + +If we fail to call crypto_sync_skcipher_setkey, we should free the +memory allocation for cipher, replace err_return with err_free_cipher +to free the memory of cipher. + +Fixes: 4891f2d008e4 ("gss_krb5: import functionality to derive keys into the kernel") +Signed-off-by: Gaosheng Cui +Reviewed-by: Simon Horman +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/gss_krb5_keys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sunrpc/auth_gss/gss_krb5_keys.c b/net/sunrpc/auth_gss/gss_krb5_keys.c +index 06d8ee0db000f..4eb19c3a54c70 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_keys.c ++++ b/net/sunrpc/auth_gss/gss_krb5_keys.c +@@ -168,7 +168,7 @@ static int krb5_DK(const struct gss_krb5_enctype *gk5e, + goto err_return; + blocksize = crypto_sync_skcipher_blocksize(cipher); + if (crypto_sync_skcipher_setkey(cipher, inkey->data, inkey->len)) +- goto err_return; ++ goto err_free_cipher; + + ret = -ENOMEM; + inblockdata = kmalloc(blocksize, gfp_mask); +-- +2.43.0 + diff --git a/queue-6.10/gve-fix-xdp-tx-completion-handling-when-counters-ove.patch b/queue-6.10/gve-fix-xdp-tx-completion-handling-when-counters-ove.patch new file mode 100644 index 00000000000..66f12621661 --- /dev/null +++ b/queue-6.10/gve-fix-xdp-tx-completion-handling-when-counters-ove.patch @@ -0,0 +1,52 @@ +From bb7c7164148e9df08d6a05213c1ab96ec8ea3d5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 10:10:41 -0700 +Subject: gve: Fix XDP TX completion handling when counters overflow + +From: Joshua Washington + +[ Upstream commit 03b54bad26f3c78bb1f90410ec3e4e7fe197adc9 ] + +In gve_clean_xdp_done, the driver processes the TX completions based on +a 32-bit NIC counter and a 32-bit completion counter stored in the tx +queue. + +Fix the for loop so that the counter wraparound is handled correctly. + +Fixes: 75eaae158b1b ("gve: Add XDP DROP and TX support for GQI-QPL format") +Signed-off-by: Joshua Washington +Signed-off-by: Praveen Kaligineedi +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20240716171041.1561142-1-pkaligineedi@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_tx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c +index 24a64ec1073e2..e7fb7d6d283df 100644 +--- a/drivers/net/ethernet/google/gve/gve_tx.c ++++ b/drivers/net/ethernet/google/gve/gve_tx.c +@@ -158,15 +158,16 @@ static int gve_clean_xdp_done(struct gve_priv *priv, struct gve_tx_ring *tx, + u32 to_do) + { + struct gve_tx_buffer_state *info; +- u32 clean_end = tx->done + to_do; + u64 pkts = 0, bytes = 0; + size_t space_freed = 0; + u32 xsk_complete = 0; + u32 idx; ++ int i; + +- for (; tx->done < clean_end; tx->done++) { ++ for (i = 0; i < to_do; i++) { + idx = tx->done & tx->mask; + info = &tx->info[idx]; ++ tx->done++; + + if (unlikely(!info->xdp.size)) + continue; +-- +2.43.0 + diff --git a/queue-6.10/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch b/queue-6.10/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch new file mode 100644 index 00000000000..c1fac0b5675 --- /dev/null +++ b/queue-6.10/hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch @@ -0,0 +1,211 @@ +From ab52a9163dbb66101c45ed8c7b5111d3f53c328f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 22:23:04 +0800 +Subject: hfsplus: fix to avoid false alarm of circular locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chao Yu + +[ Upstream commit be4edd1642ee205ed7bbf66edc0453b1be1fb8d7 ] + +Syzbot report potential ABBA deadlock as below: + +loop0: detected capacity change from 0 to 1024 +====================================================== +WARNING: possible circular locking dependency detected +6.9.0-syzkaller-10323-g8f6a15f095a6 #0 Not tainted +------------------------------------------------------ +syz-executor171/5344 is trying to acquire lock: +ffff88807cb980b0 (&tree->tree_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + +but task is already holding lock: +ffff88807a930108 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}, at: hfsplus_file_truncate+0x2da/0xb50 fs/hfsplus/extents.c:576 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&HFSPLUS_I(inode)->extents_lock){+.+.}-{3:3}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_extend+0x21b/0x1b70 fs/hfsplus/extents.c:457 + hfsplus_bmap_reserve+0x105/0x4e0 fs/hfsplus/btree.c:358 + hfsplus_rename_cat+0x1d0/0x1050 fs/hfsplus/catalog.c:456 + hfsplus_rename+0x12e/0x1c0 fs/hfsplus/dir.c:552 + vfs_rename+0xbdb/0xf00 fs/namei.c:4887 + do_renameat2+0xd94/0x13f0 fs/namei.c:5044 + __do_sys_rename fs/namei.c:5091 [inline] + __se_sys_rename fs/namei.c:5089 [inline] + __x64_sys_rename+0x86/0xa0 fs/namei.c:5089 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +-> #0 (&tree->tree_lock){+.+.}-{3:3}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __mutex_lock_common kernel/locking/mutex.c:608 [inline] + __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752 + hfsplus_file_truncate+0x811/0xb50 fs/hfsplus/extents.c:595 + hfsplus_setattr+0x1ce/0x280 fs/hfsplus/inode.c:265 + notify_change+0xb9d/0xe70 fs/attr.c:497 + do_truncate+0x220/0x310 fs/open.c:65 + handle_truncate fs/namei.c:3308 [inline] + do_open fs/namei.c:3654 [inline] + path_openat+0x2a3d/0x3280 fs/namei.c:3807 + do_filp_open+0x235/0x490 fs/namei.c:3834 + do_sys_openat2+0x13e/0x1d0 fs/open.c:1406 + do_sys_open fs/open.c:1421 [inline] + __do_sys_creat fs/open.c:1497 [inline] + __se_sys_creat fs/open.c:1491 [inline] + __x64_sys_creat+0x123/0x170 fs/open.c:1491 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + lock(&HFSPLUS_I(inode)->extents_lock); + lock(&tree->tree_lock); + +This is a false alarm as tree_lock mutex are different, one is +from sbi->cat_tree, and another is from sbi->ext_tree: + +Thread A Thread B +- hfsplus_rename + - hfsplus_rename_cat + - hfs_find_init + - mutext_lock(cat_tree->tree_lock) + - hfsplus_setattr + - hfsplus_file_truncate + - mutex_lock(hip->extents_lock) + - hfs_find_init + - mutext_lock(ext_tree->tree_lock) + - hfs_bmap_reserve + - hfsplus_file_extend + - mutex_lock(hip->extents_lock) + +So, let's call mutex_lock_nested for tree_lock mutex lock, and pass +correct lock class for it. + +Fixes: 31651c607151 ("hfsplus: avoid deadlock on file truncation") +Reported-by: syzbot+6030b3b1b9bf70e538c4@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/linux-fsdevel/000000000000e37a4005ef129563@google.com +Cc: Ernesto A. Fernández +Signed-off-by: Chao Yu +Link: https://lore.kernel.org/r/20240607142304.455441-1-chao@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/hfsplus/bfind.c | 15 ++------------- + fs/hfsplus/extents.c | 9 ++++++--- + fs/hfsplus/hfsplus_fs.h | 21 +++++++++++++++++++++ + 3 files changed, 29 insertions(+), 16 deletions(-) + +diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c +index ca2ba8c9f82ef..901e83d65d202 100644 +--- a/fs/hfsplus/bfind.c ++++ b/fs/hfsplus/bfind.c +@@ -25,19 +25,8 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) + fd->key = ptr + tree->max_key_len + 2; + hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n", + tree->cnid, __builtin_return_address(0)); +- switch (tree->cnid) { +- case HFSPLUS_CAT_CNID: +- mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX); +- break; +- case HFSPLUS_EXT_CNID: +- mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX); +- break; +- case HFSPLUS_ATTR_CNID: +- mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX); +- break; +- default: +- BUG(); +- } ++ mutex_lock_nested(&tree->tree_lock, ++ hfsplus_btree_lock_class(tree)); + return 0; + } + +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c +index 3c572e44f2adf..9c51867dddc51 100644 +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -430,7 +430,8 @@ int hfsplus_free_fork(struct super_block *sb, u32 cnid, + hfsplus_free_extents(sb, ext_entry, total_blocks - start, + total_blocks); + total_blocks = start; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + } while (total_blocks > blocks); + hfs_find_exit(&fd); + +@@ -592,7 +593,8 @@ void hfsplus_file_truncate(struct inode *inode) + alloc_cnt, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->first_extents); + hip->first_blocks = blk_cnt; +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + break; + } + res = __hfsplus_ext_cache_extent(&fd, inode, alloc_cnt); +@@ -606,7 +608,8 @@ void hfsplus_file_truncate(struct inode *inode) + hfsplus_free_extents(sb, hip->cached_extents, + alloc_cnt - start, alloc_cnt - blk_cnt); + hfsplus_dump_extent(hip->cached_extents); +- mutex_lock(&fd.tree->tree_lock); ++ mutex_lock_nested(&fd.tree->tree_lock, ++ hfsplus_btree_lock_class(fd.tree)); + if (blk_cnt > start) { + hip->extent_state |= HFSPLUS_EXT_DIRTY; + break; +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index 012a3d003fbe6..9e78f181c24f4 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -553,6 +553,27 @@ static inline __be32 __hfsp_ut2mt(time64_t ut) + return cpu_to_be32(lower_32_bits(ut) + HFSPLUS_UTC_OFFSET); + } + ++static inline enum hfsplus_btree_mutex_classes ++hfsplus_btree_lock_class(struct hfs_btree *tree) ++{ ++ enum hfsplus_btree_mutex_classes class; ++ ++ switch (tree->cnid) { ++ case HFSPLUS_CAT_CNID: ++ class = CATALOG_BTREE_MUTEX; ++ break; ++ case HFSPLUS_EXT_CNID: ++ class = EXTENTS_BTREE_MUTEX; ++ break; ++ case HFSPLUS_ATTR_CNID: ++ class = ATTR_BTREE_MUTEX; ++ break; ++ default: ++ BUG(); ++ } ++ return class; ++} ++ + /* compatibility */ + #define hfsp_mt2ut(t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) } + #define hfsp_ut2mt(t) __hfsp_ut2mt((t).tv_sec) +-- +2.43.0 + diff --git a/queue-6.10/hns3-avoid-linking-objects-into-multiple-modules.patch b/queue-6.10/hns3-avoid-linking-objects-into-multiple-modules.patch new file mode 100644 index 00000000000..43e319886e4 --- /dev/null +++ b/queue-6.10/hns3-avoid-linking-objects-into-multiple-modules.patch @@ -0,0 +1,273 @@ +From 5c70d420ade0123eaa338ded814a812ea2f68078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 18:15:25 +0200 +Subject: hns3: avoid linking objects into multiple modules + +From: Arnd Bergmann + +[ Upstream commit e3bbb994a7e0ead1e028c5a8ec5f8526b4a9c5c9 ] + +Each object file contains information about which module it gets linked +into, so linking the same file into multiple modules now causes a warning: + +scripts/Makefile.build:254: drivers/net/ethernet/hisilicon/hns3/Makefile: hns3_common/hclge_comm_cmd.o is added to multiple modules: hclge hclgevf +scripts/Makefile.build:254: drivers/net/ethernet/hisilicon/hns3/Makefile: hns3_common/hclge_comm_rss.o is added to multiple modules: hclge hclgevf +scripts/Makefile.build:254: drivers/net/ethernet/hisilicon/hns3/Makefile: hns3_common/hclge_comm_tqp_stats.o is added to multiple modules: hclge hclgevf + +Change the way that hns3 is built by moving the three common files into a +separate module with exported symbols instead. + +Fixes: 5f20be4e90e6 ("net: hns3: refactor hns3 makefile to support hns3_common module") +Signed-off-by: Arnd Bergmann +Reviewed-by: Jacob Keller +Link: https://lore.kernel.org/r/20240528161603.2443125-1-arnd@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/Makefile | 11 +++++------ + .../hisilicon/hns3/hns3_common/hclge_comm_cmd.c | 11 +++++++++++ + .../hisilicon/hns3/hns3_common/hclge_comm_rss.c | 14 ++++++++++++++ + .../hns3/hns3_common/hclge_comm_tqp_stats.c | 5 +++++ + 4 files changed, 35 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile b/drivers/net/ethernet/hisilicon/hns3/Makefile +index 8e9293e57bfd5..e8af26da1fc1e 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/Makefile ++++ b/drivers/net/ethernet/hisilicon/hns3/Makefile +@@ -15,15 +15,14 @@ hns3-objs = hns3_enet.o hns3_ethtool.o hns3_debugfs.o + + hns3-$(CONFIG_HNS3_DCB) += hns3_dcbnl.o + +-obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o ++obj-$(CONFIG_HNS3_HCLGEVF) += hclgevf.o hclge-common.o + +-hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_mbx.o hns3vf/hclgevf_devlink.o hns3vf/hclgevf_regs.o \ +- hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o ++hclge-common-objs += hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o + +-obj-$(CONFIG_HNS3_HCLGE) += hclge.o ++hclgevf-objs = hns3vf/hclgevf_main.o hns3vf/hclgevf_mbx.o hns3vf/hclgevf_devlink.o hns3vf/hclgevf_regs.o ++ ++obj-$(CONFIG_HNS3_HCLGE) += hclge.o hclge-common.o + hclge-objs = hns3pf/hclge_main.o hns3pf/hclge_mdio.o hns3pf/hclge_tm.o hns3pf/hclge_regs.o \ + hns3pf/hclge_mbx.o hns3pf/hclge_err.o hns3pf/hclge_debugfs.o hns3pf/hclge_ptp.o hns3pf/hclge_devlink.o \ +- hns3_common/hclge_comm_cmd.o hns3_common/hclge_comm_rss.o hns3_common/hclge_comm_tqp_stats.o +- + + hclge-$(CONFIG_HNS3_DCB) += hns3pf/hclge_dcb.o +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c +index ea40b594dbac7..4ad4e8ab2f1f3 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c +@@ -48,6 +48,7 @@ void hclge_comm_cmd_reuse_desc(struct hclge_desc *desc, bool is_read) + else + desc->flag &= cpu_to_le16(~HCLGE_COMM_CMD_FLAG_WR); + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_reuse_desc); + + static void hclge_comm_set_default_capability(struct hnae3_ae_dev *ae_dev, + bool is_pf) +@@ -72,6 +73,7 @@ void hclge_comm_cmd_setup_basic_desc(struct hclge_desc *desc, + if (is_read) + desc->flag |= cpu_to_le16(HCLGE_COMM_CMD_FLAG_WR); + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_setup_basic_desc); + + int hclge_comm_firmware_compat_config(struct hnae3_ae_dev *ae_dev, + struct hclge_comm_hw *hw, bool en) +@@ -517,6 +519,7 @@ int hclge_comm_cmd_send(struct hclge_comm_hw *hw, struct hclge_desc *desc, + + return ret; + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_send); + + static void hclge_comm_cmd_uninit_regs(struct hclge_comm_hw *hw) + { +@@ -553,6 +556,7 @@ void hclge_comm_cmd_uninit(struct hnae3_ae_dev *ae_dev, + hclge_comm_free_cmd_desc(&cmdq->csq); + hclge_comm_free_cmd_desc(&cmdq->crq); + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_uninit); + + int hclge_comm_cmd_queue_init(struct pci_dev *pdev, struct hclge_comm_hw *hw) + { +@@ -591,6 +595,7 @@ int hclge_comm_cmd_queue_init(struct pci_dev *pdev, struct hclge_comm_hw *hw) + hclge_comm_free_cmd_desc(&hw->cmq.csq); + return ret; + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_queue_init); + + void hclge_comm_cmd_init_ops(struct hclge_comm_hw *hw, + const struct hclge_comm_cmq_ops *ops) +@@ -602,6 +607,7 @@ void hclge_comm_cmd_init_ops(struct hclge_comm_hw *hw, + cmdq->ops.trace_cmd_get = ops->trace_cmd_get; + } + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_init_ops); + + int hclge_comm_cmd_init(struct hnae3_ae_dev *ae_dev, struct hclge_comm_hw *hw, + u32 *fw_version, bool is_pf, +@@ -672,3 +678,8 @@ int hclge_comm_cmd_init(struct hnae3_ae_dev *ae_dev, struct hclge_comm_hw *hw, + + return ret; + } ++EXPORT_SYMBOL_GPL(hclge_comm_cmd_init); ++ ++MODULE_LICENSE("GPL"); ++MODULE_DESCRIPTION("HNS3: Hisilicon Ethernet PF/VF Common Library"); ++MODULE_AUTHOR("Huawei Tech. Co., Ltd."); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c +index b4ae2160aff4f..4e2bb6556b1ce 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c +@@ -62,6 +62,7 @@ int hclge_comm_rss_init_cfg(struct hnae3_handle *nic, + + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_rss_init_cfg); + + void hclge_comm_get_rss_tc_info(u16 rss_size, u8 hw_tc_map, u16 *tc_offset, + u16 *tc_valid, u16 *tc_size) +@@ -78,6 +79,7 @@ void hclge_comm_get_rss_tc_info(u16 rss_size, u8 hw_tc_map, u16 *tc_offset, + tc_offset[i] = (hw_tc_map & BIT(i)) ? rss_size * i : 0; + } + } ++EXPORT_SYMBOL_GPL(hclge_comm_get_rss_tc_info); + + int hclge_comm_set_rss_tc_mode(struct hclge_comm_hw *hw, u16 *tc_offset, + u16 *tc_valid, u16 *tc_size) +@@ -113,6 +115,7 @@ int hclge_comm_set_rss_tc_mode(struct hclge_comm_hw *hw, u16 *tc_offset, + + return ret; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_tc_mode); + + int hclge_comm_set_rss_hash_key(struct hclge_comm_rss_cfg *rss_cfg, + struct hclge_comm_hw *hw, const u8 *key, +@@ -143,6 +146,7 @@ int hclge_comm_set_rss_hash_key(struct hclge_comm_rss_cfg *rss_cfg, + + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_hash_key); + + int hclge_comm_set_rss_tuple(struct hnae3_ae_dev *ae_dev, + struct hclge_comm_hw *hw, +@@ -185,11 +189,13 @@ int hclge_comm_set_rss_tuple(struct hnae3_ae_dev *ae_dev, + rss_cfg->rss_tuple_sets.ipv6_fragment_en = req->ipv6_fragment_en; + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_tuple); + + u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle) + { + return HCLGE_COMM_RSS_KEY_SIZE; + } ++EXPORT_SYMBOL_GPL(hclge_comm_get_rss_key_size); + + int hclge_comm_parse_rss_hfunc(struct hclge_comm_rss_cfg *rss_cfg, + const u8 hfunc, u8 *hash_algo) +@@ -217,6 +223,7 @@ void hclge_comm_rss_indir_init_cfg(struct hnae3_ae_dev *ae_dev, + for (i = 0; i < ae_dev->dev_specs.rss_ind_tbl_size; i++) + rss_cfg->rss_indirection_tbl[i] = i % rss_cfg->rss_size; + } ++EXPORT_SYMBOL_GPL(hclge_comm_rss_indir_init_cfg); + + int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type, + u8 *tuple_sets) +@@ -250,6 +257,7 @@ int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type, + + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_get_rss_tuple); + + static void + hclge_comm_append_rss_msb_info(struct hclge_comm_rss_ind_tbl_cmd *req, +@@ -304,6 +312,7 @@ int hclge_comm_set_rss_indir_table(struct hnae3_ae_dev *ae_dev, + } + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_indir_table); + + int hclge_comm_set_rss_input_tuple(struct hclge_comm_hw *hw, + struct hclge_comm_rss_cfg *rss_cfg) +@@ -332,6 +341,7 @@ int hclge_comm_set_rss_input_tuple(struct hclge_comm_hw *hw, + "failed to configure rss input, ret = %d.\n", ret); + return ret; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_input_tuple); + + void hclge_comm_get_rss_hash_info(struct hclge_comm_rss_cfg *rss_cfg, u8 *key, + u8 *hfunc) +@@ -355,6 +365,7 @@ void hclge_comm_get_rss_hash_info(struct hclge_comm_rss_cfg *rss_cfg, u8 *key, + if (key) + memcpy(key, rss_cfg->rss_hash_key, HCLGE_COMM_RSS_KEY_SIZE); + } ++EXPORT_SYMBOL_GPL(hclge_comm_get_rss_hash_info); + + void hclge_comm_get_rss_indir_tbl(struct hclge_comm_rss_cfg *rss_cfg, + u32 *indir, u16 rss_ind_tbl_size) +@@ -367,6 +378,7 @@ void hclge_comm_get_rss_indir_tbl(struct hclge_comm_rss_cfg *rss_cfg, + for (i = 0; i < rss_ind_tbl_size; i++) + indir[i] = rss_cfg->rss_indirection_tbl[i]; + } ++EXPORT_SYMBOL_GPL(hclge_comm_get_rss_indir_tbl); + + int hclge_comm_set_rss_algo_key(struct hclge_comm_hw *hw, const u8 hfunc, + const u8 *key) +@@ -408,6 +420,7 @@ int hclge_comm_set_rss_algo_key(struct hclge_comm_hw *hw, const u8 hfunc, + + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_set_rss_algo_key); + + static u8 hclge_comm_get_rss_hash_bits(struct ethtool_rxnfc *nfc) + { +@@ -502,3 +515,4 @@ u64 hclge_comm_convert_rss_tuple(u8 tuple_sets) + + return tuple_data; + } ++EXPORT_SYMBOL_GPL(hclge_comm_convert_rss_tuple); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +index 618f66d9586b3..2b31188ff5558 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +@@ -26,6 +26,7 @@ u64 *hclge_comm_tqps_get_stats(struct hnae3_handle *handle, u64 *data) + + return buff; + } ++EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_stats); + + int hclge_comm_tqps_get_sset_count(struct hnae3_handle *handle) + { +@@ -33,6 +34,7 @@ int hclge_comm_tqps_get_sset_count(struct hnae3_handle *handle) + + return kinfo->num_tqps * HCLGE_COMM_QUEUE_PAIR_SIZE; + } ++EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_sset_count); + + u8 *hclge_comm_tqps_get_strings(struct hnae3_handle *handle, u8 *data) + { +@@ -56,6 +58,7 @@ u8 *hclge_comm_tqps_get_strings(struct hnae3_handle *handle, u8 *data) + + return buff; + } ++EXPORT_SYMBOL_GPL(hclge_comm_tqps_get_strings); + + int hclge_comm_tqps_update_stats(struct hnae3_handle *handle, + struct hclge_comm_hw *hw) +@@ -99,6 +102,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle, + + return 0; + } ++EXPORT_SYMBOL_GPL(hclge_comm_tqps_update_stats); + + void hclge_comm_reset_tqp_stats(struct hnae3_handle *handle) + { +@@ -113,3 +117,4 @@ void hclge_comm_reset_tqp_stats(struct hnae3_handle *handle) + memset(&tqp->tqp_stats, 0, sizeof(tqp->tqp_stats)); + } + } ++EXPORT_SYMBOL_GPL(hclge_comm_reset_tqp_stats); +-- +2.43.0 + diff --git a/queue-6.10/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch b/queue-6.10/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch new file mode 100644 index 00000000000..155284c6a97 --- /dev/null +++ b/queue-6.10/hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch @@ -0,0 +1,38 @@ +From f7a7cd5cb9da2e6a413a026bc11f4514018a24c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 15:32:52 +0800 +Subject: hwmon: (adt7475) Fix default duty on fan is disabled + +From: Wayne Tung + +[ Upstream commit 39b24cced70fdc336dbc0070f8b3bde61d8513a8 ] + +According to the comments on fan is disabled, we change to manual mode +and set the duty cycle to 0. +For setting the duty cycle part, the register is wrong. Fix it. + +Fixes: 1c301fc5394f ("hwmon: Add a driver for the ADT7475 hardware monitoring chip") +Signed-off-by: Wayne Tung +Link: https://lore.kernel.org/r/20240701073252.317397-1-chineweff@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7475.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 4224ffb304832..ec3336804720e 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -1900,7 +1900,7 @@ static void adt7475_read_pwm(struct i2c_client *client, int index) + data->pwm[CONTROL][index] &= ~0xE0; + data->pwm[CONTROL][index] |= (7 << 5); + +- i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), ++ i2c_smbus_write_byte_data(client, PWM_REG(index), + data->pwm[INPUT][index]); + + i2c_smbus_write_byte_data(client, PWM_CONFIG_REG(index), +-- +2.43.0 + diff --git a/queue-6.10/hwmon-ltc2991-re-order-conditions-to-fix-off-by-one-.patch b/queue-6.10/hwmon-ltc2991-re-order-conditions-to-fix-off-by-one-.patch new file mode 100644 index 00000000000..0c4e6e92079 --- /dev/null +++ b/queue-6.10/hwmon-ltc2991-re-order-conditions-to-fix-off-by-one-.patch @@ -0,0 +1,42 @@ +From 8495978a77f7f97a051b2f8f49543cef5761ba6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 10:18:59 -0500 +Subject: hwmon: (ltc2991) re-order conditions to fix off by one bug + +From: Dan Carpenter + +[ Upstream commit 99bf7c2eccff82760fa23ce967cc67c8c219c6a6 ] + +LTC2991_T_INT_CH_NR is 4. The st->temp_en[] array has LTC2991_MAX_CHANNEL +(4) elements. Thus if "channel" is equal to LTC2991_T_INT_CH_NR then we +have read one element beyond the end of the array. Flip the conditions +around so that we check if "channel" is valid before using it as an array +index. + +Fixes: 2b9ea4262ae9 ("hwmon: Add driver for ltc2991") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Zoa9Y_UMY4_ROfhF@stanley.mountain +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ltc2991.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/ltc2991.c b/drivers/hwmon/ltc2991.c +index 06750bb93c236..f74ce9c25bf71 100644 +--- a/drivers/hwmon/ltc2991.c ++++ b/drivers/hwmon/ltc2991.c +@@ -225,8 +225,8 @@ static umode_t ltc2991_is_visible(const void *data, + case hwmon_temp: + switch (attr) { + case hwmon_temp_input: +- if (st->temp_en[channel] || +- channel == LTC2991_T_INT_CH_NR) ++ if (channel == LTC2991_T_INT_CH_NR || ++ st->temp_en[channel]) + return 0444; + break; + } +-- +2.43.0 + diff --git a/queue-6.10/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch b/queue-6.10/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch new file mode 100644 index 00000000000..45d480d1cdc --- /dev/null +++ b/queue-6.10/hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch @@ -0,0 +1,48 @@ +From 8410b68fe867cb9a60a2e641044e474ba9914f80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 12:03:53 -0700 +Subject: hwmon: (max6697) Fix swapped temp{1,8} critical alarms + +From: Guenter Roeck + +[ Upstream commit 1ea3fd1eb9869fcdcbc9c68f9728bfc47b9503f1 ] + +The critical alarm bit for the local temperature sensor (temp1) is in +bit 7 of register 0x45 (not bit 6), and the critical alarm bit for remote +temperature sensor 7 (temp8) is in bit 6 (not bit 7). + +This only affects MAX6581 since all other chips supported by this driver +do not support those critical alarms. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index 978476b632752..8aac8278193f0 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -429,14 +429,14 @@ static SENSOR_DEVICE_ATTR_RO(temp6_max_alarm, alarm, 20); + static SENSOR_DEVICE_ATTR_RO(temp7_max_alarm, alarm, 21); + static SENSOR_DEVICE_ATTR_RO(temp8_max_alarm, alarm, 23); + +-static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 14); ++static SENSOR_DEVICE_ATTR_RO(temp1_crit_alarm, alarm, 15); + static SENSOR_DEVICE_ATTR_RO(temp2_crit_alarm, alarm, 8); + static SENSOR_DEVICE_ATTR_RO(temp3_crit_alarm, alarm, 9); + static SENSOR_DEVICE_ATTR_RO(temp4_crit_alarm, alarm, 10); + static SENSOR_DEVICE_ATTR_RO(temp5_crit_alarm, alarm, 11); + static SENSOR_DEVICE_ATTR_RO(temp6_crit_alarm, alarm, 12); + static SENSOR_DEVICE_ATTR_RO(temp7_crit_alarm, alarm, 13); +-static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 15); ++static SENSOR_DEVICE_ATTR_RO(temp8_crit_alarm, alarm, 14); + + static SENSOR_DEVICE_ATTR_RO(temp2_fault, alarm, 1); + static SENSOR_DEVICE_ATTR_RO(temp3_fault, alarm, 2); +-- +2.43.0 + diff --git a/queue-6.10/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch b/queue-6.10/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch new file mode 100644 index 00000000000..f8631940279 --- /dev/null +++ b/queue-6.10/hwmon-max6697-fix-underflow-when-writing-limit-attri.patch @@ -0,0 +1,40 @@ +From b43322c489ccb4f5a8eaa4d088579de3ffd1c1f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 14:26:19 -0700 +Subject: hwmon: (max6697) Fix underflow when writing limit attributes + +From: Guenter Roeck + +[ Upstream commit cbf7467828cd4ec7ceac7a8b5b5ddb2f69f07b0e ] + +Using DIV_ROUND_CLOSEST() on an unbound value can result in underflows. +Indeed, module test scripts report: + +temp1_max: Suspected underflow: [min=0, read 255000, written -9223372036854775808] +temp1_crit: Suspected underflow: [min=0, read 255000, written -9223372036854775808] + +Fix by introducing an extra set of clamping. + +Fixes: 5372d2d71c46 ("hwmon: Driver for Maxim MAX6697 and compatibles") +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max6697.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/max6697.c b/drivers/hwmon/max6697.c +index d161ba0e7813c..978476b632752 100644 +--- a/drivers/hwmon/max6697.c ++++ b/drivers/hwmon/max6697.c +@@ -311,6 +311,7 @@ static ssize_t temp_store(struct device *dev, + return ret; + + mutex_lock(&data->update_lock); ++ temp = clamp_val(temp, -1000000, 1000000); /* prevent underflow */ + temp = DIV_ROUND_CLOSEST(temp, 1000) + data->temp_offset; + temp = clamp_val(temp, 0, data->type == max6581 ? 255 : 127); + data->temp[nr][index] = temp; +-- +2.43.0 + diff --git a/queue-6.10/hwrng-core-fix-wrong-quality-calculation-at-hw-rng-r.patch b/queue-6.10/hwrng-core-fix-wrong-quality-calculation-at-hw-rng-r.patch new file mode 100644 index 00000000000..5e7e0f19dcb --- /dev/null +++ b/queue-6.10/hwrng-core-fix-wrong-quality-calculation-at-hw-rng-r.patch @@ -0,0 +1,68 @@ +From c812cdb9d38240ca487b44df708a8717e91a417b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 17:02:24 +0200 +Subject: hwrng: core - Fix wrong quality calculation at hw rng registration + +From: Harald Freudenberger + +[ Upstream commit 95c0f5c3b8bb7acdc5c4f04bc6a7d3f40d319e9e ] + +When there are rng sources registering at the hwrng core via +hwrng_register() a struct hwrng is delivered. There is a quality +field in there which is used to decide which of the registered +hw rng sources will be used by the hwrng core. + +With commit 16bdbae39428 ("hwrng: core - treat default_quality as +a maximum and default to 1024") there came in a new default of +1024 in case this field is empty and all the known hw rng sources +at that time had been reworked to not fill this field and thus +use the default of 1024. + +The code choosing the 'better' hw rng source during registration +of a new hw rng source has never been adapted to this and thus +used 0 if the hw rng implementation does not fill the quality field. +So when two rng sources register, one with 0 (meaning 1024) and +the other one with 999, the 999 hw rng will be chosen. + +As the later invoked function hwrng_init() anyway adjusts the +quality field of the hw rng source, this adjustment is now done +during registration of this new hw rng source. + +Tested on s390 with two hardware rng sources: crypto cards and +trng true random generator device driver. + +Fixes: 16bdbae39428 ("hwrng: core - treat default_quality as a maximum and default to 1024") +Reported-by: Christian Rund +Suggested-by: Herbert Xu +Signed-off-by: Harald Freudenberger +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c +index 4084df65c9fa3..f6122a03ee37c 100644 +--- a/drivers/char/hw_random/core.c ++++ b/drivers/char/hw_random/core.c +@@ -161,7 +161,6 @@ static int hwrng_init(struct hwrng *rng) + reinit_completion(&rng->cleanup_done); + + skip_init: +- rng->quality = min_t(u16, min_t(u16, default_quality, 1024), rng->quality ?: 1024); + current_quality = rng->quality; /* obsolete */ + + return 0; +@@ -545,6 +544,9 @@ int hwrng_register(struct hwrng *rng) + complete(&rng->cleanup_done); + init_completion(&rng->dying); + ++ /* Adjust quality field to always have a proper value */ ++ rng->quality = min_t(u16, min_t(u16, default_quality, 1024), rng->quality ?: 1024); ++ + if (!current_rng || + (!cur_rng_set_by_user && rng->quality > current_rng->quality)) { + /* +-- +2.43.0 + diff --git a/queue-6.10/iio-adc-ad9467-use-dma-safe-buffer-for-spi.patch b/queue-6.10/iio-adc-ad9467-use-dma-safe-buffer-for-spi.patch new file mode 100644 index 00000000000..c6be04cac7a --- /dev/null +++ b/queue-6.10/iio-adc-ad9467-use-dma-safe-buffer-for-spi.patch @@ -0,0 +1,244 @@ +From 7cf612899bb4c50e742775a424c888d5fbba9d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 14:54:05 +0200 +Subject: iio: adc: ad9467: use DMA safe buffer for spi + +From: Nuno Sa + +[ Upstream commit 7a8e7f13f99b31c85b77b362cb7b7a23fead11d3 ] + +Make sure we use a DMA safe buffer (IIO_DMA_MINALIGN) for all the spi +transfers. Only relevant for writes since for reads +spi_write_then_read() is used which does not require DMA safe buffers. + +Also note that for consistency, ad9467_spi_read() is also taking struct +ad9467_state as a parameter (even if not really needed). + +Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC") +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20240522-dev-ad9467-dma-v2-1-a37bec463632@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad9467.c | 65 +++++++++++++++++++--------------------- + 1 file changed, 31 insertions(+), 34 deletions(-) + +diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c +index 8f5b9c3f6e3d6..1fd2211e29642 100644 +--- a/drivers/iio/adc/ad9467.c ++++ b/drivers/iio/adc/ad9467.c +@@ -141,9 +141,10 @@ struct ad9467_state { + struct gpio_desc *pwrdown_gpio; + /* ensure consistent state obtained on multiple related accesses */ + struct mutex lock; ++ u8 buf[3] __aligned(IIO_DMA_MINALIGN); + }; + +-static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) ++static int ad9467_spi_read(struct ad9467_state *st, unsigned int reg) + { + unsigned char tbuf[2], rbuf[1]; + int ret; +@@ -151,7 +152,7 @@ static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) + tbuf[0] = 0x80 | (reg >> 8); + tbuf[1] = reg & 0xFF; + +- ret = spi_write_then_read(spi, ++ ret = spi_write_then_read(st->spi, + tbuf, ARRAY_SIZE(tbuf), + rbuf, ARRAY_SIZE(rbuf)); + +@@ -161,35 +162,32 @@ static int ad9467_spi_read(struct spi_device *spi, unsigned int reg) + return rbuf[0]; + } + +-static int ad9467_spi_write(struct spi_device *spi, unsigned int reg, ++static int ad9467_spi_write(struct ad9467_state *st, unsigned int reg, + unsigned int val) + { +- unsigned char buf[3]; ++ st->buf[0] = reg >> 8; ++ st->buf[1] = reg & 0xFF; ++ st->buf[2] = val; + +- buf[0] = reg >> 8; +- buf[1] = reg & 0xFF; +- buf[2] = val; +- +- return spi_write(spi, buf, ARRAY_SIZE(buf)); ++ return spi_write(st->spi, st->buf, ARRAY_SIZE(st->buf)); + } + + static int ad9467_reg_access(struct iio_dev *indio_dev, unsigned int reg, + unsigned int writeval, unsigned int *readval) + { + struct ad9467_state *st = iio_priv(indio_dev); +- struct spi_device *spi = st->spi; + int ret; + + if (!readval) { + guard(mutex)(&st->lock); +- ret = ad9467_spi_write(spi, reg, writeval); ++ ret = ad9467_spi_write(st, reg, writeval); + if (ret) + return ret; +- return ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, ++ return ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + } + +- ret = ad9467_spi_read(spi, reg); ++ ret = ad9467_spi_read(st, reg); + if (ret < 0) + return ret; + *readval = ret; +@@ -295,7 +293,7 @@ static int ad9467_get_scale(struct ad9467_state *st, int *val, int *val2) + unsigned int i, vref_val; + int ret; + +- ret = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF); ++ ret = ad9467_spi_read(st, AN877_ADC_REG_VREF); + if (ret < 0) + return ret; + +@@ -330,31 +328,31 @@ static int ad9467_set_scale(struct ad9467_state *st, int val, int val2) + continue; + + guard(mutex)(&st->lock); +- ret = ad9467_spi_write(st->spi, AN877_ADC_REG_VREF, ++ ret = ad9467_spi_write(st, AN877_ADC_REG_VREF, + info->scale_table[i][1]); + if (ret < 0) + return ret; + +- return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, ++ return ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + } + + return -EINVAL; + } + +-static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode) ++static int ad9467_outputmode_set(struct ad9467_state *st, unsigned int mode) + { + int ret; + +- ret = ad9467_spi_write(spi, AN877_ADC_REG_OUTPUT_MODE, mode); ++ ret = ad9467_spi_write(st, AN877_ADC_REG_OUTPUT_MODE, mode); + if (ret < 0) + return ret; + +- return ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER, ++ return ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + } + +-static int ad9647_calibrate_prepare(const struct ad9467_state *st) ++static int ad9647_calibrate_prepare(struct ad9467_state *st) + { + struct iio_backend_data_fmt data = { + .enable = false, +@@ -362,17 +360,17 @@ static int ad9647_calibrate_prepare(const struct ad9467_state *st) + unsigned int c; + int ret; + +- ret = ad9467_spi_write(st->spi, AN877_ADC_REG_TEST_IO, ++ ret = ad9467_spi_write(st, AN877_ADC_REG_TEST_IO, + AN877_ADC_TESTMODE_PN9_SEQ); + if (ret) + return ret; + +- ret = ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, ++ ret = ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + if (ret) + return ret; + +- ret = ad9467_outputmode_set(st->spi, st->info->default_output_mode); ++ ret = ad9467_outputmode_set(st, st->info->default_output_mode); + if (ret) + return ret; + +@@ -390,7 +388,7 @@ static int ad9647_calibrate_prepare(const struct ad9467_state *st) + return iio_backend_chan_enable(st->back, 0); + } + +-static int ad9647_calibrate_polarity_set(const struct ad9467_state *st, ++static int ad9647_calibrate_polarity_set(struct ad9467_state *st, + bool invert) + { + enum iio_backend_sample_trigger trigger; +@@ -401,7 +399,7 @@ static int ad9647_calibrate_polarity_set(const struct ad9467_state *st, + if (invert) + phase |= AN877_ADC_INVERT_DCO_CLK; + +- return ad9467_spi_write(st->spi, AN877_ADC_REG_OUTPUT_PHASE, ++ return ad9467_spi_write(st, AN877_ADC_REG_OUTPUT_PHASE, + phase); + } + +@@ -437,19 +435,18 @@ static unsigned int ad9467_find_optimal_point(const unsigned long *calib_map, + return cnt; + } + +-static int ad9467_calibrate_apply(const struct ad9467_state *st, +- unsigned int val) ++static int ad9467_calibrate_apply(struct ad9467_state *st, unsigned int val) + { + unsigned int lane; + int ret; + + if (st->info->has_dco) { +- ret = ad9467_spi_write(st->spi, AN877_ADC_REG_OUTPUT_DELAY, ++ ret = ad9467_spi_write(st, AN877_ADC_REG_OUTPUT_DELAY, + val); + if (ret) + return ret; + +- return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, ++ return ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + } + +@@ -462,7 +459,7 @@ static int ad9467_calibrate_apply(const struct ad9467_state *st, + return 0; + } + +-static int ad9647_calibrate_stop(const struct ad9467_state *st) ++static int ad9647_calibrate_stop(struct ad9467_state *st) + { + struct iio_backend_data_fmt data = { + .sign_extend = true, +@@ -487,16 +484,16 @@ static int ad9647_calibrate_stop(const struct ad9467_state *st) + } + + mode = st->info->default_output_mode | AN877_ADC_OUTPUT_MODE_TWOS_COMPLEMENT; +- ret = ad9467_outputmode_set(st->spi, mode); ++ ret = ad9467_outputmode_set(st, mode); + if (ret) + return ret; + +- ret = ad9467_spi_write(st->spi, AN877_ADC_REG_TEST_IO, ++ ret = ad9467_spi_write(st, AN877_ADC_REG_TEST_IO, + AN877_ADC_TESTMODE_OFF); + if (ret) + return ret; + +- return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER, ++ return ad9467_spi_write(st, AN877_ADC_REG_TRANSFER, + AN877_ADC_TRANSFER_SYNC); + } + +@@ -846,7 +843,7 @@ static int ad9467_probe(struct spi_device *spi) + if (ret) + return ret; + +- id = ad9467_spi_read(spi, AN877_ADC_REG_CHIP_ID); ++ id = ad9467_spi_read(st, AN877_ADC_REG_CHIP_ID); + if (id != st->info->id) { + dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n", + id, st->info->id); +-- +2.43.0 + diff --git a/queue-6.10/iio-adc-adi-axi-adc-don-t-allow-concurrent-enable-di.patch b/queue-6.10/iio-adc-adi-axi-adc-don-t-allow-concurrent-enable-di.patch new file mode 100644 index 00000000000..64b13356066 --- /dev/null +++ b/queue-6.10/iio-adc-adi-axi-adc-don-t-allow-concurrent-enable-di.patch @@ -0,0 +1,47 @@ +From 03ab8a5c93060abaa5d1289e0604b89413596a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 11:41:54 +0200 +Subject: iio: adc: adi-axi-adc: don't allow concurrent enable/disable calls + +From: Nuno Sa + +[ Upstream commit 202b89f4b778d86a940f693785600acaccca6a2b ] + +Add proper mutex guards as we should not be able to disable +the core in the middle of enabling it. + +Note there's no need to rush in backporting this as the only user of the +backend does not do anything crazy.. + +Fixes: 794ef0e57854 ("iio: adc: adi-axi-adc: move to backend framework") +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20240531-dev-axi-adc-drp-v3-1-e3fa79447c67@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/adi-axi-adc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/adc/adi-axi-adc.c b/drivers/iio/adc/adi-axi-adc.c +index 0cf0d81358fd5..bf51d619ebbc9 100644 +--- a/drivers/iio/adc/adi-axi-adc.c ++++ b/drivers/iio/adc/adi-axi-adc.c +@@ -85,6 +85,7 @@ static int axi_adc_enable(struct iio_backend *back) + struct adi_axi_adc_state *st = iio_backend_get_priv(back); + int ret; + ++ guard(mutex)(&st->lock); + ret = regmap_set_bits(st->regmap, ADI_AXI_REG_RSTN, + ADI_AXI_REG_RSTN_MMCM_RSTN); + if (ret) +@@ -99,6 +100,7 @@ static void axi_adc_disable(struct iio_backend *back) + { + struct adi_axi_adc_state *st = iio_backend_get_priv(back); + ++ guard(mutex)(&st->lock); + regmap_write(st->regmap, ADI_AXI_REG_RSTN, 0); + } + +-- +2.43.0 + diff --git a/queue-6.10/iio-fix-the-sorting-functionality-in-iio_gts_build_a.patch b/queue-6.10/iio-fix-the-sorting-functionality-in-iio_gts_build_a.patch new file mode 100644 index 00000000000..afcb71eea48 --- /dev/null +++ b/queue-6.10/iio-fix-the-sorting-functionality-in-iio_gts_build_a.patch @@ -0,0 +1,71 @@ +From 37a8e4551bfa383c7f2372487ab619e6c94ccf09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 15:44:53 +0300 +Subject: iio: Fix the sorting functionality in iio_gts_build_avail_time_table + +From: Chenyuan Yang + +[ Upstream commit 5acc3f971a01be48d5ff4252d8f9cdb87998cdfb ] + +The sorting in iio_gts_build_avail_time_table is not working as intended. +It could result in an out-of-bounds access when the time is zero. + +Here are more details: + +1. When the gts->itime_table[i].time_us is zero, e.g., the time +sequence is `3, 0, 1`, the inner for-loop will not terminate and do +out-of-bound writes. This is because once `times[j] > new`, the value +`new` will be added in the current position and the `times[j]` will be +moved to `j+1` position, which makes the if-condition always hold. +Meanwhile, idx will be added one, making the loop keep running without +termination and out-of-bound write. +2. If none of the gts->itime_table[i].time_us is zero, the elements +will just be copied without being sorted as described in the comment +"Sort times from all tables to one and remove duplicates". + +For more details, please refer to +https://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com. + +Reported-by: Chenyuan Yang +Suggested-by: Matti Vaittinen +Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers") +Signed-off-by: Chenyuan Yang +Co-developed-by: Matti Vaittinen +Signed-off-by: Matti Vaittinen +Link: https://lore.kernel.org/r/d501ade8c1f7b202d34c6404eda423489cab1df5.1714480171.git.mazziesaccount@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/industrialio-gts-helper.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/industrialio-gts-helper.c b/drivers/iio/industrialio-gts-helper.c +index b51eb6cb766f3..59d7615c0f565 100644 +--- a/drivers/iio/industrialio-gts-helper.c ++++ b/drivers/iio/industrialio-gts-helper.c +@@ -362,17 +362,20 @@ static int iio_gts_build_avail_time_table(struct iio_gts *gts) + for (i = gts->num_itime - 1; i >= 0; i--) { + int new = gts->itime_table[i].time_us; + +- if (times[idx] < new) { ++ if (idx == 0 || times[idx - 1] < new) { + times[idx++] = new; + continue; + } + +- for (j = 0; j <= idx; j++) { ++ for (j = 0; j < idx; j++) { ++ if (times[j] == new) ++ break; + if (times[j] > new) { + memmove(×[j + 1], ×[j], + (idx - j) * sizeof(int)); + times[j] = new; + idx++; ++ break; + } + } + } +-- +2.43.0 + diff --git a/queue-6.10/iio-frequency-adrf6780-rm-clk-provider-include.patch b/queue-6.10/iio-frequency-adrf6780-rm-clk-provider-include.patch new file mode 100644 index 00000000000..c3114b5d191 --- /dev/null +++ b/queue-6.10/iio-frequency-adrf6780-rm-clk-provider-include.patch @@ -0,0 +1,36 @@ +From c13036aa9f97bd3b85fbdf292d6484d5c24418c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 12:28:34 +0300 +Subject: iio: frequency: adrf6780: rm clk provider include + +From: Antoniu Miclaus + +[ Upstream commit e2261b4a4de2804698935eb44f98dc897e1c44c3 ] + +The driver has no clock provider implementation, therefore remove the +include. + +Fixes: 63aaf6d06d87 ("iio: frequency: adrf6780: add support for ADRF6780") +Signed-off-by: Antoniu Miclaus +Link: https://lore.kernel.org/r/20240530092835.36892-1-antoniu.miclaus@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/frequency/adrf6780.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/iio/frequency/adrf6780.c b/drivers/iio/frequency/adrf6780.c +index b4defb82f37e3..3f46032c92752 100644 +--- a/drivers/iio/frequency/adrf6780.c ++++ b/drivers/iio/frequency/adrf6780.c +@@ -9,7 +9,6 @@ + #include + #include + #include +-#include + #include + #include + #include +-- +2.43.0 + diff --git a/queue-6.10/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch b/queue-6.10/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch new file mode 100644 index 00000000000..8eb5f4a3f4f --- /dev/null +++ b/queue-6.10/input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch @@ -0,0 +1,36 @@ +From 2cc8b02949710562f536a7b8e9a08b73bf5788af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 23:02:48 -0700 +Subject: Input: elan_i2c - do not leave interrupt disabled on suspend failure + +From: Dmitry Torokhov + +[ Upstream commit 5f82c1e04721e7cd98e604eb4e58f0724d8e5a65 ] + +Make sure interrupts are not left disabled when we fail to suspend the +touch controller. + +Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad") +Link: https://lore.kernel.org/r/ZmKiiL-1wzKrhqBj@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index c2aec5c360b3b..ce96513b34f64 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1356,6 +1356,8 @@ static int elan_suspend(struct device *dev) + } + + err: ++ if (ret) ++ enable_irq(client->irq); + mutex_unlock(&data->sysfs_mutex); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/input-qt1050-handle-chip_id-reading-error.patch b/queue-6.10/input-qt1050-handle-chip_id-reading-error.patch new file mode 100644 index 00000000000..0e09112dbbe --- /dev/null +++ b/queue-6.10/input-qt1050-handle-chip_id-reading-error.patch @@ -0,0 +1,49 @@ +From 059ba25333be7deaab9480086f63fab3181ac401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 20:30:18 +0200 +Subject: Input: qt1050 - handle CHIP_ID reading error + +From: Andrei Lalaev + +[ Upstream commit 866a5c7e2781cf1b019072288f1f5c64186dcb63 ] + +If the device is missing, we get the following error: + + qt1050 3-0041: ID -1340767592 not supported + +Let's handle this situation and print more informative error +when reading of CHIP_ID fails: + + qt1050 3-0041: Failed to read chip ID: -6 + +Fixes: cbebf5addec1 ("Input: qt1050 - add Microchip AT42QT1050 support") +Signed-off-by: Andrei Lalaev +Reviewed-by: Marco Felsch +Link: https://lore.kernel.org/r/20240617183018.916234-1-andrey.lalaev@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/qt1050.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/keyboard/qt1050.c b/drivers/input/keyboard/qt1050.c +index b51dfcd760386..056e9bc260262 100644 +--- a/drivers/input/keyboard/qt1050.c ++++ b/drivers/input/keyboard/qt1050.c +@@ -226,7 +226,12 @@ static bool qt1050_identify(struct qt1050_priv *ts) + int err; + + /* Read Chip ID */ +- regmap_read(ts->regmap, QT1050_CHIP_ID, &val); ++ err = regmap_read(ts->regmap, QT1050_CHIP_ID, &val); ++ if (err) { ++ dev_err(&ts->client->dev, "Failed to read chip ID: %d\n", err); ++ return false; ++ } ++ + if (val != QT1050_CHIP_ID_VER) { + dev_err(&ts->client->dev, "ID %d not supported\n", val); + return false; +-- +2.43.0 + diff --git a/queue-6.10/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch b/queue-6.10/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch new file mode 100644 index 00000000000..76d832251be --- /dev/null +++ b/queue-6.10/interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch @@ -0,0 +1,39 @@ +From ad9bd2ec926fade802769f9f7bb330354911a6dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 16:42:18 +0200 +Subject: interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID + +From: Konrad Dybcio + +[ Upstream commit cd5ce4589081190281cc2537301edd4275fe55eb ] + +The value was wrong, resulting in misprogramming of the hardware. +Fix it. + +Fixes: 1a14b1ac3935 ("interconnect: qcom: Add QCM2290 driver support") +Reported-by: Stephan Gerhold +Closes: https://lore.kernel.org/linux-arm-msm/ZgMs_xZVzWH5uK-v@gerhold.net/ +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240618-topic-2290_icc_2-v1-1-64446888a133@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/qcm2290.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/interconnect/qcom/qcm2290.c b/drivers/interconnect/qcom/qcm2290.c +index ba4cc08684d63..ccbdc6202c07a 100644 +--- a/drivers/interconnect/qcom/qcm2290.c ++++ b/drivers/interconnect/qcom/qcm2290.c +@@ -166,7 +166,7 @@ static struct qcom_icc_node mas_snoc_bimc = { + .qos.ap_owned = true, + .qos.qos_port = 6, + .qos.qos_mode = NOC_QOS_MODE_BYPASS, +- .mas_rpm_id = 164, ++ .mas_rpm_id = 3, + .slv_rpm_id = -1, + .num_links = ARRAY_SIZE(mas_snoc_bimc_links), + .links = mas_snoc_bimc_links, +-- +2.43.0 + diff --git a/queue-6.10/io_uring-fix-probe-of-disabled-operations.patch b/queue-6.10/io_uring-fix-probe-of-disabled-operations.patch new file mode 100644 index 00000000000..377c0600eb5 --- /dev/null +++ b/queue-6.10/io_uring-fix-probe-of-disabled-operations.patch @@ -0,0 +1,81 @@ +From 6051fa4143c1997434760d17184624ff5fc3b49f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 22:06:18 -0400 +Subject: io_uring: Fix probe of disabled operations + +From: Gabriel Krisman Bertazi + +[ Upstream commit 3e05b222382ec67dce7358d50b6006e91d028d8b ] + +io_probe checks io_issue_def->not_supported, but we never really set +that field, as we mark non-supported functions through a specific ->prep +handler. This means we end up returning IO_URING_OP_SUPPORTED, even for +disabled operations. Fix it by just checking the prep handler itself. + +Fixes: 66f4af93da57 ("io_uring: add support for probing opcodes") +Signed-off-by: Gabriel Krisman Bertazi +Link: https://lore.kernel.org/r/20240619020620.5301-2-krisman@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/opdef.c | 8 ++++++++ + io_uring/opdef.h | 4 ++-- + io_uring/register.c | 2 +- + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/io_uring/opdef.c b/io_uring/opdef.c +index 2e3b7b16effb3..760006ccc4083 100644 +--- a/io_uring/opdef.c ++++ b/io_uring/opdef.c +@@ -725,6 +725,14 @@ const char *io_uring_get_opcode(u8 opcode) + return "INVALID"; + } + ++bool io_uring_op_supported(u8 opcode) ++{ ++ if (opcode < IORING_OP_LAST && ++ io_issue_defs[opcode].prep != io_eopnotsupp_prep) ++ return true; ++ return false; ++} ++ + void __init io_uring_optable_init(void) + { + int i; +diff --git a/io_uring/opdef.h b/io_uring/opdef.h +index 7ee6f5aa90aa3..14456436ff74a 100644 +--- a/io_uring/opdef.h ++++ b/io_uring/opdef.h +@@ -17,8 +17,6 @@ struct io_issue_def { + unsigned poll_exclusive : 1; + /* op supports buffer selection */ + unsigned buffer_select : 1; +- /* opcode is not supported by this kernel */ +- unsigned not_supported : 1; + /* skip auditing */ + unsigned audit_skip : 1; + /* supports ioprio */ +@@ -47,5 +45,7 @@ struct io_cold_def { + extern const struct io_issue_def io_issue_defs[]; + extern const struct io_cold_def io_cold_defs[]; + ++bool io_uring_op_supported(u8 opcode); ++ + void io_uring_optable_init(void); + #endif +diff --git a/io_uring/register.c b/io_uring/register.c +index c0010a66a6f2c..11517b34cfc8f 100644 +--- a/io_uring/register.c ++++ b/io_uring/register.c +@@ -113,7 +113,7 @@ static __cold int io_probe(struct io_ring_ctx *ctx, void __user *arg, + + for (i = 0; i < nr_args; i++) { + p->ops[i].op = i; +- if (!io_issue_defs[i].not_supported) ++ if (io_uring_op_supported(i)) + p->ops[i].flags = IO_URING_OP_SUPPORTED; + } + p->ops_len = i; +-- +2.43.0 + diff --git a/queue-6.10/iommu-arm-smmu-qcom-register-the-tbu-driver-in-qcom_.patch b/queue-6.10/iommu-arm-smmu-qcom-register-the-tbu-driver-in-qcom_.patch new file mode 100644 index 00000000000..4b44d01c701 --- /dev/null +++ b/queue-6.10/iommu-arm-smmu-qcom-register-the-tbu-driver-in-qcom_.patch @@ -0,0 +1,141 @@ +From fa9b562f6a24d38a442b7055a46798d8af306d0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 18:07:59 -0700 +Subject: iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init + +From: Georgi Djakov + +[ Upstream commit 0b4eeee2876f2b08442eb32081451bf130e01a4c ] + +Currently the TBU driver will only probe when CONFIG_ARM_SMMU_QCOM_DEBUG +is enabled. The driver not probing would prevent the platform to reach +sync_state and the system will remain in sub-optimal power consumption +mode while waiting for all consumer drivers to probe. To address this, +let's register the TBU driver in qcom_smmu_impl_init(), so that it can +probe, but still enable its functionality only when the debug option in +Kconfig is enabled. + +Reported-by: Dmitry Baryshkov +Closes: https://lore.kernel.org/r/CAA8EJppcXVu72OSo+OiYEiC1HQjP3qCwKMumOsUhcn6Czj0URg@mail.gmail.com +Fixes: 414ecb030870 ("iommu/arm-smmu-qcom-debug: Add support for TBUs") +Signed-off-by: Georgi Djakov +Link: https://lore.kernel.org/r/20240704010759.507798-1-quic_c_gdjako@quicinc.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + .../iommu/arm/arm-smmu/arm-smmu-qcom-debug.c | 17 +------- + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 39 +++++++++++++++++++ + drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h | 2 + + 3 files changed, 42 insertions(+), 16 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c +index 552199cbd9e25..482c40aa029b4 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom-debug.c +@@ -488,7 +488,7 @@ irqreturn_t qcom_smmu_context_fault(int irq, void *dev) + return ret; + } + +-static int qcom_tbu_probe(struct platform_device *pdev) ++int qcom_tbu_probe(struct platform_device *pdev) + { + struct of_phandle_args args = { .args_count = 2 }; + struct device_node *np = pdev->dev.of_node; +@@ -530,18 +530,3 @@ static int qcom_tbu_probe(struct platform_device *pdev) + + return 0; + } +- +-static const struct of_device_id qcom_tbu_of_match[] = { +- { .compatible = "qcom,sc7280-tbu" }, +- { .compatible = "qcom,sdm845-tbu" }, +- { } +-}; +- +-static struct platform_driver qcom_tbu_driver = { +- .driver = { +- .name = "qcom_tbu", +- .of_match_table = qcom_tbu_of_match, +- }, +- .probe = qcom_tbu_probe, +-}; +-builtin_platform_driver(qcom_tbu_driver); +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +index 25f034677f568..13f3e2efb2ccb 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +@@ -8,6 +8,8 @@ + #include + #include + #include ++#include ++#include + + #include "arm-smmu.h" + #include "arm-smmu-qcom.h" +@@ -561,10 +563,47 @@ static struct acpi_platform_list qcom_acpi_platlist[] = { + }; + #endif + ++static int qcom_smmu_tbu_probe(struct platform_device *pdev) ++{ ++ struct device *dev = &pdev->dev; ++ int ret; ++ ++ if (IS_ENABLED(CONFIG_ARM_SMMU_QCOM_DEBUG)) { ++ ret = qcom_tbu_probe(pdev); ++ if (ret) ++ return ret; ++ } ++ ++ if (dev->pm_domain) { ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); ++ } ++ ++ return 0; ++} ++ ++static const struct of_device_id qcom_smmu_tbu_of_match[] = { ++ { .compatible = "qcom,sc7280-tbu" }, ++ { .compatible = "qcom,sdm845-tbu" }, ++ { } ++}; ++ ++static struct platform_driver qcom_smmu_tbu_driver = { ++ .driver = { ++ .name = "qcom_tbu", ++ .of_match_table = qcom_smmu_tbu_of_match, ++ }, ++ .probe = qcom_smmu_tbu_probe, ++}; ++ + struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu) + { + const struct device_node *np = smmu->dev->of_node; + const struct of_device_id *match; ++ static u8 tbu_registered; ++ ++ if (!tbu_registered++) ++ platform_driver_register(&qcom_smmu_tbu_driver); + + #ifdef CONFIG_ACPI + if (np == NULL) { +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h +index 9bb3ae7d62da6..3c134d1a62773 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.h +@@ -34,8 +34,10 @@ irqreturn_t qcom_smmu_context_fault(int irq, void *dev); + + #ifdef CONFIG_ARM_SMMU_QCOM_DEBUG + void qcom_smmu_tlb_sync_debug(struct arm_smmu_device *smmu); ++int qcom_tbu_probe(struct platform_device *pdev); + #else + static inline void qcom_smmu_tlb_sync_debug(struct arm_smmu_device *smmu) { } ++static inline int qcom_tbu_probe(struct platform_device *pdev) { return -EINVAL; } + #endif + + #endif /* _ARM_SMMU_QCOM_H */ +-- +2.43.0 + diff --git a/queue-6.10/iommu-arm-smmu-v3-avoid-uninitialized-asid-in-case-o.patch b/queue-6.10/iommu-arm-smmu-v3-avoid-uninitialized-asid-in-case-o.patch new file mode 100644 index 00000000000..fa4e5e52d32 --- /dev/null +++ b/queue-6.10/iommu-arm-smmu-v3-avoid-uninitialized-asid-in-case-o.patch @@ -0,0 +1,45 @@ +From 2f75fd3874acdb8428127e2fead30348c87ebb5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 18:52:18 +0000 +Subject: iommu/arm-smmu-v3: Avoid uninitialized asid in case of error + +From: Mostafa Saleh + +[ Upstream commit d3867e7148318e12b5d69b64950622f5ed06fe86 ] + +Static checker is complaining about the ASID possibly set uninitialized. +This only happens in case of error and this value would be ignored anyway. + +A simple fix would be just to initialize the local variable to zero, +this path will only be reached on the first attach to a domain where +the CD is already initialized to zero. +This avoids having to bloat the function with an error path. + +Closes: https://lore.kernel.org/linux-iommu/849e3d77-0a3c-43c4-878d-a0e061c8cd61@moroto.mountain/T/#u +Reported-by: Dan Carpenter +Signed-off-by: Mostafa Saleh +Fixes: 04905c17f648 ("iommu/arm-smmu-v3: Build the whole CD in arm_smmu_make_s1_cd()") +Reviewed-by: Jason Gunthorpe +Link: https://lore.kernel.org/r/20240604185218.2602058-1-smostafa@google.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index ab415e107054c..f456bcf1890ba 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -2302,7 +2302,7 @@ static int arm_smmu_domain_finalise_s1(struct arm_smmu_device *smmu, + struct arm_smmu_domain *smmu_domain) + { + int ret; +- u32 asid; ++ u32 asid = 0; + struct arm_smmu_ctx_desc *cd = &smmu_domain->cd; + + refcount_set(&cd->refs, 1); +-- +2.43.0 + diff --git a/queue-6.10/iommu-vt-d-fix-aligned-pages-in-calculate_psi_aligne.patch b/queue-6.10/iommu-vt-d-fix-aligned-pages-in-calculate_psi_aligne.patch new file mode 100644 index 00000000000..1116124d0dc --- /dev/null +++ b/queue-6.10/iommu-vt-d-fix-aligned-pages-in-calculate_psi_aligne.patch @@ -0,0 +1,45 @@ +From 5840abc9ec95fc8fa9ed79289d3702f7eff2cb46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 23:26:43 +0800 +Subject: iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address() + +From: Lu Baolu + +[ Upstream commit 0a3f6b3463014b03f6ad10eacc4d1d9af75d54a1 ] + +The helper calculate_psi_aligned_address() is used to convert an arbitrary +range into a size-aligned one. + +The aligned_pages variable is calculated from input start and end, but is +not adjusted when the start pfn is not aligned and the mask is adjusted, +which results in an incorrect number of pages returned. + +The number of pages is used by qi_flush_piotlb() to flush caches for the +first-stage translation. With the wrong number of pages, the cache is not +synchronized, leading to inconsistencies in some cases. + +Fixes: c4d27ffaa8eb ("iommu/vt-d: Add cache tag invalidation helpers") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240709152643.28109-3-baolu.lu@linux.intel.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/cache.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c +index 0a3bb38a52890..44e92638c0cd1 100644 +--- a/drivers/iommu/intel/cache.c ++++ b/drivers/iommu/intel/cache.c +@@ -246,6 +246,7 @@ static unsigned long calculate_psi_aligned_address(unsigned long start, + */ + shared_bits = ~(pfn ^ end_pfn) & ~bitmask; + mask = shared_bits ? __ffs(shared_bits) : MAX_AGAW_PFN_WIDTH; ++ aligned_pages = 1UL << mask; + } + + *_pages = aligned_pages; +-- +2.43.0 + diff --git a/queue-6.10/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch b/queue-6.10/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch new file mode 100644 index 00000000000..31cd7e61bc1 --- /dev/null +++ b/queue-6.10/iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch @@ -0,0 +1,43 @@ +From aa801116f22728e5139814b1158515a0f3448c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 16:49:13 -0700 +Subject: iommu/vt-d: Fix identity map bounds in si_domain_init() + +From: Jon Pan-Doh + +[ Upstream commit 31000732d56b43765d51e08cccb68818fbc0032c ] + +Intel IOMMU operates on inclusive bounds (both generally aas well as +iommu_domain_identity_map()). Meanwhile, for_each_mem_pfn_range() uses +exclusive bounds for end_pfn. This creates an off-by-one error when +switching between the two. + +Fixes: c5395d5c4a82 ("intel-iommu: Clean up iommu_domain_identity_map()") +Signed-off-by: Jon Pan-Doh +Tested-by: Sudheer Dantuluri +Suggested-by: Gary Zibrat +Reviewed-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240709234913.2749386-1-pandoh@google.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index fd11a080380c8..f55ec1fd7942a 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2071,7 +2071,7 @@ static int __init si_domain_init(int hw) + for_each_mem_pfn_range(i, nid, &start_pfn, &end_pfn, NULL) { + ret = iommu_domain_identity_map(si_domain, + mm_to_dma_pfn_start(start_pfn), +- mm_to_dma_pfn_end(end_pfn)); ++ mm_to_dma_pfn_end(end_pfn-1)); + if (ret) + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/iommu-vt-d-limit-max-address-mask-to-max_agaw_pfn_wi.patch b/queue-6.10/iommu-vt-d-limit-max-address-mask-to-max_agaw_pfn_wi.patch new file mode 100644 index 00000000000..185d06dac31 --- /dev/null +++ b/queue-6.10/iommu-vt-d-limit-max-address-mask-to-max_agaw_pfn_wi.patch @@ -0,0 +1,51 @@ +From 0d16c84e7344895db3098d2370936103bfb3cb57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 23:26:42 +0800 +Subject: iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH + +From: Lu Baolu + +[ Upstream commit c420a2b4e8be06f16f3305472bd25a1dd12059ec ] + +Address mask specifies the number of low order bits of the address field +that must be masked for the invalidation operation. + +Since address bits masked start from bit 12, the max address mask should +be MAX_AGAW_PFN_WIDTH, as defined in Table 19 ("Invalidate Descriptor +Address Mask Encodings") of the spec. + +Limit the max address mask returned from calculate_psi_aligned_address() +to MAX_AGAW_PFN_WIDTH to prevent potential integer overflow in the +following code: + +qi_flush_dev_iotlb(): + ... + addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1; + ... + +Fixes: c4d27ffaa8eb ("iommu/vt-d: Add cache tag invalidation helpers") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20240709152643.28109-2-baolu.lu@linux.intel.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c +index e8418cdd8331b..0a3bb38a52890 100644 +--- a/drivers/iommu/intel/cache.c ++++ b/drivers/iommu/intel/cache.c +@@ -245,7 +245,7 @@ static unsigned long calculate_psi_aligned_address(unsigned long start, + * shared_bits are all equal in both pfn and end_pfn. + */ + shared_bits = ~(pfn ^ end_pfn) & ~bitmask; +- mask = shared_bits ? __ffs(shared_bits) : BITS_PER_LONG; ++ mask = shared_bits ? __ffs(shared_bits) : MAX_AGAW_PFN_WIDTH; + } + + *_pages = aligned_pages; +-- +2.43.0 + diff --git a/queue-6.10/iommufd-iova_bitmap-check-iova_bitmap_done-after-set.patch b/queue-6.10/iommufd-iova_bitmap-check-iova_bitmap_done-after-set.patch new file mode 100644 index 00000000000..6f17143dbc9 --- /dev/null +++ b/queue-6.10/iommufd-iova_bitmap-check-iova_bitmap_done-after-set.patch @@ -0,0 +1,50 @@ +From afe22a39da7840cd87e2a94bbe2b7f551ea3dd96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 12:01:00 +0100 +Subject: iommufd/iova_bitmap: Check iova_bitmap_done() after set ahead + +From: Joao Martins + +[ Upstream commit 792583656f554e35383d6b2325371c8fe056a56b ] + +After iova_bitmap_set_ahead() returns it may be at the end of the range. +Move iova_bitmap_set_ahead() earlier to avoid unnecessary attempt in +trying to pin the next pages by reusing iova_bitmap_done() check. + +Fixes: 2780025e01e2 ("iommufd/iova_bitmap: Handle recording beyond the mapped pages") +Link: https://lore.kernel.org/r/20240627110105.62325-7-joao.m.martins@oracle.com +Signed-off-by: Joao Martins +Reviewed-by: Kevin Tian +Tested-by: Matt Ochs +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/iova_bitmap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c +index db8c46bee1559..e33ddfc239b5b 100644 +--- a/drivers/iommu/iommufd/iova_bitmap.c ++++ b/drivers/iommu/iommufd/iova_bitmap.c +@@ -384,8 +384,6 @@ static int iova_bitmap_advance(struct iova_bitmap *bitmap) + bitmap->mapped_base_index += count; + + iova_bitmap_put(bitmap); +- if (iova_bitmap_done(bitmap)) +- return 0; + + /* Iterate, set and skip any bits requested for next iteration */ + if (bitmap->set_ahead_length) { +@@ -396,6 +394,9 @@ static int iova_bitmap_advance(struct iova_bitmap *bitmap) + return ret; + } + ++ if (iova_bitmap_done(bitmap)) ++ return 0; ++ + /* When advancing the index we pin the next set of bitmap pages */ + return iova_bitmap_get(bitmap); + } +-- +2.43.0 + diff --git a/queue-6.10/iommufd-selftest-add-tests-for-u8-bitmap-sizes.patch b/queue-6.10/iommufd-selftest-add-tests-for-u8-bitmap-sizes.patch new file mode 100644 index 00000000000..d8a41a778d9 --- /dev/null +++ b/queue-6.10/iommufd-selftest-add-tests-for-u8-bitmap-sizes.patch @@ -0,0 +1,62 @@ +From 2fb7d52494bf03bc98d42385c881d22d619397dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 12:00:57 +0100 +Subject: iommufd/selftest: Add tests for <= u8 bitmap sizes + +From: Joao Martins + +[ Upstream commit 33335584eb78c0bda21ff8d759c39e035abb48ac ] + +Add more tests for bitmaps smaller than or equal to an u8, though skip the +tests if the IOVA buffer size is smaller than the mock page size. + +Link: https://lore.kernel.org/r/20240627110105.62325-4-joao.m.martins@oracle.com +Signed-off-by: Joao Martins +Reviewed-by: Kevin Tian +Tested-by: Matt Ochs +Signed-off-by: Jason Gunthorpe +Stable-dep-of: ffa3c799ce15 ("iommufd/selftest: Fix tests to use MOCK_PAGE_SIZE based buffer sizes") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 0b04d782a19fc..61189215e1ab7 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -1727,6 +1727,12 @@ FIXTURE_SETUP(iommufd_dirty_tracking) + void *vrc; + int rc; + ++ if (variant->buffer_size < MOCK_PAGE_SIZE) { ++ SKIP(return, ++ "Skipping buffer_size=%lu, less than MOCK_PAGE_SIZE=%lu", ++ variant->buffer_size, MOCK_PAGE_SIZE); ++ } ++ + self->fd = open("/dev/iommu", O_RDWR); + ASSERT_NE(-1, self->fd); + +@@ -1779,6 +1785,18 @@ FIXTURE_TEARDOWN(iommufd_dirty_tracking) + teardown_iommufd(self->fd, _metadata); + } + ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty8k) ++{ ++ /* half of an u8 index bitmap */ ++ .buffer_size = 8UL * 1024UL, ++}; ++ ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty16k) ++{ ++ /* one u8 index bitmap */ ++ .buffer_size = 16UL * 1024UL, ++}; ++ + FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128k) + { + /* one u32 index bitmap */ +-- +2.43.0 + diff --git a/queue-6.10/iommufd-selftest-fix-dirty-bitmap-tests-with-u8-bitm.patch b/queue-6.10/iommufd-selftest-fix-dirty-bitmap-tests-with-u8-bitm.patch new file mode 100644 index 00000000000..5ced18f6356 --- /dev/null +++ b/queue-6.10/iommufd-selftest-fix-dirty-bitmap-tests-with-u8-bitm.patch @@ -0,0 +1,98 @@ +From e07392b398c932af48386141d5182b6ad9331000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 12:00:55 +0100 +Subject: iommufd/selftest: Fix dirty bitmap tests with u8 bitmaps + +From: Joao Martins + +[ Upstream commit ec61f820a2ff07d1717583bd57d6ee45d2763a6e ] + +With 64k base pages, the first 128k iova length test requires less than a +byte for a bitmap, exposing a bug in the tests that assume that bitmaps are +at least a byte. + +Rather than dealing with bytes, have _test_mock_dirty_bitmaps() pass the +number of bits. The caller functions are adjusted to also use bits as well, +and converting to bytes when clearing, allocating and freeing the bitmap. + +Link: https://lore.kernel.org/r/20240627110105.62325-2-joao.m.martins@oracle.com +Reported-by: Matt Ochs +Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") +Signed-off-by: Joao Martins +Reviewed-by: Kevin Tian +Tested-by: Matt Ochs +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd.c | 10 +++++----- + tools/testing/selftests/iommu/iommufd_utils.h | 6 ++++-- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index edf1c99c9936c..0b04d782a19fc 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -1722,6 +1722,7 @@ FIXTURE_VARIANT(iommufd_dirty_tracking) + + FIXTURE_SETUP(iommufd_dirty_tracking) + { ++ unsigned long size; + int mmap_flags; + void *vrc; + int rc; +@@ -1749,12 +1750,11 @@ FIXTURE_SETUP(iommufd_dirty_tracking) + assert(vrc == self->buffer); + + self->page_size = MOCK_PAGE_SIZE; +- self->bitmap_size = +- variant->buffer_size / self->page_size / BITS_PER_BYTE; ++ self->bitmap_size = variant->buffer_size / self->page_size; + + /* Provision with an extra (PAGE_SIZE) for the unaligned case */ +- rc = posix_memalign(&self->bitmap, PAGE_SIZE, +- self->bitmap_size + PAGE_SIZE); ++ size = DIV_ROUND_UP(self->bitmap_size, BITS_PER_BYTE); ++ rc = posix_memalign(&self->bitmap, PAGE_SIZE, size + PAGE_SIZE); + assert(!rc); + assert(self->bitmap); + assert((uintptr_t)self->bitmap % PAGE_SIZE == 0); +@@ -1775,7 +1775,7 @@ FIXTURE_SETUP(iommufd_dirty_tracking) + FIXTURE_TEARDOWN(iommufd_dirty_tracking) + { + munmap(self->buffer, variant->buffer_size); +- munmap(self->bitmap, self->bitmap_size); ++ munmap(self->bitmap, DIV_ROUND_UP(self->bitmap_size, BITS_PER_BYTE)); + teardown_iommufd(self->fd, _metadata); + } + +diff --git a/tools/testing/selftests/iommu/iommufd_utils.h b/tools/testing/selftests/iommu/iommufd_utils.h +index 8d2b46b2114da..c612fbf0195ba 100644 +--- a/tools/testing/selftests/iommu/iommufd_utils.h ++++ b/tools/testing/selftests/iommu/iommufd_utils.h +@@ -22,6 +22,8 @@ + #define BIT_MASK(nr) (1UL << ((nr) % __BITS_PER_LONG)) + #define BIT_WORD(nr) ((nr) / __BITS_PER_LONG) + ++#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) ++ + static inline void set_bit(unsigned int nr, unsigned long *addr) + { + unsigned long mask = BIT_MASK(nr); +@@ -346,12 +348,12 @@ static int _test_cmd_mock_domain_set_dirty(int fd, __u32 hwpt_id, size_t length, + static int _test_mock_dirty_bitmaps(int fd, __u32 hwpt_id, size_t length, + __u64 iova, size_t page_size, + size_t pte_page_size, __u64 *bitmap, +- __u64 bitmap_size, __u32 flags, ++ __u64 nbits, __u32 flags, + struct __test_metadata *_metadata) + { + unsigned long npte = pte_page_size / page_size, pteset = 2 * npte; +- unsigned long nbits = bitmap_size * BITS_PER_BYTE; + unsigned long j, i, nr = nbits / pteset ?: 1; ++ unsigned long bitmap_size = DIV_ROUND_UP(nbits, BITS_PER_BYTE); + __u64 out_dirty = 0; + + /* Mark all even bits as dirty in the mock domain */ +-- +2.43.0 + diff --git a/queue-6.10/iommufd-selftest-fix-iommufd_test_dirty-to-handle-u8.patch b/queue-6.10/iommufd-selftest-fix-iommufd_test_dirty-to-handle-u8.patch new file mode 100644 index 00000000000..0f26c8ff4a2 --- /dev/null +++ b/queue-6.10/iommufd-selftest-fix-iommufd_test_dirty-to-handle-u8.patch @@ -0,0 +1,41 @@ +From a5d4b9a8e6f1b8e0adc8652cce35730985a088e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 12:00:56 +0100 +Subject: iommufd/selftest: Fix iommufd_test_dirty() to handle + +[ Upstream commit 9560393b830b415b2151b3dd8e065257cccbffa7 ] + +The calculation returns 0 if it sets less than the number of bits per +byte. For calculating memory allocation from bits, lets round it up to +one byte. + +Link: https://lore.kernel.org/r/20240627110105.62325-3-joao.m.martins@oracle.com +Reported-by: Matt Ochs +Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") +Signed-off-by: Joao Martins +Reviewed-by: Kevin Tian +Tested-by: Matt Ochs +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommufd/selftest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c +index 7a2199470f312..654ed33390957 100644 +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -1334,7 +1334,7 @@ static int iommufd_test_dirty(struct iommufd_ucmd *ucmd, unsigned int mockpt_id, + } + + max = length / page_size; +- bitmap_size = max / BITS_PER_BYTE; ++ bitmap_size = DIV_ROUND_UP(max, BITS_PER_BYTE); + + tmp = kvzalloc(bitmap_size, GFP_KERNEL_ACCOUNT); + if (!tmp) { +-- +2.43.0 + diff --git a/queue-6.10/iommufd-selftest-fix-tests-to-use-mock_page_size-bas.patch b/queue-6.10/iommufd-selftest-fix-tests-to-use-mock_page_size-bas.patch new file mode 100644 index 00000000000..03cc10fb504 --- /dev/null +++ b/queue-6.10/iommufd-selftest-fix-tests-to-use-mock_page_size-bas.patch @@ -0,0 +1,102 @@ +From e0cb438d5a5f3d2f00d8253da1b16fb6728bb946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 12:00:58 +0100 +Subject: iommufd/selftest: Fix tests to use MOCK_PAGE_SIZE based buffer sizes + +From: Joao Martins + +[ Upstream commit ffa3c799ce157493615f9f3c2b3c9ba602d320b9 ] + +commit a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") +added tests covering edge cases in the boundaries of iova bitmap. Although +it used buffer sizes thinking in PAGE_SIZE (4K) as opposed to the +MOCK_PAGE_SIZE (2K) that is used in iommufd mock selftests. This meant that +isn't correctly exercising everything specifically the u32 and 4K bitmap +test cases. Fix selftests buffer sizes to be based on mock page size. + +Link: https://lore.kernel.org/r/20240627110105.62325-5-joao.m.martins@oracle.com +Reported-by: Kevin Tian +Closes: https://lore.kernel.org/linux-iommu/96efb6cf-a41c-420f-9673-2f0b682cac8c@oracle.com/ +Fixes: a9af47e382a4 ("iommufd/selftest: Test IOMMU_HWPT_GET_DIRTY_BITMAP") +Signed-off-by: Joao Martins +Reviewed-by: Kevin Tian +Tested-by: Matt Ochs +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/iommu/iommufd.c | 36 ++++++++++++------------- + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c +index 61189215e1ab7..5f7d5a5ba89b0 100644 +--- a/tools/testing/selftests/iommu/iommufd.c ++++ b/tools/testing/selftests/iommu/iommufd.c +@@ -1797,47 +1797,47 @@ FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty16k) + .buffer_size = 16UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128k) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64k) + { + /* one u32 index bitmap */ +- .buffer_size = 128UL * 1024UL, ++ .buffer_size = 64UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256k) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128k) + { + /* one u64 index bitmap */ +- .buffer_size = 256UL * 1024UL, ++ .buffer_size = 128UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty640k) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty320k) + { + /* two u64 index and trailing end bitmap */ +- .buffer_size = 640UL * 1024UL, ++ .buffer_size = 320UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64M) + { +- /* 4K bitmap (128M IOVA range) */ +- .buffer_size = 128UL * 1024UL * 1024UL, ++ /* 4K bitmap (64M IOVA range) */ ++ .buffer_size = 64UL * 1024UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M_huge) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty64M_huge) + { +- /* 4K bitmap (128M IOVA range) */ +- .buffer_size = 128UL * 1024UL * 1024UL, ++ /* 4K bitmap (64M IOVA range) */ ++ .buffer_size = 64UL * 1024UL * 1024UL, + .hugepages = true, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256M) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M) + { +- /* 8K bitmap (256M IOVA range) */ +- .buffer_size = 256UL * 1024UL * 1024UL, ++ /* 8K bitmap (128M IOVA range) */ ++ .buffer_size = 128UL * 1024UL * 1024UL, + }; + +-FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty256M_huge) ++FIXTURE_VARIANT_ADD(iommufd_dirty_tracking, domain_dirty128M_huge) + { +- /* 8K bitmap (256M IOVA range) */ +- .buffer_size = 256UL * 1024UL * 1024UL, ++ /* 8K bitmap (128M IOVA range) */ ++ .buffer_size = 128UL * 1024UL * 1024UL, + .hugepages = true, + }; + +-- +2.43.0 + diff --git a/queue-6.10/ipmi-ssif_bmc-prevent-integer-overflow-on-32bit-syst.patch b/queue-6.10/ipmi-ssif_bmc-prevent-integer-overflow-on-32bit-syst.patch new file mode 100644 index 00000000000..d341ce246f3 --- /dev/null +++ b/queue-6.10/ipmi-ssif_bmc-prevent-integer-overflow-on-32bit-syst.patch @@ -0,0 +1,53 @@ +From 033ce8a77f7e3b53b3a132eed8694f2f37f474b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 20:30:44 +0300 +Subject: ipmi: ssif_bmc: prevent integer overflow on 32bit systems + +From: Dan Carpenter + +[ Upstream commit 0627cef36145c9ff9845bdfd7ddf485bbac1f981 ] + +There are actually two bugs here. First, we need to ensure that count +is at least sizeof(u32) or msg.len will be uninitialized data. + +The "msg.len" variable is a u32 that comes from the user. On 32bit +systems the "sizeof_field(struct ipmi_ssif_msg, len) + msg.len" +addition can overflow if "msg.len" is greater than U32_MAX - 4. + +Valid lengths for "msg.len" are 1-254. Add a check for that to +prevent the integer overflow. + +Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver") +Signed-off-by: Dan Carpenter +Message-Id: <1431ca2e-4e9c-4520-bfc0-6879313c30e9@moroto.mountain> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ssif_bmc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c +index 56346fb328727..ab4e87a99f087 100644 +--- a/drivers/char/ipmi/ssif_bmc.c ++++ b/drivers/char/ipmi/ssif_bmc.c +@@ -177,13 +177,15 @@ static ssize_t ssif_bmc_write(struct file *file, const char __user *buf, size_t + unsigned long flags; + ssize_t ret; + +- if (count > sizeof(struct ipmi_ssif_msg)) ++ if (count < sizeof(msg.len) || ++ count > sizeof(struct ipmi_ssif_msg)) + return -EINVAL; + + if (copy_from_user(&msg, buf, count)) + return -EFAULT; + +- if (!msg.len || count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len) ++ if (!msg.len || msg.len > IPMI_SSIF_PAYLOAD_MAX || ++ count < sizeof_field(struct ipmi_ssif_msg, len) + msg.len) + return -EINVAL; + + spin_lock_irqsave(&ssif_bmc->lock, flags); +-- +2.43.0 + diff --git a/queue-6.10/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch b/queue-6.10/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch new file mode 100644 index 00000000000..e0d9d257ccd --- /dev/null +++ b/queue-6.10/ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch @@ -0,0 +1,135 @@ +From e778cd6831d69c51b59db924e92618948246fc0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 17:23:54 +0300 +Subject: ipv4: Fix incorrect TOS in fibmatch route get reply + +From: Ido Schimmel + +[ Upstream commit f036e68212c11e5a7edbb59b5e25299341829485 ] + +The TOS value that is returned to user space in the route get reply is +the one with which the lookup was performed ('fl4->flowi4_tos'). This is +fine when the matched route is configured with a TOS as it would not +match if its TOS value did not match the one with which the lookup was +performed. + +However, matching on TOS is only performed when the route's TOS is not +zero. It is therefore possible to have the kernel incorrectly return a +non-zero TOS: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get fibmatch 192.0.2.2 tos 0xfc + 192.0.2.0/24 tos 0x1c dev dummy1 proto kernel scope link src 192.0.2.1 + +Fix by instead returning the DSCP field from the FIB result structure +which was populated during the route lookup. + +Output after the patch: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get fibmatch 192.0.2.2 tos 0xfc + 192.0.2.0/24 dev dummy1 proto kernel scope link src 192.0.2.1 + +Extend the existing selftests to not only verify that the correct route +is returned, but that it is also returned with correct "tos" value (or +without it). + +Fixes: b61798130f1b ("net: ipv4: RTM_GETROUTE: return matched fib result when requested") +Signed-off-by: Ido Schimmel +Reviewed-by: David Ahern +Reviewed-by: Guillaume Nault +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 2 +- + tools/testing/selftests/net/fib_tests.sh | 24 ++++++++++++------------ + 2 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 7790a83474618..3473e0105e299 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -3332,7 +3332,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + fri.tb_id = table_id; + fri.dst = res.prefix; + fri.dst_len = res.prefixlen; +- fri.dscp = inet_dsfield_to_dscp(fl4.flowi4_tos); ++ fri.dscp = res.dscp; + fri.type = rt->rt_type; + fri.offload = 0; + fri.trap = 0; +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index 73895711cdf42..5f3c28fc86249 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -1737,53 +1737,53 @@ ipv4_rt_dsfield() + + # DSCP 0x10 should match the specific route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x10 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x11 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x12 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x13 | \ +- grep -q "via 172.16.103.2" ++ grep -q "172.16.102.0/24 tos 0x10 via 172.16.103.2" + log_test $? 0 "IPv4 route with DSCP and ECN:CE" + + # Unknown DSCP should match the generic route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x14 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x15 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x16 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x17 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with unknown DSCP and ECN:CE" + + # Null DSCP should match the generic route, no matter the ECN bits + $IP route get fibmatch 172.16.102.1 dsfield 0x00 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:Not-ECT" + + $IP route get fibmatch 172.16.102.1 dsfield 0x01 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(1)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x02 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:ECT(0)" + + $IP route get fibmatch 172.16.102.1 dsfield 0x03 | \ +- grep -q "via 172.16.101.2" ++ grep -q "172.16.102.0/24 via 172.16.101.2" + log_test $? 0 "IPv4 route with no DSCP and ECN:CE" + } + +-- +2.43.0 + diff --git a/queue-6.10/ipv4-fix-incorrect-tos-in-route-get-reply.patch b/queue-6.10/ipv4-fix-incorrect-tos-in-route-get-reply.patch new file mode 100644 index 00000000000..be2cccf636d --- /dev/null +++ b/queue-6.10/ipv4-fix-incorrect-tos-in-route-get-reply.patch @@ -0,0 +1,122 @@ +From ab7e440b3d21e6169f95c67bca430fdcf6782113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 17:23:53 +0300 +Subject: ipv4: Fix incorrect TOS in route get reply + +From: Ido Schimmel + +[ Upstream commit 338bb57e4c2a1c2c6fc92f9c0bd35be7587adca7 ] + +The TOS value that is returned to user space in the route get reply is +the one with which the lookup was performed ('fl4->flowi4_tos'). This is +fine when the matched route is configured with a TOS as it would not +match if its TOS value did not match the one with which the lookup was +performed. + +However, matching on TOS is only performed when the route's TOS is not +zero. It is therefore possible to have the kernel incorrectly return a +non-zero TOS: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get 192.0.2.2 tos 0xfc + 192.0.2.2 tos 0x1c dev dummy1 src 192.0.2.1 uid 0 + cache + +Fix by adding a DSCP field to the FIB result structure (inside an +existing 4 bytes hole), populating it in the route lookup and using it +when filling the route get reply. + +Output after the patch: + + # ip link add name dummy1 up type dummy + # ip address add 192.0.2.1/24 dev dummy1 + # ip route get 192.0.2.2 tos 0xfc + 192.0.2.2 dev dummy1 src 192.0.2.1 uid 0 + cache + +Fixes: 1a00fee4ffb2 ("ipv4: Remove rt_key_{src,dst,tos} from struct rtable.") +Signed-off-by: Ido Schimmel +Reviewed-by: David Ahern +Reviewed-by: Guillaume Nault +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/net/ip_fib.h | 1 + + net/ipv4/fib_trie.c | 1 + + net/ipv4/route.c | 14 +++++++------- + 3 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 9b2f69ba5e498..c29639b4323f3 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -173,6 +173,7 @@ struct fib_result { + unsigned char type; + unsigned char scope; + u32 tclassid; ++ dscp_t dscp; + struct fib_nh_common *nhc; + struct fib_info *fi; + struct fib_table *table; +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index f474106464d2f..8f30e3f00b7f2 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1629,6 +1629,7 @@ int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp, + res->nhc = nhc; + res->type = fa->fa_type; + res->scope = fi->fib_scope; ++ res->dscp = fa->fa_dscp; + res->fi = fi; + res->table = tb; + res->fa_head = &n->leaf; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index b3073d1c8f8f7..7790a83474618 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2868,9 +2868,9 @@ EXPORT_SYMBOL_GPL(ip_route_output_flow); + + /* called with rcu_read_lock held */ + static int rt_fill_info(struct net *net, __be32 dst, __be32 src, +- struct rtable *rt, u32 table_id, struct flowi4 *fl4, +- struct sk_buff *skb, u32 portid, u32 seq, +- unsigned int flags) ++ struct rtable *rt, u32 table_id, dscp_t dscp, ++ struct flowi4 *fl4, struct sk_buff *skb, u32 portid, ++ u32 seq, unsigned int flags) + { + struct rtmsg *r; + struct nlmsghdr *nlh; +@@ -2886,7 +2886,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, + r->rtm_family = AF_INET; + r->rtm_dst_len = 32; + r->rtm_src_len = 0; +- r->rtm_tos = fl4 ? fl4->flowi4_tos : 0; ++ r->rtm_tos = inet_dscp_to_dsfield(dscp); + r->rtm_table = table_id < 256 ? table_id : RT_TABLE_COMPAT; + if (nla_put_u32(skb, RTA_TABLE, table_id)) + goto nla_put_failure; +@@ -3036,7 +3036,7 @@ static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb, + goto next; + + err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt, +- table_id, NULL, skb, ++ table_id, 0, NULL, skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, flags); + if (err) +@@ -3359,8 +3359,8 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + err = fib_dump_info(skb, NETLINK_CB(in_skb).portid, + nlh->nlmsg_seq, RTM_NEWROUTE, &fri, 0); + } else { +- err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb, +- NETLINK_CB(in_skb).portid, ++ err = rt_fill_info(net, dst, src, rt, table_id, res.dscp, &fl4, ++ skb, NETLINK_CB(in_skb).portid, + nlh->nlmsg_seq, 0); + } + if (err < 0) +-- +2.43.0 + diff --git a/queue-6.10/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch b/queue-6.10/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch new file mode 100644 index 00000000000..a17a3600e3f --- /dev/null +++ b/queue-6.10/ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch @@ -0,0 +1,47 @@ +From b244f5e12e915d218c239bf3a464add7b0d8748f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 18:54:44 +0200 +Subject: ipvs: Avoid unnecessary calls to skb_is_gso_sctp + +From: Ismael Luceno + +[ Upstream commit 53796b03295cf7ab1fc8600016fa6dfbf4a494a0 ] + +In the context of the SCTP SNAT/DNAT handler, these calls can only +return true. + +Fixes: e10d3ba4d434 ("ipvs: Fix checksumming on GSO of SCTP packets") +Signed-off-by: Ismael Luceno +Acked-by: Julian Anastasov +Acked-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c +index 1e689c7141271..83e452916403d 100644 +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -126,7 +126,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + if (sctph->source != cp->vport || payload_csum || + skb->ip_summed == CHECKSUM_PARTIAL) { + sctph->source = cp->vport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else { + skb->ip_summed = CHECKSUM_UNNECESSARY; +@@ -175,7 +175,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + (skb->ip_summed == CHECKSUM_PARTIAL && + !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { + sctph->dest = cp->dport; +- if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ if (!skb_is_gso(skb)) + sctp_nat_csum(skb, sctph, sctphoff); + } else if (skb->ip_summed != CHECKSUM_PARTIAL) { + skb->ip_summed = CHECKSUM_UNNECESSARY; +-- +2.43.0 + diff --git a/queue-6.10/ipvs-properly-dereference-pe-in-ip_vs_add_service.patch b/queue-6.10/ipvs-properly-dereference-pe-in-ip_vs_add_service.patch new file mode 100644 index 00000000000..7506067c2a2 --- /dev/null +++ b/queue-6.10/ipvs-properly-dereference-pe-in-ip_vs_add_service.patch @@ -0,0 +1,54 @@ +From cf14fc80ec59f9ecb0d6be12223dea23de710a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 14:15:15 +0800 +Subject: ipvs: properly dereference pe in ip_vs_add_service + +From: Chen Hanxiao + +[ Upstream commit cbd070a4ae62f119058973f6d2c984e325bce6e7 ] + +Use pe directly to resolve sparse warning: + + net/netfilter/ipvs/ip_vs_ctl.c:1471:27: warning: dereference of noderef expression + +Fixes: 39b972231536 ("ipvs: handle connections started by real-servers") +Signed-off-by: Chen Hanxiao +Acked-by: Julian Anastasov +Acked-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ctl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index b6d0dcf3a5c34..f4384e147ee16 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -1459,18 +1459,18 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, + if (ret < 0) + goto out_err; + +- /* Bind the ct retriever */ +- RCU_INIT_POINTER(svc->pe, pe); +- pe = NULL; +- + /* Update the virtual service counters */ + if (svc->port == FTPPORT) + atomic_inc(&ipvs->ftpsvc_counter); + else if (svc->port == 0) + atomic_inc(&ipvs->nullsvc_counter); +- if (svc->pe && svc->pe->conn_out) ++ if (pe && pe->conn_out) + atomic_inc(&ipvs->conn_out_counter); + ++ /* Bind the ct retriever */ ++ RCU_INIT_POINTER(svc->pe, pe); ++ pe = NULL; ++ + /* Count only IPv4 services for old get/setsockopt interface */ + if (svc->af == AF_INET) + ipvs->num_services++; +-- +2.43.0 + diff --git a/queue-6.10/jump_label-fix-concurrency-issues-in-static_key_slow.patch b/queue-6.10/jump_label-fix-concurrency-issues-in-static_key_slow.patch new file mode 100644 index 00000000000..b3072365a8b --- /dev/null +++ b/queue-6.10/jump_label-fix-concurrency-issues-in-static_key_slow.patch @@ -0,0 +1,143 @@ +From 35ed98179c7d758d0a318a2d396ed84bb364e7c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 14:46:36 +0200 +Subject: jump_label: Fix concurrency issues in static_key_slow_dec() + +From: Thomas Gleixner + +[ Upstream commit 83ab38ef0a0b2407d43af9575bb32333fdd74fb2 ] + +The commit which tried to fix the concurrency issues of concurrent +static_key_slow_inc() failed to fix the equivalent issues +vs. static_key_slow_dec(): + +CPU0 CPU1 + +static_key_slow_dec() + static_key_slow_try_dec() + + key->enabled == 1 + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + if (val == 1) + return false; + + jump_label_lock(); + if (atomic_dec_and_test(&key->enabled)) { + --> key->enabled == 0 + __jump_label_update() + + static_key_slow_dec() + static_key_slow_try_dec() + + key->enabled == 0 + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + + --> key->enabled == -1 <- FAIL + +There is another bug in that code, when there is a concurrent +static_key_slow_inc() which enables the key as that sets key->enabled to -1 +so on the other CPU + + val = atomic_fetch_add_unless(&key->enabled, -1, 1); + +will succeed and decrement to -2, which is invalid. + +Cure all of this by replacing the atomic_fetch_add_unless() with a +atomic_try_cmpxchg() loop similar to static_key_fast_inc_not_disabled(). + +[peterz: add WARN_ON_ONCE for the -1 race] +Fixes: 4c5ea0a9cd02 ("locking/static_key: Fix concurrent static_key_slow_inc()") +Reported-by: Yue Sun +Reported-by: Xingwei Lee +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240610124406.422897838@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/jump_label.c | 45 +++++++++++++++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 16 deletions(-) + +diff --git a/kernel/jump_label.c b/kernel/jump_label.c +index 3218fa5688b93..1f05a19918f47 100644 +--- a/kernel/jump_label.c ++++ b/kernel/jump_label.c +@@ -131,7 +131,7 @@ bool static_key_fast_inc_not_disabled(struct static_key *key) + STATIC_KEY_CHECK_USE(key); + /* + * Negative key->enabled has a special meaning: it sends +- * static_key_slow_inc() down the slow path, and it is non-zero ++ * static_key_slow_inc/dec() down the slow path, and it is non-zero + * so it counts as "enabled" in jump_label_update(). Note that + * atomic_inc_unless_negative() checks >= 0, so roll our own. + */ +@@ -150,7 +150,7 @@ bool static_key_slow_inc_cpuslocked(struct static_key *key) + lockdep_assert_cpus_held(); + + /* +- * Careful if we get concurrent static_key_slow_inc() calls; ++ * Careful if we get concurrent static_key_slow_inc/dec() calls; + * later calls must wait for the first one to _finish_ the + * jump_label_update() process. At the same time, however, + * the jump_label_update() call below wants to see +@@ -247,20 +247,32 @@ EXPORT_SYMBOL_GPL(static_key_disable); + + static bool static_key_slow_try_dec(struct static_key *key) + { +- int val; +- +- val = atomic_fetch_add_unless(&key->enabled, -1, 1); +- if (val == 1) +- return false; ++ int v; + + /* +- * The negative count check is valid even when a negative +- * key->enabled is in use by static_key_slow_inc(); a +- * __static_key_slow_dec() before the first static_key_slow_inc() +- * returns is unbalanced, because all other static_key_slow_inc() +- * instances block while the update is in progress. ++ * Go into the slow path if key::enabled is less than or equal than ++ * one. One is valid to shut down the key, anything less than one ++ * is an imbalance, which is handled at the call site. ++ * ++ * That includes the special case of '-1' which is set in ++ * static_key_slow_inc_cpuslocked(), but that's harmless as it is ++ * fully serialized in the slow path below. By the time this task ++ * acquires the jump label lock the value is back to one and the ++ * retry under the lock must succeed. + */ +- WARN(val < 0, "jump label: negative count!\n"); ++ v = atomic_read(&key->enabled); ++ do { ++ /* ++ * Warn about the '-1' case though; since that means a ++ * decrement is concurrent with a first (0->1) increment. IOW ++ * people are trying to disable something that wasn't yet fully ++ * enabled. This suggests an ordering problem on the user side. ++ */ ++ WARN_ON_ONCE(v < 0); ++ if (v <= 1) ++ return false; ++ } while (!likely(atomic_try_cmpxchg(&key->enabled, &v, v - 1))); ++ + return true; + } + +@@ -271,10 +283,11 @@ static void __static_key_slow_dec_cpuslocked(struct static_key *key) + if (static_key_slow_try_dec(key)) + return; + +- jump_label_lock(); +- if (atomic_dec_and_test(&key->enabled)) ++ guard(mutex)(&jump_label_mutex); ++ if (atomic_cmpxchg(&key->enabled, 1, 0)) + jump_label_update(key); +- jump_label_unlock(); ++ else ++ WARN_ON_ONCE(!static_key_slow_try_dec(key)); + } + + static void __static_key_slow_dec(struct static_key *key) +-- +2.43.0 + diff --git a/queue-6.10/kvm-ppc-book3s-hv-fix-the-get_one_reg-of-sdar.patch b/queue-6.10/kvm-ppc-book3s-hv-fix-the-get_one_reg-of-sdar.patch new file mode 100644 index 00000000000..294b2b4fed0 --- /dev/null +++ b/queue-6.10/kvm-ppc-book3s-hv-fix-the-get_one_reg-of-sdar.patch @@ -0,0 +1,41 @@ +From 8453279abf23bb58c207c0c0b0e8c802b1cfdd73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 13:06:28 +0000 +Subject: KVM: PPC: Book3S HV: Fix the get_one_reg of SDAR + +From: Shivaprasad G Bhat + +[ Upstream commit 009f6f42c67e9de737d6d3d199f92b21a8cb9622 ] + +The kvmppc_get_one_reg_hv() for SDAR is wrongly getting the SIAR +instead of SDAR, possibly a paste error emanating from the previous +refactoring. + +Patch fixes the wrong get_one_reg() for the same. + +Fixes: ebc88ea7a6ad ("KVM: PPC: Book3S HV: Use accessors for VCPU registers") +Signed-off-by: Shivaprasad G Bhat +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/171759278410.1480.16404209606556979576.stgit@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index a4f34f94c86f7..b576781d58d54 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2305,7 +2305,7 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + *val = get_reg_val(id, kvmppc_get_siar_hv(vcpu)); + break; + case KVM_REG_PPC_SDAR: +- *val = get_reg_val(id, kvmppc_get_siar_hv(vcpu)); ++ *val = get_reg_val(id, kvmppc_get_sdar_hv(vcpu)); + break; + case KVM_REG_PPC_SIER: + *val = get_reg_val(id, kvmppc_get_sier_hv(vcpu, 0)); +-- +2.43.0 + diff --git a/queue-6.10/kvm-ppc-book3s-hv-fix-the-set_one_reg-for-mmcr3.patch b/queue-6.10/kvm-ppc-book3s-hv-fix-the-set_one_reg-for-mmcr3.patch new file mode 100644 index 00000000000..dfff09ca6b7 --- /dev/null +++ b/queue-6.10/kvm-ppc-book3s-hv-fix-the-set_one_reg-for-mmcr3.patch @@ -0,0 +1,38 @@ +From 4dc2cd2238a20cd93515a5d7d9cf48abef4afaff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 13:06:16 +0000 +Subject: KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3 + +From: Shivaprasad G Bhat + +[ Upstream commit f9ca6a10be20479d526f27316cc32cfd1785ed39 ] + +The kvmppc_set_one_reg_hv() wrongly get() the value +instead of set() for MMCR3. Fix the same. + +Fixes: 5752fe0b811b ("KVM: PPC: Book3S HV: Save/restore new PMU registers") +Signed-off-by: Shivaprasad G Bhat +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/171759276847.1480.16387950124201117847.stgit@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index daaf7faf21a5e..a4f34f94c86f7 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2540,7 +2540,7 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + vcpu->arch.mmcrs = set_reg_val(id, *val); + break; + case KVM_REG_PPC_MMCR3: +- *val = get_reg_val(id, vcpu->arch.mmcr[3]); ++ kvmppc_set_mmcr_hv(vcpu, 3, set_reg_val(id, *val)); + break; + case KVM_REG_PPC_PMC1 ... KVM_REG_PPC_PMC8: + i = id - KVM_REG_PPC_PMC1; +-- +2.43.0 + diff --git a/queue-6.10/kvm-s390-reject-memory-region-operations-for-ucontro.patch b/queue-6.10/kvm-s390-reject-memory-region-operations-for-ucontro.patch new file mode 100644 index 00000000000..3643cdcfb34 --- /dev/null +++ b/queue-6.10/kvm-s390-reject-memory-region-operations-for-ucontro.patch @@ -0,0 +1,79 @@ +From b3ed3d9e756b0014daa962a273240a1f5c7e8746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 11:59:02 +0200 +Subject: kvm: s390: Reject memory region operations for ucontrol VMs + +From: Christoph Schlameuss + +[ Upstream commit 7816e58967d0e6cadce05c8540b47ed027dc2499 ] + +This change rejects the KVM_SET_USER_MEMORY_REGION and +KVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM. +This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and +would thus result in a null pointer dereference further in. +Memory management needs to be performed in userspace and using the +ioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP. + +Also improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION +and KVM_SET_USER_MEMORY_REGION2. + +Signed-off-by: Christoph Schlameuss +Fixes: 27e0393f15fc ("KVM: s390: ucontrol: per vcpu address spaces") +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20240624095902.29375-1-schlameuss@linux.ibm.com +Signed-off-by: Janosch Frank +[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix] +Message-ID: <20240624095902.29375-1-schlameuss@linux.ibm.com> +Signed-off-by: Sasha Levin +--- + Documentation/virt/kvm/api.rst | 12 ++++++++++++ + arch/s390/kvm/kvm-s390.c | 3 +++ + 2 files changed, 15 insertions(+) + +diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst +index a71d91978d9ef..eec8df1dde06a 100644 +--- a/Documentation/virt/kvm/api.rst ++++ b/Documentation/virt/kvm/api.rst +@@ -1403,6 +1403,12 @@ Instead, an abort (data abort if the cause of the page-table update + was a load or a store, instruction abort if it was an instruction + fetch) is injected in the guest. + ++S390: ++^^^^^ ++ ++Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. ++Returns -EINVAL if called on a protected VM. ++ + 4.36 KVM_SET_TSS_ADDR + --------------------- + +@@ -6273,6 +6279,12 @@ state. At VM creation time, all memory is shared, i.e. the PRIVATE attribute + is '0' for all gfns. Userspace can control whether memory is shared/private by + toggling KVM_MEMORY_ATTRIBUTE_PRIVATE via KVM_SET_MEMORY_ATTRIBUTES as needed. + ++S390: ++^^^^^ ++ ++Returns -EINVAL if the VM has the KVM_VM_S390_UCONTROL flag set. ++Returns -EINVAL if called on a protected VM. ++ + 4.141 KVM_SET_MEMORY_ATTRIBUTES + ------------------------------- + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 54b5b2565df8d..4a74effe68704 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -5749,6 +5749,9 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, + { + gpa_t size; + ++ if (kvm_is_ucontrol(kvm)) ++ return -EINVAL; ++ + /* When we are protected, we should not change the memory slots */ + if (kvm_s390_pv_get_handle(kvm)) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/leds-flash-leds-qcom-flash-test-the-correct-variable.patch b/queue-6.10/leds-flash-leds-qcom-flash-test-the-correct-variable.patch new file mode 100644 index 00000000000..f9c98c66ee7 --- /dev/null +++ b/queue-6.10/leds-flash-leds-qcom-flash-test-the-correct-variable.patch @@ -0,0 +1,53 @@ +From dc4c4b18f8082773beab9af8f9ac72f81b8bbb6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 10:19:32 -0500 +Subject: leds: flash: leds-qcom-flash: Test the correct variable in init + +From: Dan Carpenter + +[ Upstream commit 87e552ad654554be73e62dd43c923bcee215287d ] + +This code was passing the incorrect pointer to PTR_ERR_OR_ZERO() so it +always returned success. It should have been checking the array element +instead of the array itself. + +Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/ZoWJS_epjIMCYITg@stanley.mountain +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/flash/leds-qcom-flash.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/leds/flash/leds-qcom-flash.c b/drivers/leds/flash/leds-qcom-flash.c +index 7c99a30391716..bf70bf6fb0d59 100644 +--- a/drivers/leds/flash/leds-qcom-flash.c ++++ b/drivers/leds/flash/leds-qcom-flash.c +@@ -505,6 +505,7 @@ qcom_flash_v4l2_init(struct device *dev, struct qcom_flash_led *led, struct fwno + struct qcom_flash_data *flash_data = led->flash_data; + struct v4l2_flash_config v4l2_cfg = { 0 }; + struct led_flash_setting *intensity = &v4l2_cfg.intensity; ++ struct v4l2_flash *v4l2_flash; + + if (!(led->flash.led_cdev.flags & LED_DEV_CAP_FLASH)) + return 0; +@@ -523,9 +524,12 @@ qcom_flash_v4l2_init(struct device *dev, struct qcom_flash_led *led, struct fwno + LED_FAULT_OVER_TEMPERATURE | + LED_FAULT_TIMEOUT; + +- flash_data->v4l2_flash[flash_data->leds_count] = +- v4l2_flash_init(dev, fwnode, &led->flash, &qcom_v4l2_flash_ops, &v4l2_cfg); +- return PTR_ERR_OR_ZERO(flash_data->v4l2_flash); ++ v4l2_flash = v4l2_flash_init(dev, fwnode, &led->flash, &qcom_v4l2_flash_ops, &v4l2_cfg); ++ if (IS_ERR(v4l2_flash)) ++ return PTR_ERR(v4l2_flash); ++ ++ flash_data->v4l2_flash[flash_data->leds_count] = v4l2_flash; ++ return 0; + } + # else + static int +-- +2.43.0 + diff --git a/queue-6.10/leds-rgb-leds-qcom-lpg-add-ppg-check-for-setting-cle.patch b/queue-6.10/leds-rgb-leds-qcom-lpg-add-ppg-check-for-setting-cle.patch new file mode 100644 index 00000000000..4249826a56b --- /dev/null +++ b/queue-6.10/leds-rgb-leds-qcom-lpg-add-ppg-check-for-setting-cle.patch @@ -0,0 +1,62 @@ +From f9a9d38f7c658601fdb0732e7ff3e08c846eb917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 17:52:50 -0700 +Subject: leds: rgb: leds-qcom-lpg: Add PPG check for setting/clearing PBS + triggers + +From: Anjelique Melendez + +[ Upstream commit 7e776e21255bf4c271e0df0a7d289a4963580e61 ] + +Currently, all LED LPG devices will call lpg_{set,clear}_pbs_trigger() +when setting brightness regardless of if they support PPG and have PBS +triggers. Check if device supports PPG before setting/clearing PBS +triggers. + +Fixes: 6ab1f766a80a ("leds: rgb: leds-qcom-lpg: Add support for PPG through single SDAM") +Fixes: 5e9ff626861a ("leds: rgb: leds-qcom-lpg: Include support for PPG with dedicated LUT SDAM") +Signed-off-by: Anjelique Melendez +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20240607005250.4047135-1-quic_amelende@quicinc.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/rgb/leds-qcom-lpg.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c +index 9467c796bd041..e74b2ceed1c26 100644 +--- a/drivers/leds/rgb/leds-qcom-lpg.c ++++ b/drivers/leds/rgb/leds-qcom-lpg.c +@@ -2,7 +2,7 @@ + /* + * Copyright (c) 2017-2022 Linaro Ltd + * Copyright (c) 2010-2012, The Linux Foundation. All rights reserved. +- * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2023-2024, Qualcomm Innovation Center, Inc. All rights reserved. + */ + #include + #include +@@ -254,6 +254,9 @@ static int lpg_clear_pbs_trigger(struct lpg *lpg, unsigned int lut_mask) + u8 val = 0; + int rc; + ++ if (!lpg->lpg_chan_sdam) ++ return 0; ++ + lpg->pbs_en_bitmap &= (~lut_mask); + if (!lpg->pbs_en_bitmap) { + rc = nvmem_device_write(lpg->lpg_chan_sdam, SDAM_REG_PBS_SEQ_EN, 1, &val); +@@ -276,6 +279,9 @@ static int lpg_set_pbs_trigger(struct lpg *lpg, unsigned int lut_mask) + u8 val = PBS_SW_TRIG_BIT; + int rc; + ++ if (!lpg->lpg_chan_sdam) ++ return 0; ++ + if (!lpg->pbs_en_bitmap) { + rc = nvmem_device_write(lpg->lpg_chan_sdam, SDAM_REG_PBS_SEQ_EN, 1, &val); + if (rc < 0) +-- +2.43.0 + diff --git a/queue-6.10/leds-trigger-unregister-sysfs-attributes-before-call.patch b/queue-6.10/leds-trigger-unregister-sysfs-attributes-before-call.patch new file mode 100644 index 00000000000..70029111432 --- /dev/null +++ b/queue-6.10/leds-trigger-unregister-sysfs-attributes-before-call.patch @@ -0,0 +1,57 @@ +From 8b986fb2da5e1ffef803fa623259c6f4cb3a7187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 18:25:33 +0200 +Subject: leds: trigger: Unregister sysfs attributes before calling + deactivate() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit c0dc9adf9474ecb7106e60e5472577375aedaed3 ] + +Triggers which have trigger specific sysfs attributes typically store +related data in trigger-data allocated by the activate() callback and +freed by the deactivate() callback. + +Calling device_remove_groups() after calling deactivate() leaves a window +where the sysfs attributes show/store functions could be called after +deactivation and then operate on the just freed trigger-data. + +Move the device_remove_groups() call to before deactivate() to close +this race window. + +This also makes the deactivation path properly do things in reverse order +of the activation path which calls the activate() callback before calling +device_add_groups(). + +Fixes: a7e7a3156300 ("leds: triggers: add device attribute support") +Cc: Uwe Kleine-König +Signed-off-by: Hans de Goede +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240504162533.76780-1-hdegoede@redhat.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-triggers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c +index b1b323b19301d..19e4866b00298 100644 +--- a/drivers/leds/led-triggers.c ++++ b/drivers/leds/led-triggers.c +@@ -179,9 +179,9 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig) + + cancel_work_sync(&led_cdev->set_brightness_work); + led_stop_software_blink(led_cdev); ++ device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + if (led_cdev->trigger->deactivate) + led_cdev->trigger->deactivate(led_cdev); +- device_remove_groups(led_cdev->dev, led_cdev->trigger->groups); + led_cdev->trigger = NULL; + led_cdev->trigger_data = NULL; + led_cdev->activated = false; +-- +2.43.0 + diff --git a/queue-6.10/lib-add-missing-newline-character-in-the-warning-mes.patch b/queue-6.10/lib-add-missing-newline-character-in-the-warning-mes.patch new file mode 100644 index 00000000000..cbb260a52e9 --- /dev/null +++ b/queue-6.10/lib-add-missing-newline-character-in-the-warning-mes.patch @@ -0,0 +1,39 @@ +From b020b5c15601edbbb9312b49d04cc48a38dd9887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:04:55 -0700 +Subject: lib: add missing newline character in the warning message + +From: Suren Baghdasaryan + +[ Upstream commit 4810a82c8a8ae06fe6496a23fcb89a4952603e60 ] + +Link: https://lkml.kernel.org/r/20240711220457.1751071-1-surenb@google.com +Fixes: 22d407b164ff ("lib: add allocation tagging support for memory allocation profiling") +Signed-off-by: Suren Baghdasaryan +Cc: Kees Cook +Cc: Kent Overstreet +Cc: Pasha Tatashin +Cc: Sourav Panda +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/alloc_tag.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/alloc_tag.h b/include/linux/alloc_tag.h +index abd24016a900e..8c61ccd161ba3 100644 +--- a/include/linux/alloc_tag.h ++++ b/include/linux/alloc_tag.h +@@ -122,7 +122,7 @@ static inline void alloc_tag_add_check(union codetag_ref *ref, struct alloc_tag + "alloc_tag was not cleared (got tag for %s:%u)\n", + ref->ct->filename, ref->ct->lineno); + +- WARN_ONCE(!tag, "current->alloc_tag not set"); ++ WARN_ONCE(!tag, "current->alloc_tag not set\n"); + } + + static inline void alloc_tag_sub_check(union codetag_ref *ref) +-- +2.43.0 + diff --git a/queue-6.10/lib-objagg-fix-general-protection-fault.patch b/queue-6.10/lib-objagg-fix-general-protection-fault.patch new file mode 100644 index 00000000000..7d625188ba6 --- /dev/null +++ b/queue-6.10/lib-objagg-fix-general-protection-fault.patch @@ -0,0 +1,75 @@ +From 9adc2bcd6abc9d9272d863a8147b43b14cd699f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:41 +0200 +Subject: lib: objagg: Fix general protection fault + +From: Ido Schimmel + +[ Upstream commit b4a3a89fffcdf09702b1f161b914e52abca1894d ] + +The library supports aggregation of objects into other objects only if +the parent object does not have a parent itself. That is, nesting is not +supported. + +Aggregation happens in two cases: Without and with hints, where hints +are a pre-computed recommendation on how to aggregate the provided +objects. + +Nesting is not possible in the first case due to a check that prevents +it, but in the second case there is no check because the assumption is +that nesting cannot happen when creating objects based on hints. The +violation of this assumption leads to various warnings and eventually to +a general protection fault [1]. + +Before fixing the root cause, error out when nesting happens and warn. + +[1] +general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI +CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 +[...] +Call Trace: + + mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 + mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + + +Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") +Reported-by: Alexander Zubkov +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + lib/objagg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/objagg.c b/lib/objagg.c +index 1e248629ed643..90f3aa68c30a0 100644 +--- a/lib/objagg.c ++++ b/lib/objagg.c +@@ -167,6 +167,9 @@ static int objagg_obj_parent_assign(struct objagg *objagg, + { + void *delta_priv; + ++ if (WARN_ON(!objagg_obj_is_root(parent))) ++ return -EINVAL; ++ + delta_priv = objagg->ops->delta_create(objagg->priv, parent->obj, + objagg_obj->obj); + if (IS_ERR(delta_priv)) +-- +2.43.0 + diff --git a/queue-6.10/lib-reuse-page_ext_data-to-obtain-codetag_ref.patch b/queue-6.10/lib-reuse-page_ext_data-to-obtain-codetag_ref.patch new file mode 100644 index 00000000000..31c5283b7e0 --- /dev/null +++ b/queue-6.10/lib-reuse-page_ext_data-to-obtain-codetag_ref.patch @@ -0,0 +1,42 @@ +From 065bc343e82832f6ca50801bbc8706a41d54c679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:04:56 -0700 +Subject: lib: reuse page_ext_data() to obtain codetag_ref + +From: Suren Baghdasaryan + +[ Upstream commit fd8acc0097b91fab3104fa8a66ce2fd9cf8b0c11 ] + +codetag_ref_from_page_ext() reimplements the same calculation as +page_ext_data(). Reuse existing function instead. + +Link: https://lkml.kernel.org/r/20240711220457.1751071-2-surenb@google.com +Fixes: dcfe378c81f7 ("lib: introduce support for page allocation tagging") +Signed-off-by: Suren Baghdasaryan +Cc: Kees Cook +Cc: Kent Overstreet +Cc: Pasha Tatashin +Cc: Sourav Panda +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/pgalloc_tag.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/pgalloc_tag.h b/include/linux/pgalloc_tag.h +index 9cacadbd61f8c..acb1e9ce79815 100644 +--- a/include/linux/pgalloc_tag.h ++++ b/include/linux/pgalloc_tag.h +@@ -15,7 +15,7 @@ extern struct page_ext_operations page_alloc_tagging_ops; + + static inline union codetag_ref *codetag_ref_from_page_ext(struct page_ext *page_ext) + { +- return (void *)page_ext + page_alloc_tagging_ops.offset; ++ return (union codetag_ref *)page_ext_data(page_ext, &page_alloc_tagging_ops); + } + + static inline struct page_ext *page_ext_from_codetag_ref(union codetag_ref *ref) +-- +2.43.0 + diff --git a/queue-6.10/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch b/queue-6.10/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch new file mode 100644 index 00000000000..8c323ff655f --- /dev/null +++ b/queue-6.10/libbpf-checking-the-btf_type-kind-when-fixing-variab.patch @@ -0,0 +1,78 @@ +From 24b88f47a0b76c7cb9344ea9e0efafbc71f8600b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 05:23:55 -0700 +Subject: libbpf: Checking the btf_type kind when fixing variable offsets + +From: Donglin Peng + +[ Upstream commit cc5083d1f3881624ad2de1f3cbb3a07e152cb254 ] + +I encountered an issue when building the test_progs from the repository [1]: + + $ pwd + /work/Qemu/x86_64/linux-6.10-rc2/tools/testing/selftests/bpf/ + + $ make test_progs V=1 + [...] + ./tools/sbin/bpftool gen object ./ip_check_defrag.bpf.linked2.o ./ip_check_defrag.bpf.linked1.o + libbpf: failed to find symbol for variable 'bpf_dynptr_slice' in section '.ksyms' + Error: failed to link './ip_check_defrag.bpf.linked1.o': No such file or directory (2) + [...] + +Upon investigation, I discovered that the btf_types referenced in the '.ksyms' +section had a kind of BTF_KIND_FUNC instead of BTF_KIND_VAR: + + $ bpftool btf dump file ./ip_check_defrag.bpf.linked1.o + [...] + [2] DATASEC '.ksyms' size=0 vlen=2 + type_id=16 offset=0 size=0 (FUNC 'bpf_dynptr_from_skb') + type_id=17 offset=0 size=0 (FUNC 'bpf_dynptr_slice') + [...] + [16] FUNC 'bpf_dynptr_from_skb' type_id=82 linkage=extern + [17] FUNC 'bpf_dynptr_slice' type_id=85 linkage=extern + [...] + +For a detailed analysis, please refer to [2]. We can add a kind checking to +fix the issue. + + [1] https://github.com/eddyz87/bpf/tree/binsort-btf-dedup + [2] https://lore.kernel.org/all/0c0ef20c-c05e-4db9-bad7-2cbc0d6dfae7@oracle.com/ + +Fixes: 8fd27bf69b86 ("libbpf: Add BPF static linker BTF and BTF.ext support") +Signed-off-by: Donglin Peng +Signed-off-by: Daniel Borkmann +Reviewed-by: Alan Maguire +Acked-by: Eduard Zingerman +Link: https://lore.kernel.org/bpf/20240619122355.426405-1-dolinux.peng@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/linker.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c +index 0d4be829551b5..5a583053e3119 100644 +--- a/tools/lib/bpf/linker.c ++++ b/tools/lib/bpf/linker.c +@@ -2213,10 +2213,17 @@ static int linker_fixup_btf(struct src_obj *obj) + vi = btf_var_secinfos(t); + for (j = 0, m = btf_vlen(t); j < m; j++, vi++) { + const struct btf_type *vt = btf__type_by_id(obj->btf, vi->type); +- const char *var_name = btf__str_by_offset(obj->btf, vt->name_off); +- int var_linkage = btf_var(vt)->linkage; ++ const char *var_name; ++ int var_linkage; + Elf64_Sym *sym; + ++ /* could be a variable or function */ ++ if (!btf_is_var(vt)) ++ continue; ++ ++ var_name = btf__str_by_offset(obj->btf, vt->name_off); ++ var_linkage = btf_var(vt)->linkage; ++ + /* no need to patch up static or extern vars */ + if (var_linkage != BTF_VAR_GLOBAL_ALLOCATED) + continue; +-- +2.43.0 + diff --git a/queue-6.10/libbpf-keep-fd_cloexec-flag-when-dup-ing-fd.patch b/queue-6.10/libbpf-keep-fd_cloexec-flag-when-dup-ing-fd.patch new file mode 100644 index 00000000000..7ad82397bb9 --- /dev/null +++ b/queue-6.10/libbpf-keep-fd_cloexec-flag-when-dup-ing-fd.patch @@ -0,0 +1,58 @@ +From 63ec4cc8f50326c5a9c6e7fa1df26a8284e8b956 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 15:32:39 -0700 +Subject: libbpf: keep FD_CLOEXEC flag when dup()'ing FD + +From: Andrii Nakryiko + +[ Upstream commit 531876c80004ecff7bfdbd8ba6c6b48835ef5e22 ] + +Make sure to preserve and/or enforce FD_CLOEXEC flag on duped FDs. +Use dup3() with O_CLOEXEC flag for that. + +Without this fix libbpf effectively clears FD_CLOEXEC flag on each of BPF +map/prog FD, which is definitely not the right or expected behavior. + +Reported-by: Lennart Poettering +Fixes: bc308d011ab8 ("libbpf: call dup2() syscall directly") +Signed-off-by: Andrii Nakryiko +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20240529223239.504241-1-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf_internal.h | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h +index a0dcfb82e455d..7e7e686008c62 100644 +--- a/tools/lib/bpf/libbpf_internal.h ++++ b/tools/lib/bpf/libbpf_internal.h +@@ -597,13 +597,9 @@ static inline int ensure_good_fd(int fd) + return fd; + } + +-static inline int sys_dup2(int oldfd, int newfd) ++static inline int sys_dup3(int oldfd, int newfd, int flags) + { +-#ifdef __NR_dup2 +- return syscall(__NR_dup2, oldfd, newfd); +-#else +- return syscall(__NR_dup3, oldfd, newfd, 0); +-#endif ++ return syscall(__NR_dup3, oldfd, newfd, flags); + } + + /* Point *fixed_fd* to the same file that *tmp_fd* points to. +@@ -614,7 +610,7 @@ static inline int reuse_fd(int fixed_fd, int tmp_fd) + { + int err; + +- err = sys_dup2(tmp_fd, fixed_fd); ++ err = sys_dup3(tmp_fd, fixed_fd, O_CLOEXEC); + err = err < 0 ? -errno : 0; + close(tmp_fd); /* clean up temporary FD */ + return err; +-- +2.43.0 + diff --git a/queue-6.10/libbpf-skip-base-btf-sanity-checks.patch b/queue-6.10/libbpf-skip-base-btf-sanity-checks.patch new file mode 100644 index 00000000000..e35dfd84846 --- /dev/null +++ b/queue-6.10/libbpf-skip-base-btf-sanity-checks.patch @@ -0,0 +1,51 @@ +From 6a5097d0cc78d09427f154c1462870f3faca13ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 11:09:07 +0200 +Subject: libbpf: Skip base btf sanity checks + +From: Antoine Tenart + +[ Upstream commit c73a9683cb21012b6c0f14217974837151c527a8 ] + +When upgrading to libbpf 1.3 we noticed a big performance hit while +loading programs using CORE on non base-BTF symbols. This was tracked +down to the new BTF sanity check logic. The issue is the base BTF +definitions are checked first for the base BTF and then again for every +module BTF. + +Loading 5 dummy programs (using libbpf-rs) that are using CORE on a +non-base BTF symbol on my system: +- Before this fix: 3s. +- With this fix: 0.1s. + +Fix this by only checking the types starting at the BTF start id. This +should ensure the base BTF is still checked as expected but only once +(btf->start_id == 1 when creating the base BTF), and then only +additional types are checked for each module BTF. + +Fixes: 3903802bb99a ("libbpf: Add basic BTF sanity validation") +Signed-off-by: Antoine Tenart +Signed-off-by: Andrii Nakryiko +Reviewed-by: Alan Maguire +Link: https://lore.kernel.org/bpf/20240624090908.171231-1-atenart@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 2d0840ef599af..142060bbce0a0 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -598,7 +598,7 @@ static int btf_sanity_check(const struct btf *btf) + __u32 i, n = btf__type_cnt(btf); + int err; + +- for (i = 1; i < n; i++) { ++ for (i = btf->start_id; i < n; i++) { + t = btf_type_by_id(btf, i); + err = btf_validate_type(btf, t, i); + if (err) +-- +2.43.0 + diff --git a/queue-6.10/locking-rwsem-add-__always_inline-annotation-to-__do.patch b/queue-6.10/locking-rwsem-add-__always_inline-annotation-to-__do.patch new file mode 100644 index 00000000000..90e9d937bdb --- /dev/null +++ b/queue-6.10/locking-rwsem-add-__always_inline-annotation-to-__do.patch @@ -0,0 +1,71 @@ +From 17e23f424d7ec89d5966e26e1748680c2fdc81e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 23:08:27 -0700 +Subject: locking/rwsem: Add __always_inline annotation to + __down_write_common() and inlined callers + +From: John Stultz + +[ Upstream commit e81859fe64ad42dccefe134d1696e0635f78d763 ] + +Apparently despite it being marked inline, the compiler +may not inline __down_write_common() which makes it difficult +to identify the cause of lock contention, as the wchan of the +blocked function will always be listed as __down_write_common(). + +So add __always_inline annotation to the common function (as +well as the inlined helper callers) to force it to be inlined +so a more useful blocking function will be listed (via wchan). + +This mirrors commit 92cc5d00a431 ("locking/rwsem: Add +__always_inline annotation to __down_read_common() and inlined +callers") which did the same for __down_read_common. + +I sort of worry that I'm playing wack-a-mole here, and talking +with compiler people, they tell me inline means nothing, which +makes me want to cry a little. So I'm wondering if we need to +replace all the inlines with __always_inline, or remove them +because either we mean something by it, or not. + +Fixes: c995e638ccbb ("locking/rwsem: Fold __down_{read,write}*()") +Reported-by: Tim Murray +Signed-off-by: John Stultz +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Waiman Long +Link: https://lkml.kernel.org/r/20240709060831.495366-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index c6d17aee4209b..33cac79e39946 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1297,7 +1297,7 @@ static inline int __down_read_trylock(struct rw_semaphore *sem) + /* + * lock for writing + */ +-static inline int __down_write_common(struct rw_semaphore *sem, int state) ++static __always_inline int __down_write_common(struct rw_semaphore *sem, int state) + { + int ret = 0; + +@@ -1310,12 +1310,12 @@ static inline int __down_write_common(struct rw_semaphore *sem, int state) + return ret; + } + +-static inline void __down_write(struct rw_semaphore *sem) ++static __always_inline void __down_write(struct rw_semaphore *sem) + { + __down_write_common(sem, TASK_UNINTERRUPTIBLE); + } + +-static inline int __down_write_killable(struct rw_semaphore *sem) ++static __always_inline int __down_write_killable(struct rw_semaphore *sem) + { + return __down_write_common(sem, TASK_KILLABLE); + } +-- +2.43.0 + diff --git a/queue-6.10/loongarch-check-tif_load_watch-to-enable-user-space-.patch b/queue-6.10/loongarch-check-tif_load_watch-to-enable-user-space-.patch new file mode 100644 index 00000000000..b6092c68995 --- /dev/null +++ b/queue-6.10/loongarch-check-tif_load_watch-to-enable-user-space-.patch @@ -0,0 +1,63 @@ +From e925f6bf24706a87cdddb30fb26c8202d660c969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jul 2024 22:41:07 +0800 +Subject: LoongArch: Check TIF_LOAD_WATCH to enable user space watchpoint + +From: Tiezhu Yang + +[ Upstream commit 3892b11eac5aaaeefbf717f1953288b77759d9e2 ] + +Currently, there are some places to set CSR.PRMD.PWE, the first one is +in hw_breakpoint_thread_switch() to enable user space singlestep via +checking TIF_SINGLESTEP, the second one is in hw_breakpoint_control() to +enable user space watchpoint. For the latter case, it should also check +TIF_LOAD_WATCH to make the logic correct and clear. + +Fixes: c8e57ab0995c ("LoongArch: Trigger user-space watchpoints correctly") +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/hw_breakpoint.c | 2 +- + arch/loongarch/kernel/ptrace.c | 3 +++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/loongarch/kernel/hw_breakpoint.c b/arch/loongarch/kernel/hw_breakpoint.c +index 621ad7634df71..a6e4b605bfa8d 100644 +--- a/arch/loongarch/kernel/hw_breakpoint.c ++++ b/arch/loongarch/kernel/hw_breakpoint.c +@@ -221,7 +221,7 @@ static int hw_breakpoint_control(struct perf_event *bp, + } + enable = csr_read64(LOONGARCH_CSR_CRMD); + csr_write64(CSR_CRMD_WE | enable, LOONGARCH_CSR_CRMD); +- if (bp->hw.target) ++ if (bp->hw.target && test_tsk_thread_flag(bp->hw.target, TIF_LOAD_WATCH)) + regs->csr_prmd |= CSR_PRMD_PWE; + break; + case HW_BREAKPOINT_UNINSTALL: +diff --git a/arch/loongarch/kernel/ptrace.c b/arch/loongarch/kernel/ptrace.c +index 200109de1971a..19dc6eff45ccc 100644 +--- a/arch/loongarch/kernel/ptrace.c ++++ b/arch/loongarch/kernel/ptrace.c +@@ -589,6 +589,7 @@ static int ptrace_hbp_set_ctrl(unsigned int note_type, + struct perf_event *bp; + struct perf_event_attr attr; + struct arch_hw_breakpoint_ctrl ctrl; ++ struct thread_info *ti = task_thread_info(tsk); + + bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); + if (IS_ERR(bp)) +@@ -613,8 +614,10 @@ static int ptrace_hbp_set_ctrl(unsigned int note_type, + if (err) + return err; + attr.disabled = 0; ++ set_ti_thread_flag(ti, TIF_LOAD_WATCH); + } else { + attr.disabled = 1; ++ clear_ti_thread_flag(ti, TIF_LOAD_WATCH); + } + + return modify_user_hw_breakpoint(bp, &attr); +-- +2.43.0 + diff --git a/queue-6.10/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch b/queue-6.10/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch new file mode 100644 index 00000000000..7f4f0eaa166 --- /dev/null +++ b/queue-6.10/m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch @@ -0,0 +1,58 @@ +From 6cbb8ea55f7e608853b75b1c1d8346798938d01c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 17:49:01 +0300 +Subject: m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt + messages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eero Tamminen + +[ Upstream commit f70065a9fd988983b2c693631b801f25a615fc04 ] + +Avoid freeze on Atari TT / MegaSTe boot with continuous messages of: + + unexpected interrupt from 112 + +Which was due to VBL interrupt being enabled in SCU sys mask, but there +being no handler for that any more. + +(Bug and fix were first verified on real Atari TT HW by Christian, + this patch later on in Hatari emulator.) + +Fixes: 1fa0b29f3a43f9dd ("fbdev: Kill Atari vblank cursor blinking") +Reported-by: Nicolas Pomarède +Closes: https://listengine.tuxfamily.org/lists.tuxfamily.org/hatari-devel/2024/06/msg00016.html +Closes: https://lore.kernel.org/all/9aa793d7-82ed-4fbd-bce5-60810d8a9119@helsinkinet.fi +Tested-by: Christian Zietz +Signed-off-by: Eero Tamminen +Reviewed-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240624144901.5236-1-oak@helsinkinet.fi +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/atari/ataints.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c +index 23256434191c3..0465444ceb216 100644 +--- a/arch/m68k/atari/ataints.c ++++ b/arch/m68k/atari/ataints.c +@@ -301,11 +301,7 @@ void __init atari_init_IRQ(void) + + if (ATARIHW_PRESENT(SCU)) { + /* init the SCU if present */ +- tt_scu.sys_mask = 0x10; /* enable VBL (for the cursor) and +- * disable HSYNC interrupts (who +- * needs them?) MFP and SCC are +- * enabled in VME mask +- */ ++ tt_scu.sys_mask = 0x0; /* disable all interrupts */ + tt_scu.vme_mask = 0x60; /* enable MFP and SCC ints */ + } else { + /* If no SCU and no Hades, the HSYNC interrupt needs to be +-- +2.43.0 + diff --git a/queue-6.10/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch b/queue-6.10/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch new file mode 100644 index 00000000000..c82e670d232 --- /dev/null +++ b/queue-6.10/m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch @@ -0,0 +1,38 @@ +From b0ce1b6578012ca184f218fc1529f0e7d31c1811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 05:41:17 +0200 +Subject: m68k: cmpxchg: Fix return value for default case in __arch_xchg() + +From: Thorsten Blum + +[ Upstream commit 21b9e722ad28c19c2bc83f18f540b3dbd89bf762 ] + +The return value of __invalid_xchg_size() is assigned to tmp instead of +the return variable x. Assign it to x instead. + +Fixes: 2501cf768e4009a0 ("m68k: Fix xchg/cmpxchg to fail to link if given an inappropriate pointer") +Signed-off-by: Thorsten Blum +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/20240702034116.140234-2-thorsten.blum@toblux.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/cmpxchg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/m68k/include/asm/cmpxchg.h b/arch/m68k/include/asm/cmpxchg.h +index d7f3de9c5d6f7..4ba14f3535fcb 100644 +--- a/arch/m68k/include/asm/cmpxchg.h ++++ b/arch/m68k/include/asm/cmpxchg.h +@@ -32,7 +32,7 @@ static inline unsigned long __arch_xchg(unsigned long x, volatile void * ptr, in + x = tmp; + break; + default: +- tmp = __invalid_xchg_size(x, ptr, size); ++ x = __invalid_xchg_size(x, ptr, size); + break; + } + +-- +2.43.0 + diff --git a/queue-6.10/macintosh-therm_windtunnel-fix-module-unload.patch b/queue-6.10/macintosh-therm_windtunnel-fix-module-unload.patch new file mode 100644 index 00000000000..f250a3914c4 --- /dev/null +++ b/queue-6.10/macintosh-therm_windtunnel-fix-module-unload.patch @@ -0,0 +1,48 @@ +From 060a8447d59cbe6efcc7598e14aeadfa34374a35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 23:54:17 -0400 +Subject: macintosh/therm_windtunnel: fix module unload. + +From: Nick Bowler + +[ Upstream commit fd748e177194ebcbbaf98df75152a30e08230cc6 ] + +The of_device_unregister call in therm_windtunnel's module_exit procedure +does not fully reverse the effects of of_platform_device_create in the +module_init prodedure. Once you unload this module, it is impossible +to load it ever again since only the first of_platform_device_create +call on the fan node succeeds. + +This driver predates first git commit, and it turns out back then +of_platform_device_create worked differently than it does today. +So this is actually an old regression. + +The appropriate function to undo of_platform_device_create now appears +to be of_platform_device_destroy, and switching to use this makes it +possible to unload and load the module as expected. + +Signed-off-by: Nick Bowler +Fixes: c6e126de43e7 ("of: Keep track of populated platform devices") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240711035428.16696-1-nbowler@draconx.ca +Signed-off-by: Sasha Levin +--- + drivers/macintosh/therm_windtunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c +index 37cdc6931f6d0..2576a53f247ea 100644 +--- a/drivers/macintosh/therm_windtunnel.c ++++ b/drivers/macintosh/therm_windtunnel.c +@@ -549,7 +549,7 @@ g4fan_exit( void ) + platform_driver_unregister( &therm_of_driver ); + + if( x.of_dev ) +- of_device_unregister( x.of_dev ); ++ of_platform_device_destroy(&x.of_dev->dev, NULL); + } + + module_init(g4fan_init); +-- +2.43.0 + diff --git a/queue-6.10/mailbox-imx-fix-txdb_v2-channel-race-condition.patch b/queue-6.10/mailbox-imx-fix-txdb_v2-channel-race-condition.patch new file mode 100644 index 00000000000..939f6ec288d --- /dev/null +++ b/queue-6.10/mailbox-imx-fix-txdb_v2-channel-race-condition.patch @@ -0,0 +1,74 @@ +From 62e952eab03db0934a0ea2c2d6a618c8eee1885e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 15:56:32 +0800 +Subject: mailbox: imx: fix TXDB_V2 channel race condition + +From: Peng Fan + +[ Upstream commit b5ef17917f3a797a7b12d1edd51f676554e44a07 ] + +Two TXDB_V2 channels are used between Linux and System Manager(SM). +Channel0 for normal TX, Channel 1 for notification completion. +The TXDB_V2 trigger logic is using imx_mu_xcr_rmw which uses +read/modify/update logic. + +Note: clear MUB GSR BITs, the MUA side GCR BITs will also got cleared per +hardware design. +Channel0 Linux +read GCR->modify GCR->write GCR->M33 SM->read GSR----->clear GSR + |-(1)-| +Channel1 Linux start in time slot(1) +read GCR->modify GCR->write GCR->M33 SM->read GSR->clear GSR +So Channel1 read GCR will read back the GCR that Channel0 wrote, because +M33 has not finish clear GSR, this means Channel1 GCR writing will +trigger Channel1 and Channel0 interrupt both which is wrong. + +Channel0 will be freed(SCMI channel status set to FREE) in M33 SM when +processing the 1st Channel0 interrupt. So when 2nd interrupt trigger +(channel 0/1 trigger together), SM will see a freed Channel0, and report +protocol error. + +To address the issue, not using read/modify/update logic, just use +write, because write 0 to GCR will be ignored. And after write MUA GCR, +wait the SM to clear MUB GSR by looping MUA GCR value. + +Fixes: 5bfe4067d350 ("mailbox: imx: support channel type tx doorbell v2") +Reviewed-by: Ranjani Vaidyanathan +Signed-off-by: Peng Fan +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/imx-mailbox.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/mailbox/imx-mailbox.c b/drivers/mailbox/imx-mailbox.c +index 933727f89431d..d17efb1dd0cb1 100644 +--- a/drivers/mailbox/imx-mailbox.c ++++ b/drivers/mailbox/imx-mailbox.c +@@ -225,6 +225,8 @@ static int imx_mu_generic_tx(struct imx_mu_priv *priv, + void *data) + { + u32 *arg = data; ++ u32 val; ++ int ret; + + switch (cp->type) { + case IMX_MU_TYPE_TX: +@@ -236,7 +238,13 @@ static int imx_mu_generic_tx(struct imx_mu_priv *priv, + queue_work(system_bh_wq, &cp->txdb_work); + break; + case IMX_MU_TYPE_TXDB_V2: +- imx_mu_xcr_rmw(priv, IMX_MU_GCR, IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx), 0); ++ imx_mu_write(priv, IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx), ++ priv->dcfg->xCR[IMX_MU_GCR]); ++ ret = readl_poll_timeout(priv->base + priv->dcfg->xCR[IMX_MU_GCR], val, ++ !(val & IMX_MU_xCR_GIRn(priv->dcfg->type, cp->idx)), ++ 0, 1000); ++ if (ret) ++ dev_warn_ratelimited(priv->dev, "channel type: %d failure\n", cp->type); + break; + default: + dev_warn_ratelimited(priv->dev, "Send data on wrong channel type: %d\n", cp->type); +-- +2.43.0 + diff --git a/queue-6.10/mailbox-mtk-cmdq-move-devm_mbox_controller_register-.patch b/queue-6.10/mailbox-mtk-cmdq-move-devm_mbox_controller_register-.patch new file mode 100644 index 00000000000..f6082a48d2b --- /dev/null +++ b/queue-6.10/mailbox-mtk-cmdq-move-devm_mbox_controller_register-.patch @@ -0,0 +1,80 @@ +From 839805d914d14bfa52a74bf915d74a8942ae788d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jul 2024 22:17:04 +0800 +Subject: mailbox: mtk-cmdq: Move devm_mbox_controller_register() after + devm_pm_runtime_enable() + +From: Jason-JH.Lin + +[ Upstream commit a8bd68e4329f9a0ad1b878733e0f80be6a971649 ] + +When mtk-cmdq unbinds, a WARN_ON message with condition +pm_runtime_get_sync() < 0 occurs. + +According to the call tracei below: + cmdq_mbox_shutdown + mbox_free_channel + mbox_controller_unregister + __devm_mbox_controller_unregister + ... + +The root cause can be deduced to be calling pm_runtime_get_sync() after +calling pm_runtime_disable() as observed below: +1. CMDQ driver uses devm_mbox_controller_register() in cmdq_probe() + to bind the cmdq device to the mbox_controller, so + devm_mbox_controller_unregister() will automatically unregister + the device bound to the mailbox controller when the device-managed + resource is removed. That means devm_mbox_controller_unregister() + and cmdq_mbox_shoutdown() will be called after cmdq_remove(). +2. CMDQ driver also uses devm_pm_runtime_enable() in cmdq_probe() after + devm_mbox_controller_register(), so that devm_pm_runtime_disable() + will be called after cmdq_remove(), but before + devm_mbox_controller_unregister(). + +To fix this problem, cmdq_probe() needs to move +devm_mbox_controller_register() after devm_pm_runtime_enable() to make +devm_pm_runtime_disable() be called after +devm_mbox_controller_unregister(). + +Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver") +Signed-off-by: Jason-JH.Lin +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index 4aa394e91109c..63b5e3fe75281 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -662,12 +662,6 @@ static int cmdq_probe(struct platform_device *pdev) + cmdq->mbox.chans[i].con_priv = (void *)&cmdq->thread[i]; + } + +- err = devm_mbox_controller_register(dev, &cmdq->mbox); +- if (err < 0) { +- dev_err(dev, "failed to register mailbox: %d\n", err); +- return err; +- } +- + platform_set_drvdata(pdev, cmdq); + + WARN_ON(clk_bulk_prepare(cmdq->pdata->gce_num, cmdq->clocks)); +@@ -695,6 +689,12 @@ static int cmdq_probe(struct platform_device *pdev) + pm_runtime_set_autosuspend_delay(dev, CMDQ_MBOX_AUTOSUSPEND_DELAY_MS); + pm_runtime_use_autosuspend(dev); + ++ err = devm_mbox_controller_register(dev, &cmdq->mbox); ++ if (err < 0) { ++ dev_err(dev, "failed to register mailbox: %d\n", err); ++ return err; ++ } ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/mailbox-omap-fix-mailbox-interrupt-sharing.patch b/queue-6.10/mailbox-omap-fix-mailbox-interrupt-sharing.patch new file mode 100644 index 00000000000..a64cdacd1c3 --- /dev/null +++ b/queue-6.10/mailbox-omap-fix-mailbox-interrupt-sharing.patch @@ -0,0 +1,39 @@ +From e3b18a25bae05c1d9e6bac9a43d34196eee6f9eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 12:04:56 -0500 +Subject: mailbox: omap: Fix mailbox interrupt sharing + +From: Andrew Davis + +[ Upstream commit 0a02bc0a34cd53c7fe5bf4bae6efb56ad47677fa ] + +Multiple mailbox users can share one interrupt line. This flag was +mistakenly dropped as part of the FIFO removal. Mark the IRQ as shared. + +Reported-by: Beleswar Padhi +Fixes: 3f58c1f4206f ("mailbox: omap: Remove kernel FIFO message queuing") +Signed-off-by: Andrew Davis +Tested-by: Beleswar Padhi +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/omap-mailbox.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mailbox/omap-mailbox.c b/drivers/mailbox/omap-mailbox.c +index 46747559b438f..7a87424657a15 100644 +--- a/drivers/mailbox/omap-mailbox.c ++++ b/drivers/mailbox/omap-mailbox.c +@@ -230,7 +230,8 @@ static int omap_mbox_startup(struct omap_mbox *mbox) + int ret = 0; + + ret = request_threaded_irq(mbox->irq, NULL, mbox_interrupt, +- IRQF_ONESHOT, mbox->name, mbox); ++ IRQF_SHARED | IRQF_ONESHOT, mbox->name, ++ mbox); + if (unlikely(ret)) { + pr_err("failed to register mailbox interrupt:%d\n", ret); + return ret; +-- +2.43.0 + diff --git a/queue-6.10/md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch b/queue-6.10/md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch new file mode 100644 index 00000000000..9327dcc0ae3 --- /dev/null +++ b/queue-6.10/md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch @@ -0,0 +1,109 @@ +From 6e581e828c65ad577a7499bd902220d6e07fea93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 18:41:19 +0800 +Subject: md-cluster: fix hanging issue while a new disk adding + +From: Heming Zhao + +[ Upstream commit fff42f213824fa434a4b6cf906b4331fe6e9302b ] + +The commit 1bbe254e4336 ("md-cluster: check for timeout while a +new disk adding") is correct in terms of code syntax but not +suite real clustered code logic. + +When a timeout occurs while adding a new disk, if recv_daemon() +bypasses the unlock for ack_lockres:CR, another node will be waiting +to grab EX lock. This will cause the cluster to hang indefinitely. + +How to fix: + +1. In dlm_lock_sync(), change the wait behaviour from forever to a + timeout, This could avoid the hanging issue when another node + fails to handle cluster msg. Another result of this change is + that if another node receives an unknown msg (e.g. a new msg_type), + the old code will hang, whereas the new code will timeout and fail. + This could help cluster_md handle new msg_type from different + nodes with different kernel/module versions (e.g. The user only + updates one leg's kernel and monitors the stability of the new + kernel). +2. The old code for __sendmsg() always returns 0 (success) under the + design (must successfully unlock ->message_lockres). This commit + makes this function return an error number when an error occurs. + +Fixes: 1bbe254e4336 ("md-cluster: check for timeout while a new disk adding") +Signed-off-by: Heming Zhao +Reviewed-by: Su Yue +Acked-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240709104120.22243-1-heming.zhao@suse.com +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 8e36a0feec098..b5a802ae17bb2 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -15,6 +15,7 @@ + + #define LVB_SIZE 64 + #define NEW_DEV_TIMEOUT 5000 ++#define WAIT_DLM_LOCK_TIMEOUT (30 * HZ) + + struct dlm_lock_resource { + dlm_lockspace_t *ls; +@@ -130,8 +131,13 @@ static int dlm_lock_sync(struct dlm_lock_resource *res, int mode) + 0, sync_ast, res, res->bast); + if (ret) + return ret; +- wait_event(res->sync_locking, res->sync_locking_done); ++ ret = wait_event_timeout(res->sync_locking, res->sync_locking_done, ++ WAIT_DLM_LOCK_TIMEOUT); + res->sync_locking_done = false; ++ if (!ret) { ++ pr_err("locking DLM '%s' timeout!\n", res->name); ++ return -EBUSY; ++ } + if (res->lksb.sb_status == 0) + res->mode = mode; + return res->lksb.sb_status; +@@ -743,7 +749,7 @@ static void unlock_comm(struct md_cluster_info *cinfo) + */ + static int __sendmsg(struct md_cluster_info *cinfo, struct cluster_msg *cmsg) + { +- int error; ++ int error, unlock_error; + int slot = cinfo->slot_number - 1; + + cmsg->slot = cpu_to_le32(slot); +@@ -751,7 +757,7 @@ static int __sendmsg(struct md_cluster_info *cinfo, struct cluster_msg *cmsg) + error = dlm_lock_sync(cinfo->message_lockres, DLM_LOCK_EX); + if (error) { + pr_err("md-cluster: failed to get EX on MESSAGE (%d)\n", error); +- goto failed_message; ++ return error; + } + + memcpy(cinfo->message_lockres->lksb.sb_lvbptr, (void *)cmsg, +@@ -781,14 +787,10 @@ static int __sendmsg(struct md_cluster_info *cinfo, struct cluster_msg *cmsg) + } + + failed_ack: +- error = dlm_unlock_sync(cinfo->message_lockres); +- if (unlikely(error != 0)) { ++ while ((unlock_error = dlm_unlock_sync(cinfo->message_lockres))) + pr_err("md-cluster: failed convert to NL on MESSAGE(%d)\n", +- error); +- /* in case the message can't be released due to some reason */ +- goto failed_ack; +- } +-failed_message: ++ unlock_error); ++ + return error; + } + +-- +2.43.0 + diff --git a/queue-6.10/md-don-t-wait-for-md_recovery_needed-for-hot_remove_.patch b/queue-6.10/md-don-t-wait-for-md_recovery_needed-for-hot_remove_.patch new file mode 100644 index 00000000000..6db64fe7357 --- /dev/null +++ b/queue-6.10/md-don-t-wait-for-md_recovery_needed-for-hot_remove_.patch @@ -0,0 +1,57 @@ +From 0e12124e10ad6690f5b8b92c2e00c5f90ea3e86e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 19:23:21 +0800 +Subject: md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl + +From: Yu Kuai + +[ Upstream commit a1fd37f97808db4fa1bf55da0275790c42521e45 ] + +Commit 90f5f7ad4f38 ("md: Wait for md_check_recovery before attempting +device removal.") explained in the commit message that failed device +must be reomoved from the personality first by md_check_recovery(), +before it can be removed from the array. That's the reason the commit +add the code to wait for MD_RECOVERY_NEEDED. + +However, this is not the case now, because remove_and_add_spares() is +called directly from hot_remove_disk() from ioctl path, hence failed +device(marked faulty) can be removed from the personality by ioctl. + +On the other hand, the commit introduced a performance problem that +if MD_RECOVERY_NEEDED is set and the array is not running, ioctl will +wait for 5s before it can return failure to user. + +Since the waiting is not needed now, fix the problem by removing the +waiting. + +Fixes: 90f5f7ad4f38 ("md: Wait for md_check_recovery before attempting device removal.") +Reported-by: Mateusz Kusiak +Closes: https://lore.kernel.org/all/814ff6ee-47a2-4ba0-963e-cf256ee4ecfa@linux.intel.com/ +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240627112321.3044744-1-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 3a02b8903d626..9c5be016e5073 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -7746,12 +7746,6 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode, + return get_bitmap_file(mddev, argp); + } + +- if (cmd == HOT_REMOVE_DISK) +- /* need to ensure recovery thread has run */ +- wait_event_interruptible_timeout(mddev->sb_wait, +- !test_bit(MD_RECOVERY_NEEDED, +- &mddev->recovery), +- msecs_to_jiffies(5000)); + if (cmd == STOP_ARRAY || cmd == STOP_ARRAY_RO) { + /* Need to flush page cache, and ensure no-one else opens + * and writes +-- +2.43.0 + diff --git a/queue-6.10/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch b/queue-6.10/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch new file mode 100644 index 00000000000..66ccf78ca9b --- /dev/null +++ b/queue-6.10/md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch @@ -0,0 +1,144 @@ +From 56dec3dc820d9de862b45cb687ac8aeef2aee5a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 May 2024 02:52:57 +0800 +Subject: md: fix deadlock between mddev_suspend and flush bio + +From: Li Nan + +[ Upstream commit 611d5cbc0b35a752e657a83eebadf40d814d006b ] + +Deadlock occurs when mddev is being suspended while some flush bio is in +progress. It is a complex issue. + +T1. the first flush is at the ending stage, it clears 'mddev->flush_bio' + and tries to submit data, but is blocked because mddev is suspended + by T4. +T2. the second flush sets 'mddev->flush_bio', and attempts to queue + md_submit_flush_data(), which is already running (T1) and won't + execute again if on the same CPU as T1. +T3. the third flush inc active_io and tries to flush, but is blocked because + 'mddev->flush_bio' is not NULL (set by T2). +T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc + by T3. + + T1 T2 T3 T4 + (flush 1) (flush 2) (third 3) (suspend) + md_submit_flush_data + mddev->flush_bio = NULL; + . + . md_flush_request + . mddev->flush_bio = bio + . queue submit_flushes + . . + . . md_handle_request + . . active_io + 1 + . . md_flush_request + . . wait !mddev->flush_bio + . . + . . mddev_suspend + . . wait !active_io + . . + . submit_flushes + . queue_work md_submit_flush_data + . //md_submit_flush_data is already running (T1) + . + md_handle_request + wait resume + +The root issue is non-atomic inc/dec of active_io during flush process. +active_io is dec before md_submit_flush_data is queued, and inc soon +after md_submit_flush_data() run. + md_flush_request + active_io + 1 + submit_flushes + active_io - 1 + md_submit_flush_data + md_handle_request + active_io + 1 + make_request + active_io - 1 + +If active_io is dec after md_handle_request() instead of within +submit_flushes(), make_request() can be called directly intead of +md_handle_request() in md_submit_flush_data(), and active_io will +only inc and dec once in the whole flush process. Deadlock will be +fixed. + +Additionally, the only difference between fixing the issue and before is +that there is no return error handling of make_request(). But after +previous patch cleaned md_write_start(), make_requst() only return error +in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456, +md/raid456: fix a deadlock for dm-raid456 while io concurrent with +reshape)". Since dm always splits data and flush operation into two +separate io, io size of flush submitted by dm always is 0, make_request() +will not be called in md_submit_flush_data(). To prevent future +modifications from introducing issues, add WARN_ON to ensure +make_request() no error is returned in this context. + +Fixes: fa2bbff7b0b4 ("md: synchronize flush io with array reconfiguration") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240525185257.3896201-3-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index aff9118ff6975..3a02b8903d626 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -550,13 +550,9 @@ static void md_end_flush(struct bio *bio) + + rdev_dec_pending(rdev, mddev); + +- if (atomic_dec_and_test(&mddev->flush_pending)) { +- /* The pair is percpu_ref_get() from md_flush_request() */ +- percpu_ref_put(&mddev->active_io); +- ++ if (atomic_dec_and_test(&mddev->flush_pending)) + /* The pre-request flush has finished */ + queue_work(md_wq, &mddev->flush_work); +- } + } + + static void md_submit_flush_data(struct work_struct *ws); +@@ -587,12 +583,8 @@ static void submit_flushes(struct work_struct *ws) + rcu_read_lock(); + } + rcu_read_unlock(); +- if (atomic_dec_and_test(&mddev->flush_pending)) { +- /* The pair is percpu_ref_get() from md_flush_request() */ +- percpu_ref_put(&mddev->active_io); +- ++ if (atomic_dec_and_test(&mddev->flush_pending)) + queue_work(md_wq, &mddev->flush_work); +- } + } + + static void md_submit_flush_data(struct work_struct *ws) +@@ -617,8 +609,20 @@ static void md_submit_flush_data(struct work_struct *ws) + bio_endio(bio); + } else { + bio->bi_opf &= ~REQ_PREFLUSH; +- md_handle_request(mddev, bio); ++ ++ /* ++ * make_requst() will never return error here, it only ++ * returns error in raid5_make_request() by dm-raid. ++ * Since dm always splits data and flush operation into ++ * two separate io, io size of flush submitted by dm ++ * always is 0, make_request() will not be called here. ++ */ ++ if (WARN_ON_ONCE(!mddev->pers->make_request(mddev, bio))) ++ bio_io_error(bio);; + } ++ ++ /* The pair is percpu_ref_get() from md_flush_request() */ ++ percpu_ref_put(&mddev->active_io); + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/md-raid0-don-t-free-conf-on-raid0_run-failure.patch b/queue-6.10/md-raid0-don-t-free-conf-on-raid0_run-failure.patch new file mode 100644 index 00000000000..829662bbe46 --- /dev/null +++ b/queue-6.10/md-raid0-don-t-free-conf-on-raid0_run-failure.patch @@ -0,0 +1,74 @@ +From 93df1808bfbe4e4750db59f2b7af793c6daa5f0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 19:25:28 +0200 +Subject: md/raid0: don't free conf on raid0_run failure + +From: Christoph Hellwig + +[ Upstream commit 35f20acaa3585f25f8356da0ee6bc143e0256522 ] + +The core md code calls the ->free method which already frees conf. + +Fixes: 0c031fd37f69 ("md: Move alloc/free acct bioset in to personality") +Signed-off-by: Christoph Hellwig +Reviewed-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240604172607.3185916-2-hch@lst.de +Signed-off-by: Sasha Levin +--- + drivers/md/raid0.c | 21 +++++---------------- + 1 file changed, 5 insertions(+), 16 deletions(-) + +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index c5d4aeb68404c..81c01347cd24e 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -365,18 +365,13 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks + return array_sectors; + } + +-static void free_conf(struct mddev *mddev, struct r0conf *conf) +-{ +- kfree(conf->strip_zone); +- kfree(conf->devlist); +- kfree(conf); +-} +- + static void raid0_free(struct mddev *mddev, void *priv) + { + struct r0conf *conf = priv; + +- free_conf(mddev, conf); ++ kfree(conf->strip_zone); ++ kfree(conf->devlist); ++ kfree(conf); + } + + static int raid0_set_limits(struct mddev *mddev) +@@ -415,7 +410,7 @@ static int raid0_run(struct mddev *mddev) + if (!mddev_is_dm(mddev)) { + ret = raid0_set_limits(mddev); + if (ret) +- goto out_free_conf; ++ return ret; + } + + /* calculate array device size */ +@@ -427,13 +422,7 @@ static int raid0_run(struct mddev *mddev) + + dump_zones(mddev); + +- ret = md_integrity_register(mddev); +- if (ret) +- goto out_free_conf; +- return 0; +-out_free_conf: +- free_conf(mddev, conf); +- return ret; ++ return md_integrity_register(mddev); + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/md-raid1-don-t-free-conf-on-raid0_run-failure.patch b/queue-6.10/md-raid1-don-t-free-conf-on-raid0_run-failure.patch new file mode 100644 index 00000000000..14a0cfd6386 --- /dev/null +++ b/queue-6.10/md-raid1-don-t-free-conf-on-raid0_run-failure.patch @@ -0,0 +1,70 @@ +From 809cf917aa0a5b2ab87a74bf84e44b3112ffc053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 19:25:29 +0200 +Subject: md/raid1: don't free conf on raid0_run failure + +From: Christoph Hellwig + +[ Upstream commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 ] + +The core md code calls the ->free method which already frees conf. + +Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") +Signed-off-by: Christoph Hellwig +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 7b8a71ca66dde..1f321826ef02b 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3204,7 +3204,6 @@ static int raid1_set_limits(struct mddev *mddev) + return queue_limits_set(mddev->gendisk->queue, &lim); + } + +-static void raid1_free(struct mddev *mddev, void *priv); + static int raid1_run(struct mddev *mddev) + { + struct r1conf *conf; +@@ -3238,7 +3237,7 @@ static int raid1_run(struct mddev *mddev) + if (!mddev_is_dm(mddev)) { + ret = raid1_set_limits(mddev); + if (ret) +- goto abort; ++ return ret; + } + + mddev->degraded = 0; +@@ -3252,8 +3251,7 @@ static int raid1_run(struct mddev *mddev) + */ + if (conf->raid_disks - mddev->degraded < 1) { + md_unregister_thread(mddev, &conf->thread); +- ret = -EINVAL; +- goto abort; ++ return -EINVAL; + } + + if (conf->raid_disks - mddev->degraded == 1) +@@ -3277,14 +3275,8 @@ static int raid1_run(struct mddev *mddev) + md_set_array_sectors(mddev, raid1_size(mddev, 0, 0)); + + ret = md_integrity_register(mddev); +- if (ret) { ++ if (ret) + md_unregister_thread(mddev, &mddev->thread); +- goto abort; +- } +- return 0; +- +-abort: +- raid1_free(mddev, conf); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.10/md-raid5-recheck-if-reshape-has-finished-with-device.patch b/queue-6.10/md-raid5-recheck-if-reshape-has-finished-with-device.patch new file mode 100644 index 00000000000..9017b1c72ed --- /dev/null +++ b/queue-6.10/md-raid5-recheck-if-reshape-has-finished-with-device.patch @@ -0,0 +1,135 @@ +From 6f0d316ff2d790c2b16ce67ccaa07187746a7091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 11:18:02 -0400 +Subject: md/raid5: recheck if reshape has finished with device_lock held + +From: Benjamin Marzinski + +[ Upstream commit 25b3a8237a03ec0b67b965b52d74862e77ef7115 ] + +When handling an IO request, MD checks if a reshape is currently +happening, and if so, where the IO sector is in relation to the reshape +progress. MD uses conf->reshape_progress for both of these tasks. When +the reshape finishes, conf->reshape_progress is set to MaxSector. If +this occurs after MD checks if the reshape is currently happening but +before it calls ahead_of_reshape(), then ahead_of_reshape() will end up +comparing the IO sector against MaxSector. During a backwards reshape, +this will make MD think the IO sector is in the area not yet reshaped, +causing it to use the previous configuration, and map the IO to the +sector where that data was before the reshape. + +This bug can be triggered by running the lvm2 +lvconvert-raid-reshape-linear_to_raid6-single-type.sh test in a loop, +although it's very hard to reproduce. + +Fix this by factoring the code that checks where the IO sector is in +relation to the reshape out to a helper called get_reshape_loc(), +which reads reshape_progress and reshape_safe while holding the +device_lock, and then rechecks if the reshape has finished before +calling ahead_of_reshape with the saved values. + +Also use the helper during the REQ_NOWAIT check to see if the location +is inside of the reshape region. + +Fixes: fef9c61fdfabf ("md/raid5: change reshape-progress measurement to cope with reshaping backwards.") +Signed-off-by: Benjamin Marzinski +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240702151802.1632010-1-bmarzins@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 64 +++++++++++++++++++++++++++++----------------- + 1 file changed, 41 insertions(+), 23 deletions(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 2bd1ce9b39226..36d6764a1b25c 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5899,6 +5899,39 @@ static int add_all_stripe_bios(struct r5conf *conf, + return ret; + } + ++enum reshape_loc { ++ LOC_NO_RESHAPE, ++ LOC_AHEAD_OF_RESHAPE, ++ LOC_INSIDE_RESHAPE, ++ LOC_BEHIND_RESHAPE, ++}; ++ ++static enum reshape_loc get_reshape_loc(struct mddev *mddev, ++ struct r5conf *conf, sector_t logical_sector) ++{ ++ sector_t reshape_progress, reshape_safe; ++ /* ++ * Spinlock is needed as reshape_progress may be ++ * 64bit on a 32bit platform, and so it might be ++ * possible to see a half-updated value ++ * Of course reshape_progress could change after ++ * the lock is dropped, so once we get a reference ++ * to the stripe that we think it is, we will have ++ * to check again. ++ */ ++ spin_lock_irq(&conf->device_lock); ++ reshape_progress = conf->reshape_progress; ++ reshape_safe = conf->reshape_safe; ++ spin_unlock_irq(&conf->device_lock); ++ if (reshape_progress == MaxSector) ++ return LOC_NO_RESHAPE; ++ if (ahead_of_reshape(mddev, logical_sector, reshape_progress)) ++ return LOC_AHEAD_OF_RESHAPE; ++ if (ahead_of_reshape(mddev, logical_sector, reshape_safe)) ++ return LOC_INSIDE_RESHAPE; ++ return LOC_BEHIND_RESHAPE; ++} ++ + static enum stripe_result make_stripe_request(struct mddev *mddev, + struct r5conf *conf, struct stripe_request_ctx *ctx, + sector_t logical_sector, struct bio *bi) +@@ -5913,28 +5946,14 @@ static enum stripe_result make_stripe_request(struct mddev *mddev, + seq = read_seqcount_begin(&conf->gen_lock); + + if (unlikely(conf->reshape_progress != MaxSector)) { +- /* +- * Spinlock is needed as reshape_progress may be +- * 64bit on a 32bit platform, and so it might be +- * possible to see a half-updated value +- * Of course reshape_progress could change after +- * the lock is dropped, so once we get a reference +- * to the stripe that we think it is, we will have +- * to check again. +- */ +- spin_lock_irq(&conf->device_lock); +- if (ahead_of_reshape(mddev, logical_sector, +- conf->reshape_progress)) { +- previous = 1; +- } else { +- if (ahead_of_reshape(mddev, logical_sector, +- conf->reshape_safe)) { +- spin_unlock_irq(&conf->device_lock); +- ret = STRIPE_SCHEDULE_AND_RETRY; +- goto out; +- } ++ enum reshape_loc loc = get_reshape_loc(mddev, conf, ++ logical_sector); ++ if (loc == LOC_INSIDE_RESHAPE) { ++ ret = STRIPE_SCHEDULE_AND_RETRY; ++ goto out; + } +- spin_unlock_irq(&conf->device_lock); ++ if (loc == LOC_AHEAD_OF_RESHAPE) ++ previous = 1; + } + + new_sector = raid5_compute_sector(conf, logical_sector, previous, +@@ -6113,8 +6132,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + /* Bail out if conflicts with reshape and REQ_NOWAIT is set */ + if ((bi->bi_opf & REQ_NOWAIT) && + (conf->reshape_progress != MaxSector) && +- !ahead_of_reshape(mddev, logical_sector, conf->reshape_progress) && +- ahead_of_reshape(mddev, logical_sector, conf->reshape_safe)) { ++ get_reshape_loc(mddev, conf, logical_sector) == LOC_INSIDE_RESHAPE) { + bio_wouldblock_error(bi); + if (rw == WRITE) + md_write_end(mddev); +-- +2.43.0 + diff --git a/queue-6.10/media-c8sectpfe-add-missing-parameter-names.patch b/queue-6.10/media-c8sectpfe-add-missing-parameter-names.patch new file mode 100644 index 00000000000..7d788c46576 --- /dev/null +++ b/queue-6.10/media-c8sectpfe-add-missing-parameter-names.patch @@ -0,0 +1,42 @@ +From 98f1c1602dbe28ae261538f9999d7677e14072cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:01:07 +0000 +Subject: media: c8sectpfe: Add missing parameter names + +From: Ricardo Ribalda + +[ Upstream commit abb7a73b687dc82202f0203a112ef435fb598aa6 ] + +clang 19 complains about the missing parameter name. Let's add it. + +drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h:19:62: warning: omitting the parameter name in a function definition is a C23 extension [-Wc23-extensions] + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202406050908.1kL1C69p-lkp@intel.com/ +Fixes: e22b4973ee20 ("media: c8sectpfe: Do not depend on DEBUG_FS") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Nathan Chancellor +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h +index 8e1bfd8605247..3fe177b59b16d 100644 +--- a/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h ++++ b/drivers/media/platform/st/sti/c8sectpfe/c8sectpfe-debugfs.h +@@ -16,8 +16,8 @@ + void c8sectpfe_debugfs_init(struct c8sectpfei *); + void c8sectpfe_debugfs_exit(struct c8sectpfei *); + #else +-static inline void c8sectpfe_debugfs_init(struct c8sectpfei *) {}; +-static inline void c8sectpfe_debugfs_exit(struct c8sectpfei *) {}; ++static inline void c8sectpfe_debugfs_init(struct c8sectpfei *fei) {}; ++static inline void c8sectpfe_debugfs_exit(struct c8sectpfei *fei) {}; + #endif + + #endif /* __C8SECTPFE_DEBUG_H */ +-- +2.43.0 + diff --git a/queue-6.10/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch b/queue-6.10/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch new file mode 100644 index 00000000000..e95a5f6782c --- /dev/null +++ b/queue-6.10/media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch @@ -0,0 +1,144 @@ +From 6d8d220cd49b1709adb09f528d18100359d4cfe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 20:44:14 +0800 +Subject: media: dvb-usb: Fix unexpected infinite loop in + dvb_usb_read_remote_control() + +From: Zheng Yejian + +[ Upstream commit 2052138b7da52ad5ccaf74f736d00f39a1c9198c ] + +Infinite log printing occurs during fuzz test: + + rc rc1: DViCO FusionHDTV DVB-T USB (LGZ201) as ... + ... + dvb-usb: schedule remote query interval to 100 msecs. + dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized ... + dvb-usb: bulk message failed: -22 (1/0) + dvb-usb: bulk message failed: -22 (1/0) + dvb-usb: bulk message failed: -22 (1/0) + ... + dvb-usb: bulk message failed: -22 (1/0) + +Looking into the codes, there is a loop in dvb_usb_read_remote_control(), +that is in rc_core_dvb_usb_remote_init() create a work that will call +dvb_usb_read_remote_control(), and this work will reschedule itself at +'rc_interval' intervals to recursively call dvb_usb_read_remote_control(), +see following code snippet: + + rc_core_dvb_usb_remote_init() { + ... + INIT_DELAYED_WORK(&d->rc_query_work, dvb_usb_read_remote_control); + schedule_delayed_work(&d->rc_query_work, + msecs_to_jiffies(rc_interval)); + ... + } + + dvb_usb_read_remote_control() { + ... + err = d->props.rc.core.rc_query(d); + if (err) + err(...) // Did not return even if query failed + schedule_delayed_work(&d->rc_query_work, + msecs_to_jiffies(rc_interval)); + } + +When the infinite log printing occurs, the query callback +'d->props.rc.core.rc_query' is cxusb_rc_query(). And the log is due to +the failure of finding a valid 'generic_bulk_ctrl_endpoint' +in usb_bulk_msg(), see following code snippet: + + cxusb_rc_query() { + cxusb_ctrl_msg() { + dvb_usb_generic_rw() { + ret = usb_bulk_msg(d->udev, usb_sndbulkpipe(d->udev, + d->props.generic_bulk_ctrl_endpoint),...); + if (ret) + err("bulk message failed: %d (%d/%d)",ret,wlen,actlen); + ... + } + ... + } + +By analyzing the corresponding USB descriptor, it shows that the +bNumEndpoints is 0 in its interface descriptor, but +the 'generic_bulk_ctrl_endpoint' is 1, that means user don't configure +a valid endpoint for 'generic_bulk_ctrl_endpoint', therefore this +'invalid' USB device should be rejected before it calls into +dvb_usb_read_remote_control(). + +To fix it, we need to add endpoint check for 'generic_bulk_ctrl_endpoint'. +And as Sean suggested, the same check and clear halts should be done for +'generic_bulk_ctrl_endpoint_response'. So introduce +dvb_usb_check_bulk_endpoint() to do it for both of them. + +Fixes: 4d43e13f723e ("V4L/DVB (4643): Multi-input patch for DVB-USB device") +Signed-off-by: Zheng Yejian +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 35 +++++++++++++++++++++--- + 1 file changed, 31 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index fbf58012becdf..22d83ac18eb73 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -23,11 +23,40 @@ static int dvb_usb_force_pid_filter_usage; + module_param_named(force_pid_filter_usage, dvb_usb_force_pid_filter_usage, int, 0444); + MODULE_PARM_DESC(force_pid_filter_usage, "force all dvb-usb-devices to use a PID filter, if any (default: 0)."); + ++static int dvb_usb_check_bulk_endpoint(struct dvb_usb_device *d, u8 endpoint) ++{ ++ if (endpoint) { ++ int ret; ++ ++ ret = usb_pipe_type_check(d->udev, usb_sndbulkpipe(d->udev, endpoint)); ++ if (ret) ++ return ret; ++ ret = usb_pipe_type_check(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); ++ if (ret) ++ return ret; ++ } ++ return 0; ++} ++ ++static void dvb_usb_clear_halt(struct dvb_usb_device *d, u8 endpoint) ++{ ++ if (endpoint) { ++ usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, endpoint)); ++ usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, endpoint)); ++ } ++} ++ + static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + { + struct dvb_usb_adapter *adap; + int ret, n, o; + ++ ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint); ++ if (ret) ++ return ret; ++ ret = dvb_usb_check_bulk_endpoint(d, d->props.generic_bulk_ctrl_endpoint_response); ++ if (ret) ++ return ret; + for (n = 0; n < d->props.num_adapters; n++) { + adap = &d->adapter[n]; + adap->dev = d; +@@ -103,10 +132,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + * when reloading the driver w/o replugging the device + * sometimes a timeout occurs, this helps + */ +- if (d->props.generic_bulk_ctrl_endpoint != 0) { +- usb_clear_halt(d->udev, usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); +- usb_clear_halt(d->udev, usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint)); +- } ++ dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint); ++ dvb_usb_clear_halt(d, d->props.generic_bulk_ctrl_endpoint_response); + + return 0; + +-- +2.43.0 + diff --git a/queue-6.10/media-i2c-fix-imx412-exposure-control.patch b/queue-6.10/media-i2c-fix-imx412-exposure-control.patch new file mode 100644 index 00000000000..f5b31bdf71a --- /dev/null +++ b/queue-6.10/media-i2c-fix-imx412-exposure-control.patch @@ -0,0 +1,97 @@ +From 39afc90fb1ec5cf62fec366970f9ed1b7b47e2aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 13:53:07 +0100 +Subject: media: i2c: Fix imx412 exposure control + +From: Bryan O'Donoghue + +[ Upstream commit a1956bf53a2774014ee1768b484af2c38c633a25 ] + +Currently we have the following algorithm to calculate what value should be +written to the exposure control of imx412. + +lpfr = imx412->vblank + imx412->cur_mode->height; +shutter = lpfr - exposure; + +The 'shutter' value is given to IMX412_REG_EXPOSURE_CIT however, the above +algorithm will result in the value given to IMX412_REG_EXPOSURE_CIT +decreasing as the requested exposure value from user-space goes up. + +e.g. +[ 2255.713989] imx412 20-001a: Received exp 1608, analog gain 0 +[ 2255.714002] imx412 20-001a: Set exp 1608, analog gain 0, shutter 1938, lpfr 3546 +[ 2256.302770] imx412 20-001a: Received exp 2586, analog gain 100 +[ 2256.302800] imx412 20-001a: Set exp 2586, analog gain 100, shutter 960, lpfr 3546 +[ 2256.753755] imx412 20-001a: Received exp 3524, analog gain 110 +[ 2256.753772] imx412 20-001a: Set exp 3524, analog gain 110, shutter 22, lpfr 3546 + +This behaviour results in the image having less exposure as the requested +exposure value from user-space increases. + +Other sensor drivers such as ov5675, imx218, hid556 and others take the +requested exposure value and use the value directly. + +Take the example of the above cited sensor drivers and directly apply the +requested exposure value from user-space. The 'lpfr' variable still +functions as before but the 'shutter' variable can be dispensed with as a +result. + +Once done a similar run of the test application requesting higher exposure +looks like this, with 'exp' written directly to the sensor. + +[ 133.207884] imx412 20-001a: Received exp 1608, analog gain 0 +[ 133.207899] imx412 20-001a: Set exp 1608, analog gain 0, lpfr 3546 +[ 133.905309] imx412 20-001a: Received exp 2844, analog gain 100 +[ 133.905344] imx412 20-001a: Set exp 2844, analog gain 100, lpfr 3546 +[ 134.241705] imx412 20-001a: Received exp 3524, analog gain 110 +[ 134.241775] imx412 20-001a: Set exp 3524, analog gain 110, lpfr 3546 + +The result is then setting the sensor exposure to lower values results in +darker, less exposure images and vice versa with higher exposure values. + +Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver") +Tested-by: Bryan O'Donoghue # qrb5165-rb5/imx577 +Reviewed-by: Jacopo Mondi +Reviewed-by: Gjorgji Rosikopulos +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx412.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c +index 0efce329525e4..7d1f7af0a9dff 100644 +--- a/drivers/media/i2c/imx412.c ++++ b/drivers/media/i2c/imx412.c +@@ -542,14 +542,13 @@ static int imx412_update_controls(struct imx412 *imx412, + */ + static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + { +- u32 lpfr, shutter; ++ u32 lpfr; + int ret; + + lpfr = imx412->vblank + imx412->cur_mode->height; +- shutter = lpfr - exposure; + +- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, shutter %u, lpfr %u", +- exposure, gain, shutter, lpfr); ++ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u", ++ exposure, gain, lpfr); + + ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1); + if (ret) +@@ -559,7 +558,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain) + if (ret) + goto error_release_group_hold; + +- ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, shutter); ++ ret = imx412_write_reg(imx412, IMX412_REG_EXPOSURE_CIT, 2, exposure); + if (ret) + goto error_release_group_hold; + +-- +2.43.0 + diff --git a/queue-6.10/media-i2c-hi846-fix-v4l2_subdev_format_try-get_selec.patch b/queue-6.10/media-i2c-hi846-fix-v4l2_subdev_format_try-get_selec.patch new file mode 100644 index 00000000000..c4d8237a9e6 --- /dev/null +++ b/queue-6.10/media-i2c-hi846-fix-v4l2_subdev_format_try-get_selec.patch @@ -0,0 +1,45 @@ +From 054ee5633020015f0797a13a70575d9ae2c81f72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 17:05:55 +0000 +Subject: media: i2c: hi846: Fix V4L2_SUBDEV_FORMAT_TRY get_selection() + +From: Ricardo Ribalda + +[ Upstream commit 984abe0b5794a2aca359bb61555351d2ec520d2a ] + +The current code does not return anything to the user. + +Although the code looks a bit dangerous (using a pointer without +checking if it is valid), it should be fine. The core validates that +sel->pad has a valid value. + +Fix the following smatch error: +drivers/media/i2c/hi846.c:1854 hi846_get_selection() warn: statement has no effect 31 + +Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +[Sakari Ailus: code -> core.] +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/hi846.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c +index 9c565ec033d4e..52d9ca68a86c8 100644 +--- a/drivers/media/i2c/hi846.c ++++ b/drivers/media/i2c/hi846.c +@@ -1851,7 +1851,7 @@ static int hi846_get_selection(struct v4l2_subdev *sd, + mutex_lock(&hi846->mutex); + switch (sel->which) { + case V4L2_SUBDEV_FORMAT_TRY: +- v4l2_subdev_state_get_crop(sd_state, sel->pad); ++ sel->r = *v4l2_subdev_state_get_crop(sd_state, sel->pad); + break; + case V4L2_SUBDEV_FORMAT_ACTIVE: + sel->r = hi846->cur_mode->crop; +-- +2.43.0 + diff --git a/queue-6.10/media-i2c-imx219-fix-msr-access-command-sequence.patch b/queue-6.10/media-i2c-imx219-fix-msr-access-command-sequence.patch new file mode 100644 index 00000000000..f155ac9fd86 --- /dev/null +++ b/queue-6.10/media-i2c-imx219-fix-msr-access-command-sequence.patch @@ -0,0 +1,59 @@ +From e27bdfe342a546527dd03a0debb4631befbc17ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 16:50:23 +0100 +Subject: media: i2c: imx219: fix msr access command sequence + +From: Conor Dooley + +[ Upstream commit 3cdc776e0a5f1784c3ae5d3371b64215c228bf1f ] + +It was reported to me that the imx219 didn't work on one of our +development kits partly because the access sequence is incorrect. +The datasheet I could find [1] for this camera has the access sequence: +Seq. No. Address (Hex) data +1 30EB 05 +2 30EB 0C +3 300A FF +4 300B FF +5 30EB 05 +6 30EB 09 + +but the driver swaps the first two elements. Laurent pointed out on IRC +that the original code used the correct sequence for 1920x1080 but the +current sequence for 3280x2464 and 1640x1232. During refactoring of the +init sequence the current order was used for all formats. + +Switch to using the documented sequence. + +Link: https://www.opensourceinstruments.com/Electronics/Data/IMX219PQ.pdf [1] +Fixes: 8508455961d5 ("media: i2c: imx219: Split common registers from mode tables") +Fixes: 1283b3b8f82b ("media: i2c: Add driver for Sony IMX219 sensor") +Signed-off-by: Conor Dooley +Reviewed-by: Dave Stevenson +Tested-by: Dave Stevenson +Reviewed-by: Laurent Pinchart +Tested-by: Adam Ford #imx8mp-beacon-kit +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx219.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index 51ebf5453fceb..e78a80b2bb2e4 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -162,8 +162,8 @@ static const struct cci_reg_sequence imx219_common_regs[] = { + { IMX219_REG_MODE_SELECT, 0x00 }, /* Mode Select */ + + /* To Access Addresses 3000-5fff, send the following commands */ +- { CCI_REG8(0x30eb), 0x0c }, + { CCI_REG8(0x30eb), 0x05 }, ++ { CCI_REG8(0x30eb), 0x0c }, + { CCI_REG8(0x300a), 0xff }, + { CCI_REG8(0x300b), 0xff }, + { CCI_REG8(0x30eb), 0x05 }, +-- +2.43.0 + diff --git a/queue-6.10/media-imon-fix-race-getting-ictx-lock.patch b/queue-6.10/media-imon-fix-race-getting-ictx-lock.patch new file mode 100644 index 00000000000..05c45b40927 --- /dev/null +++ b/queue-6.10/media-imon-fix-race-getting-ictx-lock.patch @@ -0,0 +1,51 @@ +From a7e884d2b4a8416648e6ee70911844a11a7cbb61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:10:27 +0000 +Subject: media: imon: Fix race getting ictx->lock + +From: Ricardo Ribalda + +[ Upstream commit 24147897507cd3a7d63745d1518a638bf4132238 ] + +Lets fix a race between mutex_is_lock() and mutex_lock(). + +<-mutex is not locked +if (!mutex_is_locked(&ictx->lock)) { + unlock = true; <- mutex is locked externaly + mutex_lock(&ictx->lock); +} + +Let's use mutex_trylock() that does mutex_is_lock() and mutex_lock() +atomically. + +Fix the following cocci warning: +drivers/media/rc/imon.c:1167:1-7: preceding lock on line 1153 + +Fixes: 23ef710e1a6c ("[media] imon: add conditional locking in change_protocol") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/imon.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index 0b55314a80827..8f1361bcce3a6 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -1148,10 +1148,7 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 *rc_proto) + + memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet)); + +- if (!mutex_is_locked(&ictx->lock)) { +- unlock = true; +- mutex_lock(&ictx->lock); +- } ++ unlock = mutex_trylock(&ictx->lock); + + retval = send_packet(ictx); + if (retval) +-- +2.43.0 + diff --git a/queue-6.10/media-imx-jpeg-drop-initial-source-change-event-if-c.patch b/queue-6.10/media-imx-jpeg-drop-initial-source-change-event-if-c.patch new file mode 100644 index 00000000000..a0dc4ef50a5 --- /dev/null +++ b/queue-6.10/media-imx-jpeg-drop-initial-source-change-event-if-c.patch @@ -0,0 +1,43 @@ +From ddceba495b33f46fc3b3e7d8cf1d7a8624ec8473 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 16:36:36 +0800 +Subject: media: imx-jpeg: Drop initial source change event if capture has been + setup + +From: Ming Qian + +[ Upstream commit a8fb5fce7a441d37d106c82235e1f1b57f70f5b9 ] + +In section 4.5.1.5. Initialization, the step 4 may be skipped and +continue with the Capture Setup sequence, so if the capture has been +setup, there is no need to trigger the initial source change event, just +start decoding, and follow the dynamic resolution change flow if the +configured values do not match those parsed by the decoder. + +And it won't fail the gstreamer pipeline. + +Fixes: b833b178498d ("media: imx-jpeg: notify source chagne event when the first picture parsed") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +index cc97790ed30f6..b1300f15e5020 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +@@ -1634,6 +1634,9 @@ static int mxc_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + dev_dbg(ctx->mxc_jpeg->dev, "Start streaming ctx=%p", ctx); + q_data->sequence = 0; + ++ if (V4L2_TYPE_IS_CAPTURE(q->type)) ++ ctx->need_initial_source_change_evt = false; ++ + ret = pm_runtime_resume_and_get(ctx->mxc_jpeg->dev); + if (ret < 0) { + dev_err(ctx->mxc_jpeg->dev, "Failed to power up jpeg\n"); +-- +2.43.0 + diff --git a/queue-6.10/media-mediatek-vcodec-fix-unreasonable-data-conversi.patch b/queue-6.10/media-mediatek-vcodec-fix-unreasonable-data-conversi.patch new file mode 100644 index 00000000000..2eb59090a75 --- /dev/null +++ b/queue-6.10/media-mediatek-vcodec-fix-unreasonable-data-conversi.patch @@ -0,0 +1,38 @@ +From 4dd72c2fac657453c7111ced640c52ef2296eb7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 11:57:31 +0800 +Subject: media: mediatek: vcodec: Fix unreasonable data conversion + +From: Yunfei Dong + +[ Upstream commit 48d85de244047eabe07c5040af12dfa736d61d6c ] + +Both 'bs_dma' and 'dma_addr' are integers. No need to convert the +type from dma_addr_t to uint64_t again. + +Fixes: d353c3c34af0 ("media: mediatek: vcodec: support 36 bits physical address") + +Signed-off-by: Yunfei Dong +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_if.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_if.c +index 4bc89c8644fec..5f848691cea44 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp8_if.c +@@ -449,7 +449,7 @@ static int vdec_vp8_decode(void *h_vdec, struct mtk_vcodec_mem *bs, + inst->frm_cnt, y_fb_dma, c_fb_dma, fb); + + inst->cur_fb = fb; +- dec->bs_dma = (uint64_t)bs->dma_addr; ++ dec->bs_dma = bs->dma_addr; + dec->bs_sz = bs->size; + dec->cur_y_fb_dma = y_fb_dma; + dec->cur_c_fb_dma = c_fb_dma; +-- +2.43.0 + diff --git a/queue-6.10/media-mediatek-vcodec-handle-invalid-decoder-vsi.patch b/queue-6.10/media-mediatek-vcodec-handle-invalid-decoder-vsi.patch new file mode 100644 index 00000000000..e8db22f4686 --- /dev/null +++ b/queue-6.10/media-mediatek-vcodec-handle-invalid-decoder-vsi.patch @@ -0,0 +1,43 @@ +From 4dee8512754c29b589f1285b1fd7d9f379307666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 09:47:54 +0800 +Subject: media: mediatek: vcodec: Handle invalid decoder vsi + +From: Irui Wang + +[ Upstream commit 59d438f8e02ca641c58d77e1feffa000ff809e9f ] + +Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi +is valid for future use. + +Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") + +Signed-off-by: Irui Wang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Sebastian Fricke +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + .../media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +index da6be556727bb..145958206e38a 100644 +--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c ++++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c +@@ -233,6 +233,12 @@ int vpu_dec_init(struct vdec_vpu_inst *vpu) + mtk_vdec_debug(vpu->ctx, "vdec_inst=%p", vpu); + + err = vcodec_vpu_send_msg(vpu, (void *)&msg, sizeof(msg)); ++ ++ if (IS_ERR_OR_NULL(vpu->vsi)) { ++ mtk_vdec_err(vpu->ctx, "invalid vdec vsi, status=%d", err); ++ return -EINVAL; ++ } ++ + mtk_vdec_debug(vpu->ctx, "- ret=%d", err); + return err; + } +-- +2.43.0 + diff --git a/queue-6.10/media-pci-ivtv-add-check-for-dma-map-result.patch b/queue-6.10/media-pci-ivtv-add-check-for-dma-map-result.patch new file mode 100644 index 00000000000..358a523ccb6 --- /dev/null +++ b/queue-6.10/media-pci-ivtv-add-check-for-dma-map-result.patch @@ -0,0 +1,91 @@ +From 99934af0a1438da580ddab2bdef6a8c16b7d8b26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 02:32:23 +0300 +Subject: media: pci: ivtv: Add check for DMA map result + +From: Mikhail Kobuk + +[ Upstream commit 629913d6d79508b166c66e07e4857e20233d85a9 ] + +In case DMA fails, 'dma->SG_length' is 0. This value is later used to +access 'dma->SGarray[dma->SG_length - 1]', which will cause out of +bounds access. + +Add check to return early on invalid value. Adjust warnings accordingly. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1932dc2f4cf6 ("media: pci/ivtv: switch from 'pci_' to 'dma_' API") +Signed-off-by: Mikhail Kobuk +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-udma.c | 8 ++++++++ + drivers/media/pci/ivtv/ivtv-yuv.c | 6 ++++++ + drivers/media/pci/ivtv/ivtvfb.c | 6 +++--- + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-udma.c b/drivers/media/pci/ivtv/ivtv-udma.c +index 99b9f55ca8292..f467a00492f4b 100644 +--- a/drivers/media/pci/ivtv/ivtv-udma.c ++++ b/drivers/media/pci/ivtv/ivtv-udma.c +@@ -131,6 +131,8 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr, + + /* Fill SG List with new values */ + if (ivtv_udma_fill_sg_list(dma, &user_dma, 0) < 0) { ++ IVTV_DEBUG_WARN("%s: could not allocate bounce buffers for highmem userspace buffers\n", ++ __func__); + unpin_user_pages(dma->map, dma->page_count); + dma->page_count = 0; + return -ENOMEM; +@@ -139,6 +141,12 @@ int ivtv_udma_setup(struct ivtv *itv, unsigned long ivtv_dest_addr, + /* Map SG List */ + dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist, + dma->page_count, DMA_TO_DEVICE); ++ if (!dma->SG_length) { ++ IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); ++ unpin_user_pages(dma->map, dma->page_count); ++ dma->page_count = 0; ++ return -EINVAL; ++ } + + /* Fill SG Array with new values */ + ivtv_udma_fill_sg_array (dma, ivtv_dest_addr, 0, -1); +diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c +index 582146f8d70d5..2d9274537725a 100644 +--- a/drivers/media/pci/ivtv/ivtv-yuv.c ++++ b/drivers/media/pci/ivtv/ivtv-yuv.c +@@ -114,6 +114,12 @@ static int ivtv_yuv_prep_user_dma(struct ivtv *itv, struct ivtv_user_dma *dma, + } + dma->SG_length = dma_map_sg(&itv->pdev->dev, dma->SGlist, + dma->page_count, DMA_TO_DEVICE); ++ if (!dma->SG_length) { ++ IVTV_DEBUG_WARN("%s: DMA map error, SG_length is 0\n", __func__); ++ unpin_user_pages(dma->map, dma->page_count); ++ dma->page_count = 0; ++ return -EINVAL; ++ } + + /* Fill SG Array with new values */ + ivtv_udma_fill_sg_array(dma, y_buffer_offset, uv_buffer_offset, y_size); +diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c +index 410477e3e6216..d1ab7fee0d057 100644 +--- a/drivers/media/pci/ivtv/ivtvfb.c ++++ b/drivers/media/pci/ivtv/ivtvfb.c +@@ -281,10 +281,10 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv *itv, + /* Map User DMA */ + if (ivtv_udma_setup(itv, ivtv_dest_addr, userbuf, size_in_bytes) <= 0) { + mutex_unlock(&itv->udma.lock); +- IVTVFB_WARN("ivtvfb_prep_dec_dma_to_device, Error with pin_user_pages: %d bytes, %d pages returned\n", +- size_in_bytes, itv->udma.page_count); ++ IVTVFB_WARN("%s, Error in ivtv_udma_setup: %d bytes, %d pages returned\n", ++ __func__, size_in_bytes, itv->udma.page_count); + +- /* pin_user_pages must have failed completely */ ++ /* pin_user_pages or DMA must have failed completely */ + return -EIO; + } + +-- +2.43.0 + diff --git a/queue-6.10/media-rcar-csi2-cleanup-subdevice-in-remove.patch b/queue-6.10/media-rcar-csi2-cleanup-subdevice-in-remove.patch new file mode 100644 index 00000000000..7391f02ba9b --- /dev/null +++ b/queue-6.10/media-rcar-csi2-cleanup-subdevice-in-remove.patch @@ -0,0 +1,43 @@ +From f56a25f6328c1e7d96cb5681b37f62f594b2f16e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:26 +0200 +Subject: media: rcar-csi2: Cleanup subdevice in remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit f6d64d0d2897ed4e85ac00afe43e45c8b8fc0c44 ] + +Cleanup the V4L2 subdevice in the driver's remove function to +ensure its async connection are freed, and guarantee in future that +the subdev active state is cleaned up. + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-4-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar-csi2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/renesas/rcar-csi2.c b/drivers/media/platform/renesas/rcar-csi2.c +index 249e58c771761..2d464e43a5be8 100644 +--- a/drivers/media/platform/renesas/rcar-csi2.c ++++ b/drivers/media/platform/renesas/rcar-csi2.c +@@ -1938,6 +1938,7 @@ static void rcsi2_remove(struct platform_device *pdev) + v4l2_async_nf_unregister(&priv->notifier); + v4l2_async_nf_cleanup(&priv->notifier); + v4l2_async_unregister_subdev(&priv->subdev); ++ v4l2_subdev_cleanup(&priv->subdev); + + pm_runtime_disable(&pdev->dev); + +-- +2.43.0 + diff --git a/queue-6.10/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch b/queue-6.10/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch new file mode 100644 index 00000000000..4d201eb7820 --- /dev/null +++ b/queue-6.10/media-rcar-csi2-disable-runtime_pm-in-probe-error.patch @@ -0,0 +1,49 @@ +From 4a3dc9c23c2c62910714aa983e8cb047b8df1b97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:25 +0200 +Subject: media: rcar-csi2: Disable runtime_pm in probe error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit e306183628f7c2e95f9bf853d8fcb86288f606de ] + +Disable pm_runtime in the probe() function error path. + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-3-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar-csi2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/renesas/rcar-csi2.c b/drivers/media/platform/renesas/rcar-csi2.c +index 582d5e35db0e5..249e58c771761 100644 +--- a/drivers/media/platform/renesas/rcar-csi2.c ++++ b/drivers/media/platform/renesas/rcar-csi2.c +@@ -1914,12 +1914,14 @@ static int rcsi2_probe(struct platform_device *pdev) + + ret = v4l2_async_register_subdev(&priv->subdev); + if (ret < 0) +- goto error_async; ++ goto error_pm_runtime; + + dev_info(priv->dev, "%d lanes found\n", priv->lanes); + + return 0; + ++error_pm_runtime: ++ pm_runtime_disable(&pdev->dev); + error_async: + v4l2_async_nf_unregister(&priv->notifier); + v4l2_async_nf_cleanup(&priv->notifier); +-- +2.43.0 + diff --git a/queue-6.10/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch b/queue-6.10/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch new file mode 100644 index 00000000000..8614c7155b4 --- /dev/null +++ b/queue-6.10/media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch @@ -0,0 +1,71 @@ +From fc9f5f47d7d86a19d44170d24edbb2250d4355cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 18:11:24 +0200 +Subject: media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jacopo Mondi + +[ Upstream commit 9caf253e8ad6f4c66f5591bac900f9f68b6b6620 ] + +The YUYV8_1X16 and UYVY8_1X16 formats are treated as 'ITU-R +BT.601/BT.1358 16-bit YCbCr-422 input' (YUV16 - 0x5) in the R-Car VIN +driver and are thus disallowed when capturing frames from the R-Car +CSI-2 interface according to the hardware manual. + +As the 1X16 format variants are meant to be used with serial busses they +have to be treated as 'YCbCr-422 8-bit data input' (0x1) when capturing +from CSI-2, which is a valid setting for CSI-2. + +Commit 78b3f9d75a62 ("media: rcar-vin: Add check that input interface +and format are valid") disallowed capturing YUV16 when using the CSI-2 +interface. Fix this by using YUV8_BT601 for YCbCr422 when CSI-2 is in +use. + +Fixes: 78b3f9d75a62 ("media: rcar-vin: Add check that input interface and format are valid") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Niklas Söderlund +Tested-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20240617161135.130719-2-jacopo.mondi@ideasonboard.com +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + .../media/platform/renesas/rcar-vin/rcar-dma.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +index e2c40abc6d3d1..21d5b2815e86a 100644 +--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c +@@ -742,12 +742,22 @@ static int rvin_setup(struct rvin_dev *vin) + */ + switch (vin->mbus_code) { + case MEDIA_BUS_FMT_YUYV8_1X16: +- /* BT.601/BT.1358 16bit YCbCr422 */ +- vnmc |= VNMC_INF_YUV16; ++ if (vin->is_csi) ++ /* YCbCr422 8-bit */ ++ vnmc |= VNMC_INF_YUV8_BT601; ++ else ++ /* BT.601/BT.1358 16bit YCbCr422 */ ++ vnmc |= VNMC_INF_YUV16; + input_is_yuv = true; + break; + case MEDIA_BUS_FMT_UYVY8_1X16: +- vnmc |= VNMC_INF_YUV16 | VNMC_YCAL; ++ if (vin->is_csi) ++ /* YCbCr422 8-bit */ ++ vnmc |= VNMC_INF_YUV8_BT601; ++ else ++ /* BT.601/BT.1358 16bit YCbCr422 */ ++ vnmc |= VNMC_INF_YUV16; ++ vnmc |= VNMC_YCAL; + input_is_yuv = true; + break; + case MEDIA_BUS_FMT_UYVY8_2X8: +-- +2.43.0 + diff --git a/queue-6.10/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch b/queue-6.10/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch new file mode 100644 index 00000000000..e1468616343 --- /dev/null +++ b/queue-6.10/media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch @@ -0,0 +1,117 @@ +From 93a24060d0928a762d1d299a149aebf8522b3ae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 20:22:27 +0300 +Subject: media: renesas: vsp1: Fix _irqsave and _irq mix + +From: Laurent Pinchart + +[ Upstream commit 57edbbcf5258c378a9b9d0c80d33b03a010b22c8 ] + +The histogram support mixes _irqsave and _irq, causing the following +smatch warning: + + drivers/media/platform/renesas/vsp1/vsp1_histo.c:153 histo_stop_streaming() + warn: mixing irqsave and irq + +The histo_stop_streaming() calls spin_lock_irqsave() followed by +wait_event_lock_irq(). The former hints that interrupts may be disabled +by the caller, while the latter reenables interrupts unconditionally. +This doesn't cause any real bug, as the function is always called with +interrupts enabled, but the pattern is still incorrect. + +Fix the problem by using spin_lock_irq() instead of spin_lock_irqsave() +in histo_stop_streaming(). While at it, switch to spin_lock_irq() and +spin_lock() as appropriate elsewhere. + +Fixes: 99362e32332b ("[media] v4l: vsp1: Add histogram support") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-renesas-soc/164d74ff-312c-468f-be64-afa7182cd2f4@moroto.mountain/ +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + .../media/platform/renesas/vsp1/vsp1_histo.c | 20 ++++++++----------- + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_histo.c b/drivers/media/platform/renesas/vsp1/vsp1_histo.c +index 71155282ca116..cd1c8778662e6 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_histo.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_histo.c +@@ -36,9 +36,8 @@ struct vsp1_histogram_buffer * + vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + { + struct vsp1_histogram_buffer *buf = NULL; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + + if (list_empty(&histo->irqqueue)) + goto done; +@@ -49,7 +48,7 @@ vsp1_histogram_buffer_get(struct vsp1_histogram *histo) + histo->readout = true; + + done: +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + return buf; + } + +@@ -58,7 +57,6 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + size_t size) + { + struct vsp1_pipeline *pipe = histo->entity.pipe; +- unsigned long flags; + + /* + * The pipeline pointer is guaranteed to be valid as this function is +@@ -70,10 +68,10 @@ void vsp1_histogram_buffer_complete(struct vsp1_histogram *histo, + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, size); + vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock(&histo->irqlock); + histo->readout = false; + wake_up(&histo->wait_queue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock(&histo->irqlock); + } + + /* ----------------------------------------------------------------------------- +@@ -124,11 +122,10 @@ static void histo_buffer_queue(struct vb2_buffer *vb) + struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); + struct vsp1_histogram *histo = vb2_get_drv_priv(vb->vb2_queue); + struct vsp1_histogram_buffer *buf = to_vsp1_histogram_buffer(vbuf); +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + list_add_tail(&buf->queue, &histo->irqqueue); +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static int histo_start_streaming(struct vb2_queue *vq, unsigned int count) +@@ -140,9 +137,8 @@ static void histo_stop_streaming(struct vb2_queue *vq) + { + struct vsp1_histogram *histo = vb2_get_drv_priv(vq); + struct vsp1_histogram_buffer *buffer; +- unsigned long flags; + +- spin_lock_irqsave(&histo->irqlock, flags); ++ spin_lock_irq(&histo->irqlock); + + /* Remove all buffers from the IRQ queue. */ + list_for_each_entry(buffer, &histo->irqqueue, queue) +@@ -152,7 +148,7 @@ static void histo_stop_streaming(struct vb2_queue *vq) + /* Wait for the buffer being read out (if any) to complete. */ + wait_event_lock_irq(histo->wait_queue, !histo->readout, histo->irqlock); + +- spin_unlock_irqrestore(&histo->irqlock, flags); ++ spin_unlock_irq(&histo->irqlock); + } + + static const struct vb2_ops histo_video_queue_qops = { +-- +2.43.0 + diff --git a/queue-6.10/media-renesas-vsp1-store-rpf-partition-configuration.patch b/queue-6.10/media-renesas-vsp1-store-rpf-partition-configuration.patch new file mode 100644 index 00000000000..6ab5c74d52e --- /dev/null +++ b/queue-6.10/media-renesas-vsp1-store-rpf-partition-configuration.patch @@ -0,0 +1,66 @@ +From 4f30f2d3e04fe8039907017fd51de93f5c3f02e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Nov 2023 03:11:51 +0200 +Subject: media: renesas: vsp1: Store RPF partition configuration per RPF + instance + +From: Laurent Pinchart + +[ Upstream commit a213bc09b1025c771ee722ee341af1d84375db8a ] + +The vsp1_partition structure stores the RPF partition configuration in a +single field for all RPF instances, while each RPF can have its own +configuration. Fix it by storing the configuration separately for each +RPF instance. + +Signed-off-by: Laurent Pinchart +Fixes: ab45e8585182 ("media: v4l: vsp1: Allow entities to participate in the partition algorithm") +Reviewed-by: Jacopo Mondi +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/vsp1/vsp1_pipe.h | 2 +- + drivers/media/platform/renesas/vsp1/vsp1_rpf.c | 8 +++++--- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_pipe.h b/drivers/media/platform/renesas/vsp1/vsp1_pipe.h +index 674b5748d929e..85ecd53cda495 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_pipe.h ++++ b/drivers/media/platform/renesas/vsp1/vsp1_pipe.h +@@ -73,7 +73,7 @@ struct vsp1_partition_window { + * @wpf: The WPF partition window configuration + */ + struct vsp1_partition { +- struct vsp1_partition_window rpf; ++ struct vsp1_partition_window rpf[VSP1_MAX_RPF]; + struct vsp1_partition_window uds_sink; + struct vsp1_partition_window uds_source; + struct vsp1_partition_window sru; +diff --git a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c +index c47579efc65f6..6055554fb0714 100644 +--- a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c ++++ b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c +@@ -315,8 +315,8 @@ static void rpf_configure_partition(struct vsp1_entity *entity, + * 'width' need to be adjusted. + */ + if (pipe->partitions > 1) { +- crop.width = pipe->partition->rpf.width; +- crop.left += pipe->partition->rpf.left; ++ crop.width = pipe->partition->rpf[rpf->entity.index].width; ++ crop.left += pipe->partition->rpf[rpf->entity.index].left; + } + + if (pipe->interlaced) { +@@ -371,7 +371,9 @@ static void rpf_partition(struct vsp1_entity *entity, + unsigned int partition_idx, + struct vsp1_partition_window *window) + { +- partition->rpf = *window; ++ struct vsp1_rwpf *rpf = to_rwpf(&entity->subdev); ++ ++ partition->rpf[rpf->entity.index] = *window; + } + + static const struct vsp1_entity_operations rpf_entity_ops = { +-- +2.43.0 + diff --git a/queue-6.10/media-uvcvideo-add-quirk-for-invalid-dev_sof-in-logi.patch b/queue-6.10/media-uvcvideo-add-quirk-for-invalid-dev_sof-in-logi.patch new file mode 100644 index 00000000000..4a354b8a2d7 --- /dev/null +++ b/queue-6.10/media-uvcvideo-add-quirk-for-invalid-dev_sof-in-logi.patch @@ -0,0 +1,70 @@ +From 723b9615b963cc8df1cb7c2959a7c3daa18fb840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 15:26:11 +0100 +Subject: media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oleksandr Natalenko + +[ Upstream commit 85fbe91a7c9210bb30638846b551fa5d3cb7bc4c ] + +Similarly to Logitech C922, C920 seems to also suffer from a firmware +bug that breaks hardware timestamping. + +Add a quirk for this camera model too. + +Before applying the quirk: + +``` +100 (4) [-] none 100 200717 B 212.919114 213.079004 33.727 fps ts mono/SoE +101 (5) [-] none 101 200889 B 213.003703 213.114996 11.822 fps ts mono/SoE +102 (6) [-] none 102 200926 B 213.035571 213.146999 31.379 fps ts mono/SoE +103 (7) [-] none 103 200839 B 213.067424 213.179003 31.394 fps ts mono/SoE +104 (0) [-] none 104 200692 B 213.293180 213.214991 4.430 fps ts mono/SoE +105 (1) [-] none 105 200937 B 213.322374 213.247001 34.254 fps ts mono/SoE +106 (2) [-] none 106 201013 B 213.352228 213.279005 33.496 fps ts mono/SoE +… +``` + +After applying the quirk: + +``` +154 (2) [-] none 154 192417 B 42.199823 42.207788 27.779 fps ts mono/SoE +155 (3) [-] none 155 192040 B 42.231834 42.239791 31.239 fps ts mono/SoE +156 (4) [-] none 156 192213 B 42.263823 42.271822 31.261 fps ts mono/SoE +157 (5) [-] none 157 191981 B 42.299824 42.303827 27.777 fps ts mono/SoE +158 (6) [-] none 158 191953 B 42.331835 42.339811 31.239 fps ts mono/SoE +159 (7) [-] none 159 191904 B 42.363824 42.371813 31.261 fps ts mono/SoE +160 (0) [-] none 160 192210 B 42.399834 42.407801 27.770 fps ts mono/SoE +``` + +Fixes: 5d0fd3c806b9 ("[media] uvcvideo: Disable hardware timestamps by default") +Signed-off-by: Oleksandr Natalenko +Reviewed-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240325142611.15550-1-oleksandr@natalenko.name +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 6e55f91ac17fe..d435b6a6c295d 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -2580,7 +2580,8 @@ static const struct usb_device_id uvc_ids[] = { + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, +- .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT) }, ++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT ++ | UVC_QUIRK_INVALID_DEVICE_SOF) }, + /* Logitech HD Pro Webcam C922 */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, +-- +2.43.0 + diff --git a/queue-6.10/media-uvcvideo-override-default-flags.patch b/queue-6.10/media-uvcvideo-override-default-flags.patch new file mode 100644 index 00000000000..6b7d6812499 --- /dev/null +++ b/queue-6.10/media-uvcvideo-override-default-flags.patch @@ -0,0 +1,68 @@ +From 3c553c82b344a95a1a3c75d6d5c4292429b1f8f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jun 2024 14:50:53 +0800 +Subject: media: uvcvideo: Override default flags + +From: Daniel Schaefer + +[ Upstream commit 86419686e66da5b90a07fb8a40ab138fe97189b5 ] + +When the UVC device has a control that is readonly it doesn't set the +SET_CUR flag. For example the privacy control has SET_CUR flag set in +the defaults in the `uvc_ctrls` variable. Even if the device does not +have it set, it's not cleared by uvc_ctrl_get_flags(). + +Originally written with assignment in commit 859086ae3636 ("media: +uvcvideo: Apply flags from device to actual properties"). But changed to +|= in commit 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable +flags"). It would not clear the default flags. + +With this patch applied the correct flags are reported to user space. +Tested with: + +``` +> v4l2-ctl --list-ctrls | grep privacy +privacy 0x009a0910 (bool) : default=0 value=0 flags=read-only +``` + +Signed-off-by: Daniel Schaefer +Fixes: 0dc68cabdb62 ("media: uvcvideo: Prevent setting unavailable flags") +Reviewed-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20240602065053.36850-1-dhs@frame.work +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 4b685f883e4d7..a7d0ec22d95c0 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -2031,7 +2031,13 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + else + ret = uvc_query_ctrl(dev, UVC_GET_INFO, ctrl->entity->id, + dev->intfnum, info->selector, data, 1); +- if (!ret) ++ ++ if (!ret) { ++ info->flags &= ~(UVC_CTRL_FLAG_GET_CUR | ++ UVC_CTRL_FLAG_SET_CUR | ++ UVC_CTRL_FLAG_AUTO_UPDATE | ++ UVC_CTRL_FLAG_ASYNCHRONOUS); ++ + info->flags |= (data[0] & UVC_CONTROL_CAP_GET ? + UVC_CTRL_FLAG_GET_CUR : 0) + | (data[0] & UVC_CONTROL_CAP_SET ? +@@ -2040,6 +2046,7 @@ static int uvc_ctrl_get_flags(struct uvc_device *dev, + UVC_CTRL_FLAG_AUTO_UPDATE : 0) + | (data[0] & UVC_CONTROL_CAP_ASYNCHRONOUS ? + UVC_CTRL_FLAG_ASYNCHRONOUS : 0); ++ } + + kfree(data); + return ret; +-- +2.43.0 + diff --git a/queue-6.10/media-uvcvideo-quirk-for-invalid-dev_sof-in-logitech.patch b/queue-6.10/media-uvcvideo-quirk-for-invalid-dev_sof-in-logitech.patch new file mode 100644 index 00000000000..2f4072d4837 --- /dev/null +++ b/queue-6.10/media-uvcvideo-quirk-for-invalid-dev_sof-in-logitech.patch @@ -0,0 +1,141 @@ +From b77654e19bb395a0df1ed7104b68ad7bb4bceca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Mar 2024 10:48:04 +0000 +Subject: media: uvcvideo: Quirk for invalid dev_sof in Logitech C922 + +From: Ricardo Ribalda + +[ Upstream commit 9183c6f1a21e0da4415762c504e2d7f784304d12 ] + +Logitech C922 internal SOF does not increases at a stable rate of 1kHz. +This causes that the device_sof and the host_sof run at different rates, +breaking the clock domain conversion algorithm. Eg: + +30 (6) [-] none 30 614400 B 21.245557 21.395214 34.133 fps ts mono/SoE +31 (7) [-] none 31 614400 B 21.275327 21.427246 33.591 fps ts mono/SoE +32 (0) [-] none 32 614400 B 21.304739 21.459256 34.000 fps ts mono/SoE +33 (1) [-] none 33 614400 B 21.334324 21.495274 33.801 fps ts mono/SoE +* 34 (2) [-] none 34 614400 B 21.529237 21.527297 5.130 fps ts mono/SoE +* 35 (3) [-] none 35 614400 B 21.649416 21.559306 8.321 fps ts mono/SoE +36 (4) [-] none 36 614400 B 21.678789 21.595320 34.045 fps ts mono/SoE +... +99 (3) [-] none 99 614400 B 23.542226 23.696352 33.541 fps ts mono/SoE +100 (4) [-] none 100 614400 B 23.571578 23.728404 34.069 fps ts mono/SoE +101 (5) [-] none 101 614400 B 23.601425 23.760420 33.504 fps ts mono/SoE +* 102 (6) [-] none 102 614400 B 23.798324 23.796428 5.079 fps ts mono/SoE +* 103 (7) [-] none 103 614400 B 23.916271 23.828450 8.478 fps ts mono/SoE +104 (0) [-] none 104 614400 B 23.945720 23.860479 33.957 fps ts mono/SoE + +Instead of disabling completely the hardware timestamping for such +hardware we take the assumption that the packet handling jitter is +under 2ms and use the host_sof as dev_sof. + +We can think of the UVC hardware clock as a system with a coarse clock +(the SOF) and a fine clock (the PTS). The coarse clock can be replaced +with a clock on the same frequency, if the jitter of such clock is +smaller than its sampling rate. That way we can save some of the +precision of the fine clock. + +To probe this point we have run three experiments on the Logitech C922. +On that experiment we run the camera at 33fps and we analyse the +difference in msec between a frame and its predecessor. If we display +the histogram of that value, a thinner histogram will mean a better +meassurement. The results for: +- original hw timestamp: https://ibb.co/D1HJJ4x +- pure software timestamp: https://ibb.co/QC9MgVK +- modified hw timestamp: https://ibb.co/8s9dBdk + +This bug in the camera firmware has been confirmed by the vendor. + +lsusb -v + +Bus 001 Device 044: ID 046d:085c Logitech, Inc. C922 Pro Stream Webcam +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + idVendor 0x046d Logitech, Inc. + idProduct 0x085c C922 Pro Stream Webcam + bcdDevice 0.16 + iManufacturer 0 + iProduct 2 C922 Pro Stream Webcam + iSerial 1 80B912DF + bNumConfigurations 1 + +Reviewed-by: Sergey Senozhatsky +Reviewed-by: Laurent Pinchart +Signed-off-by: Ricardo Ribalda +Reviewed-by: Ricardo Ribalda +Signed-off-by: Oleksandr Natalenko +Reviewed-by: Tomasz Figa +Link: https://lore.kernel.org/r/20240323-resend-hwtimestamp-v10-3-b08e590d97c7@chromium.org +Signed-off-by: Laurent Pinchart +Stable-dep-of: 85fbe91a7c92 ("media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ + drivers/media/usb/uvc/uvc_video.c | 11 +++++++++++ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 3 files changed, 21 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 8fe24c98087e6..6e55f91ac17fe 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -2581,6 +2581,15 @@ static const struct usb_device_id uvc_ids[] = { + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_RESTORE_CTRLS_ON_INIT) }, ++ /* Logitech HD Pro Webcam C922 */ ++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = 0x046d, ++ .idProduct = 0x085c, ++ .bInterfaceClass = USB_CLASS_VIDEO, ++ .bInterfaceSubClass = 1, ++ .bInterfaceProtocol = 0, ++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_INVALID_DEVICE_SOF) }, + /* Logitech Rally Bar Huddle */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index 7cbf4692bd875..b41c7b6d1b2fc 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -529,6 +529,17 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf, + stream->clock.last_sof = dev_sof; + + host_sof = usb_get_current_frame_number(stream->dev->udev); ++ ++ /* ++ * On some devices, like the Logitech C922, the device SOF does not run ++ * at a stable rate of 1kHz. For those devices use the host SOF instead. ++ * In the tests performed so far, this improves the timestamp precision. ++ * This is probably explained by a small packet handling jitter from the ++ * host, but the exact reason hasn't been fully determined. ++ */ ++ if (stream->dev->quirks & UVC_QUIRK_INVALID_DEVICE_SOF) ++ dev_sof = host_sof; ++ + time = uvc_video_get_time(); + + /* +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 3653b2c8a86cb..e5b12717016fa 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -75,6 +75,7 @@ + #define UVC_QUIRK_WAKE_AUTOSUSPEND 0x00002000 + #define UVC_QUIRK_NO_RESET_RESUME 0x00004000 + #define UVC_QUIRK_DISABLE_AUTOSUSPEND 0x00008000 ++#define UVC_QUIRK_INVALID_DEVICE_SOF 0x00010000 + + /* Format flags */ + #define UVC_FMT_FLAG_COMPRESSED 0x00000001 +-- +2.43.0 + diff --git a/queue-6.10/media-v4l-async-fix-null-pointer-dereference-in-addi.patch b/queue-6.10/media-v4l-async-fix-null-pointer-dereference-in-addi.patch new file mode 100644 index 00000000000..242d459890b --- /dev/null +++ b/queue-6.10/media-v4l-async-fix-null-pointer-dereference-in-addi.patch @@ -0,0 +1,44 @@ +From 7fe22aa185ca1b5e0f6fdfa348d4f03770db748b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:51:49 +0800 +Subject: media: v4l: async: Fix NULL pointer dereference in adding ancillary + links + +From: ChiYuan Huang + +[ Upstream commit 9b4667ea67854f0b116fe22ad11ef5628c5b5b5f ] + +In v4l2_async_create_ancillary_links(), ancillary links are created for +lens and flash sub-devices. These are sub-device to sub-device links and +if the async notifier is related to a V4L2 device, the source sub-device +of the ancillary link is NULL, leading to a NULL pointer dereference. +Check the notifier's sd field is non-NULL in +v4l2_async_create_ancillary_links(). + +Fixes: aa4faf6eb271 ("media: v4l2-async: Create links during v4l2_async_match_notify()") +Signed-off-by: ChiYuan Huang +[Sakari Ailus: Reword the subject and commit messages slightly.] +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-async.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c +index 222f01665f7ce..c477723c07bf8 100644 +--- a/drivers/media/v4l2-core/v4l2-async.c ++++ b/drivers/media/v4l2-core/v4l2-async.c +@@ -323,6 +323,9 @@ static int v4l2_async_create_ancillary_links(struct v4l2_async_notifier *n, + sd->entity.function != MEDIA_ENT_F_FLASH) + return 0; + ++ if (!n->sd) ++ return 0; ++ + link = media_create_ancillary_link(&n->sd->entity, &sd->entity); + + return IS_ERR(link) ? PTR_ERR(link) : 0; +-- +2.43.0 + diff --git a/queue-6.10/media-venus-flush-all-buffers-in-output-plane-stream.patch b/queue-6.10/media-venus-flush-all-buffers-in-output-plane-stream.patch new file mode 100644 index 00000000000..f5a036ddc1e --- /dev/null +++ b/queue-6.10/media-venus-flush-all-buffers-in-output-plane-stream.patch @@ -0,0 +1,43 @@ +From d6e0d886297a09939f43775e90617199ed6e9c00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 11:42:14 +0530 +Subject: media: venus: flush all buffers in output plane streamoff + +From: Dikshita Agarwal + +[ Upstream commit e750a4b1224142bd8dd057b0d5adf8a5608b7e77 ] + +For scenarios, when source change is followed by VIDIOC_STREAMOFF +on output plane, driver should discard any queued OUTPUT +buffers, which are not decoded or dequeued. +Flush with HFI_FLUSH_INPUT does not have any actual impact. +So, fix it, by invoking HFI_FLUSH_ALL, which will flush all +queued buffers. + +Fixes: 85872f861d4c ("media: venus: Mark last capture buffer") +Signed-off-by: Dikshita Agarwal +Tested-by: Nathan Hebert +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Stanimir Varbanov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 29130a9441e70..0d2ab95bec0f6 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -1255,7 +1255,7 @@ static int vdec_stop_output(struct venus_inst *inst) + break; + case VENUS_DEC_STATE_INIT: + case VENUS_DEC_STATE_CAPTURE_SETUP: +- ret = hfi_session_flush(inst, HFI_FLUSH_INPUT, true); ++ ret = hfi_session_flush(inst, HFI_FLUSH_ALL, true); + break; + default: + break; +-- +2.43.0 + diff --git a/queue-6.10/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch b/queue-6.10/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch new file mode 100644 index 00000000000..64b5c8824b0 --- /dev/null +++ b/queue-6.10/memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch @@ -0,0 +1,54 @@ +From 6a4111d2dbcfce04b7dab624f6b15d0718cd393b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 16:46:36 +0200 +Subject: memory: fsl_ifc: Make FSL_IFC config visible and selectable + +From: Esben Haabendal + +[ Upstream commit 9ba0cae3cac07c21c583f9ff194f74043f90d29c ] + +While use of fsl_ifc driver with NAND flash is fine, as the fsl_ifc_nand +driver selects FSL_IFC automatically, we need the CONFIG_FSL_IFC option to +be selectable for platforms using fsl_ifc with NOR flash. + +Fixes: ea0c0ad6b6eb ("memory: Enable compile testing for most of the drivers") +Reviewed-by: Miquel Raynal +Signed-off-by: Esben Haabendal +Link: https://lore.kernel.org/r/20240530-fsl-ifc-config-v3-1-1fd2c3d233dd@geanix.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/Kconfig | 2 +- + drivers/mtd/nand/raw/Kconfig | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/memory/Kconfig b/drivers/memory/Kconfig +index 8efdd1f971395..c82d8d8a16eaf 100644 +--- a/drivers/memory/Kconfig ++++ b/drivers/memory/Kconfig +@@ -167,7 +167,7 @@ config FSL_CORENET_CF + represents a coherency violation. + + config FSL_IFC +- bool "Freescale IFC driver" if COMPILE_TEST ++ bool "Freescale IFC driver" + depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST + depends on HAS_IOMEM + +diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig +index cbf8ae85e1ae0..6142573085169 100644 +--- a/drivers/mtd/nand/raw/Kconfig ++++ b/drivers/mtd/nand/raw/Kconfig +@@ -234,8 +234,7 @@ config MTD_NAND_FSL_IFC + tristate "Freescale IFC NAND controller" + depends on FSL_SOC || ARCH_LAYERSCAPE || SOC_LS1021A || COMPILE_TEST + depends on HAS_IOMEM +- select FSL_IFC +- select MEMORY ++ depends on FSL_IFC + help + Various Freescale chips e.g P1010, include a NAND Flash machine + with built-in hardware ECC capabilities. +-- +2.43.0 + diff --git a/queue-6.10/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch b/queue-6.10/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch new file mode 100644 index 00000000000..73c99f02189 --- /dev/null +++ b/queue-6.10/mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch @@ -0,0 +1,69 @@ +From cf4ec9c37c18f5a9dec62137040c2ffb43a46cd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 21:37:03 +0200 +Subject: mfd: omap-usb-tll: Use struct_size to allocate tll + +From: Javier Carrasco + +[ Upstream commit 40176714c818b0b6a2ca8213cdb7654fbd49b742 ] + +Commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +changed the memory allocation of 'tll' to consolidate it into a single +allocation, introducing an incorrect size calculation. + +In particular, the allocation for the array of pointers was converted +into a single-pointer allocation. + +The memory allocation used to occur in two steps: + +tll = devm_kzalloc(dev, sizeof(struct usbtll_omap), GFP_KERNEL); +tll->ch_clk = devm_kzalloc(dev, sizeof(struct clk *) * tll->nch, + GFP_KERNEL); + +And it turned that into the following allocation: + +tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), + GFP_KERNEL); + +sizeof(tll->ch_clk[nch]) returns the size of a single pointer instead of +the expected nch pointers. + +This bug went unnoticed because the allocation size was small enough to +fit within the minimum size of a memory allocation for this particular +case [1]. + +The complete allocation can still be done at once with the struct_size +macro, which comes in handy for structures with a trailing flexible +array. + +Fix the memory allocation to obtain the original size again. + +Link: https://lore.kernel.org/all/202406261121.2FFD65647@keescook/ [1] +Fixes: 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Reviewed-by: Kees Cook +Signed-off-by: Javier Carrasco +Fixes: commit 16c2004d9e4d ("mfd: omap-usb-tll: Allocate driver data at once") +Link: https://lore.kernel.org/r/20240626-omap-usb-tll-counted_by-v2-1-4bedf20d1b51@gmail.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/omap-usb-tll.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c +index b6303ddb013b0..f68dd02814638 100644 +--- a/drivers/mfd/omap-usb-tll.c ++++ b/drivers/mfd/omap-usb-tll.c +@@ -230,8 +230,7 @@ static int usbtll_omap_probe(struct platform_device *pdev) + break; + } + +- tll = devm_kzalloc(dev, sizeof(*tll) + sizeof(tll->ch_clk[nch]), +- GFP_KERNEL); ++ tll = devm_kzalloc(dev, struct_size(tll, ch_clk, nch), GFP_KERNEL); + if (!tll) { + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); +-- +2.43.0 + diff --git a/queue-6.10/mfd-rsmu-split-core-code-into-separate-module.patch b/queue-6.10/mfd-rsmu-split-core-code-into-separate-module.patch new file mode 100644 index 00000000000..65765f294a7 --- /dev/null +++ b/queue-6.10/mfd-rsmu-split-core-code-into-separate-module.patch @@ -0,0 +1,61 @@ +From 44f6909cb9e210cdc4cd4811abfb98babd043f92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:48:47 +0200 +Subject: mfd: rsmu: Split core code into separate module + +From: Arnd Bergmann + +[ Upstream commit c879a8c39dd55e7fabdd8d13341f7bc5200db377 ] + +Linking a file into two modules can have unintended side-effects +and produces a W=1 warning: + +scripts/Makefile.build:236: drivers/mfd/Makefile: rsmu_core.o is added to multiple modules: rsmu-i2c rsmu-spi + +Make this one a separate module instead. + +Fixes: a1867f85e06e ("mfd: Add Renesas Synchronization Management Unit (SMU) support") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20240529094856.1869543-1-arnd@kernel.org +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/Makefile | 6 ++---- + drivers/mfd/rsmu_core.c | 2 ++ + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile +index c66f07edcd0e6..db1ba39de3b59 100644 +--- a/drivers/mfd/Makefile ++++ b/drivers/mfd/Makefile +@@ -280,7 +280,5 @@ obj-$(CONFIG_MFD_INTEL_M10_BMC_PMCI) += intel-m10-bmc-pmci.o + obj-$(CONFIG_MFD_ATC260X) += atc260x-core.o + obj-$(CONFIG_MFD_ATC260X_I2C) += atc260x-i2c.o + +-rsmu-i2c-objs := rsmu_core.o rsmu_i2c.o +-rsmu-spi-objs := rsmu_core.o rsmu_spi.o +-obj-$(CONFIG_MFD_RSMU_I2C) += rsmu-i2c.o +-obj-$(CONFIG_MFD_RSMU_SPI) += rsmu-spi.o ++obj-$(CONFIG_MFD_RSMU_I2C) += rsmu_i2c.o rsmu_core.o ++obj-$(CONFIG_MFD_RSMU_SPI) += rsmu_spi.o rsmu_core.o +diff --git a/drivers/mfd/rsmu_core.c b/drivers/mfd/rsmu_core.c +index 29437fd0bd5bf..fd04a6e5dfa31 100644 +--- a/drivers/mfd/rsmu_core.c ++++ b/drivers/mfd/rsmu_core.c +@@ -78,11 +78,13 @@ int rsmu_core_init(struct rsmu_ddata *rsmu) + + return ret; + } ++EXPORT_SYMBOL_GPL(rsmu_core_init); + + void rsmu_core_exit(struct rsmu_ddata *rsmu) + { + mutex_destroy(&rsmu->lock); + } ++EXPORT_SYMBOL_GPL(rsmu_core_exit); + + MODULE_DESCRIPTION("Renesas SMU core driver"); + MODULE_LICENSE("GPL"); +-- +2.43.0 + diff --git a/queue-6.10/mips-fix-fallback-march-for-sb1.patch b/queue-6.10/mips-fix-fallback-march-for-sb1.patch new file mode 100644 index 00000000000..154572f1602 --- /dev/null +++ b/queue-6.10/mips-fix-fallback-march-for-sb1.patch @@ -0,0 +1,37 @@ +From d141dc89f6de153b79880edd159d525a087e7b97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jul 2024 10:52:57 +0800 +Subject: MIPS: Fix fallback march for SB1 + +From: Jiaxun Yang + +[ Upstream commit 2326c8f2022636a1e47402ffd09a3b28f737275f ] + +Fallback march for SB1 should be mips64 instead of mips64r1. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202407111851.LwDasTcp-lkp@intel.com/ +Fixes: bfc0a330c1b4 ("MIPS: Fallback CPU -march flag to ISA level if unsupported") +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 80aecba248922..5785a3d5ccfbb 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -170,7 +170,7 @@ cflags-$(CONFIG_CPU_NEVADA) += $(call cc-option,-march=rm5200,-march=mips4) \ + -Wa,--trap + cflags-$(CONFIG_CPU_RM7000) += $(call cc-option,-march=rm7000,-march=mips4) \ + -Wa,--trap +-cflags-$(CONFIG_CPU_SB1) += $(call cc-option,-march=sb1,-march=mips64r1) \ ++cflags-$(CONFIG_CPU_SB1) += $(call cc-option,-march=sb1,-march=mips64) \ + -Wa,--trap + cflags-$(CONFIG_CPU_SB1) += $(call cc-option,-mno-mdmx) + cflags-$(CONFIG_CPU_SB1) += $(call cc-option,-mno-mips3d) +-- +2.43.0 + diff --git a/queue-6.10/mips-octeron-remove-source-file-executable-bit.patch b/queue-6.10/mips-octeron-remove-source-file-executable-bit.patch new file mode 100644 index 00000000000..f454e846b15 --- /dev/null +++ b/queue-6.10/mips-octeron-remove-source-file-executable-bit.patch @@ -0,0 +1,27 @@ +From 4b72d1218107ee14a00e35499fabf8783e36caeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 16:48:30 +0900 +Subject: MIPS: Octeron: remove source file executable bit + +From: Dominique Martinet + +[ Upstream commit 89c7f5078935872cf47a713a645affb5037be694 ] + +This does not matter the least, but there is no other .[ch] file in the +repo that is executable, so clean this up. + +Fixes: 29b83a64df3b ("MIPS: Octeon: Add PCIe link status check") +Signed-off-by: Dominique Martinet +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pcie-octeon.c | 0 + 1 file changed, 0 insertions(+), 0 deletions(-) + mode change 100755 => 100644 arch/mips/pci/pcie-octeon.c + +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +old mode 100755 +new mode 100644 +-- +2.43.0 + diff --git a/queue-6.10/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch b/queue-6.10/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch new file mode 100644 index 00000000000..899ddf33423 --- /dev/null +++ b/queue-6.10/mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch @@ -0,0 +1,252 @@ +From 620fa0d56d2037ec51c2b3c507bd8022818ed136 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:43 +0200 +Subject: mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors + +From: Ido Schimmel + +[ Upstream commit 75d8d7a63065b18df9555dbaab0b42d4c6f20943 ] + +ACLs that reside in the algorithmic TCAM (A-TCAM) in Spectrum-2 and +newer ASICs can share the same mask if their masks only differ in up to +8 consecutive bits. For example, consider the following filters: + + # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 192.0.2.0/24 action drop + # tc filter add dev swp1 ingress pref 1 proto ip flower dst_ip 198.51.100.128/25 action drop + +The second filter can use the same mask as the first (dst_ip/24) with a +delta of 1 bit. + +However, the above only works because the two filters have different +values in the common unmasked part (dst_ip/24). When entries have the +same value in the common unmasked part they create undesired collisions +in the device since many entries now have the same key. This leads to +firmware errors such as [1] and to a reduced scale. + +Fix by adjusting the hash table key to only include the value in the +common unmasked part. That is, without including the delta bits. That +way the driver will detect the collision during filter insertion and +spill the filter into the circuit TCAM (C-TCAM). + +Add a test case that fails without the fix and adjust existing cases +that check C-TCAM spillage according to the above limitation. + +[1] +mlxsw_spectrum2 0000:06:00.0: EMAD reg access failed (tid=3379b18a00003394,reg_id=3027(ptce3),type=write,status=8(resource not available)) + +Fixes: c22291f7cf45 ("mlxsw: spectrum: acl: Implement delta for ERP") +Reported-by: Alexander Zubkov +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../mellanox/mlxsw/spectrum_acl_atcam.c | 18 +++--- + .../mlxsw/spectrum_acl_bloom_filter.c | 2 +- + .../mellanox/mlxsw/spectrum_acl_tcam.h | 9 +-- + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 55 +++++++++++++++++-- + 4 files changed, 63 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +index 4b713832fdd55..f5c0a4214c4e5 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c +@@ -391,7 +391,8 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + if (err) + return err; + +- lkey_id = aregion->ops->lkey_id_get(aregion, aentry->enc_key, erp_id); ++ lkey_id = aregion->ops->lkey_id_get(aregion, aentry->ht_key.enc_key, ++ erp_id); + if (IS_ERR(lkey_id)) + return PTR_ERR(lkey_id); + aentry->lkey_id = lkey_id; +@@ -399,7 +400,7 @@ mlxsw_sp_acl_atcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp, + kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block); + mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_WRITE, + priority, region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -428,7 +429,7 @@ mlxsw_sp_acl_atcam_region_entry_remove(struct mlxsw_sp *mlxsw_sp, + + mlxsw_reg_ptce3_pack(ptce3_pl, false, MLXSW_REG_PTCE3_OP_WRITE_WRITE, 0, + region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -457,7 +458,7 @@ mlxsw_sp_acl_atcam_region_entry_action_replace(struct mlxsw_sp *mlxsw_sp, + kvdl_index = mlxsw_afa_block_first_kvdl_index(rulei->act_block); + mlxsw_reg_ptce3_pack(ptce3_pl, true, MLXSW_REG_PTCE3_OP_WRITE_UPDATE, + priority, region->tcam_region_info, +- aentry->enc_key, erp_id, ++ aentry->ht_key.enc_key, erp_id, + aentry->delta_info.start, + aentry->delta_info.mask, + aentry->delta_info.value, +@@ -480,15 +481,13 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, + int err; + + mlxsw_afk_encode(afk, region->key_info, &rulei->values, +- aentry->ht_key.full_enc_key, mask); ++ aentry->ht_key.enc_key, mask); + + erp_mask = mlxsw_sp_acl_erp_mask_get(aregion, mask, false); + if (IS_ERR(erp_mask)) + return PTR_ERR(erp_mask); + aentry->erp_mask = erp_mask; + aentry->ht_key.erp_id = mlxsw_sp_acl_erp_mask_erp_id(erp_mask); +- memcpy(aentry->enc_key, aentry->ht_key.full_enc_key, +- sizeof(aentry->enc_key)); + + /* Compute all needed delta information and clear the delta bits + * from the encrypted key. +@@ -497,9 +496,8 @@ __mlxsw_sp_acl_atcam_entry_add(struct mlxsw_sp *mlxsw_sp, + aentry->delta_info.start = mlxsw_sp_acl_erp_delta_start(delta); + aentry->delta_info.mask = mlxsw_sp_acl_erp_delta_mask(delta); + aentry->delta_info.value = +- mlxsw_sp_acl_erp_delta_value(delta, +- aentry->ht_key.full_enc_key); +- mlxsw_sp_acl_erp_delta_clear(delta, aentry->enc_key); ++ mlxsw_sp_acl_erp_delta_value(delta, aentry->ht_key.enc_key); ++ mlxsw_sp_acl_erp_delta_clear(delta, aentry->ht_key.enc_key); + + /* Add rule to the list of A-TCAM rules, assuming this + * rule is intended to A-TCAM. In case this rule does +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +index 95f63fcf4ba1f..a54eedb69a3f5 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_bloom_filter.c +@@ -249,7 +249,7 @@ __mlxsw_sp_acl_bf_key_encode(struct mlxsw_sp_acl_atcam_region *aregion, + memcpy(chunk + pad_bytes, &erp_region_id, + sizeof(erp_region_id)); + memcpy(chunk + key_offset, +- &aentry->enc_key[chunk_key_offsets[chunk_index]], ++ &aentry->ht_key.enc_key[chunk_key_offsets[chunk_index]], + chunk_key_len); + chunk += chunk_len; + } +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +index 79a1d86065125..010204f73ea46 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.h +@@ -167,9 +167,9 @@ struct mlxsw_sp_acl_atcam_region { + }; + + struct mlxsw_sp_acl_atcam_entry_ht_key { +- char full_enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded +- * key. +- */ ++ char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key, minus ++ * delta bits. ++ */ + u8 erp_id; + }; + +@@ -181,9 +181,6 @@ struct mlxsw_sp_acl_atcam_entry { + struct rhash_head ht_node; + struct list_head list; /* Member in entries_list */ + struct mlxsw_sp_acl_atcam_entry_ht_key ht_key; +- char enc_key[MLXSW_REG_PTCEX_FLEX_KEY_BLOCKS_LEN]; /* Encoded key, +- * minus delta bits. +- */ + struct { + u16 start; + u8 mask; +diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +index 31252bc8775e0..4994bea5daf80 100755 +--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh ++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +@@ -11,7 +11,7 @@ ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ + multiple_masks_test ctcam_edge_cases_test delta_simple_test \ + delta_two_masks_one_key_test delta_simple_rehash_test \ + bloom_simple_test bloom_complex_test bloom_delta_test \ +- max_erp_entries_test max_group_size_test" ++ max_erp_entries_test max_group_size_test collision_test" + NUM_NETIFS=2 + source $lib_dir/lib.sh + source $lib_dir/tc_common.sh +@@ -457,7 +457,7 @@ delta_two_masks_one_key_test() + { + # If 2 keys are the same and only differ in mask in a way that + # they belong under the same ERP (second is delta of the first), +- # there should be no C-TCAM spill. ++ # there should be C-TCAM spill. + + RET=0 + +@@ -474,8 +474,8 @@ delta_two_masks_one_key_test() + tp_record "mlxsw:*" "tc filter add dev $h2 ingress protocol ip \ + pref 2 handle 102 flower $tcflags dst_ip 192.0.2.2 \ + action drop" +- tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 0 +- check_err $? "incorrect C-TCAM spill while inserting the second rule" ++ tp_check_hits "mlxsw:mlxsw_sp_acl_atcam_entry_add_ctcam_spill" 1 ++ check_err $? "C-TCAM spill did not happen while inserting the second rule" + + $MZ $h1 -c 1 -p 64 -a $h1mac -b $h2mac -A 192.0.2.1 -B 192.0.2.2 \ + -t ip -q +@@ -1087,6 +1087,53 @@ max_group_size_test() + log_test "max ACL group size test ($tcflags). max size $max_size" + } + ++collision_test() ++{ ++ # Filters cannot share an eRP if in the common unmasked part (i.e., ++ # without the delta bits) they have the same values. If the driver does ++ # not prevent such configuration (by spilling into the C-TCAM), then ++ # multiple entries will be present in the device with the same key, ++ # leading to collisions and a reduced scale. ++ # ++ # Create such a scenario and make sure all the filters are successfully ++ # added. ++ ++ RET=0 ++ ++ local ret ++ ++ if [[ "$tcflags" != "skip_sw" ]]; then ++ return 0; ++ fi ++ ++ # Add a single dst_ip/24 filter and multiple dst_ip/32 filters that all ++ # have the same values in the common unmasked part (dst_ip/24). ++ ++ tc filter add dev $h2 ingress pref 1 proto ipv4 handle 101 \ ++ flower $tcflags dst_ip 198.51.100.0/24 \ ++ action drop ++ ++ for i in {0..255}; do ++ tc filter add dev $h2 ingress pref 2 proto ipv4 \ ++ handle $((102 + i)) \ ++ flower $tcflags dst_ip 198.51.100.${i}/32 \ ++ action drop ++ ret=$? ++ [[ $ret -ne 0 ]] && break ++ done ++ ++ check_err $ret "failed to add all the filters" ++ ++ for i in {255..0}; do ++ tc filter del dev $h2 ingress pref 2 proto ipv4 \ ++ handle $((102 + i)) flower ++ done ++ ++ tc filter del dev $h2 ingress pref 1 proto ipv4 handle 101 flower ++ ++ log_test "collision test ($tcflags)" ++} ++ + setup_prepare() + { + h1=${NETIFS[p1]} +-- +2.43.0 + diff --git a/queue-6.10/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch b/queue-6.10/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch new file mode 100644 index 00000000000..03fc316c85e --- /dev/null +++ b/queue-6.10/mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch @@ -0,0 +1,184 @@ +From 9439c74c75f163948ff981749d024923ae4895a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 16:49:42 +0200 +Subject: mlxsw: spectrum_acl_erp: Fix object nesting warning + +From: Ido Schimmel + +[ Upstream commit 97d833ceb27dc19f8777d63f90be4a27b5daeedf ] + +ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM +(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can +contain more ACLs (i.e., tc filters), but the number of masks in each +region (i.e., tc chain) is limited. + +In order to mitigate the effects of the above limitation, the device +allows filters to share a single mask if their masks only differ in up +to 8 consecutive bits. For example, dst_ip/25 can be represented using +dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the +number of masks being used (and therefore does not support mask +aggregation), but can contain a limited number of filters. + +The driver uses the "objagg" library to perform the mask aggregation by +passing it objects that consist of the filter's mask and whether the +filter is to be inserted into the A-TCAM or the C-TCAM since filters in +different TCAMs cannot share a mask. + +The set of created objects is dependent on the insertion order of the +filters and is not necessarily optimal. Therefore, the driver will +periodically ask the library to compute a more optimal set ("hints") by +looking at all the existing objects. + +When the library asks the driver whether two objects can be aggregated +the driver only compares the provided masks and ignores the A-TCAM / +C-TCAM indication. This is the right thing to do since the goal is to +move as many filters as possible to the A-TCAM. The driver also forbids +two identical masks from being aggregated since this can only happen if +one was intentionally put in the C-TCAM to avoid a conflict in the +A-TCAM. + +The above can result in the following set of hints: + +H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta +H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta + +After getting the hints from the library the driver will start migrating +filters from one region to another while consulting the computed hints +and instructing the device to perform a lookup in both regions during +the transition. + +Assuming a filter with mask X is being migrated into the A-TCAM in the +new region, the hints lookup will return H1. Since H2 is the parent of +H1, the library will try to find the object associated with it and +create it if necessary in which case another hints lookup (recursive) +will be performed. This hints lookup for {mask Y, A-TCAM} will either +return H2 or H3 since the driver passes the library an object comparison +function that ignores the A-TCAM / C-TCAM indication. + +This can eventually lead to nested objects which are not supported by +the library [1]. + +Fix by removing the object comparison function from both the driver and +the library as the driver was the only user. That way the lookup will +only return exact matches. + +I do not have a reliable reproducer that can reproduce the issue in a +timely manner, but before the fix the issue would reproduce in several +minutes and with the fix it does not reproduce in over an hour. + +Note that the current usefulness of the hints is limited because they +include the C-TCAM indication and represent aggregation that cannot +actually happen. This will be addressed in net-next. + +[1] +WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 +Modules linked in: +CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 +Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 +[...] +Call Trace: + + __objagg_obj_get+0x2bb/0x580 + objagg_obj_get+0xe/0x80 + mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 + mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 + mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 + process_one_work+0x151/0x370 + +Fixes: 9069a3817d82 ("lib: objagg: implement optimization hints assembly and use hints for object creation") +Signed-off-by: Ido Schimmel +Reviewed-by: Amit Cohen +Tested-by: Alexander Zubkov +Signed-off-by: Petr Machata +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 13 ------------- + include/linux/objagg.h | 1 - + lib/objagg.c | 15 --------------- + 3 files changed, 29 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +index d231f4d2888be..9eee229303cce 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c +@@ -1217,18 +1217,6 @@ static bool mlxsw_sp_acl_erp_delta_check(void *priv, const void *parent_obj, + return err ? false : true; + } + +-static int mlxsw_sp_acl_erp_hints_obj_cmp(const void *obj1, const void *obj2) +-{ +- const struct mlxsw_sp_acl_erp_key *key1 = obj1; +- const struct mlxsw_sp_acl_erp_key *key2 = obj2; +- +- /* For hints purposes, two objects are considered equal +- * in case the masks are the same. Does not matter what +- * the "ctcam" value is. +- */ +- return memcmp(key1->mask, key2->mask, sizeof(key1->mask)); +-} +- + static void *mlxsw_sp_acl_erp_delta_create(void *priv, void *parent_obj, + void *obj) + { +@@ -1308,7 +1296,6 @@ static void mlxsw_sp_acl_erp_root_destroy(void *priv, void *root_priv) + static const struct objagg_ops mlxsw_sp_acl_erp_objagg_ops = { + .obj_size = sizeof(struct mlxsw_sp_acl_erp_key), + .delta_check = mlxsw_sp_acl_erp_delta_check, +- .hints_obj_cmp = mlxsw_sp_acl_erp_hints_obj_cmp, + .delta_create = mlxsw_sp_acl_erp_delta_create, + .delta_destroy = mlxsw_sp_acl_erp_delta_destroy, + .root_create = mlxsw_sp_acl_erp_root_create, +diff --git a/include/linux/objagg.h b/include/linux/objagg.h +index 78021777df462..6df5b887dc547 100644 +--- a/include/linux/objagg.h ++++ b/include/linux/objagg.h +@@ -8,7 +8,6 @@ struct objagg_ops { + size_t obj_size; + bool (*delta_check)(void *priv, const void *parent_obj, + const void *obj); +- int (*hints_obj_cmp)(const void *obj1, const void *obj2); + void * (*delta_create)(void *priv, void *parent_obj, void *obj); + void (*delta_destroy)(void *priv, void *delta_priv); + void * (*root_create)(void *priv, void *obj, unsigned int root_id); +diff --git a/lib/objagg.c b/lib/objagg.c +index 90f3aa68c30a0..1608895b009c8 100644 +--- a/lib/objagg.c ++++ b/lib/objagg.c +@@ -906,20 +906,6 @@ static const struct objagg_opt_algo *objagg_opt_algos[] = { + [OBJAGG_OPT_ALGO_SIMPLE_GREEDY] = &objagg_opt_simple_greedy, + }; + +-static int objagg_hints_obj_cmp(struct rhashtable_compare_arg *arg, +- const void *obj) +-{ +- struct rhashtable *ht = arg->ht; +- struct objagg_hints *objagg_hints = +- container_of(ht, struct objagg_hints, node_ht); +- const struct objagg_ops *ops = objagg_hints->ops; +- const char *ptr = obj; +- +- ptr += ht->p.key_offset; +- return ops->hints_obj_cmp ? ops->hints_obj_cmp(ptr, arg->key) : +- memcmp(ptr, arg->key, ht->p.key_len); +-} +- + /** + * objagg_hints_get - obtains hints instance + * @objagg: objagg instance +@@ -958,7 +944,6 @@ struct objagg_hints *objagg_hints_get(struct objagg *objagg, + offsetof(struct objagg_hints_node, obj); + objagg_hints->ht_params.head_offset = + offsetof(struct objagg_hints_node, ht_node); +- objagg_hints->ht_params.obj_cmpfn = objagg_hints_obj_cmp; + + err = rhashtable_init(&objagg_hints->node_ht, &objagg_hints->ht_params); + if (err) +-- +2.43.0 + diff --git a/queue-6.10/mtd-make-mtd_test.c-a-separate-module.patch b/queue-6.10/mtd-make-mtd_test.c-a-separate-module.patch new file mode 100644 index 00000000000..124c6acb745 --- /dev/null +++ b/queue-6.10/mtd-make-mtd_test.c-a-separate-module.patch @@ -0,0 +1,114 @@ +From 1e1cfca8b3d686ae5d210695e7eb9e7d053acb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 11:50:39 +0200 +Subject: mtd: make mtd_test.c a separate module + +From: Arnd Bergmann + +[ Upstream commit a5cf054d325e6f362e82fe6d124a1871a4af8174 ] + +This file gets linked into nine different modules, which causes a warning: + +scripts/Makefile.build:236: drivers/mtd/tests/Makefile: mtd_test.o is added to multiple modules: mtd_nandbiterrs mtd_oobtest mtd_pagetest mtd_readtest mtd_speedtest mtd_stresstest mtd_subpagetest mtd_torturetest + +Make it a separate module instead. + +Fixes: a995c792280d ("mtd: tests: rename sources in order to link a helper object") +Signed-off-by: Arnd Bergmann +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240529095049.1915393-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/tests/Makefile | 34 +++++++++++++++++----------------- + drivers/mtd/tests/mtd_test.c | 9 +++++++++ + 2 files changed, 26 insertions(+), 17 deletions(-) + +diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile +index 5de0378f90dbd..7dae831ee8b6b 100644 +--- a/drivers/mtd/tests/Makefile ++++ b/drivers/mtd/tests/Makefile +@@ -1,19 +1,19 @@ + # SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o +-obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o ++obj-$(CONFIG_MTD_TESTS) += mtd_oobtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_pagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_readtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o mtd_test.o ++obj-$(CONFIG_MTD_TESTS) += mtd_nandbiterrs.o mtd_test.o + +-mtd_oobtest-objs := oobtest.o mtd_test.o +-mtd_pagetest-objs := pagetest.o mtd_test.o +-mtd_readtest-objs := readtest.o mtd_test.o +-mtd_speedtest-objs := speedtest.o mtd_test.o +-mtd_stresstest-objs := stresstest.o mtd_test.o +-mtd_subpagetest-objs := subpagetest.o mtd_test.o +-mtd_torturetest-objs := torturetest.o mtd_test.o +-mtd_nandbiterrs-objs := nandbiterrs.o mtd_test.o ++mtd_oobtest-objs := oobtest.o ++mtd_pagetest-objs := pagetest.o ++mtd_readtest-objs := readtest.o ++mtd_speedtest-objs := speedtest.o ++mtd_stresstest-objs := stresstest.o ++mtd_subpagetest-objs := subpagetest.o ++mtd_torturetest-objs := torturetest.o ++mtd_nandbiterrs-objs := nandbiterrs.o +diff --git a/drivers/mtd/tests/mtd_test.c b/drivers/mtd/tests/mtd_test.c +index c84250beffdc9..f391e0300cdc9 100644 +--- a/drivers/mtd/tests/mtd_test.c ++++ b/drivers/mtd/tests/mtd_test.c +@@ -25,6 +25,7 @@ int mtdtest_erase_eraseblock(struct mtd_info *mtd, unsigned int ebnum) + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_eraseblock); + + static int is_block_bad(struct mtd_info *mtd, unsigned int ebnum) + { +@@ -57,6 +58,7 @@ int mtdtest_scan_for_bad_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_scan_for_bad_eraseblocks); + + int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + unsigned int eb, int ebcnt) +@@ -75,6 +77,7 @@ int mtdtest_erase_good_eraseblocks(struct mtd_info *mtd, unsigned char *bbt, + + return 0; + } ++EXPORT_SYMBOL_GPL(mtdtest_erase_good_eraseblocks); + + int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + { +@@ -92,6 +95,7 @@ int mtdtest_read(struct mtd_info *mtd, loff_t addr, size_t size, void *buf) + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_read); + + int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + const void *buf) +@@ -107,3 +111,8 @@ int mtdtest_write(struct mtd_info *mtd, loff_t addr, size_t size, + + return err; + } ++EXPORT_SYMBOL_GPL(mtdtest_write); ++ ++MODULE_LICENSE("GPL"); ++MODULE_DESCRIPTION("MTD function test helpers"); ++MODULE_AUTHOR("Akinobu Mita"); +-- +2.43.0 + diff --git a/queue-6.10/mtd-spi-nor-winbond-fix-w25q128-regression.patch b/queue-6.10/mtd-spi-nor-winbond-fix-w25q128-regression.patch new file mode 100644 index 00000000000..46af48f27d0 --- /dev/null +++ b/queue-6.10/mtd-spi-nor-winbond-fix-w25q128-regression.patch @@ -0,0 +1,53 @@ +From ab9343ef3a50c5acb7a1ace11df93a83b2b7e83a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 14:09:29 +0200 +Subject: mtd: spi-nor: winbond: fix w25q128 regression + +From: Michael Walle + +[ Upstream commit d35df77707bf5ae1221b5ba1c8a88cf4fcdd4901 ] + +Commit 83e824a4a595 ("mtd: spi-nor: Correct flags for Winbond w25q128") +removed the flags for non-SFDP devices. It was assumed that it wasn't in +use anymore. This wasn't true. Add the no_sfdp_flags as well as the size +again. + +We add the additional flags for dual and quad read because they have +been reported to work properly by Hartmut using both older and newer +versions of this flash, the similar flashes with 64Mbit and 256Mbit +already have these flags and because it will (luckily) trigger our +legacy SFDP parsing, so newer versions with SFDP support will still get +the parameters from the SFDP tables. + +Reported-by: Hartmut Birr +Closes: https://lore.kernel.org/r/CALxbwRo_-9CaJmt7r7ELgu+vOcgk=xZcGHobnKf=oT2=u4d4aA@mail.gmail.com/ +Fixes: 83e824a4a595 ("mtd: spi-nor: Correct flags for Winbond w25q128") +Reviewed-by: Linus Walleij +Signed-off-by: Michael Walle +Acked-by: Tudor Ambarus +Reviewed-by: Esben Haabendal +Reviewed-by: Pratyush Yadav +Signed-off-by: Pratyush Yadav +Link: https://lore.kernel.org/r/20240621120929.2670185-1-mwalle@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/winbond.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/spi-nor/winbond.c b/drivers/mtd/spi-nor/winbond.c +index 142fb27b2ea9a..e065e4fd42a33 100644 +--- a/drivers/mtd/spi-nor/winbond.c ++++ b/drivers/mtd/spi-nor/winbond.c +@@ -105,7 +105,9 @@ static const struct flash_info winbond_nor_parts[] = { + }, { + .id = SNOR_ID(0xef, 0x40, 0x18), + .name = "w25q128", ++ .size = SZ_16M, + .flags = SPI_NOR_HAS_LOCK | SPI_NOR_HAS_TB, ++ .no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ, + }, { + .id = SNOR_ID(0xef, 0x40, 0x19), + .name = "w25q256", +-- +2.43.0 + diff --git a/queue-6.10/net-bridge-mst-check-vlan-state-for-egress-decision.patch b/queue-6.10/net-bridge-mst-check-vlan-state-for-egress-decision.patch new file mode 100644 index 00000000000..312ac3c4e2a --- /dev/null +++ b/queue-6.10/net-bridge-mst-check-vlan-state-for-egress-decision.patch @@ -0,0 +1,45 @@ +From 96afc3b5db686373ca0ac5a110abb5800d89306b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 13:31:33 +1200 +Subject: net: bridge: mst: Check vlan state for egress decision + +From: Elliot Ayrey + +[ Upstream commit 0a1868b93fad5938dbcca77286b25bf211c49f7a ] + +If a port is blocking in the common instance but forwarding in an MST +instance, traffic egressing the bridge will be dropped because the +state of the common instance is overriding that of the MST instance. + +Fix this by skipping the port state check in MST mode to allow +checking the vlan state via br_allowed_egress(). This is similar to +what happens in br_handle_frame_finish() when checking ingress +traffic, which was introduced in the change below. + +Fixes: ec7328b59176 ("net: bridge: mst: Multiple Spanning Tree (MST) mode") +Signed-off-by: Elliot Ayrey +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_forward.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c +index d97064d460dc7..e19b583ff2c6d 100644 +--- a/net/bridge/br_forward.c ++++ b/net/bridge/br_forward.c +@@ -25,8 +25,8 @@ static inline int should_deliver(const struct net_bridge_port *p, + + vg = nbp_vlan_group_rcu(p); + return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) && +- p->state == BR_STATE_FORWARDING && br_allowed_egress(vg, skb) && +- nbp_switchdev_allowed_egress(p, skb) && ++ (br_mst_is_enabled(p->br) || p->state == BR_STATE_FORWARDING) && ++ br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) && + !br_skb_isolated(p, skb); + } + +-- +2.43.0 + diff --git a/queue-6.10/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch b/queue-6.10/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch new file mode 100644 index 00000000000..b844ccbdb5a --- /dev/null +++ b/queue-6.10/net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch @@ -0,0 +1,49 @@ +From b0a61b84d75004a03c43f07b538c83342b56351d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2024 11:08:20 +0200 +Subject: net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports + +From: Martin Willi + +[ Upstream commit c5118072e228e7e4385fc5ac46b2e31cf6c4f2d3 ] + +Broadcom switches supported by the b53 driver use a chip-wide jumbo frame +configuration. In the commit referenced with the Fixes tag, the setting +is applied just for the last port changing its MTU. + +While configuring CPU ports accounts for tagger overhead, user ports do +not. When setting the MTU for a user port, the chip-wide setting is +reduced to not include the tagger overhead, resulting in an potentially +insufficient chip-wide maximum frame size for the CPU port. + +As, by design, the CPU port MTU is adjusted for any user port change, +apply the chip-wide setting only for CPU ports. This aligns the driver +to the behavior of other switch drivers. + +Fixes: 6ae5834b983a ("net: dsa: b53: add MTU configuration support") +Suggested-by: Vladimir Oltean +Signed-off-by: Martin Willi +Reviewed-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/b53/b53_common.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 8f50abe739b71..0783fc121bbbf 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -2256,6 +2256,9 @@ static int b53_change_mtu(struct dsa_switch *ds, int port, int mtu) + if (is5325(dev) || is5365(dev)) + return -EOPNOTSUPP; + ++ if (!dsa_is_cpu_port(ds, port)) ++ return 0; ++ + enable_jumbo = (mtu >= JMS_MIN_SIZE); + allow_10_100 = (dev->chip_id == BCM583XX_DEVICE_ID); + +-- +2.43.0 + diff --git a/queue-6.10/net-dsa-ksz_common-allow-only-up-to-two-hsr-hw-offlo.patch b/queue-6.10/net-dsa-ksz_common-allow-only-up-to-two-hsr-hw-offlo.patch new file mode 100644 index 00000000000..44e67c95859 --- /dev/null +++ b/queue-6.10/net-dsa-ksz_common-allow-only-up-to-two-hsr-hw-offlo.patch @@ -0,0 +1,68 @@ +From 07ffcb887d226dceb663d7742d37b140872c20ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 16:58:09 +0200 +Subject: net: dsa: ksz_common: Allow only up to two HSR HW offloaded ports for + KSZ9477 + +From: Lukasz Majewski + +[ Upstream commit dcec8d291da8813b5e1c7c0967ae63463a8521f6 ] + +The KSZ9477 allows HSR in-HW offloading for any of two selected ports. +This patch adds check if one tries to use more than two ports with +HSR offloading enabled. + +The problem is with RedBox configuration (HSR-SAN) - when configuring: +ip link add name hsr0 type hsr slave1 lan1 slave2 lan2 interlink lan3 \ + supervision 45 version 1 + +The lan1 (port0) and lan2 (port1) are correctly configured as ports, which +can use HSR offloading on ksz9477. + +However, when we do already have two bits set in hsr_ports, we need to +return (-ENOTSUPP), so the interlink port (lan3) would be used with +SW based HSR RedBox support. + +Otherwise, I do see some strange network behavior, as some HSR frames are +visible on non-HSR network and vice versa. + +This causes the switch connected to interlink port (lan3) to drop frames +and no communication is possible. + +Moreover, conceptually - the interlink (i.e. HSR-SAN port - lan3/port2) +shall be only supported in software as it is also possible to use ksz9477 +with only SW based HSR (i.e. port0/1 -> hsr0 with offloading, port2 -> +HSR-SAN/interlink, port4/5 -> hsr1 with SW based HSR). + +Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)") +Signed-off-by: Lukasz Majewski +Reviewed-by: Andrew Lunn +Reviewed-by: Dan Carpenter +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index 0580b2fee21c3..baa1eeb9a1b04 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -3917,6 +3917,13 @@ static int ksz_hsr_join(struct dsa_switch *ds, int port, struct net_device *hsr, + return -EOPNOTSUPP; + } + ++ /* KSZ9477 can only perform HSR offloading for up to two ports */ ++ if (hweight8(dev->hsr_ports) >= 2) { ++ NL_SET_ERR_MSG_MOD(extack, ++ "Cannot offload more than two ports - using software HSR"); ++ return -EOPNOTSUPP; ++ } ++ + /* Self MAC address filtering, to avoid frames traversing + * the HSR ring more than once. + */ +-- +2.43.0 + diff --git a/queue-6.10/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch b/queue-6.10/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch new file mode 100644 index 00000000000..f9065918352 --- /dev/null +++ b/queue-6.10/net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch @@ -0,0 +1,50 @@ +From 785a713cff524a1b45c2b4d70fae6afd21e04554 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jul 2024 11:08:19 +0200 +Subject: net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports + +From: Martin Willi + +[ Upstream commit 66b6095c264e1b4e0a441c6329861806504e06c6 ] + +Marvell chips not supporting per-port jumbo frame size configurations use +a chip-wide frame size configuration. In the commit referenced with the +Fixes tag, the setting is applied just for the last port changing its MTU. + +While configuring CPU ports accounts for tagger overhead, user ports do +not. When setting the MTU for a user port, the chip-wide setting is +reduced to not include the tagger overhead, resulting in an potentially +insufficient maximum frame size for the CPU port. Specifically, sending +full-size frames from the CPU port on a MV88E6097 having a user port MTU +of 1500 bytes results in dropped frames. + +As, by design, the CPU port MTU is adjusted for any user port change, +apply the chip-wide setting only for CPU ports. + +Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU") +Suggested-by: Vladimir Oltean +Signed-off-by: Martin Willi +Reviewed-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 07c897b13de13..5b4e2ce5470d9 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3626,7 +3626,8 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + mv88e6xxx_reg_lock(chip); + if (chip->info->ops->port_set_jumbo_size) + ret = chip->info->ops->port_set_jumbo_size(chip, port, new_mtu); +- else if (chip->info->ops->set_max_frame_size) ++ else if (chip->info->ops->set_max_frame_size && ++ dsa_is_cpu_port(ds, port)) + ret = chip->info->ops->set_max_frame_size(chip, new_mtu); + mv88e6xxx_reg_unlock(chip); + +-- +2.43.0 + diff --git a/queue-6.10/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch b/queue-6.10/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch new file mode 100644 index 00000000000..b574192e2c5 --- /dev/null +++ b/queue-6.10/net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch @@ -0,0 +1,63 @@ +From b9cd0a3980a1c2474bb35d7c238cc88cd0adee95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 13:04:39 +0000 +Subject: net: esp: cleanup esp_output_tail_tcp() in case of unsupported + ESPINTCP + +From: Hagar Hemdan + +[ Upstream commit 96f887a612e4cda89efc3f54bc10c1997e3ab0e9 ] + +xmit() functions should consume skb or return error codes in error +paths. +When the configuration "CONFIG_INET_ESPINTCP" is not set, the +implementation of the function "esp_output_tail_tcp" violates this rule. +The function frees the skb and returns the error code. +This change removes the kfree_skb from both functions, for both +esp4 and esp6. +WARN_ON is added because esp_output_tail_tcp() should never be called if +CONFIG_INET_ESPINTCP is not set. + +This bug was discovered and resolved using Coverity Static Analysis +Security Testing (SAST) by Synopsys, Inc. + +Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)") +Signed-off-by: Hagar Hemdan +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4.c | 3 +-- + net/ipv6/esp6.c | 3 +-- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 3968d3f98e083..619a4df7be1e8 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -239,8 +239,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + #else + static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + { +- kfree_skb(skb); +- ++ WARN_ON(1); + return -EOPNOTSUPP; + } + #endif +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 34a9a5b9ed00b..3920e8aa1031e 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -256,8 +256,7 @@ static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + #else + static int esp_output_tail_tcp(struct xfrm_state *x, struct sk_buff *skb) + { +- kfree_skb(skb); +- ++ WARN_ON(1); + return -EOPNOTSUPP; + } + #endif +-- +2.43.0 + diff --git a/queue-6.10/net-ethernet-cortina-restore-tso-support.patch b/queue-6.10/net-ethernet-cortina-restore-tso-support.patch new file mode 100644 index 00000000000..f219e5fe2f9 --- /dev/null +++ b/queue-6.10/net-ethernet-cortina-restore-tso-support.patch @@ -0,0 +1,135 @@ +From 6db0f444e0da58eec153aa5299016a6fa66f4ff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 21:26:44 +0200 +Subject: net: ethernet: cortina: Restore TSO support + +From: Linus Walleij + +[ Upstream commit 2942dfab630444d46aaa37fb7d629b620abbf6ba ] + +An earlier commit deleted the TSO support in the Cortina Gemini +driver because the driver was confusing gso_size and MTU, +probably because what the Linux kernel calls "gso_size" was +called "MTU" in the datasheet. + +Restore the functionality properly reading the gso_size from +the skbuff. + +Tested with iperf3, running a server on a different machine +and client on the device with the cortina gemini ethernet: + +Connecting to host 192.168.1.2, port 5201 +60008000.ethernet-port eth0: segment offloading mss = 05ea len=1c8a +60008000.ethernet-port eth0: segment offloading mss = 05ea len=1c8a +60008000.ethernet-port eth0: segment offloading mss = 05ea len=27da +60008000.ethernet-port eth0: segment offloading mss = 05ea len=0b92 +60008000.ethernet-port eth0: segment offloading mss = 05ea len=2bda +(...) + +(The hardware MSS 0x05ea here includes the ethernet headers.) + +If I disable all segment offloading on the receiving host and +dump packets using tcpdump -xx like this: + +ethtool -K enp2s0 gro off gso off tso off +tcpdump -xx -i enp2s0 host 192.168.1.136 + +I get segmented packages such as this when running iperf3: + +23:16:54.024139 IP OpenWrt.lan.59168 > Fecusia.targus-getdata1: +Flags [.], seq 1486:2934, ack 1, win 4198, +options [nop,nop,TS val 3886192908 ecr 3601341877], length 1448 +0x0000: fc34 9701 a0c6 14d6 4da8 3c4f 0800 4500 +0x0010: 05dc 16a0 4000 4006 9aa1 c0a8 0188 c0a8 +0x0020: 0102 e720 1451 ff25 9822 4c52 29cf 8010 +0x0030: 1066 ac8c 0000 0101 080a e7a2 990c d6a8 +(...) +0x05c0: 5e49 e109 fe8c 4617 5e18 7a82 7eae d647 +0x05d0: e8ee ae64 dc88 c897 3f8a 07a4 3a33 6b1b +0x05e0: 3501 a30f 2758 cc44 4b4a + +Several such packets often follow after each other verifying +the segmentation into 0x05a8 (1448) byte packages also on the +reveiving end. As can be seen, the ethernet frames are +0x05ea (1514) in size. + +Performance with iperf3 before this patch: ~15.5 Mbit/s +Performance with iperf3 after this patch: ~175 Mbit/s + +This was running a 60 second test (twice) the best measurement +was 179 Mbit/s. + +For comparison if I run iperf3 with UDP I get around 1.05 Mbit/s +both before and after this patch. + +While this is a gigabit ethernet interface, the CPU is a cheap +D-Link DIR-685 router (based on the ARMv5 Faraday FA526 at +~50 MHz), and the software is not supposed to drive traffic, +as the device has a DSA chip, so this kind of numbers can be +expected. + +Fixes: ac631873c9e7 ("net: ethernet: cortina: Drop TSO support") +Reviewed-by: Eric Dumazet +Signed-off-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 5f0c9e1771dbf..7ebd61a3a49b0 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -79,7 +79,8 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)"); + #define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT) + + #define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \ +- NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM) ++ NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \ ++ NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6) + + /** + * struct gmac_queue_page - page buffer per-page info +@@ -1148,13 +1149,25 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + skb_frag_t *skb_frag; + dma_addr_t mapping; + void *buffer; ++ u16 mss; + int ret; + +- /* TODO: implement proper TSO using MTU in word3 */ + word1 = skb->len; + word3 = SOF_BIT; + +- if (skb->len >= ETH_FRAME_LEN) { ++ mss = skb_shinfo(skb)->gso_size; ++ if (mss) { ++ /* This means we are dealing with TCP and skb->len is the ++ * sum total of all the segments. The TSO will deal with ++ * chopping this up for us. ++ */ ++ /* The accelerator needs the full frame size here */ ++ mss += skb_tcp_all_headers(skb); ++ netdev_dbg(netdev, "segment offloading mss = %04x len=%04x\n", ++ mss, skb->len); ++ word1 |= TSS_MTU_ENABLE_BIT; ++ word3 |= mss; ++ } else if (skb->len >= ETH_FRAME_LEN) { + /* Hardware offloaded checksumming isn't working on frames + * bigger than 1514 bytes. A hypothesis about this is that the + * checksum buffer is only 1518 bytes, so when the frames get +@@ -1169,7 +1182,9 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb, + return ret; + } + word1 |= TSS_BYPASS_BIT; +- } else if (skb->ip_summed == CHECKSUM_PARTIAL) { ++ } ++ ++ if (skb->ip_summed == CHECKSUM_PARTIAL) { + int tcp = 0; + + /* We do not switch off the checksumming on non TCP/UDP +-- +2.43.0 + diff --git a/queue-6.10/net-ethtool-pse-pd-fix-possible-null-deref.patch b/queue-6.10/net-ethtool-pse-pd-fix-possible-null-deref.patch new file mode 100644 index 00000000000..349d05d353a --- /dev/null +++ b/queue-6.10/net-ethtool-pse-pd-fix-possible-null-deref.patch @@ -0,0 +1,43 @@ +From 6e5e487f0ea1aba682eec8a0c1f316b1f572c03d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:55:19 +0200 +Subject: net: ethtool: pse-pd: Fix possible null-deref + +From: Kory Maincent + +[ Upstream commit 4cddb0f15ea9c62f81b4889ea69a99368cc63a86 ] + +Fix a possible null dereference when a PSE supports both c33 and PoDL, but +only one of the netlink attributes is specified. The c33 or PoDL PSE +capabilities are already validated in the ethnl_set_pse_validate() call. + +Signed-off-by: Kory Maincent +Reported-by: Jakub Kicinski +Closes: https://lore.kernel.org/netdev/20240705184116.13d8235a@kernel.org/ +Fixes: 4d18e3ddf427 ("net: ethtool: pse-pd: Expand pse commands with the PSE PoE interface") +Link: https://patch.msgid.link/20240711-fix_pse_pd_deref-v3-2-edd78fc4fe42@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ethtool/pse-pd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ethtool/pse-pd.c b/net/ethtool/pse-pd.c +index 982995ff16280..776ac96cdadc9 100644 +--- a/net/ethtool/pse-pd.c ++++ b/net/ethtool/pse-pd.c +@@ -178,9 +178,9 @@ ethnl_set_pse(struct ethnl_req_info *req_info, struct genl_info *info) + + phydev = dev->phydev; + /* These values are already validated by the ethnl_pse_set_policy */ +- if (pse_has_podl(phydev->psec)) ++ if (tb[ETHTOOL_A_PODL_PSE_ADMIN_CONTROL]) + config.podl_admin_control = nla_get_u32(tb[ETHTOOL_A_PODL_PSE_ADMIN_CONTROL]); +- if (pse_has_c33(phydev->psec)) ++ if (tb[ETHTOOL_A_C33_PSE_ADMIN_CONTROL]) + config.c33_admin_control = nla_get_u32(tb[ETHTOOL_A_C33_PSE_ADMIN_CONTROL]); + + /* Return errno directly - PSE has no notification +-- +2.43.0 + diff --git a/queue-6.10/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch b/queue-6.10/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch new file mode 100644 index 00000000000..7df831c39e2 --- /dev/null +++ b/queue-6.10/net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch @@ -0,0 +1,50 @@ +From c48097ddc3ab7a49f5cd745853ccb26bd4798e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 14:31:11 +0200 +Subject: net: fec: Fix FEC_ECR_EN1588 being cleared on link-down +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás, Bence + +[ Upstream commit c32fe1986f27cac329767d3497986e306cad1d5e ] + +FEC_ECR_EN1588 bit gets cleared after MAC reset in `fec_stop()`, which +makes all 1588 functionality shut down, and all the extended registers +disappear, on link-down, making the adapter fall back to compatibility +"dumb mode". However, some functionality needs to be retained (e.g. PPS) +even without link. + +Fixes: 6605b730c061 ("FEC: Add time stamping code and a PTP hardware clock") +Cc: Richard Cochran +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/netdev/5fa9fadc-a89d-467a-aae9-c65469ff5fe1@lunn.ch/ +Signed-off-by: Csókás, Bence +Reviewed-by: Wei Fang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 881ece735dcf1..fb19295529a21 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1361,6 +1361,12 @@ fec_stop(struct net_device *ndev) + writel(FEC_ECR_ETHEREN, fep->hwp + FEC_ECNTRL); + writel(rmii_mode, fep->hwp + FEC_R_CNTRL); + } ++ ++ if (fep->bufdesc_ex) { ++ val = readl(fep->hwp + FEC_ECNTRL); ++ val |= FEC_ECR_EN1588; ++ writel(val, fep->hwp + FEC_ECNTRL); ++ } + } + + static void +-- +2.43.0 + diff --git a/queue-6.10/net-flow_dissector-use-debug_net_warn_on_once.patch b/queue-6.10/net-flow_dissector-use-debug_net_warn_on_once.patch new file mode 100644 index 00000000000..b87319c8887 --- /dev/null +++ b/queue-6.10/net-flow_dissector-use-debug_net_warn_on_once.patch @@ -0,0 +1,81 @@ +From d619c677b200f15e14d3020b13a5b371e33626e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 16:14:42 +0200 +Subject: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE + +From: Pablo Neira Ayuso + +[ Upstream commit 120f1c857a73e52132e473dee89b340440cb692b ] + +The following splat is easy to reproduce upstream as well as in -stable +kernels. Florian Westphal provided the following commit: + + d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net") + +but this complementary fix has been also suggested by Willem de Bruijn +and it can be easily backported to -stable kernel which consists in +using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat +given __skb_get_hash() is used by the nftables tracing infrastructure to +to identify packets in traces. + +[69133.561393] ------------[ cut here ]------------ +[69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/ +[...] +[69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379 +[69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 +[69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff +ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 +[69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 +[69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 +[69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418 +[69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 +[69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400 +[69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 +[69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 +[69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0 +[69133.562040] Call Trace: +[69133.562044] +[69133.562049] ? __warn+0x9f/0x1a0 +[ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 +[...] +[ 1211.841496] ? bpf_flow_dissect+0x160/0x160 +[ 1211.841753] __skb_get_hash+0x97/0x280 +[ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230 +[ 1211.841776] ? mod_find+0xbf/0xe0 +[ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0 +[ 1211.841798] ? bpf_ksym_find+0x56/0xe0 +[ 1211.841807] ? __rcu_read_unlock+0x2a/0x70 +[ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] +[ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables] +[ 1211.841964] ? get_stack_info+0x2b/0x80 +[ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables] +[ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables] + +Fixes: 9b52e3f267a6 ("flow_dissector: handle no-skb use case") +Suggested-by: Willem de Bruijn +Signed-off-by: Pablo Neira Ayuso +Reviewed-by: Willem de Bruijn +Link: https://patch.msgid.link/20240715141442.43775-1-pablo@netfilter.org +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/flow_dissector.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index f82e9a7d3b379..7b54f44f5372a 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1101,7 +1101,7 @@ bool __skb_flow_dissect(const struct net *net, + } + } + +- WARN_ON_ONCE(!net); ++ DEBUG_NET_WARN_ON_ONCE(!net); + if (net) { + enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR; + struct bpf_prog_array *run_array; +-- +2.43.0 + diff --git a/queue-6.10/net-missing-check-virtio.patch b/queue-6.10/net-missing-check-virtio.patch new file mode 100644 index 00000000000..85dd8cc358d --- /dev/null +++ b/queue-6.10/net-missing-check-virtio.patch @@ -0,0 +1,119 @@ +From 35b9ff5bcec9589b07f0ac200d38588269af9455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 12:54:48 +0300 +Subject: net: missing check virtio + +From: Denis Arefev + +[ Upstream commit e269d79c7d35aa3808b1f3c1737d63dab504ddc8 ] + +Two missing check in virtio_net_hdr_to_skb() allowed syzbot +to crash kernels again + +1. After the skb_segment function the buffer may become non-linear +(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere +the __skb_linearize function will not be executed, then the buffer will +remain non-linear. Then the condition (offset >= skb_headlen(skb)) +becomes true, which causes WARN_ON_ONCE in skb_checksum_help. + +2. The struct sk_buff and struct virtio_net_hdr members must be +mathematically related. +(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE. +(remainder) must be greater than (needed) otherwise WARN_ON_ONCE. +(remainder) may be 0 if division is without remainder. + +offset+2 (4191) > skb_headlen() (1116) +WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 +Modules linked in: +CPU: 1 PID: 5084 Comm: syz-executor336 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0 +Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 +RIP: 0010:skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303 +Code: 89 e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 52 01 00 00 44 89 e2 2b 53 74 4c 89 ee 48 c7 c7 40 57 e9 8b e8 af 8f dd f8 90 <0f> 0b 90 90 e9 87 fe ff ff e8 40 0f 6e f9 e9 4b fa ff ff 48 89 ef +RSP: 0018:ffffc90003a9f338 EFLAGS: 00010286 +RAX: 0000000000000000 RBX: ffff888025125780 RCX: ffffffff814db209 +RDX: ffff888015393b80 RSI: ffffffff814db216 RDI: 0000000000000001 +RBP: ffff8880251257f4 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000045c +R13: 000000000000105f R14: ffff8880251257f0 R15: 000000000000105d +FS: 0000555555c24380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000002000f000 CR3: 0000000023151000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ip_do_fragment+0xa1b/0x18b0 net/ipv4/ip_output.c:777 + ip_fragment.constprop.0+0x161/0x230 net/ipv4/ip_output.c:584 + ip_finish_output_gso net/ipv4/ip_output.c:286 [inline] + __ip_finish_output net/ipv4/ip_output.c:308 [inline] + __ip_finish_output+0x49c/0x650 net/ipv4/ip_output.c:295 + ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 + NF_HOOK_COND include/linux/netfilter.h:303 [inline] + ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:433 + dst_output include/net/dst.h:451 [inline] + ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:129 + iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 + ipip6_tunnel_xmit net/ipv6/sit.c:1034 [inline] + sit_tunnel_xmit+0xed2/0x28f0 net/ipv6/sit.c:1076 + __netdev_start_xmit include/linux/netdevice.h:4940 [inline] + netdev_start_xmit include/linux/netdevice.h:4954 [inline] + xmit_one net/core/dev.c:3545 [inline] + dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3561 + __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4346 + dev_queue_xmit include/linux/netdevice.h:3134 [inline] + packet_xmit+0x257/0x380 net/packet/af_packet.c:276 + packet_snd net/packet/af_packet.c:3087 [inline] + packet_sendmsg+0x24ca/0x5240 net/packet/af_packet.c:3119 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0xd5/0x180 net/socket.c:745 + __sys_sendto+0x255/0x340 net/socket.c:2190 + __do_sys_sendto net/socket.c:2202 [inline] + __se_sys_sendto net/socket.c:2198 [inline] + __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller + +Fixes: 0f6925b3e8da ("virtio_net: Do not pull payload in skb->head") +Signed-off-by: Denis Arefev +Message-Id: <20240613095448.27118-1-arefev@swemel.ru> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + include/linux/virtio_net.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index 4dfa9b69ca8d9..d1d7825318c32 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -56,6 +56,7 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + unsigned int thlen = 0; + unsigned int p_off = 0; + unsigned int ip_proto; ++ u64 ret, remainder, gso_size; + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) { +@@ -98,6 +99,16 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + u32 off = __virtio16_to_cpu(little_endian, hdr->csum_offset); + u32 needed = start + max_t(u32, thlen, off + sizeof(__sum16)); + ++ if (hdr->gso_size) { ++ gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ ret = div64_u64_rem(skb->len, gso_size, &remainder); ++ if (!(ret && (hdr->gso_size > needed) && ++ ((remainder > needed) || (remainder == 0)))) { ++ return -EINVAL; ++ } ++ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; ++ } ++ + if (!pskb_may_pull(skb, needed)) + return -EINVAL; + +-- +2.43.0 + diff --git a/queue-6.10/net-page_pool-fix-warning-code.patch b/queue-6.10/net-page_pool-fix-warning-code.patch new file mode 100644 index 00000000000..c88bc122d7e --- /dev/null +++ b/queue-6.10/net-page_pool-fix-warning-code.patch @@ -0,0 +1,37 @@ +From c6932ee24a0e1357f34253160e615f7f0800a18b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 13:42:06 +0200 +Subject: net: page_pool: fix warning code + +From: Johannes Berg + +[ Upstream commit 946b6c48cca48591fb495508c5dbfade767173d0 ] + +WARN_ON_ONCE("string") doesn't really do what appears to +be intended, so fix that. + +Signed-off-by: Johannes Berg +Fixes: 90de47f020db ("page_pool: fragment API support for 32-bit arch with 64-bit DMA") +Link: https://patch.msgid.link/20240705134221.2f4de205caa1.I28496dc0f2ced580282d1fb892048017c4491e21@changeid +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/page_pool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/page_pool.c b/net/core/page_pool.c +index f4444b4e39e63..3772eb63dcad1 100644 +--- a/net/core/page_pool.c ++++ b/net/core/page_pool.c +@@ -445,7 +445,7 @@ static bool page_pool_dma_map(struct page_pool *pool, struct page *page) + return true; + + unmap_failed: +- WARN_ON_ONCE("unexpected DMA address, please report to netdev@"); ++ WARN_ONCE(1, "unexpected DMA address, please report to netdev@"); + dma_unmap_page_attrs(pool->p.dev, dma, + PAGE_SIZE << pool->p.order, pool->p.dma_dir, + DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING); +-- +2.43.0 + diff --git a/queue-6.10/net-pse-pd-do-not-return-eopnosupp-if-config-is-null.patch b/queue-6.10/net-pse-pd-do-not-return-eopnosupp-if-config-is-null.patch new file mode 100644 index 00000000000..ecb74765a56 --- /dev/null +++ b/queue-6.10/net-pse-pd-do-not-return-eopnosupp-if-config-is-null.patch @@ -0,0 +1,62 @@ +From eea7e434b109bfefba2f27b58c43bcf618a8b6b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 15:55:18 +0200 +Subject: net: pse-pd: Do not return EOPNOSUPP if config is null + +From: Kory Maincent + +[ Upstream commit 93c3a96c301f0b1ac0bafb5e74bef58e79937648 ] + +For a PSE supporting both c33 and PoDL, setting config for one type of PoE +leaves the other type's config null. Currently, this case returns +EOPNOTSUPP, which is incorrect. Instead, we should do nothing if the +configuration is empty. + +Signed-off-by: Kory Maincent +Fixes: d83e13761d5b ("net: pse-pd: Use regulator framework within PSE framework") +Link: https://patch.msgid.link/20240711-fix_pse_pd_deref-v3-1-edd78fc4fe42@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/pse-pd/pse_core.c | 4 ++-- + net/ethtool/pse-pd.c | 4 +++- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c +index 795ab264eaf27..513cd7f859337 100644 +--- a/drivers/net/pse-pd/pse_core.c ++++ b/drivers/net/pse-pd/pse_core.c +@@ -719,13 +719,13 @@ int pse_ethtool_set_config(struct pse_control *psec, + { + int err = 0; + +- if (pse_has_c33(psec)) { ++ if (pse_has_c33(psec) && config->c33_admin_control) { + err = pse_ethtool_c33_set_config(psec, config); + if (err) + return err; + } + +- if (pse_has_podl(psec)) ++ if (pse_has_podl(psec) && config->podl_admin_control) + err = pse_ethtool_podl_set_config(psec, config); + + return err; +diff --git a/net/ethtool/pse-pd.c b/net/ethtool/pse-pd.c +index 2c981d443f27e..982995ff16280 100644 +--- a/net/ethtool/pse-pd.c ++++ b/net/ethtool/pse-pd.c +@@ -183,7 +183,9 @@ ethnl_set_pse(struct ethnl_req_info *req_info, struct genl_info *info) + if (pse_has_c33(phydev->psec)) + config.c33_admin_control = nla_get_u32(tb[ETHTOOL_A_C33_PSE_ADMIN_CONTROL]); + +- /* Return errno directly - PSE has no notification */ ++ /* Return errno directly - PSE has no notification ++ * pse_ethtool_set_config() will do nothing if the config is null ++ */ + return pse_ethtool_set_config(phydev->psec, info->extack, &config); + } + +-- +2.43.0 + diff --git a/queue-6.10/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch b/queue-6.10/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch new file mode 100644 index 00000000000..d9a0eb2b7d5 --- /dev/null +++ b/queue-6.10/net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch @@ -0,0 +1,57 @@ +From 41433322acb3e23a26d375090affbc80463dc367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 11:00:18 +0800 +Subject: net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when + CONFIG_ARCH_NO_SG_CHAIN is defined + +From: Guangguan Wang + +[ Upstream commit 3ac14b9dfbd345e891d48d89f6c2fa519848f0f4 ] + +SG_MAX_SINGLE_ALLOC is used to limit maximum number of entries that +will be allocated in one piece of scatterlist. When the entries of +scatterlist exceeds SG_MAX_SINGLE_ALLOC, sg chain will be used. From +commit 7c703e54cc71 ("arch: switch the default on ARCH_HAS_SG_CHAIN"), +we can know that the macro CONFIG_ARCH_NO_SG_CHAIN is used to identify +whether sg chain is supported. So, SMC-R's rmb buffer should be limited +by SG_MAX_SINGLE_ALLOC only when the macro CONFIG_ARCH_NO_SG_CHAIN is +defined. + +Fixes: a3fe3d01bd0d ("net/smc: introduce sg-logic for RMBs") +Signed-off-by: Guangguan Wang +Co-developed-by: Wen Gu +Signed-off-by: Wen Gu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index fafdb97adfad9..acca3b1a068f0 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -2015,7 +2015,6 @@ int smc_conn_create(struct smc_sock *smc, struct smc_init_info *ini) + */ + static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + { +- const unsigned int max_scat = SG_MAX_SINGLE_ALLOC * PAGE_SIZE; + u8 compressed; + + if (size <= SMC_BUF_MIN_SIZE) +@@ -2025,9 +2024,11 @@ static u8 smc_compress_bufsize(int size, bool is_smcd, bool is_rmb) + compressed = min_t(u8, ilog2(size) + 1, + is_smcd ? SMCD_DMBE_SIZES : SMCR_RMBE_SIZES); + ++#ifdef CONFIG_ARCH_NO_SG_CHAIN + if (!is_smcd && is_rmb) + /* RMBs are backed by & limited to max size of scatterlists */ +- compressed = min_t(u8, compressed, ilog2(max_scat >> 14)); ++ compressed = min_t(u8, compressed, ilog2((SG_MAX_SINGLE_ALLOC * PAGE_SIZE) >> 14)); ++#endif + + return compressed; + } +-- +2.43.0 + diff --git a/queue-6.10/netfilter-ctnetlink-use-helper-function-to-calculate.patch b/queue-6.10/netfilter-ctnetlink-use-helper-function-to-calculate.patch new file mode 100644 index 00000000000..29ff4314f75 --- /dev/null +++ b/queue-6.10/netfilter-ctnetlink-use-helper-function-to-calculate.patch @@ -0,0 +1,38 @@ +From 2e8eb6808e7a9271e430dc70ab7e8c8024bcc73d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2024 16:47:38 +0200 +Subject: netfilter: ctnetlink: use helper function to calculate expect ID + +From: Pablo Neira Ayuso + +[ Upstream commit 782161895eb4ac45cf7cfa8db375bd4766cb8299 ] + +Delete expectation path is missing a call to the nf_expect_get_id() +helper function to calculate the expectation ID, otherwise LSB of the +expectation object address is leaked to userspace. + +Fixes: 3c79107631db ("netfilter: ctnetlink: don't use conntrack/expect object addresses as id") +Reported-by: zdi-disclosures@trendmicro.com +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 3b846cbdc050d..4cbf71d0786b0 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3420,7 +3420,8 @@ static int ctnetlink_del_expect(struct sk_buff *skb, + + if (cda[CTA_EXPECT_ID]) { + __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); +- if (ntohl(id) != (u32)(unsigned long)exp) { ++ ++ if (id != nf_expect_get_id(exp)) { + nf_ct_expect_put(exp); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-6.10/netfilter-nf_set_pipapo-fix-initial-map-fill.patch b/queue-6.10/netfilter-nf_set_pipapo-fix-initial-map-fill.patch new file mode 100644 index 00000000000..56456bc001a --- /dev/null +++ b/queue-6.10/netfilter-nf_set_pipapo-fix-initial-map-fill.patch @@ -0,0 +1,142 @@ +From 2b0ba83bbb868bfd10a6e8a982692a8c3c50fc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:54:03 +0200 +Subject: netfilter: nf_set_pipapo: fix initial map fill + +From: Florian Westphal + +[ Upstream commit 791a615b7ad2258c560f91852be54b0480837c93 ] + +The initial buffer has to be inited to all-ones, but it must restrict +it to the size of the first field, not the total field size. + +After each round in the map search step, the result and the fill map +are swapped, so if we have a set where f->bsize of the first element +is smaller than m->bsize_max, those one-bits are leaked into future +rounds result map. + +This makes pipapo find an incorrect matching results for sets where +first field size is not the largest. + +Followup patch adds a test case to nft_concat_range.sh selftest script. + +Thanks to Stefano Brivio for pointing out that we need to zero out +the remainder explicitly, only correcting memset() argument isn't enough. + +Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") +Reported-by: Yi Chen +Cc: Stefano Brivio +Signed-off-by: Florian Westphal +Reviewed-by: Stefano Brivio +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_pipapo.c | 4 ++-- + net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++ + net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++---- + 3 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c +index 15a236bebb46a..eb4c4a4ac7ace 100644 +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -434,7 +434,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, + res_map = scratch->map + (map_index ? m->bsize_max : 0); + fill_map = scratch->map + (map_index ? 0 : m->bsize_max); + +- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); ++ pipapo_resmap_init(m, res_map); + + nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; +@@ -542,7 +542,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, + goto out; + } + +- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); ++ pipapo_resmap_init(m, res_map); + + nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; +diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h +index 0d2e40e10f7f5..4a2ff85ce1c43 100644 +--- a/net/netfilter/nft_set_pipapo.h ++++ b/net/netfilter/nft_set_pipapo.h +@@ -278,4 +278,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc) + return size; + } + ++/** ++ * pipapo_resmap_init() - Initialise result map before first use ++ * @m: Matching data, including mapping table ++ * @res_map: Result map ++ * ++ * Initialize all bits covered by the first field to one, so that after ++ * the first step, only the matching bits of the first bit group remain. ++ * ++ * If other fields have a large bitmap, set remainder of res_map to 0. ++ */ ++static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map) ++{ ++ const struct nft_pipapo_field *f = m->f; ++ int i; ++ ++ for (i = 0; i < f->bsize; i++) ++ res_map[i] = ULONG_MAX; ++ ++ for (i = f->bsize; i < m->bsize_max; i++) ++ res_map[i] = 0ul; ++} + #endif /* _NFT_SET_PIPAPO_H */ +diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c +index d08407d589eac..8910a5ac7ed12 100644 +--- a/net/netfilter/nft_set_pipapo_avx2.c ++++ b/net/netfilter/nft_set_pipapo_avx2.c +@@ -1036,6 +1036,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + + /** + * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes ++ * @mdata: Matching data, including mapping table + * @map: Previous match result, used as initial bitmap + * @fill: Destination bitmap to be filled with current match result + * @f: Field, containing lookup and mapping tables +@@ -1051,7 +1052,8 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, + * Return: -1 on no match, rule index of match if @last, otherwise first long + * word index to be checked next (i.e. first filled word). + */ +-static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, ++static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata, ++ unsigned long *map, unsigned long *fill, + const struct nft_pipapo_field *f, + int offset, const u8 *pkt, + bool first, bool last) +@@ -1060,7 +1062,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, + int i, ret = -1, b; + + if (first) +- memset(map, 0xff, bsize * sizeof(*map)); ++ pipapo_resmap_init(mdata, map); + + for (i = offset; i < bsize; i++) { + if (f->bb == 8) +@@ -1186,7 +1188,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, + } else if (f->groups == 16) { + NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16); + } else { +- ret = nft_pipapo_avx2_lookup_slow(res, fill, f, ++ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, + ret, rp, + first, last); + } +@@ -1202,7 +1204,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, + } else if (f->groups == 32) { + NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32); + } else { +- ret = nft_pipapo_avx2_lookup_slow(res, fill, f, ++ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, + ret, rp, + first, last); + } +-- +2.43.0 + diff --git a/queue-6.10/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch b/queue-6.10/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch new file mode 100644 index 00000000000..77779f9e9f6 --- /dev/null +++ b/queue-6.10/netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch @@ -0,0 +1,34 @@ +From bc1eb1db21f7d9306e0df9a0d32886395afb5cae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 20:16:59 +0200 +Subject: netfilter: nf_tables: rise cap on SELinux secmark context + +From: Pablo Neira Ayuso + +[ Upstream commit e29630247be24c3987e2b048f8e152771b32d38b ] + +secmark context is artificially limited 256 bytes, rise it to 4Kbytes. + +Fixes: fb961945457f ("netfilter: nf_tables: add SECMARK support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_tables.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index aa4094ca2444f..639894ed1b973 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -1376,7 +1376,7 @@ enum nft_secmark_attributes { + #define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1) + + /* Max security context length */ +-#define NFT_SECMARK_CTX_MAXLEN 256 ++#define NFT_SECMARK_CTX_MAXLEN 4096 + + /** + * enum nft_reject_types - nf_tables reject expression reject types +-- +2.43.0 + diff --git a/queue-6.10/nfs-pass-explicit-offset-count-to-trace-events.patch b/queue-6.10/nfs-pass-explicit-offset-count-to-trace-events.patch new file mode 100644 index 00000000000..e9db02680c3 --- /dev/null +++ b/queue-6.10/nfs-pass-explicit-offset-count-to-trace-events.patch @@ -0,0 +1,235 @@ +From 14216eea339acaade80ca4ef2d39a9802ecf7a1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 09:17:02 +0200 +Subject: nfs: pass explicit offset/count to trace events +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit fada32ed6dbc748f447c8d050a961b75d946055a ] + +nfs_folio_length is unsafe to use without having the folio locked and a +check for a NULL ->f_mapping that protects against truncations and can +lead to kernel crashes. E.g. when running xfstests generic/065 with +all nfs trace points enabled. + +Follow the model of the XFS trace points and pass in an explіcit offset +and length. This has the additional benefit that these values can +be more accurate as some of the users touch partial folio ranges. + +Fixes: eb5654b3b89d ("NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio()") +Reported-by: Chuck Lever +Signed-off-by: Christoph Hellwig +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/file.c | 5 +++-- + fs/nfs/nfstrace.h | 36 ++++++++++++++++++++---------------- + fs/nfs/read.c | 8 +++++--- + fs/nfs/write.c | 10 +++++----- + 4 files changed, 33 insertions(+), 26 deletions(-) + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 6bd127e6683dc..445db17f1b6c1 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -434,7 +434,7 @@ static void nfs_invalidate_folio(struct folio *folio, size_t offset, + /* Cancel any unstarted writes on this page */ + nfs_wb_folio_cancel(inode, folio); + folio_wait_private_2(folio); /* [DEPRECATED] */ +- trace_nfs_invalidate_folio(inode, folio); ++ trace_nfs_invalidate_folio(inode, folio_pos(folio) + offset, length); + } + + /* +@@ -502,7 +502,8 @@ static int nfs_launder_folio(struct folio *folio) + + folio_wait_private_2(folio); /* [DEPRECATED] */ + ret = nfs_wb_folio(inode, folio); +- trace_nfs_launder_folio_done(inode, folio, ret); ++ trace_nfs_launder_folio_done(inode, folio_pos(folio), ++ folio_size(folio), ret); + return ret; + } + +diff --git a/fs/nfs/nfstrace.h b/fs/nfs/nfstrace.h +index 1e710654af117..352fdaed40754 100644 +--- a/fs/nfs/nfstrace.h ++++ b/fs/nfs/nfstrace.h +@@ -939,10 +939,11 @@ TRACE_EVENT(nfs_sillyrename_unlink, + DECLARE_EVENT_CLASS(nfs_folio_event, + TP_PROTO( + const struct inode *inode, +- struct folio *folio ++ loff_t offset, ++ size_t count + ), + +- TP_ARGS(inode, folio), ++ TP_ARGS(inode, offset, count), + + TP_STRUCT__entry( + __field(dev_t, dev) +@@ -950,7 +951,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event, + __field(u64, fileid) + __field(u64, version) + __field(loff_t, offset) +- __field(u32, count) ++ __field(size_t, count) + ), + + TP_fast_assign( +@@ -960,13 +961,13 @@ DECLARE_EVENT_CLASS(nfs_folio_event, + __entry->fileid = nfsi->fileid; + __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); + __entry->version = inode_peek_iversion_raw(inode); +- __entry->offset = folio_file_pos(folio); +- __entry->count = nfs_folio_length(folio); ++ __entry->offset = offset, ++ __entry->count = count; + ), + + TP_printk( + "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " +- "offset=%lld count=%u", ++ "offset=%lld count=%zu", + MAJOR(__entry->dev), MINOR(__entry->dev), + (unsigned long long)__entry->fileid, + __entry->fhandle, __entry->version, +@@ -978,18 +979,20 @@ DECLARE_EVENT_CLASS(nfs_folio_event, + DEFINE_EVENT(nfs_folio_event, name, \ + TP_PROTO( \ + const struct inode *inode, \ +- struct folio *folio \ ++ loff_t offset, \ ++ size_t count \ + ), \ +- TP_ARGS(inode, folio)) ++ TP_ARGS(inode, offset, count)) + + DECLARE_EVENT_CLASS(nfs_folio_event_done, + TP_PROTO( + const struct inode *inode, +- struct folio *folio, ++ loff_t offset, ++ size_t count, + int ret + ), + +- TP_ARGS(inode, folio, ret), ++ TP_ARGS(inode, offset, count, ret), + + TP_STRUCT__entry( + __field(dev_t, dev) +@@ -998,7 +1001,7 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, + __field(u64, fileid) + __field(u64, version) + __field(loff_t, offset) +- __field(u32, count) ++ __field(size_t, count) + ), + + TP_fast_assign( +@@ -1008,14 +1011,14 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, + __entry->fileid = nfsi->fileid; + __entry->fhandle = nfs_fhandle_hash(&nfsi->fh); + __entry->version = inode_peek_iversion_raw(inode); +- __entry->offset = folio_file_pos(folio); +- __entry->count = nfs_folio_length(folio); ++ __entry->offset = offset, ++ __entry->count = count, + __entry->ret = ret; + ), + + TP_printk( + "fileid=%02x:%02x:%llu fhandle=0x%08x version=%llu " +- "offset=%lld count=%u ret=%d", ++ "offset=%lld count=%zu ret=%d", + MAJOR(__entry->dev), MINOR(__entry->dev), + (unsigned long long)__entry->fileid, + __entry->fhandle, __entry->version, +@@ -1027,10 +1030,11 @@ DECLARE_EVENT_CLASS(nfs_folio_event_done, + DEFINE_EVENT(nfs_folio_event_done, name, \ + TP_PROTO( \ + const struct inode *inode, \ +- struct folio *folio, \ ++ loff_t offset, \ ++ size_t count, \ + int ret \ + ), \ +- TP_ARGS(inode, folio, ret)) ++ TP_ARGS(inode, offset, count, ret)) + + DEFINE_NFS_FOLIO_EVENT(nfs_aop_readpage); + DEFINE_NFS_FOLIO_EVENT_DONE(nfs_aop_readpage_done); +diff --git a/fs/nfs/read.c b/fs/nfs/read.c +index a142287d86f68..88e6a78d37fb3 100644 +--- a/fs/nfs/read.c ++++ b/fs/nfs/read.c +@@ -332,13 +332,15 @@ int nfs_read_add_folio(struct nfs_pageio_descriptor *pgio, + int nfs_read_folio(struct file *file, struct folio *folio) + { + struct inode *inode = file_inode(file); ++ loff_t pos = folio_pos(folio); ++ size_t len = folio_size(folio); + struct nfs_pageio_descriptor pgio; + struct nfs_open_context *ctx; + int ret; + +- trace_nfs_aop_readpage(inode, folio); ++ trace_nfs_aop_readpage(inode, pos, len); + nfs_inc_stats(inode, NFSIOS_VFSREADPAGE); +- task_io_account_read(folio_size(folio)); ++ task_io_account_read(len); + + /* + * Try to flush any pending writes to the file.. +@@ -381,7 +383,7 @@ int nfs_read_folio(struct file *file, struct folio *folio) + out_put: + put_nfs_open_context(ctx); + out: +- trace_nfs_aop_readpage_done(inode, folio, ret); ++ trace_nfs_aop_readpage_done(inode, pos, len, ret); + return ret; + out_unlock: + folio_unlock(folio); +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 2329cbb0e446b..75c1b3c7faead 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -2073,17 +2073,17 @@ int nfs_wb_folio_cancel(struct inode *inode, struct folio *folio) + */ + int nfs_wb_folio(struct inode *inode, struct folio *folio) + { +- loff_t range_start = folio_file_pos(folio); +- loff_t range_end = range_start + (loff_t)folio_size(folio) - 1; ++ loff_t range_start = folio_pos(folio); ++ size_t len = folio_size(folio); + struct writeback_control wbc = { + .sync_mode = WB_SYNC_ALL, + .nr_to_write = 0, + .range_start = range_start, +- .range_end = range_end, ++ .range_end = range_start + len - 1, + }; + int ret; + +- trace_nfs_writeback_folio(inode, folio); ++ trace_nfs_writeback_folio(inode, range_start, len); + + for (;;) { + folio_wait_writeback(folio); +@@ -2101,7 +2101,7 @@ int nfs_wb_folio(struct inode *inode, struct folio *folio) + goto out_error; + } + out_error: +- trace_nfs_writeback_folio_done(inode, folio, ret); ++ trace_nfs_writeback_folio_done(inode, range_start, len, ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.10/nfsd-fix-nfsdcld-warning.patch b/queue-6.10/nfsd-fix-nfsdcld-warning.patch new file mode 100644 index 00000000000..8ab72128078 --- /dev/null +++ b/queue-6.10/nfsd-fix-nfsdcld-warning.patch @@ -0,0 +1,58 @@ +From 3c5f7a5513e84cf8a1fcb0899b19164dbf450025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 11:24:00 -0400 +Subject: NFSD: Fix nfsdcld warning + +From: Chuck Lever + +[ Upstream commit 18a5450684c312e98eb2253f0acf88b3f780af20 ] + +Since CONFIG_NFSD_LEGACY_CLIENT_TRACKING is a new config option, its +initial default setting should have been Y (if we are to follow the +common practice of "default Y, wait, default N, wait, remove code"). + +Paul also suggested adding a clearer remedy action to the warning +message. + +Reported-by: Paul Menzel +Message-Id: +Fixes: 74fd48739d04 ("nfsd: new Kconfig option for legacy client tracking") +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/Kconfig | 2 +- + fs/nfsd/nfs4recover.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig +index 272ab8d5c4d76..ec2ab6429e00b 100644 +--- a/fs/nfsd/Kconfig ++++ b/fs/nfsd/Kconfig +@@ -162,7 +162,7 @@ config NFSD_V4_SECURITY_LABEL + config NFSD_LEGACY_CLIENT_TRACKING + bool "Support legacy NFSv4 client tracking methods (DEPRECATED)" + depends on NFSD_V4 +- default n ++ default y + help + The NFSv4 server needs to store a small amount of information on + stable storage in order to handle state recovery after reboot. Most +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index 2c060e0b16048..67d8673a9391c 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -2086,8 +2086,8 @@ nfsd4_client_tracking_init(struct net *net) + status = nn->client_tracking_ops->init(net); + out: + if (status) { +- printk(KERN_WARNING "NFSD: Unable to initialize client " +- "recovery tracking! (%d)\n", status); ++ pr_warn("NFSD: Unable to initialize client recovery tracking! (%d)\n", status); ++ pr_warn("NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING.\n"); + nn->client_tracking_ops = NULL; + } + return status; +-- +2.43.0 + diff --git a/queue-6.10/nfsd-nfsd_file_lease_notifier_call-gets-a-file_lease.patch b/queue-6.10/nfsd-nfsd_file_lease_notifier_call-gets-a-file_lease.patch new file mode 100644 index 00000000000..d33883c070a --- /dev/null +++ b/queue-6.10/nfsd-nfsd_file_lease_notifier_call-gets-a-file_lease.patch @@ -0,0 +1,40 @@ +From 4813c26ec0c13921454a7983367194fe37e46eb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 07:26:44 -0400 +Subject: nfsd: nfsd_file_lease_notifier_call gets a file_lease as an argument + +From: Jeff Layton + +[ Upstream commit 769d20028f45a4f442cfe558a32faba357a7f5e2 ] + +"data" actually refers to a file_lease and not a file_lock. Both structs +have their file_lock_core as the first field though, so this bug should +be harmless without struct randomization in play. + +Reported-by: Florian Evers +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219008 +Fixes: 05580bbfc6bc ("nfsd: adapt to breakup of struct file_lock") +Signed-off-by: Jeff Layton +Tested-by: Florian Evers +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/filecache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index ad9083ca144ba..f4704f5d40867 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -664,7 +664,7 @@ static int + nfsd_file_lease_notifier_call(struct notifier_block *nb, unsigned long arg, + void *data) + { +- struct file_lock *fl = data; ++ struct file_lease *fl = data; + + /* Only close files for F_SETLEASE leases */ + if (fl->c.flc_flags & FL_LEASE) +-- +2.43.0 + diff --git a/queue-6.10/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch b/queue-6.10/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch new file mode 100644 index 00000000000..02fabbbe7b0 --- /dev/null +++ b/queue-6.10/nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch @@ -0,0 +1,66 @@ +From 7cd76c626e736ee1b5df705022da80e2d310a567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 09:28:27 -0400 +Subject: NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server + +From: Olga Kornievskaia + +[ Upstream commit 4840c00003a2275668a13b82c9f5b1aed80183aa ] + +Previously in order to mark the communication with the DS server, +we tried to use NFS_CS_DS in cl_flags. However, this flag would +only be saved for the DS server and in case where DS equals MDS, +the client would not find a matching nfs_client in nfs_match_client +that represents the MDS (but is also a DS). + +Instead, don't rely on the NFS_CS_DS but instead use NFS_CS_PNFS. + +Fixes: 379e4adfddd6 ("NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 6 ++---- + fs/nfs/nfs4proc.c | 2 +- + 2 files changed, 3 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 84573df5cf5ae..83378f69b35ea 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -231,9 +231,8 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); + __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); + __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); +- +- if (test_bit(NFS_CS_DS, &cl_init->init_flags)) +- __set_bit(NFS_CS_DS, &clp->cl_flags); ++ if (test_bit(NFS_CS_PNFS, &cl_init->init_flags)) ++ __set_bit(NFS_CS_PNFS, &clp->cl_flags); + /* + * Set up the connection to the server before we add add to the + * global list. +@@ -1013,7 +1012,6 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv, + if (mds_srv->flags & NFS_MOUNT_NORESVPORT) + __set_bit(NFS_CS_NORESVPORT, &cl_init.init_flags); + +- __set_bit(NFS_CS_DS, &cl_init.init_flags); + __set_bit(NFS_CS_PNFS, &cl_init.init_flags); + cl_init.max_connect = NFS_MAX_TRANSPORTS; + /* +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index a691fa10b3e95..bff9d6600741e 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8840,7 +8840,7 @@ nfs4_run_exchange_id(struct nfs_client *clp, const struct cred *cred, + #ifdef CONFIG_NFS_V4_1_MIGRATION + calldata->args.flags |= EXCHGID4_FLAG_SUPP_MOVED_MIGR; + #endif +- if (test_bit(NFS_CS_DS, &clp->cl_flags)) ++ if (test_bit(NFS_CS_PNFS, &clp->cl_flags)) + calldata->args.flags |= EXCHGID4_FLAG_USE_PNFS_DS; + msg.rpc_argp = &calldata->args; + msg.rpc_resp = &calldata->res; +-- +2.43.0 + diff --git a/queue-6.10/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch b/queue-6.10/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch new file mode 100644 index 00000000000..9925d62f702 --- /dev/null +++ b/queue-6.10/nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch @@ -0,0 +1,47 @@ +From 06b52c650f8b46b6d6118904f80d48cf3d782de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 03:35:12 +0900 +Subject: nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro + +From: Ryusuke Konishi + +[ Upstream commit 0f3819e8c483771a59cf9d3190cd68a7a990083c ] + +According to the C standard 3.4.3p3, the result of signed integer overflow +is undefined. The macro nilfs_cnt32_ge(), which compares two sequence +numbers, uses signed integer subtraction that can overflow, and therefore +the result of the calculation may differ from what is expected due to +undefined behavior in different environments. + +Similar to an earlier change to the jiffies-related comparison macros in +commit 5a581b367b5d ("jiffies: Avoid undefined behavior from signed +overflow"), avoid this potential issue by changing the definition of the +macro to perform the subtraction as unsigned integers, then cast the +result to a signed integer for comparison. + +Link: https://lkml.kernel.org/r/20130727225828.GA11864@linux.vnet.ibm.com +Link: https://lkml.kernel.org/r/20240702183512.6390-1-konishi.ryusuke@gmail.com +Fixes: 9ff05123e3bf ("nilfs2: segment constructor") +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/segment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c +index 6ea81f1d50944..d02fd92cdb432 100644 +--- a/fs/nilfs2/segment.c ++++ b/fs/nilfs2/segment.c +@@ -136,7 +136,7 @@ static void nilfs_dispose_list(struct the_nilfs *, struct list_head *, int); + + #define nilfs_cnt32_ge(a, b) \ + (typecheck(__u32, a) && typecheck(__u32, b) && \ +- ((__s32)(a) - (__s32)(b) >= 0)) ++ ((__s32)((a) - (b)) >= 0)) + + static int nilfs_prepare_segment_lock(struct super_block *sb, + struct nilfs_transaction_info *ti) +-- +2.43.0 + diff --git a/queue-6.10/nvmem-rockchip-otp-set-add_legacy_fixed_of_cells-con.patch b/queue-6.10/nvmem-rockchip-otp-set-add_legacy_fixed_of_cells-con.patch new file mode 100644 index 00000000000..d5f9761fe0d --- /dev/null +++ b/queue-6.10/nvmem-rockchip-otp-set-add_legacy_fixed_of_cells-con.patch @@ -0,0 +1,37 @@ +From 97a39c5ab4bd899145d1e807bdcf83c18476a80c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 08:48:41 +0100 +Subject: nvmem: rockchip-otp: set add_legacy_fixed_of_cells config option + +From: Heiko Stuebner + +[ Upstream commit 2933e79db3c00a8cdc56f6bb050a857fec1875ad ] + +The Rockchip OTP describes its layout via devicetree subnodes, +so set the appropriate property. + +Fixes: 2cc3b37f5b6d ("nvmem: add explicit config option to read old syntax fixed OF cells") +Signed-off-by: Heiko Stuebner +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240705074852.423202-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/rockchip-otp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvmem/rockchip-otp.c b/drivers/nvmem/rockchip-otp.c +index cb9aa5428350a..7107d68a2f8c7 100644 +--- a/drivers/nvmem/rockchip-otp.c ++++ b/drivers/nvmem/rockchip-otp.c +@@ -255,6 +255,7 @@ static int rockchip_otp_read(void *context, unsigned int offset, + static struct nvmem_config otp_config = { + .name = "rockchip-otp", + .owner = THIS_MODULE, ++ .add_legacy_fixed_of_cells = true, + .read_only = true, + .stride = 1, + .word_size = 1, +-- +2.43.0 + diff --git a/queue-6.10/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch b/queue-6.10/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch new file mode 100644 index 00000000000..0aa1bc77856 --- /dev/null +++ b/queue-6.10/nvmet-auth-fix-nvmet_auth-hash-error-handling.patch @@ -0,0 +1,89 @@ +From b79dec7531dfe378df53e991e28f55454f2cd1f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2024 14:46:25 +0800 +Subject: nvmet-auth: fix nvmet_auth hash error handling + +From: Gaosheng Cui + +[ Upstream commit 89f58f96d1e2357601c092d85b40a2109cf25ef3 ] + +If we fail to call nvme_auth_augmented_challenge, or fail to kmalloc +for shash, we should free the memory allocation for challenge, so add +err path out_free_challenge to fix the memory leak. + +Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support") +Signed-off-by: Gaosheng Cui +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/auth.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c +index 7d2633940f9b8..8bc3f431c77f6 100644 +--- a/drivers/nvme/target/auth.c ++++ b/drivers/nvme/target/auth.c +@@ -314,7 +314,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + req->sq->dhchap_c1, + challenge, shash_len); + if (ret) +- goto out_free_response; ++ goto out_free_challenge; + } + + pr_debug("ctrl %d qid %d host response seq %u transaction %d\n", +@@ -325,7 +325,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + GFP_KERNEL); + if (!shash) { + ret = -ENOMEM; +- goto out_free_response; ++ goto out_free_challenge; + } + shash->tfm = shash_tfm; + ret = crypto_shash_init(shash); +@@ -361,9 +361,10 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, + goto out; + ret = crypto_shash_final(shash, response); + out: ++ kfree(shash); ++out_free_challenge: + if (challenge != req->sq->dhchap_c1) + kfree(challenge); +- kfree(shash); + out_free_response: + nvme_auth_free_key(transformed_key); + out_free_tfm: +@@ -427,14 +428,14 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, + req->sq->dhchap_c2, + challenge, shash_len); + if (ret) +- goto out_free_response; ++ goto out_free_challenge; + } + + shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm), + GFP_KERNEL); + if (!shash) { + ret = -ENOMEM; +- goto out_free_response; ++ goto out_free_challenge; + } + shash->tfm = shash_tfm; + +@@ -471,9 +472,10 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, + goto out; + ret = crypto_shash_final(shash, response); + out: ++ kfree(shash); ++out_free_challenge: + if (challenge != req->sq->dhchap_c2) + kfree(challenge); +- kfree(shash); + out_free_response: + nvme_auth_free_key(transformed_key); + out_free_tfm: +-- +2.43.0 + diff --git a/queue-6.10/opp-fix-missing-cleanup-on-error-in-_opp_attach_genp.patch b/queue-6.10/opp-fix-missing-cleanup-on-error-in-_opp_attach_genp.patch new file mode 100644 index 00000000000..b0b10496db7 --- /dev/null +++ b/queue-6.10/opp-fix-missing-cleanup-on-error-in-_opp_attach_genp.patch @@ -0,0 +1,42 @@ +From cd801da3e1c65db0d709c1897253aeca4bd7a101 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 10:58:37 +0530 +Subject: OPP: Fix missing cleanup on error in _opp_attach_genpd() + +From: Viresh Kumar + +[ Upstream commit d86a2f0800683652004490c590b4b96a63e7fc04 ] + +A recent commit updated the code mistakenly to return directly on +errors, without doing the required cleanups. Fix it. + +Fixes: 2a56c462fe5a ("OPP: Fix required_opp_tables for multiple genpds using same table") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202405180016.4fbn86bm-lkp@intel.com/ +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index cb4611fe1b5b2..4e4d293bf5b10 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -2443,8 +2443,10 @@ static int _opp_attach_genpd(struct opp_table *opp_table, struct device *dev, + * Cross check it again and fix if required. + */ + gdev = dev_to_genpd_dev(virt_dev); +- if (IS_ERR(gdev)) +- return PTR_ERR(gdev); ++ if (IS_ERR(gdev)) { ++ ret = PTR_ERR(gdev); ++ goto err; ++ } + + genpd_table = _find_opp_table(gdev); + if (!IS_ERR(genpd_table)) { +-- +2.43.0 + diff --git a/queue-6.10/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch b/queue-6.10/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch new file mode 100644 index 00000000000..4b64b1762a1 --- /dev/null +++ b/queue-6.10/opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch @@ -0,0 +1,43 @@ +From c29593fbfc644b574bc73ba4a44f1322536542f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 09:01:27 +0200 +Subject: OPP: ti: Fix ti_opp_supply_probe wrong return values + +From: Primoz Fiser + +[ Upstream commit 3a1ac6b8f603a9310274990a0ad563a5fb709f59 ] + +Function ti_opp_supply_probe() since commit 6baee034cb55 ("OPP: ti: +Migrate to dev_pm_opp_set_config_regulators()") returns wrong values +when all goes well and hence driver probing eventually fails. + +Fixes: 6baee034cb55 ("OPP: ti: Migrate to dev_pm_opp_set_config_regulators()") +Signed-off-by: Primoz Fiser +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/ti-opp-supply.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c +index e3b97cd1fbbf3..ec0056a4bb135 100644 +--- a/drivers/opp/ti-opp-supply.c ++++ b/drivers/opp/ti-opp-supply.c +@@ -393,10 +393,12 @@ static int ti_opp_supply_probe(struct platform_device *pdev) + } + + ret = dev_pm_opp_set_config_regulators(cpu_dev, ti_opp_config_regulators); +- if (ret < 0) ++ if (ret < 0) { + _free_optimized_voltages(dev, &opp_data); ++ return ret; ++ } + +- return ret; ++ return 0; + } + + static struct platform_driver ti_opp_supply_driver = { +-- +2.43.0 + diff --git a/queue-6.10/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch b/queue-6.10/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch new file mode 100644 index 00000000000..f0c4a8d8ed9 --- /dev/null +++ b/queue-6.10/pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch @@ -0,0 +1,100 @@ +From f964a129f2f7efbb05b629cee0d172dd283456a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2024 12:08:41 -0400 +Subject: PCI: dwc: Fix index 0 incorrectly being interpreted as a free ATU + slot +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +[ Upstream commit c2a57ee0f2f1ad8c970ff58b78a43e85abbdeb7f ] + +When PERST# assert and deassert happens on the PERST# supported platforms, +both iATU0 and iATU6 will map inbound window to BAR0. DMA will access the +area that was previously allocated (iATU0) for BAR0, instead of the new +area (iATU6) for BAR0. + +Right now, this isn't an issue because both iATU0 and iATU6 should +translate inbound accesses to BAR0 to the same allocated memory area. +However, having two separate inbound mappings for the same BAR is a +disaster waiting to happen. + +The mappings between PCI BAR and iATU inbound window are maintained in the +dw_pcie_ep::bar_to_atu[] array. While allocating a new inbound iATU map for +a BAR, dw_pcie_ep_inbound_atu() API checks for the availability of the +existing mapping in the array and if it is not found (i.e., value in the +array indexed by the BAR is found to be 0), it allocates a new map value +using find_first_zero_bit(). + +The issue is the existing logic failed to consider the fact that the map +value '0' is a valid value for BAR0, so find_first_zero_bit() will return +'0' as the map value for BAR0 (note that it returns the first zero bit +position). + +Due to this, when PERST# assert + deassert happens on the PERST# supported +platforms, the inbound window allocation restarts from BAR0 and the +existing logic to find the BAR mapping will return '6' for BAR0 instead of +'0' due to the fact that it considers '0' as an invalid map value. + +Fix this issue by always incrementing the map value before assigning to +bar_to_atu[] array and then decrementing it while fetching. This will make +sure that the map value '0' always represents the invalid mapping." + +Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") +Closes: https://lore.kernel.org/linux-pci/ZXsRp+Lzg3x%2Fnhk3@x1-carbon/ +Link: https://lore.kernel.org/linux-pci/20240412160841.925927-1-Frank.Li@nxp.com +Reported-by: Niklas Cassel +Tested-by: Niklas Cassel +Signed-off-by: Frank Li +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index 47391d7d3a734..769e848246870 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -161,7 +161,7 @@ static int dw_pcie_ep_inbound_atu(struct dw_pcie_ep *ep, u8 func_no, int type, + if (!ep->bar_to_atu[bar]) + free_win = find_first_zero_bit(ep->ib_window_map, pci->num_ib_windows); + else +- free_win = ep->bar_to_atu[bar]; ++ free_win = ep->bar_to_atu[bar] - 1; + + if (free_win >= pci->num_ib_windows) { + dev_err(pci->dev, "No free inbound window\n"); +@@ -175,7 +175,11 @@ static int dw_pcie_ep_inbound_atu(struct dw_pcie_ep *ep, u8 func_no, int type, + return ret; + } + +- ep->bar_to_atu[bar] = free_win; ++ /* ++ * Always increment free_win before assignment, since value 0 is used to identify ++ * unallocated mapping. ++ */ ++ ep->bar_to_atu[bar] = free_win + 1; + set_bit(free_win, ep->ib_window_map); + + return 0; +@@ -212,7 +216,10 @@ static void dw_pcie_ep_clear_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, + struct dw_pcie_ep *ep = epc_get_drvdata(epc); + struct dw_pcie *pci = to_dw_pcie_from_ep(ep); + enum pci_barno bar = epf_bar->barno; +- u32 atu_index = ep->bar_to_atu[bar]; ++ u32 atu_index = ep->bar_to_atu[bar] - 1; ++ ++ if (!ep->bar_to_atu[bar]) ++ return; + + __dw_pcie_ep_reset_bar(pci, func_no, bar, epf_bar->flags); + +-- +2.43.0 + diff --git a/queue-6.10/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch b/queue-6.10/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch new file mode 100644 index 00000000000..1af3e79db42 --- /dev/null +++ b/queue-6.10/pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch @@ -0,0 +1,68 @@ +From 56f8881ff9c861cdd69794c0b59515ffca247e6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 12:33:39 +0300 +Subject: PCI: endpoint: Clean up error handling in vpci_scan_bus() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 8e0f5a96c534f781e8c57ca30459448b3bfe5429 ] + +Smatch complains about inconsistent NULL checking in vpci_scan_bus(): + + drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bus() error: we previously assumed 'vpci_bus' could be null (see line 1021) + +Instead of printing an error message and then crashing we should return +an error code and clean up. + +Also the NULL check is reversed so it prints an error for success +instead of failure. + +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Link: https://lore.kernel.org/linux-pci/68e0f6a4-fd57-45d0-945b-0876f2c8cb86@moroto.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c +index 8e779eecd62d4..7f05a44e9a9fd 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c ++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c +@@ -1018,8 +1018,10 @@ static int vpci_scan_bus(void *sysdata) + struct epf_ntb *ndev = sysdata; + + vpci_bus = pci_scan_bus(ndev->vbus_number, &vpci_ops, sysdata); +- if (vpci_bus) +- pr_err("create pci bus\n"); ++ if (!vpci_bus) { ++ pr_err("create pci bus failed\n"); ++ return -EINVAL; ++ } + + pci_bus_add_devices(vpci_bus); + +@@ -1338,10 +1340,14 @@ static int epf_ntb_bind(struct pci_epf *epf) + goto err_bar_alloc; + } + +- vpci_scan_bus(ntb); ++ ret = vpci_scan_bus(ntb); ++ if (ret) ++ goto err_unregister; + + return 0; + ++err_unregister: ++ pci_unregister_driver(&vntb_pci_driver); + err_bar_alloc: + epf_ntb_config_spad_bar_free(ntb); + +-- +2.43.0 + diff --git a/queue-6.10/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch b/queue-6.10/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch new file mode 100644 index 00000000000..5ee715967ba --- /dev/null +++ b/queue-6.10/pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch @@ -0,0 +1,67 @@ +From 3c1a903763d9ce19e2e108bd3ee497f6339e62db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 12:33:49 +0300 +Subject: PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 6bba3c0ac5dc54737998a0982b2e272242c87e0f ] + +There are two issues related to epf_ntb_epc_cleanup(): + + 1) It should call epf_ntb_config_sspad_bar_clear() + 2) The epf_ntb_bind() function should call epf_ntb_epc_cleanup() + to cleanup. + +I also changed the ordering a bit. Unwinding should be done in the +mirror order from how they are allocated. + +Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") +Link: https://lore.kernel.org/linux-pci/aaffbe8d-7094-4083-8146-185f4a84e8a1@moroto.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-vntb.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c +index 7f05a44e9a9fd..874cb097b093a 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c ++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c +@@ -799,8 +799,9 @@ static int epf_ntb_epc_init(struct epf_ntb *ntb) + */ + static void epf_ntb_epc_cleanup(struct epf_ntb *ntb) + { +- epf_ntb_db_bar_clear(ntb); + epf_ntb_mw_bar_clear(ntb, ntb->num_mws); ++ epf_ntb_db_bar_clear(ntb); ++ epf_ntb_config_sspad_bar_clear(ntb); + } + + #define EPF_NTB_R(_name) \ +@@ -1337,7 +1338,7 @@ static int epf_ntb_bind(struct pci_epf *epf) + ret = pci_register_driver(&vntb_pci_driver); + if (ret) { + dev_err(dev, "failure register vntb pci driver\n"); +- goto err_bar_alloc; ++ goto err_epc_cleanup; + } + + ret = vpci_scan_bus(ntb); +@@ -1348,6 +1349,8 @@ static int epf_ntb_bind(struct pci_epf *epf) + + err_unregister: + pci_unregister_driver(&vntb_pci_driver); ++err_epc_cleanup: ++ epf_ntb_epc_cleanup(ntb); + err_bar_alloc: + epf_ntb_config_spad_bar_free(ntb); + +-- +2.43.0 + diff --git a/queue-6.10/pci-endpoint-pci-epf-test-make-use-of-cached-epc_fea.patch b/queue-6.10/pci-endpoint-pci-epf-test-make-use-of-cached-epc_fea.patch new file mode 100644 index 00000000000..96df2b0e34d --- /dev/null +++ b/queue-6.10/pci-endpoint-pci-epf-test-make-use-of-cached-epc_fea.patch @@ -0,0 +1,90 @@ +From 69104801401c82cc90f6eba6fa5a59c241561464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 13:29:58 +0530 +Subject: PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in + pci_epf_test_core_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manivannan Sadhasivam + +[ Upstream commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a ] + +Instead of getting the epc_features from pci_epc_get_features() API, use +the cached pci_epf_test::epc_features value to avoid the NULL check. Since +the NULL check is already performed in pci_epf_test_bind(), having one more +check in pci_epf_test_core_init() is redundant and it is not possible to +hit the NULL pointer dereference. + +Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" +flag"), 'epc_features' got dereferenced without the NULL check, leading to +the following false positive Smatch warning: + + drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) + +Thus, remove the redundant NULL check and also use the epc_features:: +{msix_capable/msi_capable} flags directly to avoid local variables. + +[kwilczynski: commit log] +Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") +Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moroto.mountain +Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd54831444@linaro.org +Reported-by: Dan Carpenter +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Frank Li +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index 977fb79c15677..546d2a27955cf 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -735,20 +735,12 @@ static int pci_epf_test_core_init(struct pci_epf *epf) + { + struct pci_epf_test *epf_test = epf_get_drvdata(epf); + struct pci_epf_header *header = epf->header; +- const struct pci_epc_features *epc_features; ++ const struct pci_epc_features *epc_features = epf_test->epc_features; + struct pci_epc *epc = epf->epc; + struct device *dev = &epf->dev; + bool linkup_notifier = false; +- bool msix_capable = false; +- bool msi_capable = true; + int ret; + +- epc_features = pci_epc_get_features(epc, epf->func_no, epf->vfunc_no); +- if (epc_features) { +- msix_capable = epc_features->msix_capable; +- msi_capable = epc_features->msi_capable; +- } +- + if (epf->vfunc_no <= 1) { + ret = pci_epc_write_header(epc, epf->func_no, epf->vfunc_no, header); + if (ret) { +@@ -761,7 +753,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) + if (ret) + return ret; + +- if (msi_capable) { ++ if (epc_features->msi_capable) { + ret = pci_epc_set_msi(epc, epf->func_no, epf->vfunc_no, + epf->msi_interrupts); + if (ret) { +@@ -770,7 +762,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) + } + } + +- if (msix_capable) { ++ if (epc_features->msix_capable) { + ret = pci_epc_set_msix(epc, epf->func_no, epf->vfunc_no, + epf->msix_interrupts, + epf_test->test_reg_bar, +-- +2.43.0 + diff --git a/queue-6.10/pci-fix-resource-double-counting-on-remove-rescan.patch b/queue-6.10/pci-fix-resource-double-counting-on-remove-rescan.patch new file mode 100644 index 00000000000..5ebcbc362db --- /dev/null +++ b/queue-6.10/pci-fix-resource-double-counting-on-remove-rescan.patch @@ -0,0 +1,73 @@ +From ed8fea7c35c3d20612d4c7cc164844f93f072608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 13:25:16 +0300 +Subject: PCI: Fix resource double counting on remove & rescan +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 903534fa7d30214d8ba840ab1cd9e917e0c88e41 ] + +pbus_size_mem() keeps the size of the optional resources in +children_add_size. When calculating the PCI bridge window size, +calculate_memsize() lower bounds size by old_size before adding +children_add_size and performing the window size alignment. This +results in double counting for the resources in children_add_size +because old_size may be based on the previous size of the bridge +window after it has already included children_add_size (that is, +size1 in pbus_size_mem() from an earlier invocation of that +function). + +As a result, on repeated remove of the bus & rescan cycles the resource +size keeps increasing when children_add_size is non-zero as can be seen +from this extract: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200001fffff : PCI Bus 0000:03 # 2MiB + iomem2: 20000000000-200002fffff : PCI Bus 0000:03 # 3MiB + iomem3: 20000000000-200003fffff : PCI Bus 0000:03 # 4MiB + iomem4: 20000000000-200004fffff : PCI Bus 0000:03 # 5MiB + +Solve the double counting by moving old_size check later in +calculate_memsize() so that children_add_size is already accounted for. + +After the patch, the bridge window retains its size as expected: + + iomem0: 23fffd00000-23fffdfffff : PCI Bus 0000:03 # 1MiB + iomem1: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + iomem2: 20000000000-200000fffff : PCI Bus 0000:03 # 1MiB + +Fixes: a4ac9fea016f ("PCI : Calculate right add_size") +Link: https://lore.kernel.org/r/20240507102523.57320-2-ilpo.jarvinen@linux.intel.com +Tested-by: Lidong Wang +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Reviewed-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/setup-bus.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c +index 909e6a7c3cc31..141d6b31959be 100644 +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -829,11 +829,9 @@ static resource_size_t calculate_memsize(resource_size_t size, + size = min_size; + if (old_size == 1) + old_size = 0; +- if (size < old_size) +- size = old_size; + +- size = ALIGN(max(size, add_size) + children_add_size, align); +- return size; ++ size = max(size, add_size) + children_add_size; ++ return ALIGN(max(size, old_size), align); + } + + resource_size_t __weak pcibios_window_alignment(struct pci_bus *bus, +-- +2.43.0 + diff --git a/queue-6.10/pci-keystone-don-t-enable-bar-0-for-am654x.patch b/queue-6.10/pci-keystone-don-t-enable-bar-0-for-am654x.patch new file mode 100644 index 00000000000..eebe7b20b17 --- /dev/null +++ b/queue-6.10/pci-keystone-don-t-enable-bar-0-for-am654x.patch @@ -0,0 +1,113 @@ +From ce85659be6880cea68f51b61398cfc21512481d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 14:20:41 +0530 +Subject: PCI: keystone: Don't enable BAR 0 for AM654x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +[ Upstream commit 9ffa0e70b2daf9b0271e4960b7c8a2350e2cda08 ] + +After 6ab15b5e7057 ("PCI: dwc: keystone: Convert .scan_bus() callback to +use add_bus"), ks_pcie_v3_65_add_bus() enabled BAR 0 for both v3.65a and +v4.90a devices. On the AM654x SoC, which uses v4.90a, enabling BAR 0 +causes Completion Timeouts when setting up MSI-X. These timeouts delay +boot of the AM654x by about 45 seconds. + +Move the BAR 0 initialization to ks_pcie_msi_host_init(), which is only +used for v3.65a devices, and remove ks_pcie_v3_65_add_bus(). + +[bhelgaas: commit log] +Fixes: 6ab15b5e7057 ("PCI: dwc: keystone: Convert .scan_bus() callback to use add_bus") +Link: https://lore.kernel.org/linux-pci/20240328085041.2916899-3-s-vadapalli@ti.com +Suggested-by: Bjorn Helgaas +Suggested-by: Niklas Cassel +Suggested-by: Serge Semin +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 52 ++++++++--------------- + 1 file changed, 18 insertions(+), 34 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index cff5bca45878d..57135eee2d7d1 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -289,6 +289,24 @@ static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) + + static int ks_pcie_msi_host_init(struct dw_pcie_rp *pp) + { ++ struct dw_pcie *pci = to_dw_pcie_from_pp(pp); ++ struct keystone_pcie *ks_pcie = to_keystone_pcie(pci); ++ ++ /* Configure and set up BAR0 */ ++ ks_pcie_set_dbi_mode(ks_pcie); ++ ++ /* Enable BAR0 */ ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1); ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1); ++ ++ ks_pcie_clear_dbi_mode(ks_pcie); ++ ++ /* ++ * For BAR0, just setting bus address for inbound writes (MSI) should ++ * be sufficient. Use physical address to avoid any conflicts. ++ */ ++ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start); ++ + pp->msi_irq_chip = &ks_pcie_msi_irq_chip; + return dw_pcie_allocate_domains(pp); + } +@@ -445,44 +463,10 @@ static struct pci_ops ks_child_pcie_ops = { + .write = pci_generic_config_write, + }; + +-/** +- * ks_pcie_v3_65_add_bus() - keystone add_bus post initialization +- * @bus: A pointer to the PCI bus structure. +- * +- * This sets BAR0 to enable inbound access for MSI_IRQ register +- */ +-static int ks_pcie_v3_65_add_bus(struct pci_bus *bus) +-{ +- struct dw_pcie_rp *pp = bus->sysdata; +- struct dw_pcie *pci = to_dw_pcie_from_pp(pp); +- struct keystone_pcie *ks_pcie = to_keystone_pcie(pci); +- +- if (!pci_is_root_bus(bus)) +- return 0; +- +- /* Configure and set up BAR0 */ +- ks_pcie_set_dbi_mode(ks_pcie); +- +- /* Enable BAR0 */ +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 1); +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, SZ_4K - 1); +- +- ks_pcie_clear_dbi_mode(ks_pcie); +- +- /* +- * For BAR0, just setting bus address for inbound writes (MSI) should +- * be sufficient. Use physical address to avoid any conflicts. +- */ +- dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, ks_pcie->app.start); +- +- return 0; +-} +- + static struct pci_ops ks_pcie_ops = { + .map_bus = dw_pcie_own_conf_map_bus, + .read = pci_generic_config_read, + .write = pci_generic_config_write, +- .add_bus = ks_pcie_v3_65_add_bus, + }; + + /** +-- +2.43.0 + diff --git a/queue-6.10/pci-keystone-fix-null-pointer-dereference-in-case-of.patch b/queue-6.10/pci-keystone-fix-null-pointer-dereference-in-case-of.patch new file mode 100644 index 00000000000..79f5a986c2a --- /dev/null +++ b/queue-6.10/pci-keystone-fix-null-pointer-dereference-in-case-of.patch @@ -0,0 +1,98 @@ +From 370705b53d2b64eee5dcc0f4ae13f236549bba3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2024 09:15:17 +0300 +Subject: PCI: keystone: Fix NULL pointer dereference in case of DT error in + ks_pcie_setup_rc_app_regs() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aleksandr Mishin + +[ Upstream commit a231707a91f323af1e5d9f1722055ec2fc1c7775 ] + +If IORESOURCE_MEM is not provided in Device Tree due to +any error, resource_list_first_type() will return NULL and +pci_parse_request_of_pci_ranges() will just emit a warning. + +This will cause a NULL pointer dereference. Fix this bug by adding NULL +return check. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f71c60ffd26 ("PCI: dwc: Remove storing of PCI resources") +Link: https://lore.kernel.org/linux-pci/20240505061517.11527-1-amishin@t-argos.ru +Suggested-by: Bjorn Helgaas +Suggested-by: Manivannan Sadhasivam +Signed-off-by: Aleksandr Mishin +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index 57135eee2d7d1..cd0e0022f91d6 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -400,17 +400,22 @@ static const struct irq_domain_ops ks_pcie_intx_irq_domain_ops = { + .xlate = irq_domain_xlate_onetwocell, + }; + +-static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) ++static int ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + { + u32 val; + u32 num_viewport = ks_pcie->num_viewport; + struct dw_pcie *pci = ks_pcie->pci; + struct dw_pcie_rp *pp = &pci->pp; +- u64 start, end; ++ struct resource_entry *entry; + struct resource *mem; ++ u64 start, end; + int i; + +- mem = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM)->res; ++ entry = resource_list_first_type(&pp->bridge->windows, IORESOURCE_MEM); ++ if (!entry) ++ return -ENODEV; ++ ++ mem = entry->res; + start = mem->start; + end = mem->end; + +@@ -421,7 +426,7 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + ks_pcie_clear_dbi_mode(ks_pcie); + + if (ks_pcie->is_am6) +- return; ++ return 0; + + val = ilog2(OB_WIN_SIZE); + ks_pcie_app_writel(ks_pcie, OB_SIZE, val); +@@ -438,6 +443,8 @@ static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); + val |= OB_XLAT_EN_VAL; + ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ return 0; + } + + static void __iomem *ks_pcie_other_map_bus(struct pci_bus *bus, +@@ -798,7 +805,10 @@ static int __init ks_pcie_host_init(struct dw_pcie_rp *pp) + return ret; + + ks_pcie_stop_link(pci); +- ks_pcie_setup_rc_app_regs(ks_pcie); ++ ret = ks_pcie_setup_rc_app_regs(ks_pcie); ++ if (ret) ++ return ret; ++ + writew(PCI_IO_RANGE_TYPE_32 | (PCI_IO_RANGE_TYPE_32 << 8), + pci->dbi_base + PCI_IO_BASE); + +-- +2.43.0 + diff --git a/queue-6.10/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch b/queue-6.10/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch new file mode 100644 index 00000000000..c1b7fb9c846 --- /dev/null +++ b/queue-6.10/pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch @@ -0,0 +1,130 @@ +From 0f4c455df373da73031e71cc0418161743f1c228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 14:20:40 +0530 +Subject: PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddharth Vadapalli + +[ Upstream commit 5125fdc3292eea20870d4e6cefa62dc1245ce7ec ] + +Relocate ks_pcie_set_dbi_mode() and ks_pcie_clear_dbi_mode() to avoid +forward declaration in a subsequent patch. No functional change intended. + +Link: https://lore.kernel.org/linux-pci/20240328085041.2916899-2-s-vadapalli@ti.com +Signed-off-by: Siddharth Vadapalli +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Stable-dep-of: 9ffa0e70b2da ("PCI: keystone: Don't enable BAR 0 for AM654x") +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-keystone.c | 84 +++++++++++------------ + 1 file changed, 42 insertions(+), 42 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c +index d3a7d14ee685a..cff5bca45878d 100644 +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -245,6 +245,48 @@ static struct irq_chip ks_pcie_msi_irq_chip = { + .irq_unmask = ks_pcie_msi_unmask, + }; + ++/** ++ * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers ++ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone ++ * PCIe host controller driver information. ++ * ++ * Since modification of dbi_cs2 involves different clock domain, read the ++ * status back to ensure the transition is complete. ++ */ ++static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie) ++{ ++ u32 val; ++ ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ val |= DBI_CS2; ++ ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ do { ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ } while (!(val & DBI_CS2)); ++} ++ ++/** ++ * ks_pcie_clear_dbi_mode() - Disable DBI mode ++ * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone ++ * PCIe host controller driver information. ++ * ++ * Since modification of dbi_cs2 involves different clock domain, read the ++ * status back to ensure the transition is complete. ++ */ ++static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) ++{ ++ u32 val; ++ ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ val &= ~DBI_CS2; ++ ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); ++ ++ do { ++ val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); ++ } while (val & DBI_CS2); ++} ++ + static int ks_pcie_msi_host_init(struct dw_pcie_rp *pp) + { + pp->msi_irq_chip = &ks_pcie_msi_irq_chip; +@@ -340,48 +382,6 @@ static const struct irq_domain_ops ks_pcie_intx_irq_domain_ops = { + .xlate = irq_domain_xlate_onetwocell, + }; + +-/** +- * ks_pcie_set_dbi_mode() - Set DBI mode to access overlaid BAR mask registers +- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone +- * PCIe host controller driver information. +- * +- * Since modification of dbi_cs2 involves different clock domain, read the +- * status back to ensure the transition is complete. +- */ +-static void ks_pcie_set_dbi_mode(struct keystone_pcie *ks_pcie) +-{ +- u32 val; +- +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- val |= DBI_CS2; +- ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); +- +- do { +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- } while (!(val & DBI_CS2)); +-} +- +-/** +- * ks_pcie_clear_dbi_mode() - Disable DBI mode +- * @ks_pcie: A pointer to the keystone_pcie structure which holds the KeyStone +- * PCIe host controller driver information. +- * +- * Since modification of dbi_cs2 involves different clock domain, read the +- * status back to ensure the transition is complete. +- */ +-static void ks_pcie_clear_dbi_mode(struct keystone_pcie *ks_pcie) +-{ +- u32 val; +- +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- val &= ~DBI_CS2; +- ks_pcie_app_writel(ks_pcie, CMD_STATUS, val); +- +- do { +- val = ks_pcie_app_readl(ks_pcie, CMD_STATUS); +- } while (val & DBI_CS2); +-} +- + static void ks_pcie_setup_rc_app_regs(struct keystone_pcie *ks_pcie) + { + u32 val; +-- +2.43.0 + diff --git a/queue-6.10/pci-qcom-ep-disable-resources-unconditionally-during.patch b/queue-6.10/pci-qcom-ep-disable-resources-unconditionally-during.patch new file mode 100644 index 00000000000..5a0e0ffe8dd --- /dev/null +++ b/queue-6.10/pci-qcom-ep-disable-resources-unconditionally-during.patch @@ -0,0 +1,52 @@ +From a80787d4bba28506654d9021dd2072a0605190a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 11:43:42 +0530 +Subject: PCI: qcom-ep: Disable resources unconditionally during PERST# assert +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Manivannan Sadhasivam + +[ Upstream commit 912315715d7b74f7abdb6f063ebace44ee288af9 ] + +All EP specific resources are enabled during PERST# deassert. As a counter +operation, all resources should be disabled during PERST# assert. There is +no point in skipping that if the link was not enabled. + +This will also result in enablement of the resources twice if PERST# got +deasserted again. So remove the check from qcom_pcie_perst_assert() and +disable all the resources unconditionally. + +Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver") +Link: https://lore.kernel.org/linux-pci/20240430-pci-epf-rework-v4-1-22832d0d456f@linaro.org +Tested-by: Niklas Cassel +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-qcom-ep.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-qcom-ep.c b/drivers/pci/controller/dwc/pcie-qcom-ep.c +index 2fb8c15e7a911..50b1635e3cbb1 100644 +--- a/drivers/pci/controller/dwc/pcie-qcom-ep.c ++++ b/drivers/pci/controller/dwc/pcie-qcom-ep.c +@@ -500,12 +500,6 @@ static int qcom_pcie_perst_deassert(struct dw_pcie *pci) + static void qcom_pcie_perst_assert(struct dw_pcie *pci) + { + struct qcom_pcie_ep *pcie_ep = to_pcie_ep(pci); +- struct device *dev = pci->dev; +- +- if (pcie_ep->link_status == QCOM_PCIE_EP_LINK_DISABLED) { +- dev_dbg(dev, "Link is already disabled\n"); +- return; +- } + + dw_pcie_ep_cleanup(&pci->ep); + qcom_pcie_disable_resources(pcie_ep); +-- +2.43.0 + diff --git a/queue-6.10/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch b/queue-6.10/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch new file mode 100644 index 00000000000..f34c4e45e0e --- /dev/null +++ b/queue-6.10/pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch @@ -0,0 +1,77 @@ +From 80ba3526c9c62f9eb673f15a40b1c485868f5137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 May 2024 01:54:50 +0200 +Subject: PCI: rcar: Demote WARN() to dev_warn_ratelimited() in + rcar_pcie_wakeup() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit c93637e6a4c4e1d0e85ef7efac78d066bbb24d96 ] + +Avoid large backtrace, it is sufficient to warn the user that there has +been a link problem. Either the link has failed and the system is in need +of maintenance, or the link continues to work and user has been informed. +The message from the warning can be looked up in the sources. + +This makes an actual link issue less verbose. + +First of all, this controller has a limitation in that the controller +driver has to assist the hardware with transition to L1 link state by +writing L1IATN to PMCTRL register, the L1 and L0 link state switching +is not fully automatic on this controller. + +In case of an ASMedia ASM1062 PCIe SATA controller which does not support +ASPM, on entry to suspend or during platform pm_test, the SATA controller +enters D3hot state and the link enters L1 state. If the SATA controller +wakes up before rcar_pcie_wakeup() was called and returns to D0, the link +returns to L0 before the controller driver even started its transition to +L1 link state. At this point, the SATA controller did send an PM_ENTER_L1 +DLLP to the PCIe controller and the PCIe controller received it, and the +PCIe controller did set PMSR PMEL1RX bit. + +Once rcar_pcie_wakeup() is called, if the link is already back in L0 state +and PMEL1RX bit is set, the controller driver has no way to determine if +it should perform the link transition to L1 state, or treat the link as if +it is in L0 state. Currently the driver attempts to perform the transition +to L1 link state unconditionally, which in this specific case fails with a +PMSR L1FAEG poll timeout, however the link still works as it is already +back in L0 state. + +Reduce this warning verbosity. In case the link is really broken, the +rcar_pcie_config_access() would fail, otherwise it will succeed and any +system with this controller and ASM1062 can suspend without generating +a backtrace. + +Fixes: 84b576146294 ("PCI: rcar: Finish transition to L1 state in rcar_pcie_config_access()") +Link: https://lore.kernel.org/linux-pci/20240511235513.77301-1-marek.vasut+renesas@mailbox.org +Signed-off-by: Marek Vasut +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-rcar-host.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c +index 996077ab7cfdb..c01efc6ea64f6 100644 +--- a/drivers/pci/controller/pcie-rcar-host.c ++++ b/drivers/pci/controller/pcie-rcar-host.c +@@ -78,7 +78,11 @@ static int rcar_pcie_wakeup(struct device *pcie_dev, void __iomem *pcie_base) + writel(L1IATN, pcie_base + PMCTLR); + ret = readl_poll_timeout_atomic(pcie_base + PMSR, val, + val & L1FAEG, 10, 1000); +- WARN(ret, "Timeout waiting for L1 link state, ret=%d\n", ret); ++ if (ret) { ++ dev_warn_ratelimited(pcie_dev, ++ "Timeout waiting for L1 link state, ret=%d\n", ++ ret); ++ } + writel(L1FAEG | PMEL1RX, pcie_base + PMSR); + } + +-- +2.43.0 + diff --git a/queue-6.10/pci-tegra194-set-ep-alignment-restriction-for-inboun.patch b/queue-6.10/pci-tegra194-set-ep-alignment-restriction-for-inboun.patch new file mode 100644 index 00000000000..938a6c5e178 --- /dev/null +++ b/queue-6.10/pci-tegra194-set-ep-alignment-restriction-for-inboun.patch @@ -0,0 +1,43 @@ +From 537559980b43b09f86578ce8cc7efd9594229fd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:22:07 +0100 +Subject: PCI: tegra194: Set EP alignment restriction for inbound ATU +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jon Hunter + +[ Upstream commit d19a86d584e04191cdab7ced24d7ed791075697a ] + +Tegra194 and Tegra234 PCIe EP controllers have 64K alignment restriction +for the inbound ATU. Set the endpoint inbound ATU alignment to 64kB in the +Tegra194 PCIe driver. + +Fixes: c57247f940e8 ("PCI: tegra: Add support for PCIe endpoint mode in Tegra194") +Suggested-by: Manikanta Maddireddy +Link: https://lore.kernel.org/linux-pci/20240508092207.337063-1-jonathanh@nvidia.com +Signed-off-by: Jon Hunter +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 93f5433c5c550..4537313ef37a9 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -2015,6 +2015,7 @@ static const struct pci_epc_features tegra_pcie_epc_features = { + .bar[BAR_3] = { .type = BAR_RESERVED, }, + .bar[BAR_4] = { .type = BAR_RESERVED, }, + .bar[BAR_5] = { .type = BAR_RESERVED, }, ++ .align = SZ_64K, + }; + + static const struct pci_epc_features* +-- +2.43.0 + diff --git a/queue-6.10/perf-arm_pmuv3-avoid-assigning-fixed-cycle-counter-w.patch b/queue-6.10/perf-arm_pmuv3-avoid-assigning-fixed-cycle-counter-w.patch new file mode 100644 index 00000000000..a4ab06c4d90 --- /dev/null +++ b/queue-6.10/perf-arm_pmuv3-avoid-assigning-fixed-cycle-counter-w.patch @@ -0,0 +1,65 @@ +From 25bbdf1807576c4b8091ebef258c23a0d93fd6ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 16:32:25 -0600 +Subject: perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold + +From: Rob Herring (Arm) + +[ Upstream commit 81e15ca3e523a508d62806fe681c1d289361ca16 ] + +If the user has requested a counting threshold for the CPU cycles event, +then the fixed cycle counter can't be assigned as it lacks threshold +support. Currently, the thresholds will work or not randomly depending +on which counter the event is assigned. + +While using thresholds for CPU cycles doesn't make much sense, it can be +useful for testing purposes. + +Fixes: 816c26754447 ("arm64: perf: Add support for event counting threshold") +Signed-off-by: Rob Herring (Arm) +Acked-by: Mark Rutland +Link: https://lore.kernel.org/r/20240626-arm-pmu-3-9-icntr-v2-1-c9784b4f4065@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_pmuv3.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c +index 23fa6c5da82c4..8ed5c3358920a 100644 +--- a/drivers/perf/arm_pmuv3.c ++++ b/drivers/perf/arm_pmuv3.c +@@ -338,6 +338,11 @@ static bool armv8pmu_event_want_user_access(struct perf_event *event) + return ATTR_CFG_GET_FLD(&event->attr, rdpmc); + } + ++static u32 armv8pmu_event_get_threshold(struct perf_event_attr *attr) ++{ ++ return ATTR_CFG_GET_FLD(attr, threshold); ++} ++ + static u8 armv8pmu_event_threshold_control(struct perf_event_attr *attr) + { + u8 th_compare = ATTR_CFG_GET_FLD(attr, threshold_compare); +@@ -941,7 +946,8 @@ static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, + unsigned long evtype = hwc->config_base & ARMV8_PMU_EVTYPE_EVENT; + + /* Always prefer to place a cycle counter into the cycle counter. */ +- if (evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) { ++ if ((evtype == ARMV8_PMUV3_PERFCTR_CPU_CYCLES) && ++ !armv8pmu_event_get_threshold(&event->attr)) { + if (!test_and_set_bit(ARMV8_IDX_CYCLE_COUNTER, cpuc->used_mask)) + return ARMV8_IDX_CYCLE_COUNTER; + else if (armv8pmu_event_is_64bit(event) && +@@ -1033,7 +1039,7 @@ static int armv8pmu_set_event_filter(struct hw_perf_event *event, + * If FEAT_PMUv3_TH isn't implemented, then THWIDTH (threshold_max) will + * be 0 and will also trigger this check, preventing it from being used. + */ +- th = ATTR_CFG_GET_FLD(attr, threshold); ++ th = armv8pmu_event_get_threshold(attr); + if (th > threshold_max(cpu_pmu)) { + pr_debug("PMU event threshold exceeds max value\n"); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/perf-dso-fix-address-sanitizer-build.patch b/queue-6.10/perf-dso-fix-address-sanitizer-build.patch new file mode 100644 index 00000000000..579286cc4fd --- /dev/null +++ b/queue-6.10/perf-dso-fix-address-sanitizer-build.patch @@ -0,0 +1,382 @@ +From 2014c39a27eb4b728dfffce983d7ed511884fb78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 18:17:45 -0700 +Subject: perf dso: Fix address sanitizer build + +From: Ian Rogers + +[ Upstream commit 1553419c3c10cf386496e68b90b5d0ce966ac614 ] + +Various files had been missed from having accessor functions added for +the sake of dso reference count checking. Add the function calls and +missing dso accessor functions. + +Fixes: ee756ef7491e ("perf dso: Add reference count checking and accessor functions") +Signed-off-by: Ian Rogers +Cc: James Clark +Cc: Suzuki K Poulose +Cc: Yunseong Kim +Cc: Will Deacon +Cc: Mike Leach +Cc: Leo Yan +Cc: Athira Rajeev +Cc: John Garry +Link: https://lore.kernel.org/r/20240704011745.1021288-1-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + .../arch/powerpc/util/skip-callchain-idx.c | 8 ++++---- + tools/perf/ui/gtk/annotate.c | 5 +++-- + tools/perf/util/cs-etm.c | 10 +++++----- + tools/perf/util/disasm.c | 10 +++++----- + tools/perf/util/dso.h | 10 ++++++++++ + tools/perf/util/srcline.c | 12 ++++++------ + tools/perf/util/symbol.c | 15 ++++++++------- + tools/perf/util/unwind-libdw.c | 12 ++++++------ + tools/perf/util/unwind-libunwind-local.c | 18 +++++++++--------- + 9 files changed, 56 insertions(+), 44 deletions(-) + +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index 5f3edb3004d84..356786432fd3c 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -159,9 +159,9 @@ static int check_return_addr(struct dso *dso, u64 map_start, Dwarf_Addr pc) + Dwarf_Addr start = pc; + Dwarf_Addr end = pc; + bool signalp; +- const char *exec_file = dso->long_name; ++ const char *exec_file = dso__long_name(dso); + +- dwfl = dso->dwfl; ++ dwfl = RC_CHK_ACCESS(dso)->dwfl; + + if (!dwfl) { + dwfl = dwfl_begin(&offline_callbacks); +@@ -183,7 +183,7 @@ static int check_return_addr(struct dso *dso, u64 map_start, Dwarf_Addr pc) + dwfl_end(dwfl); + goto out; + } +- dso->dwfl = dwfl; ++ RC_CHK_ACCESS(dso)->dwfl = dwfl; + } + + mod = dwfl_addrmodule(dwfl, pc); +@@ -267,7 +267,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + rc = check_return_addr(dso, map__start(al.map), ip); + + pr_debug("[DSO %s, sym %s, ip 0x%" PRIx64 "] rc %d\n", +- dso->long_name, al.sym->name, ip, rc); ++ dso__long_name(dso), al.sym->name, ip, rc); + + if (rc == 0) { + /* +diff --git a/tools/perf/ui/gtk/annotate.c b/tools/perf/ui/gtk/annotate.c +index 93ce3d47e47e6..6da24aa039ebb 100644 +--- a/tools/perf/ui/gtk/annotate.c ++++ b/tools/perf/ui/gtk/annotate.c +@@ -180,13 +180,14 @@ static int symbol__gtk_annotate(struct map_symbol *ms, struct evsel *evsel, + GtkWidget *tab_label; + int err; + +- if (dso->annotate_warned) ++ if (dso__annotate_warned(dso)) + return -1; + + err = symbol__annotate(ms, evsel, NULL); + if (err) { + char msg[BUFSIZ]; +- dso->annotate_warned = true; ++ ++ dso__set_annotate_warned(dso); + symbol__strerror_disassemble(ms, err, msg, sizeof(msg)); + ui__error("Couldn't annotate %s: %s\n", sym->name, msg); + return -1; +diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c +index 32818bd7cd177..5e9fbcfad7d44 100644 +--- a/tools/perf/util/cs-etm.c ++++ b/tools/perf/util/cs-etm.c +@@ -1013,7 +1013,7 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, + if (!dso) + goto out; + +- if (dso->data.status == DSO_DATA_STATUS_ERROR && ++ if (dso__data(dso)->status == DSO_DATA_STATUS_ERROR && + dso__data_status_seen(dso, DSO_DATA_STATUS_SEEN_ITRACE)) + goto out; + +@@ -1027,11 +1027,11 @@ static u32 cs_etm__mem_access(struct cs_etm_queue *etmq, u8 trace_chan_id, + if (len <= 0) { + ui__warning_once("CS ETM Trace: Missing DSO. Use 'perf archive' or debuginfod to export data from the traced system.\n" + " Enable CONFIG_PROC_KCORE or use option '-k /path/to/vmlinux' for kernel symbols.\n"); +- if (!dso->auxtrace_warned) { ++ if (!dso__auxtrace_warned(dso)) { + pr_err("CS ETM Trace: Debug data not found for address %#"PRIx64" in %s\n", +- address, +- dso->long_name ? dso->long_name : "Unknown"); +- dso->auxtrace_warned = true; ++ address, ++ dso__long_name(dso) ? dso__long_name(dso) : "Unknown"); ++ dso__set_auxtrace_warned(dso); + } + goto out; + } +diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c +index 72aec8f61b944..e10558b79504b 100644 +--- a/tools/perf/util/disasm.c ++++ b/tools/perf/util/disasm.c +@@ -1199,7 +1199,7 @@ static int symbol__disassemble_bpf(struct symbol *sym, + int ret; + FILE *s; + +- if (dso->binary_type != DSO_BINARY_TYPE__BPF_PROG_INFO) ++ if (dso__binary_type(dso) != DSO_BINARY_TYPE__BPF_PROG_INFO) + return SYMBOL_ANNOTATE_ERRNO__BPF_INVALID_FILE; + + pr_debug("%s: handling sym %s addr %" PRIx64 " len %" PRIx64 "\n", __func__, +@@ -1226,14 +1226,14 @@ static int symbol__disassemble_bpf(struct symbol *sym, + info.arch = bfd_get_arch(bfdf); + info.mach = bfd_get_mach(bfdf); + +- info_node = perf_env__find_bpf_prog_info(dso->bpf_prog.env, +- dso->bpf_prog.id); ++ info_node = perf_env__find_bpf_prog_info(dso__bpf_prog(dso)->env, ++ dso__bpf_prog(dso)->id); + if (!info_node) { + ret = SYMBOL_ANNOTATE_ERRNO__BPF_MISSING_BTF; + goto out; + } + info_linear = info_node->info_linear; +- sub_id = dso->bpf_prog.sub_id; ++ sub_id = dso__bpf_prog(dso)->sub_id; + + info.buffer = (void *)(uintptr_t)(info_linear->info.jited_prog_insns); + info.buffer_length = info_linear->info.jited_prog_len; +@@ -1244,7 +1244,7 @@ static int symbol__disassemble_bpf(struct symbol *sym, + if (info_linear->info.btf_id) { + struct btf_node *node; + +- node = perf_env__find_btf(dso->bpf_prog.env, ++ node = perf_env__find_btf(dso__bpf_prog(dso)->env, + info_linear->info.btf_id); + if (node) + btf = btf__new((__u8 *)(node->data), +diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h +index d72f3b8c37f6a..878c1f441868b 100644 +--- a/tools/perf/util/dso.h ++++ b/tools/perf/util/dso.h +@@ -280,6 +280,16 @@ static inline void dso__set_annotate_warned(struct dso *dso) + RC_CHK_ACCESS(dso)->annotate_warned = 1; + } + ++static inline bool dso__auxtrace_warned(const struct dso *dso) ++{ ++ return RC_CHK_ACCESS(dso)->auxtrace_warned; ++} ++ ++static inline void dso__set_auxtrace_warned(struct dso *dso) ++{ ++ RC_CHK_ACCESS(dso)->auxtrace_warned = 1; ++} ++ + static inline struct auxtrace_cache *dso__auxtrace_cache(struct dso *dso) + { + return RC_CHK_ACCESS(dso)->auxtrace_cache; +diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c +index 9d670d8c1c089..4d67c1e095a18 100644 +--- a/tools/perf/util/srcline.c ++++ b/tools/perf/util/srcline.c +@@ -288,7 +288,7 @@ static int inline_list__append_dso_a2l(struct dso *dso, + struct inline_node *node, + struct symbol *sym) + { +- struct a2l_data *a2l = dso->a2l; ++ struct a2l_data *a2l = dso__a2l(dso); + struct symbol *inline_sym = new_inline_sym(dso, sym, a2l->funcname); + char *srcline = NULL; + +@@ -304,11 +304,11 @@ static int addr2line(const char *dso_name, u64 addr, + struct symbol *sym) + { + int ret = 0; +- struct a2l_data *a2l = dso->a2l; ++ struct a2l_data *a2l = dso__a2l(dso); + + if (!a2l) { +- dso->a2l = addr2line_init(dso_name); +- a2l = dso->a2l; ++ a2l = addr2line_init(dso_name); ++ dso__set_a2l(dso, a2l); + } + + if (a2l == NULL) { +@@ -360,14 +360,14 @@ static int addr2line(const char *dso_name, u64 addr, + + void dso__free_a2l(struct dso *dso) + { +- struct a2l_data *a2l = dso->a2l; ++ struct a2l_data *a2l = dso__a2l(dso); + + if (!a2l) + return; + + addr2line_cleanup(a2l); + +- dso->a2l = NULL; ++ dso__set_a2l(dso, NULL); + } + + #else /* HAVE_LIBBFD_SUPPORT */ +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index aee0a4cfb3836..22646f0cca7da 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -1607,7 +1607,7 @@ int dso__load_bfd_symbols(struct dso *dso, const char *debugfile) + + if (!bfd_check_format(abfd, bfd_object)) { + pr_debug2("%s: cannot read %s bfd file.\n", __func__, +- dso->long_name); ++ dso__long_name(dso)); + goto out_close; + } + +@@ -1640,12 +1640,13 @@ int dso__load_bfd_symbols(struct dso *dso, const char *debugfile) + } + if (i < symbols_count) { + /* PE symbols can only have 4 bytes, so use .text high bits */ +- dso->text_offset = section->vma - (u32)section->vma; +- dso->text_offset += (u32)bfd_asymbol_value(symbols[i]); +- dso->text_end = (section->vma - dso->text_offset) + section->size; ++ u64 text_offset = (section->vma - (u32)section->vma) ++ + (u32)bfd_asymbol_value(symbols[i]); ++ dso__set_text_offset(dso, text_offset); ++ dso__set_text_end(dso, (section->vma - text_offset) + section->size); + } else { +- dso->text_offset = section->vma - section->filepos; +- dso->text_end = section->filepos + section->size; ++ dso__set_text_offset(dso, section->vma - section->filepos); ++ dso__set_text_end(dso, section->filepos + section->size); + } + } + +@@ -1671,7 +1672,7 @@ int dso__load_bfd_symbols(struct dso *dso, const char *debugfile) + else + len = section->size - sym->value; + +- start = bfd_asymbol_value(sym) - dso->text_offset; ++ start = bfd_asymbol_value(sym) - dso__text_offset(dso); + symbol = symbol__new(start, len, bfd2elf_binding(sym), STT_FUNC, + bfd_asymbol_name(sym)); + if (!symbol) +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index b38d322734b4a..bde216e630d29 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -29,8 +29,8 @@ static int __find_debuginfo(Dwfl_Module *mod __maybe_unused, void **userdata, + const struct dso *dso = *userdata; + + assert(dso); +- if (dso->symsrc_filename && strcmp (file_name, dso->symsrc_filename)) +- *debuginfo_file_name = strdup(dso->symsrc_filename); ++ if (dso__symsrc_filename(dso) && strcmp(file_name, dso__symsrc_filename(dso))) ++ *debuginfo_file_name = strdup(dso__symsrc_filename(dso)); + return -1; + } + +@@ -66,7 +66,7 @@ static int __report_module(struct addr_location *al, u64 ip, + * a different code in another DSO. So just use the map->start + * directly to pick the correct one. + */ +- if (!strncmp(dso->long_name, "/tmp/jitted-", 12)) ++ if (!strncmp(dso__long_name(dso), "/tmp/jitted-", 12)) + base = map__start(al->map); + else + base = map__start(al->map) - map__pgoff(al->map); +@@ -83,15 +83,15 @@ static int __report_module(struct addr_location *al, u64 ip, + if (!mod) { + char filename[PATH_MAX]; + +- __symbol__join_symfs(filename, sizeof(filename), dso->long_name); +- mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1, ++ __symbol__join_symfs(filename, sizeof(filename), dso__long_name(dso)); ++ mod = dwfl_report_elf(ui->dwfl, dso__short_name(dso), filename, -1, + base, false); + } + if (!mod) { + char filename[PATH_MAX]; + + if (dso__build_id_filename(dso, filename, sizeof(filename), false)) +- mod = dwfl_report_elf(ui->dwfl, dso->short_name, filename, -1, ++ mod = dwfl_report_elf(ui->dwfl, dso__short_name(dso), filename, -1, + base, false); + } + +diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c +index cde267ea3e99e..5c073d815ba2b 100644 +--- a/tools/perf/util/unwind-libunwind-local.c ++++ b/tools/perf/util/unwind-libunwind-local.c +@@ -363,7 +363,7 @@ static int read_unwind_spec_debug_frame(struct dso *dso, + struct machine *machine, u64 *offset) + { + int fd; +- u64 ofs = dso->data.debug_frame_offset; ++ u64 ofs = dso__data(dso)->debug_frame_offset; + + /* debug_frame can reside in: + * - dso +@@ -379,7 +379,7 @@ static int read_unwind_spec_debug_frame(struct dso *dso, + } + + if (ofs <= 0) { +- fd = open(dso->symsrc_filename, O_RDONLY); ++ fd = open(dso__symsrc_filename(dso), O_RDONLY); + if (fd >= 0) { + ofs = elf_section_offset(fd, ".debug_frame"); + close(fd); +@@ -402,21 +402,21 @@ static int read_unwind_spec_debug_frame(struct dso *dso, + } + } + if (ofs > 0) { +- if (dso->symsrc_filename != NULL) { ++ if (dso__symsrc_filename(dso) != NULL) { + pr_warning( + "%s: overwrite symsrc(%s,%s)\n", + __func__, +- dso->symsrc_filename, ++ dso__symsrc_filename(dso), + debuglink); +- zfree(&dso->symsrc_filename); ++ zfree(&dso__symsrc_filename(dso)); + } +- dso->symsrc_filename = debuglink; ++ dso__set_symsrc_filename(dso, debuglink); + } else { + free(debuglink); + } + } + +- dso->data.debug_frame_offset = ofs; ++ dso__data(dso)->debug_frame_offset = ofs; + } + + *offset = ofs; +@@ -481,7 +481,7 @@ find_proc_info(unw_addr_space_t as, unw_word_t ip, unw_proc_info_t *pi, + if (ret < 0 && + !read_unwind_spec_debug_frame(dso, ui->machine, &segbase)) { + int fd = dso__data_get_fd(dso, ui->machine); +- int is_exec = elf_is_exec(fd, dso->name); ++ int is_exec = elf_is_exec(fd, dso__name(dso)); + u64 start = map__start(map); + unw_word_t base = is_exec ? 0 : start; + const char *symfile; +@@ -489,7 +489,7 @@ find_proc_info(unw_addr_space_t as, unw_word_t ip, unw_proc_info_t *pi, + if (fd >= 0) + dso__data_put_fd(dso); + +- symfile = dso->symsrc_filename ?: dso->name; ++ symfile = dso__symsrc_filename(dso) ?: dso__name(dso); + + memset(&di, 0, sizeof(di)); + if (dwarf_find_debug_frame(0, &di, ip, base, symfile, start, map__end(map))) +-- +2.43.0 + diff --git a/queue-6.10/perf-fix-default-aux_watermark-calculation.patch b/queue-6.10/perf-fix-default-aux_watermark-calculation.patch new file mode 100644 index 00000000000..8fa3f60e1a4 --- /dev/null +++ b/queue-6.10/perf-fix-default-aux_watermark-calculation.patch @@ -0,0 +1,47 @@ +From d7d97feb0259f66558f6505579e573d6610ed2b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:11:00 +0300 +Subject: perf: Fix default aux_watermark calculation + +From: Adrian Hunter + +[ Upstream commit 43deb76b19663a96ec2189d8f4eb9a9dc2d7623f ] + +The default aux_watermark is half the AUX area buffer size. In general, +on a 64-bit architecture, the AUX area buffer size could be a bigger than +fits in a 32-bit type, but the calculation does not allow for that +possibility. + +However the aux_watermark value is recorded in a u32, so should not be +more than U32_MAX either. + +Fix by doing the calculation in a correctly sized type, and limiting the +result to U32_MAX. + +Fixes: d68e6799a5c8 ("perf: Cap allocation order at aux_watermark") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-7-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/ring_buffer.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 4013408ce0123..485cf0a66631b 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -688,7 +688,9 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event, + * max_order, to aid PMU drivers in double buffering. + */ + if (!watermark) +- watermark = nr_pages << (PAGE_SHIFT - 1); ++ watermark = min_t(unsigned long, ++ U32_MAX, ++ (unsigned long)nr_pages << (PAGE_SHIFT - 1)); + + /* + * Use aux_watermark as the basis for chunking to +-- +2.43.0 + diff --git a/queue-6.10/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch b/queue-6.10/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch new file mode 100644 index 00000000000..b0685b4abda --- /dev/null +++ b/queue-6.10/perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch @@ -0,0 +1,37 @@ +From 488708aae0e2afa033825ec4b82759d0af21c72f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:58 +0300 +Subject: perf: Fix perf_aux_size() for greater-than 32-bit size + +From: Adrian Hunter + +[ Upstream commit 3df94a5b1078dfe2b0c03f027d018800faf44c82 ] + +perf_buffer->aux_nr_pages uses a 32-bit type, so a cast is needed to +calculate a 64-bit size. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-5-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/internal.h b/kernel/events/internal.h +index 5150d5f84c033..386d21c7edfa0 100644 +--- a/kernel/events/internal.h ++++ b/kernel/events/internal.h +@@ -128,7 +128,7 @@ static inline unsigned long perf_data_size(struct perf_buffer *rb) + + static inline unsigned long perf_aux_size(struct perf_buffer *rb) + { +- return rb->aux_nr_pages << PAGE_SHIFT; ++ return (unsigned long)rb->aux_nr_pages << PAGE_SHIFT; + } + + #define __DEFINE_OUTPUT_COPY_BODY(advance_buf, memcpy_func, ...) \ +-- +2.43.0 + diff --git a/queue-6.10/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch b/queue-6.10/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch new file mode 100644 index 00000000000..315094dc476 --- /dev/null +++ b/queue-6.10/perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch @@ -0,0 +1,38 @@ +From ba2790258f50f348dd215484b6d8ba82f94c0029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:45:31 +0300 +Subject: perf intel-pt: Fix aux_watermark calculation for 64-bit size + +From: Adrian Hunter + +[ Upstream commit 36b4cd990a8fd3f5b748883050e9d8c69fe6398d ] + +aux_watermark is a u32. For a 64-bit size, cap the aux_watermark +calculation at UINT_MAX instead of truncating it to 32-bits. + +Fixes: 874fc35cdd55 ("perf intel-pt: Use aux_watermark") +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240625104532.11990-2-adrian.hunter@intel.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/intel-pt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c +index 6de7e2d210756..c8fa15f280d29 100644 +--- a/tools/perf/arch/x86/util/intel-pt.c ++++ b/tools/perf/arch/x86/util/intel-pt.c +@@ -758,7 +758,8 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, + } + + if (!opts->auxtrace_snapshot_mode && !opts->auxtrace_sample_mode) { +- u32 aux_watermark = opts->auxtrace_mmap_pages * page_size / 4; ++ size_t aw = opts->auxtrace_mmap_pages * (size_t)page_size / 4; ++ u32 aux_watermark = aw > UINT_MAX ? UINT_MAX : aw; + + intel_pt_evsel->core.attr.aux_watermark = aux_watermark; + } +-- +2.43.0 + diff --git a/queue-6.10/perf-intel-pt-fix-exclude_guest-setting.patch b/queue-6.10/perf-intel-pt-fix-exclude_guest-setting.patch new file mode 100644 index 00000000000..5cd2399682f --- /dev/null +++ b/queue-6.10/perf-intel-pt-fix-exclude_guest-setting.patch @@ -0,0 +1,69 @@ +From 514d34dea97af8456c0aae66e697244ca15c899b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 13:45:32 +0300 +Subject: perf intel-pt: Fix exclude_guest setting + +From: Adrian Hunter + +[ Upstream commit b40934ae32232140e85dc7dc1c3ea0e296986723 ] + +In the past, the exclude_guest setting has had no effect on Intel PT +tracing, but that may not be the case in the future. + +Set the flag correctly based upon whether KVM is using Intel PT +"Host/Guest" mode, which is determined by the kvm_intel module +parameter pt_mode: + + pt_mode=0 System-wide mode : host and guest output to host buffer + pt_mode=1 Host/Guest mode : host/guest output to host/guest + buffers respectively + +Fixes: 6e86bfdc4a60 ("perf intel-pt: Support decoding of guest kernel") +Signed-off-by: Adrian Hunter +Link: https://lore.kernel.org/r/20240625104532.11990-3-adrian.hunter@intel.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/intel-pt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c +index c8fa15f280d29..4b710e875953a 100644 +--- a/tools/perf/arch/x86/util/intel-pt.c ++++ b/tools/perf/arch/x86/util/intel-pt.c +@@ -32,6 +32,7 @@ + #include "../../../util/tsc.h" + #include // page_size + #include "../../../util/intel-pt.h" ++#include + + #define KiB(x) ((x) * 1024) + #define MiB(x) ((x) * 1024 * 1024) +@@ -428,6 +429,16 @@ static int intel_pt_track_switches(struct evlist *evlist) + } + #endif + ++static bool intel_pt_exclude_guest(void) ++{ ++ int pt_mode; ++ ++ if (sysfs__read_int("module/kvm_intel/parameters/pt_mode", &pt_mode)) ++ pt_mode = 0; ++ ++ return pt_mode == 1; ++} ++ + static void intel_pt_valid_str(char *str, size_t len, u64 valid) + { + unsigned int val, last = 0, state = 1; +@@ -620,6 +631,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr, + } + evsel->core.attr.freq = 0; + evsel->core.attr.sample_period = 1; ++ evsel->core.attr.exclude_guest = intel_pt_exclude_guest(); + evsel->no_aux_samples = true; + evsel->needs_auxtrace_mmap = true; + intel_pt_evsel = evsel; +-- +2.43.0 + diff --git a/queue-6.10/perf-maps-fix-use-after-free-in-__maps__fixup_overla.patch b/queue-6.10/perf-maps-fix-use-after-free-in-__maps__fixup_overla.patch new file mode 100644 index 00000000000..c6b7061cbd6 --- /dev/null +++ b/queue-6.10/perf-maps-fix-use-after-free-in-__maps__fixup_overla.patch @@ -0,0 +1,76 @@ +From a25f1068faea52dc37236e532ded26ac457c93ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 09:51:07 -0700 +Subject: perf maps: Fix use after free in __maps__fixup_overlap_and_insert + +From: Ian Rogers + +[ Upstream commit 0b90dfda222e38b7ca8dad6e098e36f5186f0b94 ] + +In the case 'before' and 'after' are broken out from pos, +maps_by_address may be changed by __maps__insert, as such it needs +re-reading. + +Don't ignore the return value from __maps_insert. + +Fixes: 659ad3492b91 ("perf maps: Switch from rbtree to lazily sorted array for addresses") +Signed-off-by: Ian Rogers +Reviewed-by: James Clark +Cc: Steinar H . Gunderson +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240521165109.708593-2-irogers@google.com +Signed-off-by: Sasha Levin +--- + tools/perf/util/maps.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c +index 16b39db594f4c..eaada3e0f5b4e 100644 +--- a/tools/perf/util/maps.c ++++ b/tools/perf/util/maps.c +@@ -741,7 +741,6 @@ static unsigned int first_ending_after(struct maps *maps, const struct map *map) + */ + static int __maps__fixup_overlap_and_insert(struct maps *maps, struct map *new) + { +- struct map **maps_by_address; + int err = 0; + FILE *fp = debug_file(); + +@@ -749,12 +748,12 @@ static int __maps__fixup_overlap_and_insert(struct maps *maps, struct map *new) + if (!maps__maps_by_address_sorted(maps)) + __maps__sort_by_address(maps); + +- maps_by_address = maps__maps_by_address(maps); + /* + * Iterate through entries where the end of the existing entry is + * greater-than the new map's start. + */ + for (unsigned int i = first_ending_after(maps, new); i < maps__nr_maps(maps); ) { ++ struct map **maps_by_address = maps__maps_by_address(maps); + struct map *pos = maps_by_address[i]; + struct map *before = NULL, *after = NULL; + +@@ -821,8 +820,10 @@ static int __maps__fixup_overlap_and_insert(struct maps *maps, struct map *new) + /* Maps are still ordered, go to next one. */ + i++; + if (after) { +- __maps__insert(maps, after); ++ err = __maps__insert(maps, after); + map__put(after); ++ if (err) ++ goto out_err; + if (!maps__maps_by_address_sorted(maps)) { + /* + * Sorting broken so invariants don't +@@ -851,7 +852,7 @@ static int __maps__fixup_overlap_and_insert(struct maps *maps, struct map *new) + check_invariants(maps); + } + /* Add the map. */ +- __maps__insert(maps, new); ++ err = __maps__insert(maps, new); + out_err: + return err; + } +-- +2.43.0 + diff --git a/queue-6.10/perf-pmu-restore-full-pmu-name-wildcard-support.patch b/queue-6.10/perf-pmu-restore-full-pmu-name-wildcard-support.patch new file mode 100644 index 00000000000..64f2648f40b --- /dev/null +++ b/queue-6.10/perf-pmu-restore-full-pmu-name-wildcard-support.patch @@ -0,0 +1,153 @@ +From 20adbb4dbda533ce0d3a88f89a73fba1a83ae3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 15:54:45 +0100 +Subject: perf pmu: Restore full PMU name wildcard support + +From: James Clark + +[ Upstream commit 3e0bf9fde29844694ad9912aa290fbdb2c3fa767 ] + +Commit b2b9d3a3f021 ("perf pmu: Support wildcards on pmu name in dynamic +pmu events") gives the following example for wildcarding a subset of +PMUs: + + E.g., in a system with the following dynamic pmus: + + mypmu_0 + mypmu_1 + mypmu_2 + mypmu_4 + + perf stat -e mypmu_[01]// + +Since commit f91fa2ae6360 ("perf pmu: Refactor perf_pmu__match()"), only +"*" has been supported, removing the ability to subset PMUs, even though +parse-events.l still supports ? and [] characters. + +Fix it by using fnmatch() when any glob character is detected and add a +test which covers that and other scenarios of +perf_pmu__match_ignoring_suffix(). + +Fixes: f91fa2ae6360 ("perf pmu: Refactor perf_pmu__match()") +Signed-off-by: James Clark +Reviewed-by: Ian Rogers +Cc: robin.murphy@arm.com +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240626145448.896746-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + tools/perf/tests/pmu.c | 78 ++++++++++++++++++++++++++++++++++++++++++ + tools/perf/util/pmu.c | 2 +- + 2 files changed, 79 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c +index cc88b5920c3e2..fd07331b2d6e6 100644 +--- a/tools/perf/tests/pmu.c ++++ b/tools/perf/tests/pmu.c +@@ -437,12 +437,90 @@ static int test__name_cmp(struct test_suite *test __maybe_unused, int subtest __ + return TEST_OK; + } + ++/** ++ * Test perf_pmu__match() that's used to search for a PMU given a name passed ++ * on the command line. The name that's passed may also be a filename type glob ++ * match. ++ */ ++static int test__pmu_match(struct test_suite *test __maybe_unused, int subtest __maybe_unused) ++{ ++ struct perf_pmu test_pmu; ++ ++ test_pmu.name = "pmuname"; ++ TEST_ASSERT_EQUAL("Exact match", perf_pmu__match(&test_pmu, "pmuname"), true); ++ TEST_ASSERT_EQUAL("Longer token", perf_pmu__match(&test_pmu, "longertoken"), false); ++ TEST_ASSERT_EQUAL("Shorter token", perf_pmu__match(&test_pmu, "pmu"), false); ++ ++ test_pmu.name = "pmuname_10"; ++ TEST_ASSERT_EQUAL("Diff suffix_", perf_pmu__match(&test_pmu, "pmuname_2"), false); ++ TEST_ASSERT_EQUAL("Sub suffix_", perf_pmu__match(&test_pmu, "pmuname_1"), true); ++ TEST_ASSERT_EQUAL("Same suffix_", perf_pmu__match(&test_pmu, "pmuname_10"), true); ++ TEST_ASSERT_EQUAL("No suffix_", perf_pmu__match(&test_pmu, "pmuname"), true); ++ TEST_ASSERT_EQUAL("Underscore_", perf_pmu__match(&test_pmu, "pmuname_"), true); ++ TEST_ASSERT_EQUAL("Substring_", perf_pmu__match(&test_pmu, "pmuna"), false); ++ ++ test_pmu.name = "pmuname_ab23"; ++ TEST_ASSERT_EQUAL("Diff suffix hex_", perf_pmu__match(&test_pmu, "pmuname_2"), false); ++ TEST_ASSERT_EQUAL("Sub suffix hex_", perf_pmu__match(&test_pmu, "pmuname_ab"), true); ++ TEST_ASSERT_EQUAL("Same suffix hex_", perf_pmu__match(&test_pmu, "pmuname_ab23"), true); ++ TEST_ASSERT_EQUAL("No suffix hex_", perf_pmu__match(&test_pmu, "pmuname"), true); ++ TEST_ASSERT_EQUAL("Underscore hex_", perf_pmu__match(&test_pmu, "pmuname_"), true); ++ TEST_ASSERT_EQUAL("Substring hex_", perf_pmu__match(&test_pmu, "pmuna"), false); ++ ++ test_pmu.name = "pmuname10"; ++ TEST_ASSERT_EQUAL("Diff suffix", perf_pmu__match(&test_pmu, "pmuname2"), false); ++ TEST_ASSERT_EQUAL("Sub suffix", perf_pmu__match(&test_pmu, "pmuname1"), true); ++ TEST_ASSERT_EQUAL("Same suffix", perf_pmu__match(&test_pmu, "pmuname10"), true); ++ TEST_ASSERT_EQUAL("No suffix", perf_pmu__match(&test_pmu, "pmuname"), true); ++ TEST_ASSERT_EQUAL("Underscore", perf_pmu__match(&test_pmu, "pmuname_"), false); ++ TEST_ASSERT_EQUAL("Substring", perf_pmu__match(&test_pmu, "pmuna"), false); ++ ++ test_pmu.name = "pmunameab23"; ++ TEST_ASSERT_EQUAL("Diff suffix hex", perf_pmu__match(&test_pmu, "pmuname2"), false); ++ TEST_ASSERT_EQUAL("Sub suffix hex", perf_pmu__match(&test_pmu, "pmunameab"), true); ++ TEST_ASSERT_EQUAL("Same suffix hex", perf_pmu__match(&test_pmu, "pmunameab23"), true); ++ TEST_ASSERT_EQUAL("No suffix hex", perf_pmu__match(&test_pmu, "pmuname"), true); ++ TEST_ASSERT_EQUAL("Underscore hex", perf_pmu__match(&test_pmu, "pmuname_"), false); ++ TEST_ASSERT_EQUAL("Substring hex", perf_pmu__match(&test_pmu, "pmuna"), false); ++ ++ /* ++ * 2 hex chars or less are not considered suffixes so it shouldn't be ++ * possible to wildcard by skipping the suffix. Therefore there are more ++ * false results here than above. ++ */ ++ test_pmu.name = "pmuname_a3"; ++ TEST_ASSERT_EQUAL("Diff suffix 2 hex_", perf_pmu__match(&test_pmu, "pmuname_2"), false); ++ /* ++ * This one should be false, but because pmuname_a3 ends in 3 which is ++ * decimal, it's not possible to determine if it's a short hex suffix or ++ * a normal decimal suffix following text. And we want to match on any ++ * length of decimal suffix. Run the test anyway and expect the wrong ++ * result. And slightly fuzzy matching shouldn't do too much harm. ++ */ ++ TEST_ASSERT_EQUAL("Sub suffix 2 hex_", perf_pmu__match(&test_pmu, "pmuname_a"), true); ++ TEST_ASSERT_EQUAL("Same suffix 2 hex_", perf_pmu__match(&test_pmu, "pmuname_a3"), true); ++ TEST_ASSERT_EQUAL("No suffix 2 hex_", perf_pmu__match(&test_pmu, "pmuname"), false); ++ TEST_ASSERT_EQUAL("Underscore 2 hex_", perf_pmu__match(&test_pmu, "pmuname_"), false); ++ TEST_ASSERT_EQUAL("Substring 2 hex_", perf_pmu__match(&test_pmu, "pmuna"), false); ++ ++ test_pmu.name = "pmuname_5"; ++ TEST_ASSERT_EQUAL("Glob 1", perf_pmu__match(&test_pmu, "pmu*"), true); ++ TEST_ASSERT_EQUAL("Glob 2", perf_pmu__match(&test_pmu, "nomatch*"), false); ++ TEST_ASSERT_EQUAL("Seq 1", perf_pmu__match(&test_pmu, "pmuname_[12345]"), true); ++ TEST_ASSERT_EQUAL("Seq 2", perf_pmu__match(&test_pmu, "pmuname_[67890]"), false); ++ TEST_ASSERT_EQUAL("? 1", perf_pmu__match(&test_pmu, "pmuname_?"), true); ++ TEST_ASSERT_EQUAL("? 2", perf_pmu__match(&test_pmu, "pmuname_1?"), false); ++ ++ return TEST_OK; ++} ++ + static struct test_case tests__pmu[] = { + TEST_CASE("Parsing with PMU format directory", pmu_format), + TEST_CASE("Parsing with PMU event", pmu_events), + TEST_CASE("PMU event names", pmu_event_names), + TEST_CASE("PMU name combining", name_len), + TEST_CASE("PMU name comparison", name_cmp), ++ TEST_CASE("PMU cmdline match", pmu_match), + { .name = NULL, } + }; + +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 888ce99122759..22291f48e4da1 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -2143,7 +2143,7 @@ void perf_pmu__warn_invalid_config(struct perf_pmu *pmu, __u64 config, + bool perf_pmu__match(const struct perf_pmu *pmu, const char *tok) + { + const char *name = pmu->name; +- bool need_fnmatch = strchr(tok, '*') != NULL; ++ bool need_fnmatch = strisglob(tok); + + if (!strncmp(tok, "uncore_", 7)) + tok += 7; +-- +2.43.0 + diff --git a/queue-6.10/perf-pmus-fixes-always-false-when-compare-duplicates.patch b/queue-6.10/perf-pmus-fixes-always-false-when-compare-duplicates.patch new file mode 100644 index 00000000000..494761c179a --- /dev/null +++ b/queue-6.10/perf-pmus-fixes-always-false-when-compare-duplicates.patch @@ -0,0 +1,80 @@ +From 9a445e3b767387679ef725b0d2e275b93880c506 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 17:43:18 +0800 +Subject: perf pmus: Fixes always false when compare duplicates aliases + +From: Junhao He + +[ Upstream commit dd9a426eade634bf794c7e0f1b0c6659f556942f ] + +In the previous loop, all the members in the aliases[j-1] have been freed +and set to NULL. But in this loop, the function pmu_alias_is_duplicate() +compares the aliases[j] with the aliases[j-1] that has already been +disposed, so the function will always return false and duplicate aliases +will never be discarded. + +If we find duplicate aliases, it skips the zfree aliases[j], which is +accompanied by a memory leak. + +We can use the next aliases[j+1] to theck for duplicate aliases to +fixes the aliases NULL pointer dereference, then goto zfree code snippet +to release it. + +After patch testing: + $ perf list --unit=hisi_sicl,cpa pmu + + uncore cpa: + cpa_p0_rd_dat_32b + [Number of read ops transmitted by the P0 port which size is 32 bytes. + Unit: hisi_sicl,cpa] + cpa_p0_rd_dat_64b + [Number of read ops transmitted by the P0 port which size is 64 bytes. + Unit: hisi_sicl,cpa] + +Fixes: c3245d2093c1 ("perf pmu: Abstract alias/event struct") +Signed-off-by: Junhao He +Cc: ravi.bangoria@amd.com +Cc: james.clark@arm.com +Cc: prime.zeng@hisilicon.com +Cc: cuigaosheng1@huawei.com +Cc: jonathan.cameron@huawei.com +Cc: linuxarm@huawei.com +Cc: yangyicong@huawei.com +Cc: robh@kernel.org +Cc: renyu.zj@linux.alibaba.com +Cc: kjain@linux.ibm.com +Cc: john.g.garry@oracle.com +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240614094318.11607-1-hejunhao3@huawei.com +Signed-off-by: Sasha Levin +--- + tools/perf/util/pmus.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/pmus.c b/tools/perf/util/pmus.c +index b9b4c5eb50027..6907e3e7fbd16 100644 +--- a/tools/perf/util/pmus.c ++++ b/tools/perf/util/pmus.c +@@ -477,8 +477,8 @@ void perf_pmus__print_pmu_events(const struct print_callbacks *print_cb, void *p + qsort(aliases, len, sizeof(struct sevent), cmp_sevent); + for (int j = 0; j < len; j++) { + /* Skip duplicates */ +- if (j > 0 && pmu_alias_is_duplicate(&aliases[j], &aliases[j - 1])) +- continue; ++ if (j < len - 1 && pmu_alias_is_duplicate(&aliases[j], &aliases[j + 1])) ++ goto free; + + print_cb->print_event(print_state, + aliases[j].pmu_name, +@@ -491,6 +491,7 @@ void perf_pmus__print_pmu_events(const struct print_callbacks *print_cb, void *p + aliases[j].desc, + aliases[j].long_desc, + aliases[j].encoding_desc); ++free: + zfree(&aliases[j].name); + zfree(&aliases[j].alias); + zfree(&aliases[j].scale_unit); +-- +2.43.0 + diff --git a/queue-6.10/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch b/queue-6.10/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch new file mode 100644 index 00000000000..c3dab0bc007 --- /dev/null +++ b/queue-6.10/perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch @@ -0,0 +1,51 @@ +From 81aabe6eb8ad96f520de8683c63e88bfdc4abd0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:59 +0300 +Subject: perf: Prevent passing zero nr_pages to rb_alloc_aux() + +From: Adrian Hunter + +[ Upstream commit dbc48c8f41c208082cfa95e973560134489e3309 ] + +nr_pages is unsigned long but gets passed to rb_alloc_aux() as an int, +and is stored as an int. + +Only power-of-2 values are accepted, so if nr_pages is a 64_bit value, it +will be passed to rb_alloc_aux() as zero. + +That is not ideal because: + 1. the value is incorrect + 2. rb_alloc_aux() is at risk of misbehaving, although it manages to + return -ENOMEM in that case, it is a result of passing zero to get_order() + even though the get_order() result is documented to be undefined in that + case. + +Fix by simply validating the maximum supported value in the first place. +Use -ENOMEM error code for consistency with the current error code that +is returned in that case. + +Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-6-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 8f908f0779354..053e546d5bf07 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6509,6 +6509,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) + return -EINVAL; + + nr_pages = vma_size / PAGE_SIZE; ++ if (nr_pages > INT_MAX) ++ return -ENOMEM; + + mutex_lock(&event->mmap_mutex); + ret = -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/perf-report-fix-condition-in-sort__sym_cmp.patch b/queue-6.10/perf-report-fix-condition-in-sort__sym_cmp.patch new file mode 100644 index 00000000000..b84eaa3a290 --- /dev/null +++ b/queue-6.10/perf-report-fix-condition-in-sort__sym_cmp.patch @@ -0,0 +1,42 @@ +From f8108d6b866cb93529ceddcfbd85d372d0045c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 10:05:25 -0700 +Subject: perf report: Fix condition in sort__sym_cmp() + +From: Namhyung Kim + +[ Upstream commit cb39d05e67dc24985ff9f5150e71040fa4d60ab8 ] + +It's expected that both hist entries are in the same hists when +comparing two. But the current code in the function checks one without +dso sort key and other with the key. This would make the condition true +in any case. + +I guess the intention of the original commit was to add '!' for the +right side too. But as it should be the same, let's just remove it. + +Fixes: 69849fc5d2119 ("perf hists: Move sort__has_dso into struct perf_hpp_list") +Reviewed-by: Kan Liang +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240621170528.608772-2-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + tools/perf/util/sort.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c +index cd39ea9721937..ab7c7ff35f9bb 100644 +--- a/tools/perf/util/sort.c ++++ b/tools/perf/util/sort.c +@@ -334,7 +334,7 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right) + * comparing symbol address alone is not enough since it's a + * relative address within a dso. + */ +- if (!hists__has(left->hists, dso) || hists__has(right->hists, dso)) { ++ if (!hists__has(left->hists, dso)) { + ret = sort__dso_cmp(left, right); + if (ret != 0) + return ret; +-- +2.43.0 + diff --git a/queue-6.10/perf-stat-fix-a-segfault-with-per-cluster-metric-onl.patch b/queue-6.10/perf-stat-fix-a-segfault-with-per-cluster-metric-onl.patch new file mode 100644 index 00000000000..a0f0992fffd --- /dev/null +++ b/queue-6.10/perf-stat-fix-a-segfault-with-per-cluster-metric-onl.patch @@ -0,0 +1,55 @@ +From ebf4c2dd4be08839e6fa9d77f08d460b0eddb53a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 17:06:03 -0700 +Subject: perf stat: Fix a segfault with --per-cluster --metric-only + +From: Namhyung Kim + +[ Upstream commit caa463bb79a82ac5fce05a0dcf7893d94c84fc5e ] + +The new --per-cluster option was added recently but it forgot to update +the aggr_header fields which are used for --metric-only option. And it +resulted in a segfault due to NULL string in fputs(). + +Fixes: cbc917a1b03b ("perf stat: Support per-cluster aggregation") +Reviewed-by: Yicong Yang +Tested-by: Yicong Yang +Tested-by: Arnaldo Carvalho de Melo +Link: https://lore.kernel.org/r/20240628000604.1296808-1-namhyung@kernel.org +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-display.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index 91d2f7f65df74..186305fd2d0ef 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -38,6 +38,7 @@ + static int aggr_header_lens[] = { + [AGGR_CORE] = 18, + [AGGR_CACHE] = 22, ++ [AGGR_CLUSTER] = 20, + [AGGR_DIE] = 12, + [AGGR_SOCKET] = 6, + [AGGR_NODE] = 6, +@@ -49,6 +50,7 @@ static int aggr_header_lens[] = { + static const char *aggr_header_csv[] = { + [AGGR_CORE] = "core,cpus,", + [AGGR_CACHE] = "cache,cpus,", ++ [AGGR_CLUSTER] = "cluster,cpus,", + [AGGR_DIE] = "die,cpus,", + [AGGR_SOCKET] = "socket,cpus,", + [AGGR_NONE] = "cpu,", +@@ -60,6 +62,7 @@ static const char *aggr_header_csv[] = { + static const char *aggr_header_std[] = { + [AGGR_CORE] = "core", + [AGGR_CACHE] = "cache", ++ [AGGR_CLUSTER] = "cluster", + [AGGR_DIE] = "die", + [AGGR_SOCKET] = "socket", + [AGGR_NONE] = "cpu", +-- +2.43.0 + diff --git a/queue-6.10/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch b/queue-6.10/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch new file mode 100644 index 00000000000..1fe15be5537 --- /dev/null +++ b/queue-6.10/perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch @@ -0,0 +1,131 @@ +From 76ddd54f0df28a554a6ba2f219d426ee4cc33477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 15:03:14 +0100 +Subject: perf test: Make test_arm_callgraph_fp.sh more robust + +From: James Clark + +[ Upstream commit ff16aeb9b83441b8458d4235496cf320189a0c60 ] + +The 2 second sleep can cause the test to fail on very slow network file +systems because Perf ends up being killed before it finishes starting +up. + +Fix it by making the leafloop workload end after a fixed time like the +other workloads so there is no need to kill it after 2 seconds. + +Also remove the 1 second start sampling delay because it is similarly +fragile. Instead, search through all samples for a matching one, rather +than just checking the first sample and hoping it's in the right place. + +Fixes: cd6382d82752 ("perf test arm64: Test unwinding using fame-pointer (fp) mode") +Signed-off-by: James Clark +Acked-by: Namhyung Kim +Cc: German Gomez +Cc: Spoorthy S +Cc: Kajol Jain +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240612140316.3006660-1-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + .../perf/tests/shell/test_arm_callgraph_fp.sh | 27 +++++++------------ + tools/perf/tests/workloads/leafloop.c | 20 +++++++++++--- + 2 files changed, 26 insertions(+), 21 deletions(-) + +diff --git a/tools/perf/tests/shell/test_arm_callgraph_fp.sh b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +index 61898e2566160..9caa361301759 100755 +--- a/tools/perf/tests/shell/test_arm_callgraph_fp.sh ++++ b/tools/perf/tests/shell/test_arm_callgraph_fp.sh +@@ -28,28 +28,21 @@ cleanup_files() + + trap cleanup_files EXIT TERM INT + +-# Add a 1 second delay to skip samples that are not in the leaf() function + # shellcheck disable=SC2086 +-perf record -o "$PERF_DATA" --call-graph fp -e cycles//u -D 1000 --user-callchains -- $TEST_PROGRAM 2> /dev/null & +-PID=$! ++perf record -o "$PERF_DATA" --call-graph fp -e cycles//u --user-callchains -- $TEST_PROGRAM + +-echo " + Recording (PID=$PID)..." +-sleep 2 +-echo " + Stopping perf-record..." +- +-kill $PID +-wait $PID ++# Try opening the file so any immediate errors are visible in the log ++perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 + +-# expected perf-script output: ++# expected perf-script output if 'leaf' has been inserted correctly: + # +-# program ++# perf + # 728 leaf + # 753 parent + # 76c leafloop +-# ... ++# ... remaining stack to main() ... + +-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 +-perf script -i "$PERF_DATA" -F comm,ip,sym | head -n4 | \ +- awk '{ if ($2 != "") sym[i++] = $2 } END { if (sym[0] != "leaf" || +- sym[1] != "parent" || +- sym[2] != "leafloop") exit 1 }' ++# Each frame is separated by a tab, some spaces and an address ++SEP="[[:space:]]+ [[:xdigit:]]+" ++perf script -i "$PERF_DATA" -F comm,ip,sym | tr '\n' ' ' | \ ++ grep -E -q "perf $SEP leaf $SEP parent $SEP leafloop" +diff --git a/tools/perf/tests/workloads/leafloop.c b/tools/perf/tests/workloads/leafloop.c +index 1bf5cc97649b0..f7561767e32cd 100644 +--- a/tools/perf/tests/workloads/leafloop.c ++++ b/tools/perf/tests/workloads/leafloop.c +@@ -1,6 +1,8 @@ + /* SPDX-License-Identifier: GPL-2.0 */ ++#include + #include + #include ++#include + #include "../tests.h" + + /* We want to check these symbols in perf script */ +@@ -8,10 +10,16 @@ noinline void leaf(volatile int b); + noinline void parent(volatile int b); + + static volatile int a; ++static volatile sig_atomic_t done; ++ ++static void sighandler(int sig __maybe_unused) ++{ ++ done = 1; ++} + + noinline void leaf(volatile int b) + { +- for (;;) ++ while (!done) + a += b; + } + +@@ -22,12 +30,16 @@ noinline void parent(volatile int b) + + static int leafloop(int argc, const char **argv) + { +- int c = 1; ++ int sec = 1; + + if (argc > 0) +- c = atoi(argv[0]); ++ sec = atoi(argv[0]); ++ ++ signal(SIGINT, sighandler); ++ signal(SIGALRM, sighandler); ++ alarm(sec); + +- parent(c); ++ parent(sec); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/perf-tests-add-some-pmu-core-functionality-tests.patch b/queue-6.10/perf-tests-add-some-pmu-core-functionality-tests.patch new file mode 100644 index 00000000000..a680409e69d --- /dev/null +++ b/queue-6.10/perf-tests-add-some-pmu-core-functionality-tests.patch @@ -0,0 +1,155 @@ +From 527f8bef2c7f975a7c00f843fcb76a7016c8b17f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 23:01:14 -0700 +Subject: perf tests: Add some pmu core functionality tests + +From: Ian Rogers + +[ Upstream commit 678be1ca30cc939e0180c85b4cc9150b3d5ef0c8 ] + +Test behavior of PMU names and comparisons wrt suffixes using Intel +uncore_cha, marvell mrvl_ddr_pmu and S390's cpum_cf as examples. + +Signed-off-by: Ian Rogers +Acked-by: Namhyung Kim +Cc: Ravi Bangoria +Cc: James Clark +Cc: Robin Murphy +Cc: Stephane Eranian +Cc: Will Deacon +Cc: Thomas Richter +Cc: Bharat Bhushan +Cc: Bhaskara Budiredla +Cc: Tuan Phan +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240515060114.3268149-3-irogers@google.com +Stable-dep-of: 3e0bf9fde298 ("perf pmu: Restore full PMU name wildcard support") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/pmu.c | 99 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 99 insertions(+) + +diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c +index 06cc0e46cb289..cc88b5920c3e2 100644 +--- a/tools/perf/tests/pmu.c ++++ b/tools/perf/tests/pmu.c +@@ -3,6 +3,7 @@ + #include "evsel.h" + #include "parse-events.h" + #include "pmu.h" ++#include "pmus.h" + #include "tests.h" + #include "debug.h" + #include "fncache.h" +@@ -340,10 +341,108 @@ static int test__pmu_event_names(struct test_suite *test __maybe_unused, + return ret; + } + ++static const char * const uncore_chas[] = { ++ "uncore_cha_0", ++ "uncore_cha_1", ++ "uncore_cha_2", ++ "uncore_cha_3", ++ "uncore_cha_4", ++ "uncore_cha_5", ++ "uncore_cha_6", ++ "uncore_cha_7", ++ "uncore_cha_8", ++ "uncore_cha_9", ++ "uncore_cha_10", ++ "uncore_cha_11", ++ "uncore_cha_12", ++ "uncore_cha_13", ++ "uncore_cha_14", ++ "uncore_cha_15", ++ "uncore_cha_16", ++ "uncore_cha_17", ++ "uncore_cha_18", ++ "uncore_cha_19", ++ "uncore_cha_20", ++ "uncore_cha_21", ++ "uncore_cha_22", ++ "uncore_cha_23", ++ "uncore_cha_24", ++ "uncore_cha_25", ++ "uncore_cha_26", ++ "uncore_cha_27", ++ "uncore_cha_28", ++ "uncore_cha_29", ++ "uncore_cha_30", ++ "uncore_cha_31", ++}; ++ ++static const char * const mrvl_ddrs[] = { ++ "mrvl_ddr_pmu_87e1b0000000", ++ "mrvl_ddr_pmu_87e1b1000000", ++ "mrvl_ddr_pmu_87e1b2000000", ++ "mrvl_ddr_pmu_87e1b3000000", ++ "mrvl_ddr_pmu_87e1b4000000", ++ "mrvl_ddr_pmu_87e1b5000000", ++ "mrvl_ddr_pmu_87e1b6000000", ++ "mrvl_ddr_pmu_87e1b7000000", ++ "mrvl_ddr_pmu_87e1b8000000", ++ "mrvl_ddr_pmu_87e1b9000000", ++ "mrvl_ddr_pmu_87e1ba000000", ++ "mrvl_ddr_pmu_87e1bb000000", ++ "mrvl_ddr_pmu_87e1bc000000", ++ "mrvl_ddr_pmu_87e1bd000000", ++ "mrvl_ddr_pmu_87e1be000000", ++ "mrvl_ddr_pmu_87e1bf000000", ++}; ++ ++static int test__name_len(struct test_suite *test __maybe_unused, int subtest __maybe_unused) ++{ ++ TEST_ASSERT_VAL("cpu", pmu_name_len_no_suffix("cpu") == strlen("cpu")); ++ TEST_ASSERT_VAL("i915", pmu_name_len_no_suffix("i915") == strlen("i915")); ++ TEST_ASSERT_VAL("cpum_cf", pmu_name_len_no_suffix("cpum_cf") == strlen("cpum_cf")); ++ for (size_t i = 0; i < ARRAY_SIZE(uncore_chas); i++) { ++ TEST_ASSERT_VAL("Strips uncore_cha suffix", ++ pmu_name_len_no_suffix(uncore_chas[i]) == ++ strlen("uncore_cha")); ++ } ++ for (size_t i = 0; i < ARRAY_SIZE(mrvl_ddrs); i++) { ++ TEST_ASSERT_VAL("Strips mrvl_ddr_pmu suffix", ++ pmu_name_len_no_suffix(mrvl_ddrs[i]) == ++ strlen("mrvl_ddr_pmu")); ++ } ++ return TEST_OK; ++} ++ ++static int test__name_cmp(struct test_suite *test __maybe_unused, int subtest __maybe_unused) ++{ ++ TEST_ASSERT_EQUAL("cpu", pmu_name_cmp("cpu", "cpu"), 0); ++ TEST_ASSERT_EQUAL("i915", pmu_name_cmp("i915", "i915"), 0); ++ TEST_ASSERT_EQUAL("cpum_cf", pmu_name_cmp("cpum_cf", "cpum_cf"), 0); ++ TEST_ASSERT_VAL("i915", pmu_name_cmp("cpu", "i915") < 0); ++ TEST_ASSERT_VAL("i915", pmu_name_cmp("i915", "cpu") > 0); ++ TEST_ASSERT_VAL("cpum_cf", pmu_name_cmp("cpum_cf", "cpum_ce") > 0); ++ TEST_ASSERT_VAL("cpum_cf", pmu_name_cmp("cpum_cf", "cpum_d0") < 0); ++ for (size_t i = 1; i < ARRAY_SIZE(uncore_chas); i++) { ++ TEST_ASSERT_VAL("uncore_cha suffixes ordered lt", ++ pmu_name_cmp(uncore_chas[i-1], uncore_chas[i]) < 0); ++ TEST_ASSERT_VAL("uncore_cha suffixes ordered gt", ++ pmu_name_cmp(uncore_chas[i], uncore_chas[i-1]) > 0); ++ } ++ for (size_t i = 1; i < ARRAY_SIZE(mrvl_ddrs); i++) { ++ TEST_ASSERT_VAL("mrvl_ddr_pmu suffixes ordered lt", ++ pmu_name_cmp(mrvl_ddrs[i-1], mrvl_ddrs[i]) < 0); ++ TEST_ASSERT_VAL("mrvl_ddr_pmu suffixes ordered gt", ++ pmu_name_cmp(mrvl_ddrs[i], mrvl_ddrs[i-1]) > 0); ++ } ++ return TEST_OK; ++} ++ + static struct test_case tests__pmu[] = { + TEST_CASE("Parsing with PMU format directory", pmu_format), + TEST_CASE("Parsing with PMU event", pmu_events), + TEST_CASE("PMU event names", pmu_event_names), ++ TEST_CASE("PMU name combining", name_len), ++ TEST_CASE("PMU name comparison", name_cmp), + { .name = NULL, } + }; + +-- +2.43.0 + diff --git a/queue-6.10/perf-x86-amd-uncore-avoid-pmu-registration-if-counte.patch b/queue-6.10/perf-x86-amd-uncore-avoid-pmu-registration-if-counte.patch new file mode 100644 index 00000000000..f0fa10dbfb3 --- /dev/null +++ b/queue-6.10/perf-x86-amd-uncore-avoid-pmu-registration-if-counte.patch @@ -0,0 +1,97 @@ +From d3275e8a76be84b2edb4ab540ef321fdeae21eff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 13:14:04 +0530 +Subject: perf/x86/amd/uncore: Avoid PMU registration if counters are + unavailable + +From: Sandipan Das + +[ Upstream commit f997e208b6c96858a2f6c0855debfbdb9b52f131 ] + +X86_FEATURE_PERFCTR_NB and X86_FEATURE_PERFCTR_LLC are derived from +CPUID leaf 0x80000001 ECX bits 24 and 28 respectively and denote the +availability of DF and L3 counters. When these bits are not set, the +corresponding PMUs have no counters and hence, should not be registered. + +Fixes: 07888daa056e ("perf/x86/amd/uncore: Move discovery and registration") +Signed-off-by: Sandipan Das +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240626074404.1044230-1-sandipan.das@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/uncore.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c +index 4ccb8fa483e61..b78e05ab4a737 100644 +--- a/arch/x86/events/amd/uncore.c ++++ b/arch/x86/events/amd/uncore.c +@@ -654,17 +654,20 @@ int amd_uncore_df_ctx_init(struct amd_uncore *uncore, unsigned int cpu) + { + struct attribute **df_attr = amd_uncore_df_format_attr; + struct amd_uncore_pmu *pmu; ++ int num_counters; + + /* Run just once */ + if (uncore->init_done) + return amd_uncore_ctx_init(uncore, cpu); + ++ num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu); ++ if (!num_counters) ++ goto done; ++ + /* No grouping, single instance for a system */ + uncore->pmus = kzalloc(sizeof(*uncore->pmus), GFP_KERNEL); +- if (!uncore->pmus) { +- uncore->num_pmus = 0; ++ if (!uncore->pmus) + goto done; +- } + + /* + * For Family 17h and above, the Northbridge counters are repurposed +@@ -674,7 +677,7 @@ int amd_uncore_df_ctx_init(struct amd_uncore *uncore, unsigned int cpu) + pmu = &uncore->pmus[0]; + strscpy(pmu->name, boot_cpu_data.x86 >= 0x17 ? "amd_df" : "amd_nb", + sizeof(pmu->name)); +- pmu->num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu); ++ pmu->num_counters = num_counters; + pmu->msr_base = MSR_F15H_NB_PERF_CTL; + pmu->rdpmc_base = RDPMC_BASE_NB; + pmu->group = amd_uncore_ctx_gid(uncore, cpu); +@@ -785,17 +788,20 @@ int amd_uncore_l3_ctx_init(struct amd_uncore *uncore, unsigned int cpu) + { + struct attribute **l3_attr = amd_uncore_l3_format_attr; + struct amd_uncore_pmu *pmu; ++ int num_counters; + + /* Run just once */ + if (uncore->init_done) + return amd_uncore_ctx_init(uncore, cpu); + ++ num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu); ++ if (!num_counters) ++ goto done; ++ + /* No grouping, single instance for a system */ + uncore->pmus = kzalloc(sizeof(*uncore->pmus), GFP_KERNEL); +- if (!uncore->pmus) { +- uncore->num_pmus = 0; ++ if (!uncore->pmus) + goto done; +- } + + /* + * For Family 17h and above, L3 cache counters are available instead +@@ -805,7 +811,7 @@ int amd_uncore_l3_ctx_init(struct amd_uncore *uncore, unsigned int cpu) + pmu = &uncore->pmus[0]; + strscpy(pmu->name, boot_cpu_data.x86 >= 0x17 ? "amd_l3" : "amd_l2", + sizeof(pmu->name)); +- pmu->num_counters = amd_uncore_ctx_num_pmcs(uncore, cpu); ++ pmu->num_counters = num_counters; + pmu->msr_base = MSR_F16H_L2I_PERF_CTL; + pmu->rdpmc_base = RDPMC_BASE_LLC; + pmu->group = amd_uncore_ctx_gid(uncore, cpu); +-- +2.43.0 + diff --git a/queue-6.10/perf-x86-amd-uncore-fix-df-and-umc-domain-identifica.patch b/queue-6.10/perf-x86-amd-uncore-fix-df-and-umc-domain-identifica.patch new file mode 100644 index 00000000000..b679e4665b5 --- /dev/null +++ b/queue-6.10/perf-x86-amd-uncore-fix-df-and-umc-domain-identifica.patch @@ -0,0 +1,59 @@ +From f58bd15fb9ccfd84fee96c986097847bf46bb912 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2024 13:19:42 +0530 +Subject: perf/x86/amd/uncore: Fix DF and UMC domain identification + +From: Sandipan Das + +[ Upstream commit 57e11990f45f89bc29d0f84dd7b13a4e4263eeb2 ] + +For uncore PMUs, a single context is shared across all CPUs in a domain. +The domain can be a CCX, like in the case of the L3 PMU, or a socket, +like in the case of DF and UMC PMUs. This information is available via +the PMU's cpumask. + +For contexts shared across a socket, the domain is currently determined +from topology_die_id() which is incorrect after the introduction of +commit 63edbaa48a57 ("x86/cpu/topology: Add support for the AMD +0x80000026 leaf") as it now returns a CCX identifier on Zen 4 and later +systems which support CPUID leaf 0x80000026. + +Use topology_logical_package_id() instead as it always returns a socket +identifier irrespective of the availability of CPUID leaf 0x80000026. + +Fixes: 63edbaa48a57 ("x86/cpu/topology: Add support for the AMD 0x80000026 leaf") +Signed-off-by: Sandipan Das +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240626074942.1044818-1-sandipan.das@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/uncore.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c +index b78e05ab4a737..5a4bfe9aea237 100644 +--- a/arch/x86/events/amd/uncore.c ++++ b/arch/x86/events/amd/uncore.c +@@ -639,7 +639,7 @@ void amd_uncore_df_ctx_scan(struct amd_uncore *uncore, unsigned int cpu) + info.split.aux_data = 0; + info.split.num_pmcs = NUM_COUNTERS_NB; + info.split.gid = 0; +- info.split.cid = topology_die_id(cpu); ++ info.split.cid = topology_logical_package_id(cpu); + + if (pmu_version >= 2) { + ebx.full = cpuid_ebx(EXT_PERFMON_DEBUG_FEATURES); +@@ -899,8 +899,8 @@ void amd_uncore_umc_ctx_scan(struct amd_uncore *uncore, unsigned int cpu) + cpuid(EXT_PERFMON_DEBUG_FEATURES, &eax, &ebx.full, &ecx, &edx); + info.split.aux_data = ecx; /* stash active mask */ + info.split.num_pmcs = ebx.split.num_umc_pmc; +- info.split.gid = topology_die_id(cpu); +- info.split.cid = topology_die_id(cpu); ++ info.split.gid = topology_logical_package_id(cpu); ++ info.split.cid = topology_logical_package_id(cpu); + *per_cpu_ptr(uncore->info, cpu) = info; + } + +-- +2.43.0 + diff --git a/queue-6.10/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch b/queue-6.10/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch new file mode 100644 index 00000000000..f783a6f425d --- /dev/null +++ b/queue-6.10/perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch @@ -0,0 +1,63 @@ +From e9ae2b26b7e80d6091df7c396c7a0faa84f62d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 11:17:56 +0800 +Subject: perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake + +From: Zhang Rui + +[ Upstream commit 2c3aedd9db6295619d21e50ad29efda614023bf1 ] + +For Alderlake, the spec changes after the patch submitted and PC7/PC9 +are removed. + +Raptorlake and Meteorlake, which copy the Alderlake cstate PMU, also +don't have PC7/PC9. + +Remove PC7/PC9 support for Alderlake/Raptorlake/Meteorlake. + +Fixes: d0ca946bcf84 ("perf/x86/cstate: Add Alder Lake CPU support") +Signed-off-by: Zhang Rui +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20240628031758.43103-2-rui.zhang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 9d6e8f13d13a7..dd18320558914 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -81,7 +81,7 @@ + * MSR_PKG_C7_RESIDENCY: Package C7 Residency Counter. + * perf code: 0x03 + * Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,CNL, +- * KBL,CML,ICL,TGL,RKL,ADL,RPL,MTL ++ * KBL,CML,ICL,TGL,RKL + * Scope: Package (physical package) + * MSR_PKG_C8_RESIDENCY: Package C8 Residency Counter. + * perf code: 0x04 +@@ -90,8 +90,7 @@ + * Scope: Package (physical package) + * MSR_PKG_C9_RESIDENCY: Package C9 Residency Counter. + * perf code: 0x05 +- * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL, +- * ADL,RPL,MTL ++ * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL + * Scope: Package (physical package) + * MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter. + * perf code: 0x06 +@@ -637,9 +636,7 @@ static const struct cstate_model adl_cstates __initconst = { + .pkg_events = BIT(PERF_CSTATE_PKG_C2_RES) | + BIT(PERF_CSTATE_PKG_C3_RES) | + BIT(PERF_CSTATE_PKG_C6_RES) | +- BIT(PERF_CSTATE_PKG_C7_RES) | + BIT(PERF_CSTATE_PKG_C8_RES) | +- BIT(PERF_CSTATE_PKG_C9_RES) | + BIT(PERF_CSTATE_PKG_C10_RES), + }; + +-- +2.43.0 + diff --git a/queue-6.10/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch b/queue-6.10/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch new file mode 100644 index 00000000000..f222b2de959 --- /dev/null +++ b/queue-6.10/perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch @@ -0,0 +1,42 @@ +From 5411c60c9c7c0edffb7326d745cb9a73941c6afd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 23:10:57 +0300 +Subject: perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation + +From: Adrian Hunter + +[ Upstream commit 3520b251dcae2b4a27b95cd6f745c54fd658bda5 ] + +Currently, perf allocates an array of page pointers which is limited in +size by MAX_PAGE_ORDER. That in turn limits the maximum Intel PT buffer +size to 2GiB. Should that limitation be lifted, the Intel PT driver can +support larger sizes, except for one calculation in +pt_topa_entry_for_page(), which is limited to 32-bits. + +Fix pt_topa_entry_for_page() address calculation by adding a cast. + +Fixes: 39152ee51b77 ("perf/x86/intel/pt: Get rid of reverse lookup table for ToPA") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20240624201101.60186-4-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/pt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index 14db6d9d318b3..c3259164a8e46 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -990,7 +990,7 @@ pt_topa_entry_for_page(struct pt_buffer *buf, unsigned int pg) + * order allocations, there shouldn't be many of these. + */ + list_for_each_entry(topa, &buf->tables, list) { +- if (topa->offset + topa->size > pg << PAGE_SHIFT) ++ if (topa->offset + topa->size > (unsigned long)pg << PAGE_SHIFT) + goto found; + } + +-- +2.43.0 + diff --git a/queue-6.10/perf-x86-serialize-set_attr_rdpmc.patch b/queue-6.10/perf-x86-serialize-set_attr_rdpmc.patch new file mode 100644 index 00000000000..cce781e0cd9 --- /dev/null +++ b/queue-6.10/perf-x86-serialize-set_attr_rdpmc.patch @@ -0,0 +1,70 @@ +From 9355a02c55d594a442528ffdb3a3d9038eb49713 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 14:46:35 +0200 +Subject: perf/x86: Serialize set_attr_rdpmc() + +From: Thomas Gleixner + +[ Upstream commit bb9bb45f746b0f9457de9c3fc4da143a6351bdc9 ] + +Yue and Xingwei reported a jump label failure. It's caused by the lack of +serialization in set_attr_rdpmc(): + +CPU0 CPU1 + +Assume: x86_pmu.attr_rdpmc == 0 + +if (val != x86_pmu.attr_rdpmc) { + if (val == 0) + ... + else if (x86_pmu.attr_rdpmc == 0) + static_branch_dec(&rdpmc_never_available_key); + + if (val != x86_pmu.attr_rdpmc) { + if (val == 0) + ... + else if (x86_pmu.attr_rdpmc == 0) + FAIL, due to imbalance ---> static_branch_dec(&rdpmc_never_available_key); + +The reported BUG() is a consequence of the above and of another bug in the +jump label core code. The core code needs a separate fix, but that cannot +prevent the imbalance problem caused by set_attr_rdpmc(). + +Prevent this by serializing set_attr_rdpmc() locally. + +Fixes: a66734297f78 ("perf/x86: Add /sys/devices/cpu/rdpmc=2 to allow rdpmc for all tasks") +Closes: https://lore.kernel.org/r/CAEkJfYNzfW1vG=ZTMdz_Weoo=RXY1NDunbxnDaLyj8R4kEoE_w@mail.gmail.com +Reported-by: Yue Sun +Reported-by: Xingwei Lee +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20240610124406.359476013@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/events/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 5b0dd07b1ef19..acd367c453341 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2547,6 +2547,7 @@ static ssize_t set_attr_rdpmc(struct device *cdev, + struct device_attribute *attr, + const char *buf, size_t count) + { ++ static DEFINE_MUTEX(rdpmc_mutex); + unsigned long val; + ssize_t ret; + +@@ -2560,6 +2561,8 @@ static ssize_t set_attr_rdpmc(struct device *cdev, + if (x86_pmu.attr_rdpmc_broken) + return -ENOTSUPP; + ++ guard(mutex)(&rdpmc_mutex); ++ + if (val != x86_pmu.attr_rdpmc) { + /* + * Changing into or out of never available or always available, +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch b/queue-6.10/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch new file mode 100644 index 00000000000..7f44c8f8e3a --- /dev/null +++ b/queue-6.10/pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch @@ -0,0 +1,59 @@ +From b8565b99eafe3660ed21fb5060b5119efb4cbc7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:02 +0800 +Subject: pinctrl: core: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit ae1cf4759972c5fe665ee4c5e0c29de66fe3cf4a ] + +In devm_pinctrl_register(), if pinctrl_enable() fails in pinctrl_register(), +the "pctldev" has not been added to dev resources, so devm_pinctrl_dev_release() +can not be called, it leads memory leak. + +Introduce pinctrl_uninit_controller(), call it in the error path to free memory. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-2-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/core.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index f424a57f00136..4438f3b4b5ef9 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -2080,6 +2080,14 @@ pinctrl_init_controller(struct pinctrl_desc *pctldesc, struct device *dev, + return ERR_PTR(ret); + } + ++static void pinctrl_uninit_controller(struct pinctrl_dev *pctldev, struct pinctrl_desc *pctldesc) ++{ ++ pinctrl_free_pindescs(pctldev, pctldesc->pins, ++ pctldesc->npins); ++ mutex_destroy(&pctldev->mutex); ++ kfree(pctldev); ++} ++ + static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) + { + pctldev->p = create_pinctrl(pctldev->dev, pctldev); +@@ -2160,8 +2168,10 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc, + return pctldev; + + error = pinctrl_enable(pctldev); +- if (error) ++ if (error) { ++ pinctrl_uninit_controller(pctldev, pctldesc); + return ERR_PTR(error); ++ } + + return pctldev; + } +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-freescale-mxs-fix-refcount-of-child.patch b/queue-6.10/pinctrl-freescale-mxs-fix-refcount-of-child.patch new file mode 100644 index 00000000000..05bccfdee4c --- /dev/null +++ b/queue-6.10/pinctrl-freescale-mxs-fix-refcount-of-child.patch @@ -0,0 +1,43 @@ +From dd82208445bda2f620029149febf78346aa80781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2024 21:20:16 +0800 +Subject: pinctrl: freescale: mxs: Fix refcount of child + +From: Peng Fan + +[ Upstream commit 7f500f2011c0bbb6e1cacab74b4c99222e60248e ] + +of_get_next_child() will increase refcount of the returned node, need +use of_node_put() on it when done. + +Per current implementation, 'child' will be override by +for_each_child_of_node(np, child), so use of_get_child_count to avoid +refcount leakage. + +Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support") +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/20240504-pinctrl-cleanup-v2-18-26c5f2dc1181@nxp.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/freescale/pinctrl-mxs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c +index e77311f26262a..4813a9e16cb3b 100644 +--- a/drivers/pinctrl/freescale/pinctrl-mxs.c ++++ b/drivers/pinctrl/freescale/pinctrl-mxs.c +@@ -413,8 +413,8 @@ static int mxs_pinctrl_probe_dt(struct platform_device *pdev, + int ret; + u32 val; + +- child = of_get_next_child(np, NULL); +- if (!child) { ++ val = of_get_child_count(np); ++ if (val == 0) { + dev_err(&pdev->dev, "no group is defined\n"); + return -ENOENT; + } +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch new file mode 100644 index 00000000000..92040970cf3 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch @@ -0,0 +1,97 @@ +From 711bcb415214d1fc1f88507404a453f7e896e077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:48 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix CANFD5 suffix + +From: Geert Uytterhoeven + +[ Upstream commit 77fa9007ac31e80674beadc452d3f3614f283e18 ] + +CAN-FD instance 5 has two alternate pin groups: "canfd5" and "canfd5_b". +Rename the former to "canfd5_a" to increase uniformity. + +While at it, remove the unneeded separator. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: c2b4b2cd632d17e7 ("pinctrl: renesas: r8a779g0: Add missing CANFD5_B") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/10b22d54086ed11cdfeb0004583029ccf249bdb9.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index d2de526a3b588..d90ba8b6b4b42 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -341,8 +341,8 @@ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -896,11 +896,11 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), + + PINMUX_IPSR_GPSR(IP0SR2_11_8, RXDA_EXTFXR), +- PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX), ++ PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX_A), + PINMUX_IPSR_GPSR(IP0SR2_11_8, IRQ5), + + PINMUX_IPSR_GPSR(IP0SR2_15_12, CLK_EXTFXR), +- PINMUX_IPSR_GPSR(IP0SR2_15_12, CANFD5_RX), ++ PINMUX_IPSR_GPSR(IP0SR2_15_12, CANFD5_RX_A), + PINMUX_IPSR_GPSR(IP0SR2_15_12, IRQ4_B), + + PINMUX_IPSR_GPSR(IP0SR2_19_16, RXDB_EXTFXR), +@@ -1531,15 +1531,14 @@ static const unsigned int canfd4_data_mux[] = { + }; + + /* - CANFD5 ----------------------------------------------------------------- */ +-static const unsigned int canfd5_data_pins[] = { +- /* CANFD5_TX, CANFD5_RX */ ++static const unsigned int canfd5_data_a_pins[] = { ++ /* CANFD5_TX_A, CANFD5_RX_A */ + RCAR_GP_PIN(2, 2), RCAR_GP_PIN(2, 3), + }; +-static const unsigned int canfd5_data_mux[] = { +- CANFD5_TX_MARK, CANFD5_RX_MARK, ++static const unsigned int canfd5_data_a_mux[] = { ++ CANFD5_TX_A_MARK, CANFD5_RX_A_MARK, + }; + +-/* - CANFD5_B ----------------------------------------------------------------- */ + static const unsigned int canfd5_data_b_pins[] = { + /* CANFD5_TX_B, CANFD5_RX_B */ + RCAR_GP_PIN(1, 8), RCAR_GP_PIN(1, 9), +@@ -2578,8 +2577,8 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(canfd2_data), + SH_PFC_PIN_GROUP(canfd3_data), + SH_PFC_PIN_GROUP(canfd4_data), +- SH_PFC_PIN_GROUP(canfd5_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(canfd5_data_b), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(canfd5_data_a), ++ SH_PFC_PIN_GROUP(canfd5_data_b), + SH_PFC_PIN_GROUP(canfd6_data), + SH_PFC_PIN_GROUP(canfd7_data), + SH_PFC_PIN_GROUP(can_clk), +@@ -2788,8 +2787,7 @@ static const char * const canfd4_groups[] = { + }; + + static const char * const canfd5_groups[] = { +- /* suffix might be updated */ +- "canfd5_data", ++ "canfd5_data_a", + "canfd5_data_b", + }; + +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch new file mode 100644 index 00000000000..c3e81ca7171 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch @@ -0,0 +1,103 @@ +From 1610b356bd68d87cd74f5d16ab5658622f425371 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:49 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 4976d61ca39ce51f422e094de53b46e2e3ac5c0d ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pins named both +"FXR_TXEN[AB]". To differentiate, the pin control driver uses +"FXR_TXEN[AB]" and "FXR_TXEN[AB]_X", which were considered temporary +names until the conflict was sorted out. + +Fix this by adopting R-Car V4M naming: + - Rename "FXR_TXEN[AB]" to "FXR_TXEN[AB]_A", + - Rename "FXR_TXEN[AB]_X" to "FXR_TXEN[AB]_B". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 1c2646b5cebfff07 ("pinctrl: renesas: r8a779g0: Add missing FlexRay") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5e1e9abb46c311d4c54450d991072d6d0e66f14c.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index d90ba8b6b4b42..ba2ec8e042119 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -122,11 +122,11 @@ + #define GPSR2_8 F_(TPU0TO0, IP1SR2_3_0) + #define GPSR2_7 F_(TPU0TO1, IP0SR2_31_28) + #define GPSR2_6 F_(FXR_TXDB, IP0SR2_27_24) +-#define GPSR2_5 F_(FXR_TXENB_N, IP0SR2_23_20) ++#define GPSR2_5 F_(FXR_TXENB_N_A, IP0SR2_23_20) + #define GPSR2_4 F_(RXDB_EXTFXR, IP0SR2_19_16) + #define GPSR2_3 F_(CLK_EXTFXR, IP0SR2_15_12) + #define GPSR2_2 F_(RXDA_EXTFXR, IP0SR2_11_8) +-#define GPSR2_1 F_(FXR_TXENA_N, IP0SR2_7_4) ++#define GPSR2_1 F_(FXR_TXENA_N_A, IP0SR2_7_4) + #define GPSR2_0 F_(FXR_TXDA, IP0SR2_3_0) + + /* GPSR3 */ +@@ -340,18 +340,18 @@ + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_7_4 FM(FXR_TXENA_N) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_23_20 FM(FXR_TXENB_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -891,7 +891,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR2_3_0, CANFD1_TX), + PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_A), + +- PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N), ++ PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N_A), + PINMUX_IPSR_GPSR(IP0SR2_7_4, CANFD1_RX), + PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), + +@@ -905,7 +905,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_19_16, RXDB_EXTFXR), + +- PINMUX_IPSR_GPSR(IP0SR2_23_20, FXR_TXENB_N), ++ PINMUX_IPSR_GPSR(IP0SR2_23_20, FXR_TXENB_N_A), + + PINMUX_IPSR_GPSR(IP0SR2_27_24, FXR_TXDB), + +@@ -919,10 +919,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_A), + + PINMUX_IPSR_GPSR(IP1SR2_7_4, CAN_CLK), +- PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_X), ++ PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_B), + + PINMUX_IPSR_GPSR(IP1SR2_11_8, CANFD0_TX), +- PINMUX_IPSR_GPSR(IP1SR2_11_8, FXR_TXENB_N_X), ++ PINMUX_IPSR_GPSR(IP1SR2_11_8, FXR_TXENB_N_B), + + PINMUX_IPSR_GPSR(IP1SR2_15_12, CANFD0_RX), + PINMUX_IPSR_GPSR(IP1SR2_15_12, STPWT_EXTFXR), +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch new file mode 100644 index 00000000000..f02926be690 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch @@ -0,0 +1,380 @@ +From 479a2a143250d419dbcf99cbdf064dbc5c89dfb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:50 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 3cf834a1669ea433aeee4c82c642776899c87451 ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pin groups (GP0_14-18 +and GP1_6-10) each named both HSCIF1 and SCIF1. To differentiate, the +pin control driver uses "(h)scif1" and "(h)scif1_x", which were +considered temporary names until the conflict was sorted out. + +Fix this by adopting R-Car V4M naming: + - Rename "(h)scif1" to "(h)scif1_a", + - Rename "(h)scif1_x" to "(h)scif1_b". + +Adopt the R-Car V4M naming "(h)scif1_a" and "(h)scif1_b" to increase +uniformity. + +While at it, remove unneeded separators. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: cf4f7891847bc558 ("pinctrl: renesas: r8a779g0: Add missing HSCIF1_X") +Fixes: 9c151c2be92becf2 ("pinctrl: renesas: r8a779g0: Add missing SCIF1_X") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/5009130d1867e12abf9b231c8838fd05e2b28bee.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 208 ++++++++++++------------- + 1 file changed, 102 insertions(+), 106 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index ba2ec8e042119..7b64429c35ad3 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -291,13 +291,13 @@ + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1) FM(TX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1) FM(RX1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N) FM(CTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N) FM(RTS1_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1) FM(SCK1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_3_0 FM(MSIOF2_TXD) FM(HCTS1_N_A) FM(CTS1_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_7_4 FM(MSIOF2_SCK) FM(HRTS1_N_A) FM(RTS1_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR0_11_8 FM(MSIOF2_RXD) FM(HSCK1_A) FM(SCK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR1 */ + /* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -307,13 +307,13 @@ + #define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_X) FM(TX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_X) FM(RX1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_B) FM(TX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_B) FM(RX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_X) FM(CTS1_N_X) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_X) FM(RTS1_N_X) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_X) FM(SCK1_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_3_0 FM(MSIOF0_SYNC) FM(HCTS1_N_B) FM(CTS1_N_B) FM(CANFD5_TX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_7_4 FM(MSIOF0_TXD) FM(HRTS1_N_B) FM(RTS1_N_B) FM(CANFD5_RX_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_B) FM(SCK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -754,25 +754,25 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_A), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), +- PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1), +- PINMUX_IPSR_GPSR(IP1SR0_27_24, TX1), ++ PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1_A), ++ PINMUX_IPSR_GPSR(IP1SR0_27_24, TX1_A), + + PINMUX_IPSR_GPSR(IP1SR0_31_28, MSIOF2_SYNC), +- PINMUX_IPSR_GPSR(IP1SR0_31_28, HRX1), +- PINMUX_IPSR_GPSR(IP1SR0_31_28, RX1), ++ PINMUX_IPSR_GPSR(IP1SR0_31_28, HRX1_A), ++ PINMUX_IPSR_GPSR(IP1SR0_31_28, RX1_A), + + /* IP2SR0 */ + PINMUX_IPSR_GPSR(IP2SR0_3_0, MSIOF2_TXD), +- PINMUX_IPSR_GPSR(IP2SR0_3_0, HCTS1_N), +- PINMUX_IPSR_GPSR(IP2SR0_3_0, CTS1_N), ++ PINMUX_IPSR_GPSR(IP2SR0_3_0, HCTS1_N_A), ++ PINMUX_IPSR_GPSR(IP2SR0_3_0, CTS1_N_A), + + PINMUX_IPSR_GPSR(IP2SR0_7_4, MSIOF2_SCK), +- PINMUX_IPSR_GPSR(IP2SR0_7_4, HRTS1_N), +- PINMUX_IPSR_GPSR(IP2SR0_7_4, RTS1_N), ++ PINMUX_IPSR_GPSR(IP2SR0_7_4, HRTS1_N_A), ++ PINMUX_IPSR_GPSR(IP2SR0_7_4, RTS1_N_A), + + PINMUX_IPSR_GPSR(IP2SR0_11_8, MSIOF2_RXD), +- PINMUX_IPSR_GPSR(IP2SR0_11_8, HSCK1), +- PINMUX_IPSR_GPSR(IP2SR0_11_8, SCK1), ++ PINMUX_IPSR_GPSR(IP2SR0_11_8, HSCK1_A), ++ PINMUX_IPSR_GPSR(IP2SR0_11_8, SCK1_A), + + /* IP0SR1 */ + PINMUX_IPSR_GPSR(IP0SR1_3_0, MSIOF1_SS2), +@@ -798,27 +798,27 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP0SR1_23_20, MSIOF1_RXD), + + PINMUX_IPSR_GPSR(IP0SR1_27_24, MSIOF0_SS2), +- PINMUX_IPSR_GPSR(IP0SR1_27_24, HTX1_X), +- PINMUX_IPSR_GPSR(IP0SR1_27_24, TX1_X), ++ PINMUX_IPSR_GPSR(IP0SR1_27_24, HTX1_B), ++ PINMUX_IPSR_GPSR(IP0SR1_27_24, TX1_B), + + PINMUX_IPSR_GPSR(IP0SR1_31_28, MSIOF0_SS1), +- PINMUX_IPSR_GPSR(IP0SR1_31_28, HRX1_X), +- PINMUX_IPSR_GPSR(IP0SR1_31_28, RX1_X), ++ PINMUX_IPSR_GPSR(IP0SR1_31_28, HRX1_B), ++ PINMUX_IPSR_GPSR(IP0SR1_31_28, RX1_B), + + /* IP1SR1 */ + PINMUX_IPSR_GPSR(IP1SR1_3_0, MSIOF0_SYNC), +- PINMUX_IPSR_GPSR(IP1SR1_3_0, HCTS1_N_X), +- PINMUX_IPSR_GPSR(IP1SR1_3_0, CTS1_N_X), ++ PINMUX_IPSR_GPSR(IP1SR1_3_0, HCTS1_N_B), ++ PINMUX_IPSR_GPSR(IP1SR1_3_0, CTS1_N_B), + PINMUX_IPSR_GPSR(IP1SR1_3_0, CANFD5_TX_B), + + PINMUX_IPSR_GPSR(IP1SR1_7_4, MSIOF0_TXD), +- PINMUX_IPSR_GPSR(IP1SR1_7_4, HRTS1_N_X), +- PINMUX_IPSR_GPSR(IP1SR1_7_4, RTS1_N_X), ++ PINMUX_IPSR_GPSR(IP1SR1_7_4, HRTS1_N_B), ++ PINMUX_IPSR_GPSR(IP1SR1_7_4, RTS1_N_B), + PINMUX_IPSR_GPSR(IP1SR1_7_4, CANFD5_RX_B), + + PINMUX_IPSR_GPSR(IP1SR1_11_8, MSIOF0_SCK), +- PINMUX_IPSR_GPSR(IP1SR1_11_8, HSCK1_X), +- PINMUX_IPSR_GPSR(IP1SR1_11_8, SCK1_X), ++ PINMUX_IPSR_GPSR(IP1SR1_11_8, HSCK1_B), ++ PINMUX_IPSR_GPSR(IP1SR1_11_8, SCK1_B), + + PINMUX_IPSR_GPSR(IP1SR1_15_12, MSIOF0_RXD), + +@@ -1598,49 +1598,48 @@ static const unsigned int hscif0_ctrl_mux[] = { + }; + + /* - HSCIF1 ----------------------------------------------------------------- */ +-static const unsigned int hscif1_data_pins[] = { +- /* HRX1, HTX1 */ ++static const unsigned int hscif1_data_a_pins[] = { ++ /* HRX1_A, HTX1_A */ + RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14), + }; +-static const unsigned int hscif1_data_mux[] = { +- HRX1_MARK, HTX1_MARK, ++static const unsigned int hscif1_data_a_mux[] = { ++ HRX1_A_MARK, HTX1_A_MARK, + }; +-static const unsigned int hscif1_clk_pins[] = { +- /* HSCK1 */ ++static const unsigned int hscif1_clk_a_pins[] = { ++ /* HSCK1_A */ + RCAR_GP_PIN(0, 18), + }; +-static const unsigned int hscif1_clk_mux[] = { +- HSCK1_MARK, ++static const unsigned int hscif1_clk_a_mux[] = { ++ HSCK1_A_MARK, + }; +-static const unsigned int hscif1_ctrl_pins[] = { +- /* HRTS1_N, HCTS1_N */ ++static const unsigned int hscif1_ctrl_a_pins[] = { ++ /* HRTS1_N_A, HCTS1_N_A */ + RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16), + }; +-static const unsigned int hscif1_ctrl_mux[] = { +- HRTS1_N_MARK, HCTS1_N_MARK, ++static const unsigned int hscif1_ctrl_a_mux[] = { ++ HRTS1_N_A_MARK, HCTS1_N_A_MARK, + }; + +-/* - HSCIF1_X---------------------------------------------------------------- */ +-static const unsigned int hscif1_data_x_pins[] = { +- /* HRX1_X, HTX1_X */ ++static const unsigned int hscif1_data_b_pins[] = { ++ /* HRX1_B, HTX1_B */ + RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6), + }; +-static const unsigned int hscif1_data_x_mux[] = { +- HRX1_X_MARK, HTX1_X_MARK, ++static const unsigned int hscif1_data_b_mux[] = { ++ HRX1_B_MARK, HTX1_B_MARK, + }; +-static const unsigned int hscif1_clk_x_pins[] = { +- /* HSCK1_X */ ++static const unsigned int hscif1_clk_b_pins[] = { ++ /* HSCK1_B */ + RCAR_GP_PIN(1, 10), + }; +-static const unsigned int hscif1_clk_x_mux[] = { +- HSCK1_X_MARK, ++static const unsigned int hscif1_clk_b_mux[] = { ++ HSCK1_B_MARK, + }; +-static const unsigned int hscif1_ctrl_x_pins[] = { +- /* HRTS1_N_X, HCTS1_N_X */ ++static const unsigned int hscif1_ctrl_b_pins[] = { ++ /* HRTS1_N_B, HCTS1_N_B */ + RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8), + }; +-static const unsigned int hscif1_ctrl_x_mux[] = { +- HRTS1_N_X_MARK, HCTS1_N_X_MARK, ++static const unsigned int hscif1_ctrl_b_mux[] = { ++ HRTS1_N_B_MARK, HCTS1_N_B_MARK, + }; + + /* - HSCIF2 ----------------------------------------------------------------- */ +@@ -2260,49 +2259,48 @@ static const unsigned int scif0_ctrl_mux[] = { + }; + + /* - SCIF1 ------------------------------------------------------------------ */ +-static const unsigned int scif1_data_pins[] = { +- /* RX1, TX1 */ ++static const unsigned int scif1_data_a_pins[] = { ++ /* RX1_A, TX1_A */ + RCAR_GP_PIN(0, 15), RCAR_GP_PIN(0, 14), + }; +-static const unsigned int scif1_data_mux[] = { +- RX1_MARK, TX1_MARK, ++static const unsigned int scif1_data_a_mux[] = { ++ RX1_A_MARK, TX1_A_MARK, + }; +-static const unsigned int scif1_clk_pins[] = { +- /* SCK1 */ ++static const unsigned int scif1_clk_a_pins[] = { ++ /* SCK1_A */ + RCAR_GP_PIN(0, 18), + }; +-static const unsigned int scif1_clk_mux[] = { +- SCK1_MARK, ++static const unsigned int scif1_clk_a_mux[] = { ++ SCK1_A_MARK, + }; +-static const unsigned int scif1_ctrl_pins[] = { +- /* RTS1_N, CTS1_N */ ++static const unsigned int scif1_ctrl_a_pins[] = { ++ /* RTS1_N_A, CTS1_N_A */ + RCAR_GP_PIN(0, 17), RCAR_GP_PIN(0, 16), + }; +-static const unsigned int scif1_ctrl_mux[] = { +- RTS1_N_MARK, CTS1_N_MARK, ++static const unsigned int scif1_ctrl_a_mux[] = { ++ RTS1_N_A_MARK, CTS1_N_A_MARK, + }; + +-/* - SCIF1_X ------------------------------------------------------------------ */ +-static const unsigned int scif1_data_x_pins[] = { +- /* RX1_X, TX1_X */ ++static const unsigned int scif1_data_b_pins[] = { ++ /* RX1_B, TX1_B */ + RCAR_GP_PIN(1, 7), RCAR_GP_PIN(1, 6), + }; +-static const unsigned int scif1_data_x_mux[] = { +- RX1_X_MARK, TX1_X_MARK, ++static const unsigned int scif1_data_b_mux[] = { ++ RX1_B_MARK, TX1_B_MARK, + }; +-static const unsigned int scif1_clk_x_pins[] = { +- /* SCK1_X */ ++static const unsigned int scif1_clk_b_pins[] = { ++ /* SCK1_B */ + RCAR_GP_PIN(1, 10), + }; +-static const unsigned int scif1_clk_x_mux[] = { +- SCK1_X_MARK, ++static const unsigned int scif1_clk_b_mux[] = { ++ SCK1_B_MARK, + }; +-static const unsigned int scif1_ctrl_x_pins[] = { +- /* RTS1_N_X, CTS1_N_X */ ++static const unsigned int scif1_ctrl_b_pins[] = { ++ /* RTS1_N_B, CTS1_N_B */ + RCAR_GP_PIN(1, 9), RCAR_GP_PIN(1, 8), + }; +-static const unsigned int scif1_ctrl_x_mux[] = { +- RTS1_N_X_MARK, CTS1_N_X_MARK, ++static const unsigned int scif1_ctrl_b_mux[] = { ++ RTS1_N_B_MARK, CTS1_N_B_MARK, + }; + + /* - SCIF3 ------------------------------------------------------------------ */ +@@ -2586,12 +2584,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(hscif0_data), + SH_PFC_PIN_GROUP(hscif0_clk), + SH_PFC_PIN_GROUP(hscif0_ctrl), +- SH_PFC_PIN_GROUP(hscif1_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_data_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_clk_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif1_ctrl_x), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(hscif1_data_a), ++ SH_PFC_PIN_GROUP(hscif1_clk_a), ++ SH_PFC_PIN_GROUP(hscif1_ctrl_a), ++ SH_PFC_PIN_GROUP(hscif1_data_b), ++ SH_PFC_PIN_GROUP(hscif1_clk_b), ++ SH_PFC_PIN_GROUP(hscif1_ctrl_b), + SH_PFC_PIN_GROUP(hscif2_data), + SH_PFC_PIN_GROUP(hscif2_clk), + SH_PFC_PIN_GROUP(hscif2_ctrl), +@@ -2685,12 +2683,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(scif0_data), + SH_PFC_PIN_GROUP(scif0_clk), + SH_PFC_PIN_GROUP(scif0_ctrl), +- SH_PFC_PIN_GROUP(scif1_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_data_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_clk_x), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif1_ctrl_x), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(scif1_data_a), ++ SH_PFC_PIN_GROUP(scif1_clk_a), ++ SH_PFC_PIN_GROUP(scif1_ctrl_a), ++ SH_PFC_PIN_GROUP(scif1_data_b), ++ SH_PFC_PIN_GROUP(scif1_clk_b), ++ SH_PFC_PIN_GROUP(scif1_ctrl_b), + SH_PFC_PIN_GROUP(scif3_data), /* suffix might be updated */ + SH_PFC_PIN_GROUP(scif3_clk), /* suffix might be updated */ + SH_PFC_PIN_GROUP(scif3_ctrl), /* suffix might be updated */ +@@ -2810,13 +2808,12 @@ static const char * const hscif0_groups[] = { + }; + + static const char * const hscif1_groups[] = { +- /* suffix might be updated */ +- "hscif1_data", +- "hscif1_clk", +- "hscif1_ctrl", +- "hscif1_data_x", +- "hscif1_clk_x", +- "hscif1_ctrl_x", ++ "hscif1_data_a", ++ "hscif1_clk_a", ++ "hscif1_ctrl_a", ++ "hscif1_data_b", ++ "hscif1_clk_b", ++ "hscif1_ctrl_b", + }; + + static const char * const hscif2_groups[] = { +@@ -2993,13 +2990,12 @@ static const char * const scif0_groups[] = { + }; + + static const char * const scif1_groups[] = { +- /* suffix might be updated */ +- "scif1_data", +- "scif1_clk", +- "scif1_ctrl", +- "scif1_data_x", +- "scif1_clk_x", +- "scif1_ctrl_x", ++ "scif1_data_a", ++ "scif1_clk_a", ++ "scif1_ctrl_a", ++ "scif1_data_b", ++ "scif1_clk_b", ++ "scif1_ctrl_b", + }; + + static const char * const scif3_groups[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch new file mode 100644 index 00000000000..903229ef571 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch @@ -0,0 +1,360 @@ +From b30e0cc2a6fe204aeb8f3b0611e94eacfb26034b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:51 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 5350f38150a171322b50c0a48efa671885f87050 ] + +(H)SCIF instance 3 has two alternate pin groups: "hscif3" and +"hscif3_a", resp. "scif3" and "scif3_a", but the actual meanings of the +pins within the groups do not match. + +Increase uniformity by adopting R-Car V4M naming: + - Rename "hscif3_a" to "hscif3_b", + - Rename "hscif3" to "hscif3_a", + - Rename "scif3" to "scif3_b". + +While at it, remove unneeded separators. + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: 213b713255defaa6 ("pinctrl: renesas: r8a779g0: Add missing HSCIF3_A") +Fixes: 49e4697656bdd1cd ("pinctrl: renesas: r8a779g0: Add missing SCIF3") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/61fdde58e369e8070ffd3c5811c089e6219c7ecc.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 192 ++++++++++++------------- + 1 file changed, 94 insertions(+), 98 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 7b64429c35ad3..e3c720ea76e32 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -77,11 +77,11 @@ + #define GPSR0_0 F_(GP0_00, IP0SR0_3_0) + + /* GPSR1 */ +-#define GPSR1_28 F_(HTX3, IP3SR1_19_16) +-#define GPSR1_27 F_(HCTS3_N, IP3SR1_15_12) +-#define GPSR1_26 F_(HRTS3_N, IP3SR1_11_8) +-#define GPSR1_25 F_(HSCK3, IP3SR1_7_4) +-#define GPSR1_24 F_(HRX3, IP3SR1_3_0) ++#define GPSR1_28 F_(HTX3_A, IP3SR1_19_16) ++#define GPSR1_27 F_(HCTS3_N_A, IP3SR1_15_12) ++#define GPSR1_26 F_(HRTS3_N_A, IP3SR1_11_8) ++#define GPSR1_25 F_(HSCK3_A, IP3SR1_7_4) ++#define GPSR1_24 F_(HRX3_A, IP3SR1_3_0) + #define GPSR1_23 F_(GP1_23, IP2SR1_31_28) + #define GPSR1_22 F_(AUDIO_CLKIN, IP2SR1_27_24) + #define GPSR1_21 F_(AUDIO_CLKOUT, IP2SR1_23_20) +@@ -301,11 +301,11 @@ + + /* SR1 */ + /* IP0SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_A) FM(TX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_A) FM(RX3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_A) FM(RTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_A) FM(CTS3_N) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_A) FM(SCK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_3_0 FM(MSIOF1_SS2) FM(HTX3_B) FM(TX3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_7_4 FM(MSIOF1_SS1) FM(HCTS3_N_B) FM(RX3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_11_8 FM(MSIOF1_SYNC) FM(HRTS3_N_B) FM(RTS3_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_15_12 FM(MSIOF1_SCK) FM(HSCK3_B) FM(CTS3_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR1_19_16 FM(MSIOF1_TXD) FM(HRX3_B) FM(SCK3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_23_20 FM(MSIOF1_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_27_24 FM(MSIOF0_SS2) FM(HTX1_B) FM(TX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR1_31_28 FM(MSIOF0_SS1) FM(HRX1_B) FM(RX1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -331,11 +331,11 @@ + #define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP3SR1_3_0 FM(HRX3) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_7_4 FM(HSCK3) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_11_8 FM(HRTS3_N) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_15_12 FM(HCTS3_N) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_19_16 FM(HTX3) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_15_12 FM(HCTS3_N_A) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_19_16 FM(HTX3_A) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -776,24 +776,24 @@ static const u16 pinmux_data[] = { + + /* IP0SR1 */ + PINMUX_IPSR_GPSR(IP0SR1_3_0, MSIOF1_SS2), +- PINMUX_IPSR_GPSR(IP0SR1_3_0, HTX3_A), +- PINMUX_IPSR_GPSR(IP0SR1_3_0, TX3), ++ PINMUX_IPSR_GPSR(IP0SR1_3_0, HTX3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_3_0, TX3_B), + + PINMUX_IPSR_GPSR(IP0SR1_7_4, MSIOF1_SS1), +- PINMUX_IPSR_GPSR(IP0SR1_7_4, HCTS3_N_A), +- PINMUX_IPSR_GPSR(IP0SR1_7_4, RX3), ++ PINMUX_IPSR_GPSR(IP0SR1_7_4, HCTS3_N_B), ++ PINMUX_IPSR_GPSR(IP0SR1_7_4, RX3_B), + + PINMUX_IPSR_GPSR(IP0SR1_11_8, MSIOF1_SYNC), +- PINMUX_IPSR_GPSR(IP0SR1_11_8, HRTS3_N_A), +- PINMUX_IPSR_GPSR(IP0SR1_11_8, RTS3_N), ++ PINMUX_IPSR_GPSR(IP0SR1_11_8, HRTS3_N_B), ++ PINMUX_IPSR_GPSR(IP0SR1_11_8, RTS3_N_B), + + PINMUX_IPSR_GPSR(IP0SR1_15_12, MSIOF1_SCK), +- PINMUX_IPSR_GPSR(IP0SR1_15_12, HSCK3_A), +- PINMUX_IPSR_GPSR(IP0SR1_15_12, CTS3_N), ++ PINMUX_IPSR_GPSR(IP0SR1_15_12, HSCK3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_15_12, CTS3_N_B), + + PINMUX_IPSR_GPSR(IP0SR1_19_16, MSIOF1_TXD), +- PINMUX_IPSR_GPSR(IP0SR1_19_16, HRX3_A), +- PINMUX_IPSR_GPSR(IP0SR1_19_16, SCK3), ++ PINMUX_IPSR_GPSR(IP0SR1_19_16, HRX3_B), ++ PINMUX_IPSR_GPSR(IP0SR1_19_16, SCK3_B), + + PINMUX_IPSR_GPSR(IP0SR1_23_20, MSIOF1_RXD), + +@@ -864,25 +864,25 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_31_28, IRQ3_B), + + /* IP3SR1 */ +- PINMUX_IPSR_GPSR(IP3SR1_3_0, HRX3), ++ PINMUX_IPSR_GPSR(IP3SR1_3_0, HRX3_A), + PINMUX_IPSR_GPSR(IP3SR1_3_0, SCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_3_0, MSIOF4_SS2), + +- PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3), ++ PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, CTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, MSIOF4_SCK), + PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_A), + +- PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N), ++ PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, RTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, MSIOF4_TXD), + PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_A), + +- PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N), ++ PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, RX3_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, MSIOF4_RXD), + +- PINMUX_IPSR_GPSR(IP3SR1_19_16, HTX3), ++ PINMUX_IPSR_GPSR(IP3SR1_19_16, HTX3_A), + PINMUX_IPSR_GPSR(IP3SR1_19_16, TX3_A), + PINMUX_IPSR_GPSR(IP3SR1_19_16, MSIOF4_SYNC), + +@@ -1666,49 +1666,48 @@ static const unsigned int hscif2_ctrl_mux[] = { + }; + + /* - HSCIF3 ----------------------------------------------------------------- */ +-static const unsigned int hscif3_data_pins[] = { +- /* HRX3, HTX3 */ ++static const unsigned int hscif3_data_a_pins[] = { ++ /* HRX3_A, HTX3_A */ + RCAR_GP_PIN(1, 24), RCAR_GP_PIN(1, 28), + }; +-static const unsigned int hscif3_data_mux[] = { +- HRX3_MARK, HTX3_MARK, ++static const unsigned int hscif3_data_a_mux[] = { ++ HRX3_A_MARK, HTX3_A_MARK, + }; +-static const unsigned int hscif3_clk_pins[] = { +- /* HSCK3 */ ++static const unsigned int hscif3_clk_a_pins[] = { ++ /* HSCK3_A */ + RCAR_GP_PIN(1, 25), + }; +-static const unsigned int hscif3_clk_mux[] = { +- HSCK3_MARK, ++static const unsigned int hscif3_clk_a_mux[] = { ++ HSCK3_A_MARK, + }; +-static const unsigned int hscif3_ctrl_pins[] = { +- /* HRTS3_N, HCTS3_N */ ++static const unsigned int hscif3_ctrl_a_pins[] = { ++ /* HRTS3_N_A, HCTS3_N_A */ + RCAR_GP_PIN(1, 26), RCAR_GP_PIN(1, 27), + }; +-static const unsigned int hscif3_ctrl_mux[] = { +- HRTS3_N_MARK, HCTS3_N_MARK, ++static const unsigned int hscif3_ctrl_a_mux[] = { ++ HRTS3_N_A_MARK, HCTS3_N_A_MARK, + }; + +-/* - HSCIF3_A ----------------------------------------------------------------- */ +-static const unsigned int hscif3_data_a_pins[] = { +- /* HRX3_A, HTX3_A */ ++static const unsigned int hscif3_data_b_pins[] = { ++ /* HRX3_B, HTX3_B */ + RCAR_GP_PIN(1, 4), RCAR_GP_PIN(1, 0), + }; +-static const unsigned int hscif3_data_a_mux[] = { +- HRX3_A_MARK, HTX3_A_MARK, ++static const unsigned int hscif3_data_b_mux[] = { ++ HRX3_B_MARK, HTX3_B_MARK, + }; +-static const unsigned int hscif3_clk_a_pins[] = { +- /* HSCK3_A */ ++static const unsigned int hscif3_clk_b_pins[] = { ++ /* HSCK3_B */ + RCAR_GP_PIN(1, 3), + }; +-static const unsigned int hscif3_clk_a_mux[] = { +- HSCK3_A_MARK, ++static const unsigned int hscif3_clk_b_mux[] = { ++ HSCK3_B_MARK, + }; +-static const unsigned int hscif3_ctrl_a_pins[] = { +- /* HRTS3_N_A, HCTS3_N_A */ ++static const unsigned int hscif3_ctrl_b_pins[] = { ++ /* HRTS3_N_B, HCTS3_N_B */ + RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 1), + }; +-static const unsigned int hscif3_ctrl_a_mux[] = { +- HRTS3_N_A_MARK, HCTS3_N_A_MARK, ++static const unsigned int hscif3_ctrl_b_mux[] = { ++ HRTS3_N_B_MARK, HCTS3_N_B_MARK, + }; + + /* - I2C0 ------------------------------------------------------------------- */ +@@ -2304,29 +2303,6 @@ static const unsigned int scif1_ctrl_b_mux[] = { + }; + + /* - SCIF3 ------------------------------------------------------------------ */ +-static const unsigned int scif3_data_pins[] = { +- /* RX3, TX3 */ +- RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0), +-}; +-static const unsigned int scif3_data_mux[] = { +- RX3_MARK, TX3_MARK, +-}; +-static const unsigned int scif3_clk_pins[] = { +- /* SCK3 */ +- RCAR_GP_PIN(1, 4), +-}; +-static const unsigned int scif3_clk_mux[] = { +- SCK3_MARK, +-}; +-static const unsigned int scif3_ctrl_pins[] = { +- /* RTS3_N, CTS3_N */ +- RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3), +-}; +-static const unsigned int scif3_ctrl_mux[] = { +- RTS3_N_MARK, CTS3_N_MARK, +-}; +- +-/* - SCIF3_A ------------------------------------------------------------------ */ + static const unsigned int scif3_data_a_pins[] = { + /* RX3_A, TX3_A */ + RCAR_GP_PIN(1, 27), RCAR_GP_PIN(1, 28), +@@ -2349,6 +2325,28 @@ static const unsigned int scif3_ctrl_a_mux[] = { + RTS3_N_A_MARK, CTS3_N_A_MARK, + }; + ++static const unsigned int scif3_data_b_pins[] = { ++ /* RX3_B, TX3_B */ ++ RCAR_GP_PIN(1, 1), RCAR_GP_PIN(1, 0), ++}; ++static const unsigned int scif3_data_b_mux[] = { ++ RX3_B_MARK, TX3_B_MARK, ++}; ++static const unsigned int scif3_clk_b_pins[] = { ++ /* SCK3_B */ ++ RCAR_GP_PIN(1, 4), ++}; ++static const unsigned int scif3_clk_b_mux[] = { ++ SCK3_B_MARK, ++}; ++static const unsigned int scif3_ctrl_b_pins[] = { ++ /* RTS3_N_B, CTS3_N_B */ ++ RCAR_GP_PIN(1, 2), RCAR_GP_PIN(1, 3), ++}; ++static const unsigned int scif3_ctrl_b_mux[] = { ++ RTS3_N_B_MARK, CTS3_N_B_MARK, ++}; ++ + /* - SCIF4 ------------------------------------------------------------------ */ + static const unsigned int scif4_data_pins[] = { + /* RX4, TX4 */ +@@ -2593,12 +2591,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(hscif2_data), + SH_PFC_PIN_GROUP(hscif2_clk), + SH_PFC_PIN_GROUP(hscif2_ctrl), +- SH_PFC_PIN_GROUP(hscif3_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_data_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_clk_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(hscif3_ctrl_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(hscif3_data_a), ++ SH_PFC_PIN_GROUP(hscif3_clk_a), ++ SH_PFC_PIN_GROUP(hscif3_ctrl_a), ++ SH_PFC_PIN_GROUP(hscif3_data_b), ++ SH_PFC_PIN_GROUP(hscif3_clk_b), ++ SH_PFC_PIN_GROUP(hscif3_ctrl_b), + + SH_PFC_PIN_GROUP(i2c0), + SH_PFC_PIN_GROUP(i2c1), +@@ -2689,12 +2687,12 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(scif1_data_b), + SH_PFC_PIN_GROUP(scif1_clk_b), + SH_PFC_PIN_GROUP(scif1_ctrl_b), +- SH_PFC_PIN_GROUP(scif3_data), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_clk), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_ctrl), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_data_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_clk_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(scif3_ctrl_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(scif3_data_a), ++ SH_PFC_PIN_GROUP(scif3_clk_a), ++ SH_PFC_PIN_GROUP(scif3_ctrl_a), ++ SH_PFC_PIN_GROUP(scif3_data_b), ++ SH_PFC_PIN_GROUP(scif3_clk_b), ++ SH_PFC_PIN_GROUP(scif3_ctrl_b), + SH_PFC_PIN_GROUP(scif4_data), + SH_PFC_PIN_GROUP(scif4_clk), + SH_PFC_PIN_GROUP(scif4_ctrl), +@@ -2823,13 +2821,12 @@ static const char * const hscif2_groups[] = { + }; + + static const char * const hscif3_groups[] = { +- /* suffix might be updated */ +- "hscif3_data", +- "hscif3_clk", +- "hscif3_ctrl", + "hscif3_data_a", + "hscif3_clk_a", + "hscif3_ctrl_a", ++ "hscif3_data_b", ++ "hscif3_clk_b", ++ "hscif3_ctrl_b", + }; + + static const char * const i2c0_groups[] = { +@@ -2999,13 +2996,12 @@ static const char * const scif1_groups[] = { + }; + + static const char * const scif3_groups[] = { +- /* suffix might be updated */ +- "scif3_data", +- "scif3_clk", +- "scif3_ctrl", + "scif3_data_a", + "scif3_clk_a", + "scif3_ctrl_a", ++ "scif3_data_b", ++ "scif3_clk_b", ++ "scif3_ctrl_b", + }; + + static const char * const scif4_groups[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch new file mode 100644 index 00000000000..08bcfe61880 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch @@ -0,0 +1,133 @@ +From 47c4bae0a75813704bde562b29547e6a8ad4e57c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:52 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix IRQ suffixes + +From: Geert Uytterhoeven + +[ Upstream commit c391dcde3884dbbea37f57dd2625225d8661da97 ] + +The suffixes of the IRQ identifiers for external interrupts 0-3 +are inconsistent: + - "IRQ0" and "IRQ0_A", + - "IRQ1" and "IRQ1_A", + - "IRQ2" and "IRQ2_A", + - "IRQ3" and "IRQ3_B". +The suffixes for external interrupts 4 and 5 do follow conventional +naming: + - "IRQ4A" and IRQ4_B", + - "IRQ5". + +Fix this by adopting R-Car V4M naming: + - Rename "IRQ[0-2]_A" to "IRQ[0-2]_B", + - Rename "IRQ[0-3]" to "IRQ[0-3]_A". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 1b23d8a478bea9d1 ("pinctrl: renesas: r8a779g0: Add missing IRQx_A/IRQx_B") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/8ce9baf0a0f9346544a3ac801fd962c7c12fd247.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 36 +++++++++++++------------- + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index e3c720ea76e32..f9f650f232e6e 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -68,10 +68,10 @@ + #define GPSR0_9 F_(MSIOF5_SYNC, IP1SR0_7_4) + #define GPSR0_8 F_(MSIOF5_SS1, IP1SR0_3_0) + #define GPSR0_7 F_(MSIOF5_SS2, IP0SR0_31_28) +-#define GPSR0_6 F_(IRQ0, IP0SR0_27_24) +-#define GPSR0_5 F_(IRQ1, IP0SR0_23_20) +-#define GPSR0_4 F_(IRQ2, IP0SR0_19_16) +-#define GPSR0_3 F_(IRQ3, IP0SR0_15_12) ++#define GPSR0_6 F_(IRQ0_A, IP0SR0_27_24) ++#define GPSR0_5 F_(IRQ1_A, IP0SR0_23_20) ++#define GPSR0_4 F_(IRQ2_A, IP0SR0_19_16) ++#define GPSR0_3 F_(IRQ3_A, IP0SR0_15_12) + #define GPSR0_2 F_(GP0_02, IP0SR0_11_8) + #define GPSR0_1 F_(GP0_01, IP0SR0_7_4) + #define GPSR0_0 F_(GP0_00, IP0SR0_3_0) +@@ -278,10 +278,10 @@ + #define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_15_12 FM(IRQ3) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_19_16 FM(IRQ2) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_23_20 FM(IRQ1) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR0_27_24 FM(IRQ0) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_15_12 FM(IRQ3_A) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_19_16 FM(IRQ2_A) FM(MSIOF3_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_23_20 FM(IRQ1_A) FM(MSIOF3_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_27_24 FM(IRQ0_A) FM(MSIOF3_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_31_28 FM(MSIOF5_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -290,7 +290,7 @@ + #define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -325,8 +325,8 @@ + #define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -724,16 +724,16 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR0_11_8, MSIOF3_SS2), + +- PINMUX_IPSR_GPSR(IP0SR0_15_12, IRQ3), ++ PINMUX_IPSR_GPSR(IP0SR0_15_12, IRQ3_A), + PINMUX_IPSR_GPSR(IP0SR0_15_12, MSIOF3_SCK), + +- PINMUX_IPSR_GPSR(IP0SR0_19_16, IRQ2), ++ PINMUX_IPSR_GPSR(IP0SR0_19_16, IRQ2_A), + PINMUX_IPSR_GPSR(IP0SR0_19_16, MSIOF3_TXD), + +- PINMUX_IPSR_GPSR(IP0SR0_23_20, IRQ1), ++ PINMUX_IPSR_GPSR(IP0SR0_23_20, IRQ1_A), + PINMUX_IPSR_GPSR(IP0SR0_23_20, MSIOF3_RXD), + +- PINMUX_IPSR_GPSR(IP0SR0_27_24, IRQ0), ++ PINMUX_IPSR_GPSR(IP0SR0_27_24, IRQ0_A), + PINMUX_IPSR_GPSR(IP0SR0_27_24, MSIOF3_SYNC), + + PINMUX_IPSR_GPSR(IP0SR0_31_28, MSIOF5_SS2), +@@ -751,7 +751,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR0_23_20, MSIOF2_SS2), + PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1), +- PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_A), ++ PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_B), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), + PINMUX_IPSR_GPSR(IP1SR0_27_24, HTX1_A), +@@ -851,10 +851,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4), + + PINMUX_IPSR_GPSR(IP2SR1_19_16, SSI_SD), +- PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_A), ++ PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_B), + + PINMUX_IPSR_GPSR(IP2SR1_23_20, AUDIO_CLKOUT), +- PINMUX_IPSR_GPSR(IP2SR1_23_20, IRQ1_A), ++ PINMUX_IPSR_GPSR(IP2SR1_23_20, IRQ1_B), + + PINMUX_IPSR_GPSR(IP2SR1_27_24, AUDIO_CLKIN), + PINMUX_IPSR_GPSR(IP2SR1_27_24, PWM3_A), +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch new file mode 100644 index 00000000000..37eb769aaf5 --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch @@ -0,0 +1,207 @@ +From 6f9bd164200ead179b4be10162c8c6a7f05df15c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:53 +0200 +Subject: pinctrl: renesas: r8a779g0: FIX PWM suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 0aabdc9a4d3644fd57d804b283b2ab0f9c28dc6c ] + +PWM channels 0, 2, 8, and 9 do not have alternate pins. +Remove their "_a" or "_b" suffixes to increase uniformity. + +Fixes: c606c2fde2330547 ("pinctrl: renesas: r8a779g0: Add missing PWM") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/abb748e6e1e4e7d78beac7d96e7a0a3481b32e75.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 76 ++++++++++++-------------- + 1 file changed, 36 insertions(+), 40 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index f9f650f232e6e..3228a61ea4098 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -316,9 +316,9 @@ + #define IP1SR1_11_8 FM(MSIOF0_SCK) FM(HSCK1_B) FM(SCK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_15_12 FM(MSIOF0_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR1_19_16 FM(HTX0) FM(TX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_23_20 FM(HCTS0_N) FM(CTS0_N) FM(PWM8) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_27_24 FM(HRTS0_N) FM(RTS0_N) FM(PWM9) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR1_31_28 FM(HSCK0) FM(SCK0) FM(PWM0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -355,7 +355,7 @@ + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -827,15 +827,15 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR1_23_20, HCTS0_N), + PINMUX_IPSR_GPSR(IP1SR1_23_20, CTS0_N), +- PINMUX_IPSR_GPSR(IP1SR1_23_20, PWM8_A), ++ PINMUX_IPSR_GPSR(IP1SR1_23_20, PWM8), + + PINMUX_IPSR_GPSR(IP1SR1_27_24, HRTS0_N), + PINMUX_IPSR_GPSR(IP1SR1_27_24, RTS0_N), +- PINMUX_IPSR_GPSR(IP1SR1_27_24, PWM9_A), ++ PINMUX_IPSR_GPSR(IP1SR1_27_24, PWM9), + + PINMUX_IPSR_GPSR(IP1SR1_31_28, HSCK0), + PINMUX_IPSR_GPSR(IP1SR1_31_28, SCK0), +- PINMUX_IPSR_GPSR(IP1SR1_31_28, PWM0_A), ++ PINMUX_IPSR_GPSR(IP1SR1_31_28, PWM0), + + /* IP2SR1 */ + PINMUX_IPSR_GPSR(IP2SR1_3_0, HRX0), +@@ -937,7 +937,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_A), + + PINMUX_IPSR_GPSR(IP1SR2_27_24, CANFD3_TX), +- PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2_B), ++ PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2), + + PINMUX_IPSR_GPSR(IP1SR2_31_28, CANFD3_RX), + PINMUX_IPSR_GPSR(IP1SR2_31_28, PWM3_B), +@@ -2090,13 +2090,13 @@ static const unsigned int pcie1_clkreq_n_mux[] = { + PCIE1_CLKREQ_N_MARK, + }; + +-/* - PWM0_A ------------------------------------------------------------------- */ +-static const unsigned int pwm0_a_pins[] = { +- /* PWM0_A */ ++/* - PWM0 ------------------------------------------------------------------- */ ++static const unsigned int pwm0_pins[] = { ++ /* PWM0 */ + RCAR_GP_PIN(1, 15), + }; +-static const unsigned int pwm0_a_mux[] = { +- PWM0_A_MARK, ++static const unsigned int pwm0_mux[] = { ++ PWM0_MARK, + }; + + /* - PWM1_A ------------------------------------------------------------------- */ +@@ -2117,13 +2117,13 @@ static const unsigned int pwm1_b_mux[] = { + PWM1_B_MARK, + }; + +-/* - PWM2_B ------------------------------------------------------------------- */ +-static const unsigned int pwm2_b_pins[] = { +- /* PWM2_B */ ++/* - PWM2 ------------------------------------------------------------------- */ ++static const unsigned int pwm2_pins[] = { ++ /* PWM2 */ + RCAR_GP_PIN(2, 14), + }; +-static const unsigned int pwm2_b_mux[] = { +- PWM2_B_MARK, ++static const unsigned int pwm2_mux[] = { ++ PWM2_MARK, + }; + + /* - PWM3_A ------------------------------------------------------------------- */ +@@ -2180,22 +2180,22 @@ static const unsigned int pwm7_mux[] = { + PWM7_MARK, + }; + +-/* - PWM8_A ------------------------------------------------------------------- */ +-static const unsigned int pwm8_a_pins[] = { +- /* PWM8_A */ ++/* - PWM8 ------------------------------------------------------------------- */ ++static const unsigned int pwm8_pins[] = { ++ /* PWM8 */ + RCAR_GP_PIN(1, 13), + }; +-static const unsigned int pwm8_a_mux[] = { +- PWM8_A_MARK, ++static const unsigned int pwm8_mux[] = { ++ PWM8_MARK, + }; + +-/* - PWM9_A ------------------------------------------------------------------- */ +-static const unsigned int pwm9_a_pins[] = { +- /* PWM9_A */ ++/* - PWM9 ------------------------------------------------------------------- */ ++static const unsigned int pwm9_pins[] = { ++ /* PWM9 */ + RCAR_GP_PIN(1, 14), + }; +-static const unsigned int pwm9_a_mux[] = { +- PWM9_A_MARK, ++static const unsigned int pwm9_mux[] = { ++ PWM9_MARK, + }; + + /* - QSPI0 ------------------------------------------------------------------ */ +@@ -2658,18 +2658,18 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(pcie0_clkreq_n), + SH_PFC_PIN_GROUP(pcie1_clkreq_n), + +- SH_PFC_PIN_GROUP(pwm0_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm0), + SH_PFC_PIN_GROUP(pwm1_a), + SH_PFC_PIN_GROUP(pwm1_b), +- SH_PFC_PIN_GROUP(pwm2_b), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm2), + SH_PFC_PIN_GROUP(pwm3_a), + SH_PFC_PIN_GROUP(pwm3_b), + SH_PFC_PIN_GROUP(pwm4), + SH_PFC_PIN_GROUP(pwm5), + SH_PFC_PIN_GROUP(pwm6), + SH_PFC_PIN_GROUP(pwm7), +- SH_PFC_PIN_GROUP(pwm8_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(pwm9_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(pwm8), ++ SH_PFC_PIN_GROUP(pwm9), + + SH_PFC_PIN_GROUP(qspi0_ctrl), + BUS_DATA_PIN_GROUP(qspi0_data, 2), +@@ -2923,8 +2923,7 @@ static const char * const pcie_groups[] = { + }; + + static const char * const pwm0_groups[] = { +- /* suffix might be updated */ +- "pwm0_a", ++ "pwm0", + }; + + static const char * const pwm1_groups[] = { +@@ -2933,8 +2932,7 @@ static const char * const pwm1_groups[] = { + }; + + static const char * const pwm2_groups[] = { +- /* suffix might be updated */ +- "pwm2_b", ++ "pwm2", + }; + + static const char * const pwm3_groups[] = { +@@ -2959,13 +2957,11 @@ static const char * const pwm7_groups[] = { + }; + + static const char * const pwm8_groups[] = { +- /* suffix might be updated */ +- "pwm8_a", ++ "pwm8", + }; + + static const char * const pwm9_groups[] = { +- /* suffix might be updated */ +- "pwm9_a", ++ "pwm9", + }; + + static const char * const qspi0_groups[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch new file mode 100644 index 00000000000..2016ec7966e --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch @@ -0,0 +1,189 @@ +From eb1e923238f4543a398cf09d8d1e1a6fda75905d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:54 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix TCLK suffixes + +From: Geert Uytterhoeven + +[ Upstream commit bfd2428f3a80647af681df4793e473258aa755da ] + +The Pin Multiplex attachment in Rev.1.10 of the R-Car V4H Series +Hardware User's Manual still has two alternate pins named both TCLK3 +and TCLK4. To differentiate, the pin control driver uses "TCLK[34]" and +"TCLK[34]_X". In addition, there are alternate pins without suffix, and +with an "_A" or "_B" suffix. + +Increase uniformity by adopting R-Car V4M naming: + - Rename "TCLK2_B" to "TCLK2_C", + - Rename "TCLK[12]_A" to "TCLK[12]_B", + - Rename "TCLK[12]" to "TCLK[12]_A", + - Rename "TCLK[34]_A" to "TCLK[34]_C", + - Rename "TCLK[34]_X" to "TCLK[34]_A", + - Rename "TCLK[34]" to "TCLK[34]_B". + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 0df46188a58895e1 ("pinctrl: renesas: r8a779g0: Add missing TCLKx_A/TCLKx_B/TCLKx_X") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/2845ff1f8fe1fd8d23d2f307ad5e8eb8243da608.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 44 +++++++++++++------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 3228a61ea4098..8c19b892441a3 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -275,7 +275,7 @@ + + /* SR0 */ + /* IP0SR0 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR0_3_0 F_(0, 0) FM(ERROROUTC_N_B) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_7_4 F_(0, 0) FM(MSIOF3_SS1) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_11_8 F_(0, 0) FM(MSIOF3_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR0_15_12 FM(IRQ3_A) FM(MSIOF3_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -290,7 +290,7 @@ + #define IP1SR0_11_8 FM(MSIOF5_TXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_15_12 FM(MSIOF5_SCK) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_19_16 FM(MSIOF5_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR0_23_20 FM(MSIOF2_SS2) FM(TCLK1_A) FM(IRQ2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_27_24 FM(MSIOF2_SS1) FM(HTX1_A) FM(TX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR0_31_28 FM(MSIOF2_SYNC) FM(HRX1_A) FM(RX1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -323,12 +323,12 @@ + /* IP2SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP2SR1_3_0 FM(HRX0) FM(RX0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_7_4 FM(SCIF_CLK) FM(IRQ4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_11_8 FM(SSI_SCK) FM(TCLK3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_15_12 FM(SSI_WS) FM(TCLK4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_19_16 FM(SSI_SD) FM(IRQ0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_23_20 FM(AUDIO_CLKOUT) FM(IRQ1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP2SR1_27_24 FM(AUDIO_CLKIN) FM(PWM3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP2SR1_31_28 F_(0, 0) FM(TCLK2) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP2SR1_31_28 F_(0, 0) FM(TCLK2_A) FM(MSIOF4_SS1) FM(IRQ3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +@@ -346,15 +346,15 @@ + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -381,8 +381,8 @@ + #define IP1SR3_11_8 FM(MMC_SD_CMD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_15_12 FM(SD_CD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_19_16 FM(SD_WP) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_X) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_23_20 FM(IPC_CLKIN) FM(IPC_CLKEN_IN) FM(PWM1_A) FM(TCLK3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR3_27_24 FM(IPC_CLKOUT) FM(IPC_CLKEN_OUT) FM(ERROROUTC_N_A) FM(TCLK4_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR3_31_28 FM(QSPI0_SSL) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP2SR3 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +@@ -718,7 +718,7 @@ static const u16 pinmux_data[] = { + + /* IP0SR0 */ + PINMUX_IPSR_GPSR(IP0SR0_3_0, ERROROUTC_N_B), +- PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_A), ++ PINMUX_IPSR_GPSR(IP0SR0_3_0, TCLK2_B), + + PINMUX_IPSR_GPSR(IP0SR0_7_4, MSIOF3_SS1), + +@@ -750,7 +750,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR0_19_16, MSIOF5_RXD), + + PINMUX_IPSR_GPSR(IP1SR0_23_20, MSIOF2_SS2), +- PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1), ++ PINMUX_IPSR_GPSR(IP1SR0_23_20, TCLK1_A), + PINMUX_IPSR_GPSR(IP1SR0_23_20, IRQ2_B), + + PINMUX_IPSR_GPSR(IP1SR0_27_24, MSIOF2_SS1), +@@ -845,10 +845,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_7_4, IRQ4_A), + + PINMUX_IPSR_GPSR(IP2SR1_11_8, SSI_SCK), +- PINMUX_IPSR_GPSR(IP2SR1_11_8, TCLK3), ++ PINMUX_IPSR_GPSR(IP2SR1_11_8, TCLK3_B), + + PINMUX_IPSR_GPSR(IP2SR1_15_12, SSI_WS), +- PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4), ++ PINMUX_IPSR_GPSR(IP2SR1_15_12, TCLK4_B), + + PINMUX_IPSR_GPSR(IP2SR1_19_16, SSI_SD), + PINMUX_IPSR_GPSR(IP2SR1_19_16, IRQ0_B), +@@ -859,7 +859,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP2SR1_27_24, AUDIO_CLKIN), + PINMUX_IPSR_GPSR(IP2SR1_27_24, PWM3_A), + +- PINMUX_IPSR_GPSR(IP2SR1_31_28, TCLK2), ++ PINMUX_IPSR_GPSR(IP2SR1_31_28, TCLK2_A), + PINMUX_IPSR_GPSR(IP2SR1_31_28, MSIOF4_SS1), + PINMUX_IPSR_GPSR(IP2SR1_31_28, IRQ3_B), + +@@ -911,12 +911,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1), + PINMUX_IPSR_GPSR(IP0SR2_31_28, CANFD6_TX), +- PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_B), ++ PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_C), + + /* IP1SR2 */ + PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0), + PINMUX_IPSR_GPSR(IP1SR2_3_0, CANFD6_RX), +- PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_A), ++ PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_B), + + PINMUX_IPSR_GPSR(IP1SR2_7_4, CAN_CLK), + PINMUX_IPSR_GPSR(IP1SR2_7_4, FXR_TXENA_N_B), +@@ -929,12 +929,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP1SR2_19_16, CANFD2_TX), + PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2), +- PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_A), ++ PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_C), + + PINMUX_IPSR_GPSR(IP1SR2_23_20, CANFD2_RX), + PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3), + PINMUX_IPSR_GPSR(IP1SR2_23_20, PWM1_B), +- PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_A), ++ PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_C), + + PINMUX_IPSR_GPSR(IP1SR2_27_24, CANFD3_TX), + PINMUX_IPSR_GPSR(IP1SR2_27_24, PWM2), +@@ -979,12 +979,12 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR3_23_20, IPC_CLKIN), + PINMUX_IPSR_GPSR(IP1SR3_23_20, IPC_CLKEN_IN), + PINMUX_IPSR_GPSR(IP1SR3_23_20, PWM1_A), +- PINMUX_IPSR_GPSR(IP1SR3_23_20, TCLK3_X), ++ PINMUX_IPSR_GPSR(IP1SR3_23_20, TCLK3_A), + + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKOUT), + PINMUX_IPSR_GPSR(IP1SR3_27_24, IPC_CLKEN_OUT), + PINMUX_IPSR_GPSR(IP1SR3_27_24, ERROROUTC_N_A), +- PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_X), ++ PINMUX_IPSR_GPSR(IP1SR3_27_24, TCLK4_A), + + PINMUX_IPSR_GPSR(IP1SR3_31_28, QSPI0_SSL), + +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch b/queue-6.10/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch new file mode 100644 index 00000000000..ceb01fe30ac --- /dev/null +++ b/queue-6.10/pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch @@ -0,0 +1,281 @@ +From 179d653cb7105c75e2ce430375c346039b8eb65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2024 12:13:55 +0200 +Subject: pinctrl: renesas: r8a779g0: Fix TPU suffixes + +From: Geert Uytterhoeven + +[ Upstream commit 3d144ef10a448f89065dcff39c40d90ac18e035e ] + +The Timer Pulse Unit channels have two alternate pin groups: +"tpu_to[0-3]" and "tpu_to[0-3]_a". + +Increase uniformity by adopting R-Car V4M naming: + - Rename "tpu_to[0-3]_a" to "tpu_to[0-3]_b", + - Rename "tpu_to[0-3]" to "tpu_to[0-3]_a", + +Fixes: ad9bb2fec66262b0 ("pinctrl: renesas: Initial R8A779G0 (R-Car V4H) PFC support") +Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions") +Fixes: 85a9cbe4c57bb958 ("pinctrl: renesas: r8a779g0: Add missing TPU0TOx_A") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/0dd9428bc24e97e1001ed3976b1cb98966f5e7e3.1717754960.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a779g0.c | 128 ++++++++++++------------- + 1 file changed, 63 insertions(+), 65 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c +index 8c19b892441a3..bb843e333c880 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c ++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c +@@ -119,8 +119,8 @@ + #define GPSR2_11 F_(CANFD0_RX, IP1SR2_15_12) + #define GPSR2_10 F_(CANFD0_TX, IP1SR2_11_8) + #define GPSR2_9 F_(CAN_CLK, IP1SR2_7_4) +-#define GPSR2_8 F_(TPU0TO0, IP1SR2_3_0) +-#define GPSR2_7 F_(TPU0TO1, IP0SR2_31_28) ++#define GPSR2_8 F_(TPU0TO0_A, IP1SR2_3_0) ++#define GPSR2_7 F_(TPU0TO1_A, IP0SR2_31_28) + #define GPSR2_6 F_(FXR_TXDB, IP0SR2_27_24) + #define GPSR2_5 F_(FXR_TXENB_N_A, IP0SR2_23_20) + #define GPSR2_4 F_(RXDB_EXTFXR, IP0SR2_19_16) +@@ -332,29 +332,29 @@ + + /* IP3SR1 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ + #define IP3SR1_3_0 FM(HRX3_A) FM(SCK3_A) FM(MSIOF4_SS2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_7_4 FM(HSCK3_A) FM(CTS3_N_A) FM(MSIOF4_SCK) FM(TPU0TO0_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP3SR1_11_8 FM(HRTS3_N_A) FM(RTS3_N_A) FM(MSIOF4_TXD) FM(TPU0TO1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP3SR1_15_12 FM(HCTS3_N_A) FM(RX3_A) FM(MSIOF4_RXD) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP3SR1_19_16 FM(HTX3_A) FM(TX3_A) FM(MSIOF4_SYNC) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* SR2 */ + /* IP0SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_3_0 FM(FXR_TXDA) FM(CANFD1_TX) FM(TPU0TO2_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_7_4 FM(FXR_TXENA_N_A) FM(CANFD1_RX) FM(TPU0TO3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_11_8 FM(RXDA_EXTFXR) FM(CANFD5_TX_A) FM(IRQ5) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_15_12 FM(CLK_EXTFXR) FM(CANFD5_RX_A) FM(IRQ4_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_19_16 FM(RXDB_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_23_20 FM(FXR_TXENB_N_A) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP0SR2_27_24 FM(FXR_TXDB) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP0SR2_31_28 FM(TPU0TO1) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP0SR2_31_28 FM(TPU0TO1_A) FM(CANFD6_TX) F_(0, 0) FM(TCLK2_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + + /* IP1SR2 */ /* 0 */ /* 1 */ /* 2 */ /* 3 4 5 6 7 8 9 A B C D E F */ +-#define IP1SR2_3_0 FM(TPU0TO0) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_3_0 FM(TPU0TO0_A) FM(CANFD6_RX) F_(0, 0) FM(TCLK1_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_7_4 FM(CAN_CLK) FM(FXR_TXENA_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_11_8 FM(CANFD0_TX) FM(FXR_TXENB_N_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_15_12 FM(CANFD0_RX) FM(STPWT_EXTFXR) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) +-#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_19_16 FM(CANFD2_TX) FM(TPU0TO2_A) F_(0, 0) FM(TCLK3_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) ++#define IP1SR2_23_20 FM(CANFD2_RX) FM(TPU0TO3_A) FM(PWM1_B) FM(TCLK4_C) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_27_24 FM(CANFD3_TX) F_(0, 0) FM(PWM2) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + #define IP1SR2_31_28 FM(CANFD3_RX) F_(0, 0) FM(PWM3_B) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) F_(0, 0) + +@@ -871,12 +871,12 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP3SR1_7_4, HSCK3_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, CTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_7_4, MSIOF4_SCK), +- PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_A), ++ PINMUX_IPSR_GPSR(IP3SR1_7_4, TPU0TO0_B), + + PINMUX_IPSR_GPSR(IP3SR1_11_8, HRTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, RTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_11_8, MSIOF4_TXD), +- PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_A), ++ PINMUX_IPSR_GPSR(IP3SR1_11_8, TPU0TO1_B), + + PINMUX_IPSR_GPSR(IP3SR1_15_12, HCTS3_N_A), + PINMUX_IPSR_GPSR(IP3SR1_15_12, RX3_A), +@@ -889,11 +889,11 @@ static const u16 pinmux_data[] = { + /* IP0SR2 */ + PINMUX_IPSR_GPSR(IP0SR2_3_0, FXR_TXDA), + PINMUX_IPSR_GPSR(IP0SR2_3_0, CANFD1_TX), +- PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_A), ++ PINMUX_IPSR_GPSR(IP0SR2_3_0, TPU0TO2_B), + + PINMUX_IPSR_GPSR(IP0SR2_7_4, FXR_TXENA_N_A), + PINMUX_IPSR_GPSR(IP0SR2_7_4, CANFD1_RX), +- PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_A), ++ PINMUX_IPSR_GPSR(IP0SR2_7_4, TPU0TO3_B), + + PINMUX_IPSR_GPSR(IP0SR2_11_8, RXDA_EXTFXR), + PINMUX_IPSR_GPSR(IP0SR2_11_8, CANFD5_TX_A), +@@ -909,12 +909,12 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP0SR2_27_24, FXR_TXDB), + +- PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1), ++ PINMUX_IPSR_GPSR(IP0SR2_31_28, TPU0TO1_A), + PINMUX_IPSR_GPSR(IP0SR2_31_28, CANFD6_TX), + PINMUX_IPSR_GPSR(IP0SR2_31_28, TCLK2_C), + + /* IP1SR2 */ +- PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0), ++ PINMUX_IPSR_GPSR(IP1SR2_3_0, TPU0TO0_A), + PINMUX_IPSR_GPSR(IP1SR2_3_0, CANFD6_RX), + PINMUX_IPSR_GPSR(IP1SR2_3_0, TCLK1_B), + +@@ -928,11 +928,11 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP1SR2_15_12, STPWT_EXTFXR), + + PINMUX_IPSR_GPSR(IP1SR2_19_16, CANFD2_TX), +- PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2), ++ PINMUX_IPSR_GPSR(IP1SR2_19_16, TPU0TO2_A), + PINMUX_IPSR_GPSR(IP1SR2_19_16, TCLK3_C), + + PINMUX_IPSR_GPSR(IP1SR2_23_20, CANFD2_RX), +- PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3), ++ PINMUX_IPSR_GPSR(IP1SR2_23_20, TPU0TO3_A), + PINMUX_IPSR_GPSR(IP1SR2_23_20, PWM1_B), + PINMUX_IPSR_GPSR(IP1SR2_23_20, TCLK4_C), + +@@ -2403,64 +2403,63 @@ static const unsigned int ssi_ctrl_mux[] = { + SSI_SCK_MARK, SSI_WS_MARK, + }; + +-/* - TPU ------------------------------------------------------------------- */ +-static const unsigned int tpu_to0_pins[] = { +- /* TPU0TO0 */ ++/* - TPU -------------------------------------------------------------------- */ ++static const unsigned int tpu_to0_a_pins[] = { ++ /* TPU0TO0_A */ + RCAR_GP_PIN(2, 8), + }; +-static const unsigned int tpu_to0_mux[] = { +- TPU0TO0_MARK, ++static const unsigned int tpu_to0_a_mux[] = { ++ TPU0TO0_A_MARK, + }; +-static const unsigned int tpu_to1_pins[] = { +- /* TPU0TO1 */ ++static const unsigned int tpu_to1_a_pins[] = { ++ /* TPU0TO1_A */ + RCAR_GP_PIN(2, 7), + }; +-static const unsigned int tpu_to1_mux[] = { +- TPU0TO1_MARK, ++static const unsigned int tpu_to1_a_mux[] = { ++ TPU0TO1_A_MARK, + }; +-static const unsigned int tpu_to2_pins[] = { +- /* TPU0TO2 */ ++static const unsigned int tpu_to2_a_pins[] = { ++ /* TPU0TO2_A */ + RCAR_GP_PIN(2, 12), + }; +-static const unsigned int tpu_to2_mux[] = { +- TPU0TO2_MARK, ++static const unsigned int tpu_to2_a_mux[] = { ++ TPU0TO2_A_MARK, + }; +-static const unsigned int tpu_to3_pins[] = { +- /* TPU0TO3 */ ++static const unsigned int tpu_to3_a_pins[] = { ++ /* TPU0TO3_A */ + RCAR_GP_PIN(2, 13), + }; +-static const unsigned int tpu_to3_mux[] = { +- TPU0TO3_MARK, ++static const unsigned int tpu_to3_a_mux[] = { ++ TPU0TO3_A_MARK, + }; + +-/* - TPU_A ------------------------------------------------------------------- */ +-static const unsigned int tpu_to0_a_pins[] = { +- /* TPU0TO0_A */ ++static const unsigned int tpu_to0_b_pins[] = { ++ /* TPU0TO0_B */ + RCAR_GP_PIN(1, 25), + }; +-static const unsigned int tpu_to0_a_mux[] = { +- TPU0TO0_A_MARK, ++static const unsigned int tpu_to0_b_mux[] = { ++ TPU0TO0_B_MARK, + }; +-static const unsigned int tpu_to1_a_pins[] = { +- /* TPU0TO1_A */ ++static const unsigned int tpu_to1_b_pins[] = { ++ /* TPU0TO1_B */ + RCAR_GP_PIN(1, 26), + }; +-static const unsigned int tpu_to1_a_mux[] = { +- TPU0TO1_A_MARK, ++static const unsigned int tpu_to1_b_mux[] = { ++ TPU0TO1_B_MARK, + }; +-static const unsigned int tpu_to2_a_pins[] = { +- /* TPU0TO2_A */ ++static const unsigned int tpu_to2_b_pins[] = { ++ /* TPU0TO2_B */ + RCAR_GP_PIN(2, 0), + }; +-static const unsigned int tpu_to2_a_mux[] = { +- TPU0TO2_A_MARK, ++static const unsigned int tpu_to2_b_mux[] = { ++ TPU0TO2_B_MARK, + }; +-static const unsigned int tpu_to3_a_pins[] = { +- /* TPU0TO3_A */ ++static const unsigned int tpu_to3_b_pins[] = { ++ /* TPU0TO3_B */ + RCAR_GP_PIN(2, 1), + }; +-static const unsigned int tpu_to3_a_mux[] = { +- TPU0TO3_A_MARK, ++static const unsigned int tpu_to3_b_mux[] = { ++ TPU0TO3_B_MARK, + }; + + /* - TSN0 ------------------------------------------------ */ +@@ -2702,14 +2701,14 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(ssi_data), + SH_PFC_PIN_GROUP(ssi_ctrl), + +- SH_PFC_PIN_GROUP(tpu_to0), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to0_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to1), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to1_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to2), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to2_a), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to3), /* suffix might be updated */ +- SH_PFC_PIN_GROUP(tpu_to3_a), /* suffix might be updated */ ++ SH_PFC_PIN_GROUP(tpu_to0_a), ++ SH_PFC_PIN_GROUP(tpu_to0_b), ++ SH_PFC_PIN_GROUP(tpu_to1_a), ++ SH_PFC_PIN_GROUP(tpu_to1_b), ++ SH_PFC_PIN_GROUP(tpu_to2_a), ++ SH_PFC_PIN_GROUP(tpu_to2_b), ++ SH_PFC_PIN_GROUP(tpu_to3_a), ++ SH_PFC_PIN_GROUP(tpu_to3_b), + + SH_PFC_PIN_GROUP(tsn0_link), + SH_PFC_PIN_GROUP(tsn0_phy_int), +@@ -3020,15 +3019,14 @@ static const char * const ssi_groups[] = { + }; + + static const char * const tpu_groups[] = { +- /* suffix might be updated */ +- "tpu_to0", + "tpu_to0_a", +- "tpu_to1", ++ "tpu_to0_b", + "tpu_to1_a", +- "tpu_to2", ++ "tpu_to1_b", + "tpu_to2_a", +- "tpu_to3", ++ "tpu_to2_b", + "tpu_to3_a", ++ "tpu_to3_b", + }; + + static const char * const tsn0_groups[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-rockchip-update-rk3308-iomux-routes.patch b/queue-6.10/pinctrl-rockchip-update-rk3308-iomux-routes.patch new file mode 100644 index 00000000000..ef2ee981aab --- /dev/null +++ b/queue-6.10/pinctrl-rockchip-update-rk3308-iomux-routes.patch @@ -0,0 +1,60 @@ +From 878820b330265e65e223231d11f4a0fd5ac6ab95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 17:16:32 +0500 +Subject: pinctrl: rockchip: update rk3308 iomux routes + +From: Dmitry Yashin + +[ Upstream commit a8f2548548584549ea29d43431781d67c4afa42b ] + +Some of the rk3308 iomux routes in rk3308_mux_route_data belong to +the rk3308b SoC. Remove them and correct i2c3 routes. + +Fixes: 7825aeb7b208 ("pinctrl: rockchip: add rk3308 SoC support") +Signed-off-by: Dmitry Yashin +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20240515121634.23945-2-dmt.yashin@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 17 ++--------------- + 1 file changed, 2 insertions(+), 15 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 3f56991f5b892..6a74619786300 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -915,9 +915,8 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = { + RK_MUXROUTE_SAME(0, RK_PC3, 1, 0x314, BIT(16 + 0) | BIT(0)), /* rtc_clk */ + RK_MUXROUTE_SAME(1, RK_PC6, 2, 0x314, BIT(16 + 2) | BIT(16 + 3)), /* uart2_rxm0 */ + RK_MUXROUTE_SAME(4, RK_PD2, 2, 0x314, BIT(16 + 2) | BIT(16 + 3) | BIT(2)), /* uart2_rxm1 */ +- RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x608, BIT(16 + 8) | BIT(16 + 9)), /* i2c3_sdam0 */ +- RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(8)), /* i2c3_sdam1 */ +- RK_MUXROUTE_SAME(2, RK_PA0, 3, 0x608, BIT(16 + 8) | BIT(16 + 9) | BIT(9)), /* i2c3_sdam2 */ ++ RK_MUXROUTE_SAME(0, RK_PB7, 2, 0x314, BIT(16 + 4)), /* i2c3_sdam0 */ ++ RK_MUXROUTE_SAME(3, RK_PB4, 2, 0x314, BIT(16 + 4) | BIT(4)), /* i2c3_sdam1 */ + RK_MUXROUTE_SAME(1, RK_PA3, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclktxm0 */ + RK_MUXROUTE_SAME(1, RK_PA4, 2, 0x308, BIT(16 + 3)), /* i2s-8ch-1-sclkrxm0 */ + RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x308, BIT(16 + 3) | BIT(3)), /* i2s-8ch-1-sclktxm1 */ +@@ -926,18 +925,6 @@ static struct rockchip_mux_route_data rk3308_mux_route_data[] = { + RK_MUXROUTE_SAME(1, RK_PB6, 4, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* pdm-clkm1 */ + RK_MUXROUTE_SAME(2, RK_PA6, 2, 0x308, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* pdm-clkm2 */ + RK_MUXROUTE_SAME(2, RK_PA4, 3, 0x600, BIT(16 + 2) | BIT(2)), /* pdm-clkm-m2 */ +- RK_MUXROUTE_SAME(3, RK_PB2, 3, 0x314, BIT(16 + 9)), /* spi1_miso */ +- RK_MUXROUTE_SAME(2, RK_PA4, 2, 0x314, BIT(16 + 9) | BIT(9)), /* spi1_miso_m1 */ +- RK_MUXROUTE_SAME(0, RK_PB3, 3, 0x314, BIT(16 + 10) | BIT(16 + 11)), /* owire_m0 */ +- RK_MUXROUTE_SAME(1, RK_PC6, 7, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(10)), /* owire_m1 */ +- RK_MUXROUTE_SAME(2, RK_PA2, 5, 0x314, BIT(16 + 10) | BIT(16 + 11) | BIT(11)), /* owire_m2 */ +- RK_MUXROUTE_SAME(0, RK_PB3, 2, 0x314, BIT(16 + 12) | BIT(16 + 13)), /* can_rxd_m0 */ +- RK_MUXROUTE_SAME(1, RK_PC6, 5, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(12)), /* can_rxd_m1 */ +- RK_MUXROUTE_SAME(2, RK_PA2, 4, 0x314, BIT(16 + 12) | BIT(16 + 13) | BIT(13)), /* can_rxd_m2 */ +- RK_MUXROUTE_SAME(1, RK_PC4, 3, 0x314, BIT(16 + 14)), /* mac_rxd0_m0 */ +- RK_MUXROUTE_SAME(4, RK_PA2, 2, 0x314, BIT(16 + 14) | BIT(14)), /* mac_rxd0_m1 */ +- RK_MUXROUTE_SAME(3, RK_PB4, 4, 0x314, BIT(16 + 15)), /* uart3_rx */ +- RK_MUXROUTE_SAME(0, RK_PC1, 3, 0x314, BIT(16 + 15) | BIT(15)), /* uart3_rx_m1 */ + }; + + static struct rockchip_mux_route_data rk3328_mux_route_data[] = { +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch b/queue-6.10/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch new file mode 100644 index 00000000000..1223fb4d41c --- /dev/null +++ b/queue-6.10/pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch @@ -0,0 +1,60 @@ +From 81e30628036a20a9b3da771901b590eb5c8802e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:03 +0800 +Subject: pinctrl: single: fix possible memory leak when pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 8f773bfbdd428819328a2d185976cfc6ae811cd3 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And call pcs_free_resources() if pinctrl_enable() fails. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-3-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-single.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c +index a798f31d69542..4c6bfabb6bd7d 100644 +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -1329,7 +1329,6 @@ static void pcs_irq_free(struct pcs_device *pcs) + static void pcs_free_resources(struct pcs_device *pcs) + { + pcs_irq_free(pcs); +- pinctrl_unregister(pcs->pctl); + + #if IS_BUILTIN(CONFIG_PINCTRL_SINGLE) + if (pcs->missing_nr_pinctrl_cells) +@@ -1879,7 +1878,7 @@ static int pcs_probe(struct platform_device *pdev) + if (ret < 0) + goto free; + +- ret = pinctrl_register_and_init(&pcs->desc, pcs->dev, pcs, &pcs->pctl); ++ ret = devm_pinctrl_register_and_init(pcs->dev, &pcs->desc, pcs, &pcs->pctl); + if (ret) { + dev_err(pcs->dev, "could not register single pinctrl driver\n"); + goto free; +@@ -1912,8 +1911,10 @@ static int pcs_probe(struct platform_device *pdev) + + dev_info(pcs->dev, "%i pins, size %u\n", pcs->desc.npins, pcs->size); + +- return pinctrl_enable(pcs->pctl); ++ if (pinctrl_enable(pcs->pctl)) ++ goto free; + ++ return 0; + free: + pcs_free_resources(pcs); + +-- +2.43.0 + diff --git a/queue-6.10/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch b/queue-6.10/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch new file mode 100644 index 00000000000..71275033250 --- /dev/null +++ b/queue-6.10/pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch @@ -0,0 +1,64 @@ +From a9f73d4dec7c674aca2976c3bc567db354222ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:37:04 +0800 +Subject: pinctrl: ti: ti-iodelay: fix possible memory leak when + pinctrl_enable() fails + +From: Yang Yingliang + +[ Upstream commit 9b401f4a7170125365160c9af267a41ff6b39001 ] + +This driver calls pinctrl_register_and_init() which is not +devm_ managed, it will leads memory leak if pinctrl_enable() +fails. Replace it with devm_pinctrl_register_and_init(). +And add missing of_node_put() in the error path. + +Fixes: 5038a66dad01 ("pinctrl: core: delete incorrect free in pinctrl_enable()") +Signed-off-by: Yang Yingliang +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20240606023704.3931561-4-yangyingliang@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/ti/pinctrl-ti-iodelay.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +index 040f2c46a868d..ef97586385019 100644 +--- a/drivers/pinctrl/ti/pinctrl-ti-iodelay.c ++++ b/drivers/pinctrl/ti/pinctrl-ti-iodelay.c +@@ -876,7 +876,7 @@ static int ti_iodelay_probe(struct platform_device *pdev) + iod->desc.name = dev_name(dev); + iod->desc.owner = THIS_MODULE; + +- ret = pinctrl_register_and_init(&iod->desc, dev, iod, &iod->pctl); ++ ret = devm_pinctrl_register_and_init(dev, &iod->desc, iod, &iod->pctl); + if (ret) { + dev_err(dev, "Failed to register pinctrl\n"); + goto exit_out; +@@ -884,7 +884,11 @@ static int ti_iodelay_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, iod); + +- return pinctrl_enable(iod->pctl); ++ ret = pinctrl_enable(iod->pctl); ++ if (ret) ++ goto exit_out; ++ ++ return 0; + + exit_out: + of_node_put(np); +@@ -899,9 +903,6 @@ static void ti_iodelay_remove(struct platform_device *pdev) + { + struct ti_iodelay_device *iod = platform_get_drvdata(pdev); + +- if (iod->pctl) +- pinctrl_unregister(iod->pctl); +- + ti_iodelay_pinconf_deinit_dev(iod); + + /* Expect other allocations to be freed by devm */ +-- +2.43.0 + diff --git a/queue-6.10/platform-arm64-build-drivers-even-on-non-arm64-platf.patch b/queue-6.10/platform-arm64-build-drivers-even-on-non-arm64-platf.patch new file mode 100644 index 00000000000..32c89162e0d --- /dev/null +++ b/queue-6.10/platform-arm64-build-drivers-even-on-non-arm64-platf.patch @@ -0,0 +1,42 @@ +From a70139d1eeae08d49cdc0661446b404a2c978157 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 18:08:12 +0300 +Subject: platform/arm64: build drivers even on non-ARM64 platforms +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Baryshkov + +[ Upstream commit 13bbe1c83bc401c2538c758228d27b4042b08341 ] + +The Kconfig for platforms/arm64 has 'depends on ARM64 || COMPILE_TEST'. +However due to Makefile having just obj-$(CONFIG_ARM64) the subdir will +not be descended for !ARM64 platforms and thus the drivers won't get +built. This breaks modular builds of other driver drivers which depend +on arm64 platform drivers. + +Reported-by: Greg Kroah-Hartman +Fixes: 363c8aea2572 ("platform: Add ARM64 platform directory") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240624-ucsi-yoga-ec-driver-v9-1-53af411a9bd6@linaro.org +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/Makefile b/drivers/platform/Makefile +index fbbe4f77aa5d7..837202842a6f6 100644 +--- a/drivers/platform/Makefile ++++ b/drivers/platform/Makefile +@@ -11,4 +11,4 @@ obj-$(CONFIG_OLPC_EC) += olpc/ + obj-$(CONFIG_GOLDFISH) += goldfish/ + obj-$(CONFIG_CHROME_PLATFORMS) += chrome/ + obj-$(CONFIG_SURFACE_PLATFORMS) += surface/ +-obj-$(CONFIG_ARM64) += arm64/ ++obj-$(CONFIG_ARM64_PLATFORM_DEVICES) += arm64/ +-- +2.43.0 + diff --git a/queue-6.10/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch b/queue-6.10/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch new file mode 100644 index 00000000000..74b1dcd3565 --- /dev/null +++ b/queue-6.10/platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch @@ -0,0 +1,38 @@ +From 8455b24f137c9027e1e27961595b9347359401e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 11:31:10 +0000 +Subject: platform/chrome: cros_ec_debugfs: fix wrong EC message version + +From: Tzung-Bi Shih + +[ Upstream commit c2a28647bbb4e0894e8824362410f72b06ac57a4 ] + +ec_read_version_supported() uses ec_params_get_cmd_versions_v1 but it +wrongly uses message version 0. + +Fix it. + +Fixes: e86264595225 ("mfd: cros_ec: add debugfs, console log file") +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20240611113110.16955-1-tzungbi@kernel.org +Signed-off-by: Tzung-Bi Shih +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c +index e1d313246beb5..5996e9d53c387 100644 +--- a/drivers/platform/chrome/cros_ec_debugfs.c ++++ b/drivers/platform/chrome/cros_ec_debugfs.c +@@ -330,6 +330,7 @@ static int ec_read_version_supported(struct cros_ec_dev *ec) + if (!msg) + return 0; + ++ msg->version = 1; + msg->command = EC_CMD_GET_CMD_VERSIONS + ec->cmd_offset; + msg->outsize = sizeof(*params); + msg->insize = sizeof(*response); +-- +2.43.0 + diff --git a/queue-6.10/platform-x86-asus-wmi-fix-tuf-laptop-rgb-variant.patch b/queue-6.10/platform-x86-asus-wmi-fix-tuf-laptop-rgb-variant.patch new file mode 100644 index 00000000000..c27e00bf97a --- /dev/null +++ b/queue-6.10/platform-x86-asus-wmi-fix-tuf-laptop-rgb-variant.patch @@ -0,0 +1,53 @@ +From 44e1425d9d21e64ee7be025006ae46d52e724387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 13:11:30 +1200 +Subject: platform/x86: asus-wmi: fix TUF laptop RGB variant +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luke D. Jones + +[ Upstream commit d8b17a364ec48239fccb65efe74bb485e79e6743 ] + +In kbd_rgb_mode_store the dev_get_drvdata() call was assuming the device +data was asus_wmi when it was actually led_classdev. + +This patch corrects this by making the correct chain of calls to get the +asus_wmi driver data. + +Fixes: ae834a549ec1 ("platform/x86: asus-wmi: add support variant of TUF RGB") +Tested-by: Denis Benato +Signed-off-by: Luke D. Jones +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20240716011130.17464-2-luke@ljones.dev +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 3f9b6285c9a66..bc9c5db383244 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -879,10 +879,14 @@ static ssize_t kbd_rgb_mode_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) + { +- struct asus_wmi *asus = dev_get_drvdata(dev); + u32 cmd, mode, r, g, b, speed; ++ struct led_classdev *led; ++ struct asus_wmi *asus; + int err; + ++ led = dev_get_drvdata(dev); ++ asus = container_of(led, struct asus_wmi, kbd_led); ++ + if (sscanf(buf, "%d %d %d %d %d %d", &cmd, &mode, &r, &g, &b, &speed) != 6) + return -EINVAL; + +-- +2.43.0 + diff --git a/queue-6.10/power-supply-ab8500-fix-error-handling-when-calling-.patch b/queue-6.10/power-supply-ab8500-fix-error-handling-when-calling-.patch new file mode 100644 index 00000000000..1f083c0144e --- /dev/null +++ b/queue-6.10/power-supply-ab8500-fix-error-handling-when-calling-.patch @@ -0,0 +1,84 @@ +From e629473124125a6afc34b0fca95f9ae016dd8e33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 09:04:24 +0200 +Subject: power: supply: ab8500: Fix error handling when calling + iio_read_channel_processed() + +From: Christophe JAILLET + +[ Upstream commit 3288757087cbb93b91019ba6b7de53a1908c9d48 ] + +The ab8500_charger_get_[ac|vbus]_[current|voltage]() functions should +return an error code on error. + +Up to now, an un-initialized value is returned. +This makes the error handling of the callers un-reliable. + +Return the error code instead, to fix the issue. + +Fixes: 97ab78bac5d0 ("power: supply: ab8500_charger: Convert to IIO ADC") +Signed-off-by: Christophe JAILLET +Reviewed-by: Jonathan Cameron +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/f9f65642331c9e40aaebb888589db043db80b7eb.1719037737.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_charger.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 9b34d1a60f662..4b0ad1b4b4c9b 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -488,8 +488,10 @@ static int ab8500_charger_get_ac_voltage(struct ab8500_charger *di) + /* Only measure voltage if the charger is connected */ + if (di->ac.charger_connected) { + ret = iio_read_channel_processed(di->adc_main_charger_v, &vch); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s ADC conv failed,\n", __func__); ++ return ret; ++ } + } else { + vch = 0; + } +@@ -540,8 +542,10 @@ static int ab8500_charger_get_vbus_voltage(struct ab8500_charger *di) + /* Only measure voltage if the charger is connected */ + if (di->usb.charger_connected) { + ret = iio_read_channel_processed(di->adc_vbus_v, &vch); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s ADC conv failed,\n", __func__); ++ return ret; ++ } + } else { + vch = 0; + } +@@ -563,8 +567,10 @@ static int ab8500_charger_get_usb_current(struct ab8500_charger *di) + /* Only measure current if the charger is online */ + if (di->usb.charger_online) { + ret = iio_read_channel_processed(di->adc_usb_charger_c, &ich); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s ADC conv failed,\n", __func__); ++ return ret; ++ } + } else { + ich = 0; + } +@@ -586,8 +592,10 @@ static int ab8500_charger_get_ac_current(struct ab8500_charger *di) + /* Only measure current if the charger is online */ + if (di->ac.charger_online) { + ret = iio_read_channel_processed(di->adc_main_charger_c, &ich); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s ADC conv failed,\n", __func__); ++ return ret; ++ } + } else { + ich = 0; + } +-- +2.43.0 + diff --git a/queue-6.10/power-supply-ingenic-fix-some-error-handling-paths-i.patch b/queue-6.10/power-supply-ingenic-fix-some-error-handling-paths-i.patch new file mode 100644 index 00000000000..5c355c1b0a4 --- /dev/null +++ b/queue-6.10/power-supply-ingenic-fix-some-error-handling-paths-i.patch @@ -0,0 +1,64 @@ +From 6ed1f1a2010eba25f7ed6c9d50a4eb859b66b39e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jun 2024 07:50:32 +0200 +Subject: power: supply: ingenic: Fix some error handling paths in + ingenic_battery_get_property() + +From: Christophe JAILLET + +[ Upstream commit f8b6c1eb76f73ed721facd58d0cfb08513aad34c ] + +If iio_read_channel_processed() fails, 'val->intval' is not updated, but it +is still *1000 just after. So, in case of error, the *1000 accumulate and +'val->intval' becomes erroneous. + +So instead of rescaling the value after the fact, use the dedicated scaling +API. This way the result is updated only when needed. In case of error, the +previous value is kept, unmodified. + +This should also reduce any inaccuracies resulting from the scaling. + +Finally, this is also slightly more efficient as it saves a function call +and a multiplication. + +Fixes: fb24ccfbe1e0 ("power: supply: add Ingenic JZ47xx battery driver.") +Signed-off-by: Christophe JAILLET +Acked-by: Artur Rojek +Link: https://lore.kernel.org/r/51e49c18574003db1e20c9299061a5ecd1661a3c.1719121781.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ingenic-battery.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/power/supply/ingenic-battery.c b/drivers/power/supply/ingenic-battery.c +index 2e7fdfde47ece..0a40f425c2772 100644 +--- a/drivers/power/supply/ingenic-battery.c ++++ b/drivers/power/supply/ingenic-battery.c +@@ -31,8 +31,9 @@ static int ingenic_battery_get_property(struct power_supply *psy, + + switch (psp) { + case POWER_SUPPLY_PROP_HEALTH: +- ret = iio_read_channel_processed(bat->channel, &val->intval); +- val->intval *= 1000; ++ ret = iio_read_channel_processed_scale(bat->channel, ++ &val->intval, ++ 1000); + if (val->intval < info->voltage_min_design_uv) + val->intval = POWER_SUPPLY_HEALTH_DEAD; + else if (val->intval > info->voltage_max_design_uv) +@@ -41,8 +42,9 @@ static int ingenic_battery_get_property(struct power_supply *psy, + val->intval = POWER_SUPPLY_HEALTH_GOOD; + return ret; + case POWER_SUPPLY_PROP_VOLTAGE_NOW: +- ret = iio_read_channel_processed(bat->channel, &val->intval); +- val->intval *= 1000; ++ ret = iio_read_channel_processed_scale(bat->channel, ++ &val->intval, ++ 1000); + return ret; + case POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN: + val->intval = info->voltage_min_design_uv; +-- +2.43.0 + diff --git a/queue-6.10/powerpc-8xx-fix-size-given-to-set_huge_pte_at.patch b/queue-6.10/powerpc-8xx-fix-size-given-to-set_huge_pte_at.patch new file mode 100644 index 00000000000..51fa9271050 --- /dev/null +++ b/queue-6.10/powerpc-8xx-fix-size-given-to-set_huge_pte_at.patch @@ -0,0 +1,43 @@ +From 0ab6026be83f75c63518f6bac27908b4f8a7be4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 15:51:24 +0200 +Subject: powerpc/8xx: fix size given to set_huge_pte_at() + +From: Christophe Leroy + +[ Upstream commit 7ea981070fd9ec24bc0111636038193aebb0289c ] + +set_huge_pte_at() expects the size of the hugepage as an int, not the +psize which is the index of the page definition in table mmu_psize_defs[] + +Link: https://lkml.kernel.org/r/97f2090011e25d99b6b0aae73e22e1b921c5d1fb.1719928057.git.christophe.leroy@csgroup.eu +Fixes: 935d4f0c6dc8 ("mm: hugetlb: add huge page size param to set_huge_pte_at()") +Signed-off-by: Christophe Leroy +Reviewed-by: Oscar Salvador +Cc: Jason Gunthorpe +Cc: Michael Ellerman +Cc: Nicholas Piggin +Cc: Peter Xu +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/nohash/8xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/nohash/8xx.c b/arch/powerpc/mm/nohash/8xx.c +index 43d4842bb1c7a..d93433e26dedb 100644 +--- a/arch/powerpc/mm/nohash/8xx.c ++++ b/arch/powerpc/mm/nohash/8xx.c +@@ -94,7 +94,8 @@ static int __ref __early_map_kernel_hugepage(unsigned long va, phys_addr_t pa, + return -EINVAL; + + set_huge_pte_at(&init_mm, va, ptep, +- pte_mkhuge(pfn_pte(pa >> PAGE_SHIFT, prot)), psize); ++ pte_mkhuge(pfn_pte(pa >> PAGE_SHIFT, prot)), ++ 1UL << mmu_psize_to_shift(psize)); + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch b/queue-6.10/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch new file mode 100644 index 00000000000..89aa5953508 --- /dev/null +++ b/queue-6.10/powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch @@ -0,0 +1,119 @@ +From 68290bb5298cfe0e7aa3de29d3cfc92458b66f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 15:52:35 +0530 +Subject: powerpc/kexec_file: fix cpus node update to FDT + +From: Sourabh Jain + +[ Upstream commit 932bed41217059638c78a75411b7893b121d2162 ] + +While updating the cpus node, commit 40c753993e3a ("powerpc/kexec_file: + Use current CPU info while setting up FDT") first deletes all subnodes +under the /cpus node. However, while adding sub-nodes back, it missed +adding cpus subnodes whose device_type != "cpu", such as l2-cache*, +l3-cache*, ibm,powerpc-cpu-features. + +Fix this by only deleting cpus sub-nodes of device_type == "cpus" and +then adding all available nodes with device_type == "cpu". + +Fixes: 40c753993e3a ("powerpc/kexec_file: Use current CPU info while setting up FDT") +Signed-off-by: Sourabh Jain +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240510102235.2269496-3-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kexec/core_64.c | 53 +++++++++++++++++++++++++----------- + 1 file changed, 37 insertions(+), 16 deletions(-) + +diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c +index 72b12bc10f90b..222aa326dacee 100644 +--- a/arch/powerpc/kexec/core_64.c ++++ b/arch/powerpc/kexec/core_64.c +@@ -467,9 +467,15 @@ static int add_node_props(void *fdt, int node_offset, const struct device_node * + * @fdt: Flattened device tree of the kernel. + * + * Returns 0 on success, negative errno on error. ++ * ++ * Note: expecting no subnodes under /cpus/ with device_type == "cpu". ++ * If this changes, update this function to include them. + */ + int update_cpus_node(void *fdt) + { ++ int prev_node_offset; ++ const char *device_type; ++ const struct fdt_property *prop; + struct device_node *cpus_node, *dn; + int cpus_offset, cpus_subnode_offset, ret = 0; + +@@ -480,30 +486,44 @@ int update_cpus_node(void *fdt) + return cpus_offset; + } + +- if (cpus_offset > 0) { +- ret = fdt_del_node(fdt, cpus_offset); ++ prev_node_offset = cpus_offset; ++ /* Delete sub-nodes of /cpus node with device_type == "cpu" */ ++ for (cpus_subnode_offset = fdt_first_subnode(fdt, cpus_offset); cpus_subnode_offset >= 0;) { ++ /* Ignore nodes that do not have a device_type property or device_type != "cpu" */ ++ prop = fdt_get_property(fdt, cpus_subnode_offset, "device_type", NULL); ++ if (!prop || strcmp(prop->data, "cpu")) { ++ prev_node_offset = cpus_subnode_offset; ++ goto next_node; ++ } ++ ++ ret = fdt_del_node(fdt, cpus_subnode_offset); + if (ret < 0) { +- pr_err("Error deleting /cpus node: %s\n", fdt_strerror(ret)); +- return -EINVAL; ++ pr_err("Failed to delete a cpus sub-node: %s\n", fdt_strerror(ret)); ++ return ret; + } ++next_node: ++ if (prev_node_offset == cpus_offset) ++ cpus_subnode_offset = fdt_first_subnode(fdt, cpus_offset); ++ else ++ cpus_subnode_offset = fdt_next_subnode(fdt, prev_node_offset); + } + +- /* Add cpus node to fdt */ +- cpus_offset = fdt_add_subnode(fdt, fdt_path_offset(fdt, "/"), "cpus"); +- if (cpus_offset < 0) { +- pr_err("Error creating /cpus node: %s\n", fdt_strerror(cpus_offset)); ++ cpus_node = of_find_node_by_path("/cpus"); ++ /* Fail here to avoid kexec/kdump kernel boot hung */ ++ if (!cpus_node) { ++ pr_err("No /cpus node found\n"); + return -EINVAL; + } + +- /* Add cpus node properties */ +- cpus_node = of_find_node_by_path("/cpus"); +- ret = add_node_props(fdt, cpus_offset, cpus_node); +- of_node_put(cpus_node); +- if (ret < 0) +- return ret; ++ /* Add all /cpus sub-nodes of device_type == "cpu" to FDT */ ++ for_each_child_of_node(cpus_node, dn) { ++ /* Ignore device nodes that do not have a device_type property ++ * or device_type != "cpu". ++ */ ++ device_type = of_get_property(dn, "device_type", NULL); ++ if (!device_type || strcmp(device_type, "cpu")) ++ continue; + +- /* Loop through all subnodes of cpus and add them to fdt */ +- for_each_node_by_type(dn, "cpu") { + cpus_subnode_offset = fdt_add_subnode(fdt, cpus_offset, dn->full_name); + if (cpus_subnode_offset < 0) { + pr_err("Unable to add %s subnode: %s\n", dn->full_name, +@@ -517,6 +537,7 @@ int update_cpus_node(void *fdt) + goto out; + } + out: ++ of_node_put(cpus_node); + of_node_put(dn); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.10/powerpc-prom-add-cpu-info-to-hardware-description-st.patch b/queue-6.10/powerpc-prom-add-cpu-info-to-hardware-description-st.patch new file mode 100644 index 00000000000..20839b988d7 --- /dev/null +++ b/queue-6.10/powerpc-prom-add-cpu-info-to-hardware-description-st.patch @@ -0,0 +1,86 @@ +From bc6b30a6e2549a14855eb5d58f92ada078cb45d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 07:36:55 -0500 +Subject: powerpc/prom: Add CPU info to hardware description string later + +From: Nathan Lynch + +[ Upstream commit 7bdd1c6c87de758750d419eedab7285b95b66417 ] + +cur_cpu_spec->cpu_name is appended to ppc_hw_desc before cur_cpu_spec +has taken on its final value. This is illustrated on pseries by +comparing the CPU name as reported at boot ("POWER8E (raw)") to the +contents of /proc/cpuinfo ("POWER8 (architected)"): + + $ dmesg | grep Hardware + Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 \ + of:IBM,FW860.50 (SV860_146) hv:phyp pSeries + + $ grep -m 1 ^cpu /proc/cpuinfo + cpu : POWER8 (architected), altivec supported + +Some 44x models would appear to be affected as well; see +identical_pvr_fixup(). + +This results in incorrect CPU information in stack dumps -- +ppc_hw_desc is an input to dump_stack_set_arch_desc(). + +Delay gathering the CPU name until after all potential calls to +identify_cpu(). + +Signed-off-by: Nathan Lynch +Fixes: bd649d40e0f2 ("powerpc: Add PVR & CPU name to hardware description") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240603-fix-cpu-hwdesc-v1-1-945f2850fcaa@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 60819751e55e6..0be07ed407c70 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -331,6 +331,7 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + void *data) + { + const char *type = of_get_flat_dt_prop(node, "device_type", NULL); ++ const __be32 *cpu_version = NULL; + const __be32 *prop; + const __be32 *intserv; + int i, nthreads; +@@ -420,7 +421,7 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + prop = of_get_flat_dt_prop(node, "cpu-version", NULL); + if (prop && (be32_to_cpup(prop) & 0xff000000) == 0x0f000000) { + identify_cpu(0, be32_to_cpup(prop)); +- seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(prop)); ++ cpu_version = prop; + } + + check_cpu_feature_properties(node); +@@ -431,6 +432,12 @@ static int __init early_init_dt_scan_cpus(unsigned long node, + } + + identical_pvr_fixup(node); ++ ++ // We can now add the CPU name & PVR to the hardware description ++ seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR)); ++ if (cpu_version) ++ seq_buf_printf(&ppc_hw_desc, "0x%04x ", be32_to_cpup(cpu_version)); ++ + init_mmu_slb_size(node); + + #ifdef CONFIG_PPC64 +@@ -881,9 +888,6 @@ void __init early_init_devtree(void *params) + + dt_cpu_ftrs_scan(); + +- // We can now add the CPU name & PVR to the hardware description +- seq_buf_printf(&ppc_hw_desc, "%s 0x%04lx ", cur_cpu_spec->cpu_name, mfspr(SPRN_PVR)); +- + /* Retrieve CPU related informations from the flat tree + * (altivec support, boot CPU ID, ...) + */ +-- +2.43.0 + diff --git a/queue-6.10/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch b/queue-6.10/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch new file mode 100644 index 00000000000..0c3b198fdbf --- /dev/null +++ b/queue-6.10/powerpc-xmon-fix-disassembly-cpu-feature-checks.patch @@ -0,0 +1,99 @@ +From ce381a62e0d6e1be1dcadafa66e24e97d430221e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 22:12:47 +1000 +Subject: powerpc/xmon: Fix disassembly CPU feature checks + +From: Michael Ellerman + +[ Upstream commit 14196e47c5ffe32af7ed5a51c9e421c5ea5bccce ] + +In the xmon disassembly code there are several CPU feature checks to +determine what dialects should be passed to the disassembler. The +dialect controls which instructions the disassembler will recognise. + +Unfortunately the checks are incorrect, because instead of passing a +single CPU feature they are passing a mask of feature bits. + +For example the code: + + if (cpu_has_feature(CPU_FTRS_POWER5)) + dialect |= PPC_OPCODE_POWER5; + +Is trying to check if the system is running on a Power5 CPU. But +CPU_FTRS_POWER5 is a mask of *all* the feature bits that are enabled on +a Power5. + +In practice the test will always return true for any 64-bit CPU, because +at least one bit in the mask will be present in the CPU_FTRS_ALWAYS +mask. + +Similarly for all the other checks against CPU_FTRS_xx masks. + +Rather than trying to match the disassembly behaviour exactly to the +current CPU, just differentiate between 32-bit and 64-bit, and Altivec, +VSX and HTM. + +That will cause some instructions to be shown in disassembly even +on a CPU that doesn't support them, but that's OK, objdump -d output +has the same behaviour, and if anything it's less confusing than some +instructions not being disassembled. + +Fixes: 897f112bb42e ("[POWERPC] Import updated version of ppc disassembly code for xmon") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240509121248.270878-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/xmon/ppc-dis.c | 33 +++++++++++---------------------- + 1 file changed, 11 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/xmon/ppc-dis.c b/arch/powerpc/xmon/ppc-dis.c +index 75fa98221d485..af105e1bc3fca 100644 +--- a/arch/powerpc/xmon/ppc-dis.c ++++ b/arch/powerpc/xmon/ppc-dis.c +@@ -122,32 +122,21 @@ int print_insn_powerpc (unsigned long insn, unsigned long memaddr) + bool insn_is_short; + ppc_cpu_t dialect; + +- dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON +- | PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_ALTIVEC; ++ dialect = PPC_OPCODE_PPC | PPC_OPCODE_COMMON; + +- if (cpu_has_feature(CPU_FTRS_POWER5)) +- dialect |= PPC_OPCODE_POWER5; ++ if (IS_ENABLED(CONFIG_PPC64)) ++ dialect |= PPC_OPCODE_64 | PPC_OPCODE_POWER4 | PPC_OPCODE_CELL | ++ PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 | PPC_OPCODE_POWER8 | ++ PPC_OPCODE_POWER9; + +- if (cpu_has_feature(CPU_FTRS_CELL)) +- dialect |= (PPC_OPCODE_CELL | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_TM)) ++ dialect |= PPC_OPCODE_HTM; + +- if (cpu_has_feature(CPU_FTRS_POWER6)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_ALTIVEC); ++ if (cpu_has_feature(CPU_FTR_ALTIVEC)) ++ dialect |= PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2; + +- if (cpu_has_feature(CPU_FTRS_POWER7)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER8)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 | PPC_OPCODE_VSX); +- +- if (cpu_has_feature(CPU_FTRS_POWER9)) +- dialect |= (PPC_OPCODE_POWER5 | PPC_OPCODE_POWER6 | PPC_OPCODE_POWER7 +- | PPC_OPCODE_POWER8 | PPC_OPCODE_POWER9 | PPC_OPCODE_HTM +- | PPC_OPCODE_ALTIVEC | PPC_OPCODE_ALTIVEC2 +- | PPC_OPCODE_VSX | PPC_OPCODE_VSX3); ++ if (cpu_has_feature(CPU_FTR_VSX)) ++ dialect |= PPC_OPCODE_VSX | PPC_OPCODE_VSX3; + + /* Get the major opcode of the insn. */ + opcode = NULL; +-- +2.43.0 + diff --git a/queue-6.10/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch b/queue-6.10/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch new file mode 100644 index 00000000000..3efcf62c7ff --- /dev/null +++ b/queue-6.10/pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch @@ -0,0 +1,105 @@ +From 22203d4a75403512101253196fb98547c95bbdfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 12:18:05 +0200 +Subject: pwm: atmel-tcb: Fix race condition and convert to guards +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 37f7707077f5ea2515bf4b1dc7fad43f8e12993e ] + +The hardware only supports a single period length for both PWM outputs. So +atmel_tcb_pwm_config() checks the configuration of the other output if it's +compatible with the currently requested setting. The register values are +then actually updated in atmel_tcb_pwm_enable(). To make this race free +the lock must be held during the whole process, so grab the lock in +.apply() instead of individually in atmel_tcb_pwm_disable() and +atmel_tcb_pwm_enable() which then also covers atmel_tcb_pwm_config(). + +To simplify handling, use the guard helper to let the compiler care for +unlocking. Otherwise unlocking would be more difficult as there is more +than one exit path in atmel_tcb_pwm_apply(). + +Fixes: 9421bade0765 ("pwm: atmel: add Timer Counter Block PWM driver") +Signed-off-by: Uwe Kleine-König +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20240709101806.52394-3-u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-atmel-tcb.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/pwm/pwm-atmel-tcb.c b/drivers/pwm/pwm-atmel-tcb.c +index 528e54c5999d8..aca11493239a5 100644 +--- a/drivers/pwm/pwm-atmel-tcb.c ++++ b/drivers/pwm/pwm-atmel-tcb.c +@@ -81,7 +81,8 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + tcbpwm->period = 0; + tcbpwm->div = 0; + +- spin_lock(&tcbpwmc->lock); ++ guard(spinlock)(&tcbpwmc->lock); ++ + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + /* + * Get init config from Timer Counter registers if +@@ -107,7 +108,6 @@ static int atmel_tcb_pwm_request(struct pwm_chip *chip, + + cmr |= ATMEL_TC_WAVE | ATMEL_TC_WAVESEL_UP_AUTO | ATMEL_TC_EEVT_XC0; + regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), cmr); +- spin_unlock(&tcbpwmc->lock); + + return 0; + } +@@ -137,7 +137,6 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm, + if (tcbpwm->duty == 0) + polarity = !polarity; + +- spin_lock(&tcbpwmc->lock); + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + + /* flush old setting and set the new one */ +@@ -172,8 +171,6 @@ static void atmel_tcb_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm, + ATMEL_TC_SWTRG); + tcbpwmc->bkup.enabled = 0; + } +- +- spin_unlock(&tcbpwmc->lock); + } + + static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, +@@ -194,7 +191,6 @@ static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, + if (tcbpwm->duty == 0) + polarity = !polarity; + +- spin_lock(&tcbpwmc->lock); + regmap_read(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CMR), &cmr); + + /* flush old setting and set the new one */ +@@ -256,7 +252,6 @@ static int atmel_tcb_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm, + regmap_write(tcbpwmc->regmap, ATMEL_TC_REG(tcbpwmc->channel, CCR), + ATMEL_TC_SWTRG | ATMEL_TC_CLKEN); + tcbpwmc->bkup.enabled = 1; +- spin_unlock(&tcbpwmc->lock); + return 0; + } + +@@ -341,9 +336,12 @@ static int atmel_tcb_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + static int atmel_tcb_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + const struct pwm_state *state) + { ++ struct atmel_tcb_pwm_chip *tcbpwmc = to_tcb_chip(chip); + int duty_cycle, period; + int ret; + ++ guard(spinlock)(&tcbpwmc->lock); ++ + if (!state->enabled) { + atmel_tcb_pwm_disable(chip, pwm, state->polarity); + return 0; +-- +2.43.0 + diff --git a/queue-6.10/pwm-stm32-always-do-lazy-disabling.patch b/queue-6.10/pwm-stm32-always-do-lazy-disabling.patch new file mode 100644 index 00000000000..98ad64db6b3 --- /dev/null +++ b/queue-6.10/pwm-stm32-always-do-lazy-disabling.patch @@ -0,0 +1,56 @@ +From 062afc611a7b4d83d899d5d7ac20f04690121dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jul 2024 13:00:06 +0200 +Subject: pwm: stm32: Always do lazy disabling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7346e7a058a2c9aa9ff1cc699c7bf18a402d9f84 ] + +When the state changes from enabled to disabled, polarity, duty_cycle +and period are not configured in hardware and TIM_CCER_CCxE is just +cleared. However if the state changes from one disabled state to +another, all parameters are written to hardware because the early exit +from stm32_pwm_apply() is only taken if the pwm is currently enabled. + +This yields surprises like: Applying + + { .period = 1, .duty_cycle = 0, .enabled = false } + +succeeds if the pwm is initially on, but fails if it's already off +because 1 is a too small period. + +Update the check for lazy disable to always exit early if the target +state is disabled, no matter what is currently configured. + +Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20240703110010.672654-2-u.kleine-koenig@baylibre.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 8bae3fd2b3306..c586029caf233 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -452,8 +452,9 @@ static int stm32_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + + enabled = pwm->state.enabled; + +- if (enabled && !state->enabled) { +- stm32_pwm_disable(priv, pwm->hwpwm); ++ if (!state->enabled) { ++ if (enabled) ++ stm32_pwm_disable(priv, pwm->hwpwm); + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch b/queue-6.10/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch new file mode 100644 index 00000000000..b6fa50601e6 --- /dev/null +++ b/queue-6.10/rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch @@ -0,0 +1,111 @@ +From 2370b67d86b3e3cbdf6ca5a089502a0b9302332b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 17:23:02 +0200 +Subject: rcu/tasks: Fix stale task snaphot for Tasks Trace + +From: Frederic Weisbecker + +[ Upstream commit 399ced9594dfab51b782798efe60a2376cd5b724 ] + +When RCU-TASKS-TRACE pre-gp takes a snapshot of the current task running +on all online CPUs, no explicit ordering synchronizes properly with a +context switch. This lack of ordering can permit the new task to miss +pre-grace-period update-side accesses. The following diagram, courtesy +of Paul, shows the possible bad scenario: + + CPU 0 CPU 1 + ----- ----- + + // Pre-GP update side access + WRITE_ONCE(*X, 1); + smp_mb(); + r0 = rq->curr; + RCU_INIT_POINTER(rq->curr, TASK_B) + spin_unlock(rq) + rcu_read_lock_trace() + r1 = X; + /* ignore TASK_B */ + +Either r0==TASK_B or r1==1 is needed but neither is guaranteed. + +One possible solution to solve this is to wait for an RCU grace period +at the beginning of the RCU-tasks-trace grace period before taking the +current tasks snaphot. However this would introduce large additional +latencies to RCU-tasks-trace grace periods. + +Another solution is to lock the target runqueue while taking the current +task snapshot. This ensures that the update side sees the latest context +switch and subsequent context switches will see the pre-grace-period +update side accesses. + +This commit therefore adds runqueue locking to cpu_curr_snapshot(). + +Fixes: e386b6725798 ("rcu-tasks: Eliminate RCU Tasks Trace IPIs to online CPUs") +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 10 ++++++++++ + kernel/sched/core.c | 14 +++++++------- + 2 files changed, 17 insertions(+), 7 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index e1bf33018e6d5..098e82bcc427f 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -1757,6 +1757,16 @@ static void rcu_tasks_trace_pregp_step(struct list_head *hop) + // allow safe access to the hop list. + for_each_online_cpu(cpu) { + rcu_read_lock(); ++ // Note that cpu_curr_snapshot() picks up the target ++ // CPU's current task while its runqueue is locked with ++ // an smp_mb__after_spinlock(). This ensures that either ++ // the grace-period kthread will see that task's read-side ++ // critical section or the task will see the updater's pre-GP ++ // accesses. The trailing smp_mb() in cpu_curr_snapshot() ++ // does not currently play a role other than simplify ++ // that function's ordering semantics. If these simplified ++ // ordering semantics continue to be redundant, that smp_mb() ++ // might be removed. + t = cpu_curr_snapshot(cpu); + if (rcu_tasks_trace_pertask_prep(t, true)) + trc_add_holdout(t, hop); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 59ce0841eb1fd..35a35e36024bf 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4466,12 +4466,7 @@ int task_call_func(struct task_struct *p, task_call_f func, void *arg) + * @cpu: The CPU on which to snapshot the task. + * + * Returns the task_struct pointer of the task "currently" running on +- * the specified CPU. If the same task is running on that CPU throughout, +- * the return value will be a pointer to that task's task_struct structure. +- * If the CPU did any context switches even vaguely concurrently with the +- * execution of this function, the return value will be a pointer to the +- * task_struct structure of a randomly chosen task that was running on +- * that CPU somewhere around the time that this function was executing. ++ * the specified CPU. + * + * If the specified CPU was offline, the return value is whatever it + * is, perhaps a pointer to the task_struct structure of that CPU's idle +@@ -4485,11 +4480,16 @@ int task_call_func(struct task_struct *p, task_call_f func, void *arg) + */ + struct task_struct *cpu_curr_snapshot(int cpu) + { ++ struct rq *rq = cpu_rq(cpu); + struct task_struct *t; ++ struct rq_flags rf; + +- smp_mb(); /* Pairing determined by caller's synchronization design. */ ++ rq_lock_irqsave(rq, &rf); ++ smp_mb__after_spinlock(); /* Pairing determined by caller's synchronization design. */ + t = rcu_dereference(cpu_curr(cpu)); ++ rq_unlock_irqrestore(rq, &rf); + smp_mb(); /* Pairing determined by caller's synchronization design. */ ++ + return t; + } + +-- +2.43.0 + diff --git a/queue-6.10/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch b/queue-6.10/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch new file mode 100644 index 00000000000..fe166d06dfc --- /dev/null +++ b/queue-6.10/rdma-cache-release-gid-table-even-if-leak-is-detecte.patch @@ -0,0 +1,58 @@ +From fb02acb0df7c86c4bdb220ea3acfcd43f916daa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 15:52:51 +0300 +Subject: RDMA/cache: Release GID table even if leak is detected + +From: Leon Romanovsky + +[ Upstream commit a92fbeac7e94a420b55570c10fe1b90e64da4025 ] + +When the table is released, we nullify pointer to GID table, it means +that in case GID entry leak is detected, we will leak table too. + +Delete code that prevents table destruction. + +Fixes: b150c3862d21 ("IB/core: Introduce GID entry reference counts") +Link: https://lore.kernel.org/r/a62560af06ba82c88ef9194982bfa63d14768ff9.1716900410.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cache.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index c02a96d3572a8..6791df64a5fe0 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -794,7 +794,6 @@ static struct ib_gid_table *alloc_gid_table(int sz) + static void release_gid_table(struct ib_device *device, + struct ib_gid_table *table) + { +- bool leak = false; + int i; + + if (!table) +@@ -803,15 +802,12 @@ static void release_gid_table(struct ib_device *device, + for (i = 0; i < table->sz; i++) { + if (is_gid_entry_free(table->data_vec[i])) + continue; +- if (kref_read(&table->data_vec[i]->kref) > 1) { +- dev_err(&device->dev, +- "GID entry ref leak for index %d ref=%u\n", i, +- kref_read(&table->data_vec[i]->kref)); +- leak = true; +- } ++ ++ WARN_ONCE(true, ++ "GID entry ref leak for dev %s index %d ref=%u\n", ++ dev_name(&device->dev), i, ++ kref_read(&table->data_vec[i]->kref)); + } +- if (leak) +- return; + + mutex_destroy(&table->lock); + kfree(table->data_vec); +-- +2.43.0 + diff --git a/queue-6.10/rdma-device-return-error-earlier-if-port-in-not-vali.patch b/queue-6.10/rdma-device-return-error-earlier-if-port-in-not-vali.patch new file mode 100644 index 00000000000..790042b7826 --- /dev/null +++ b/queue-6.10/rdma-device-return-error-earlier-if-port-in-not-vali.patch @@ -0,0 +1,46 @@ +From d6d10f843b0c9eee087623392aba028052ebe325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 16:24:32 +0300 +Subject: RDMA/device: Return error earlier if port in not valid + +From: Leon Romanovsky + +[ Upstream commit 917918f57a7b139c043e78c502876f2c286f4f0a ] + +There is no need to allocate port data if port provided is not valid. + +Fixes: c2261dd76b54 ("RDMA/device: Add ib_device_set_netdev() as an alternative to get_netdev") +Link: https://lore.kernel.org/r/022047a8b16988fc88d4426da50bf60a4833311b.1719235449.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 55aa7aa32d4ab..e0cff28bb0ef1 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -2146,6 +2146,9 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, + unsigned long flags; + int ret; + ++ if (!rdma_is_port_valid(ib_dev, port)) ++ return -EINVAL; ++ + /* + * Drivers wish to call this before ib_register_driver, so we have to + * setup the port data early. +@@ -2154,9 +2157,6 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, + if (ret) + return ret; + +- if (!rdma_is_port_valid(ib_dev, port)) +- return -EINVAL; +- + pdata = &ib_dev->port_data[port]; + spin_lock_irqsave(&pdata->netdev_lock, flags); + old_ndev = rcu_dereference_protected( +-- +2.43.0 + diff --git a/queue-6.10/rdma-fix-netdev-tracker-in-ib_device_set_netdev.patch b/queue-6.10/rdma-fix-netdev-tracker-in-ib_device_set_netdev.patch new file mode 100644 index 00000000000..9ed81628666 --- /dev/null +++ b/queue-6.10/rdma-fix-netdev-tracker-in-ib_device_set_netdev.patch @@ -0,0 +1,49 @@ +From e7639f124d16beae012ea1f5528523531fe1cc13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 13:33:10 -0700 +Subject: RDMA: Fix netdev tracker in ib_device_set_netdev + +From: David Ahern + +[ Upstream commit 2043a14fb3de9d88440b21590f714306fcbbd55f ] + +If a netdev has already been assigned, ib_device_set_netdev needs to +release the reference on the older netdev but it is mistakenly being +called for the new netdev. Fix it and in the process use netdev_put +to be symmetrical with the netdev_hold. + +Fixes: 09f530f0c6d6 ("RDMA: Add netdevice_tracker to ib_device_set_netdev()") +Signed-off-by: David Ahern +Link: https://lore.kernel.org/r/20240710203310.19317-1-dsahern@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index e0cff28bb0ef1..46d1c2c32d719 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -2166,16 +2166,12 @@ int ib_device_set_netdev(struct ib_device *ib_dev, struct net_device *ndev, + return 0; + } + +- if (old_ndev) +- netdev_tracker_free(ndev, &pdata->netdev_tracker); +- if (ndev) +- netdev_hold(ndev, &pdata->netdev_tracker, GFP_ATOMIC); + rcu_assign_pointer(pdata->netdev, ndev); ++ netdev_put(old_ndev, &pdata->netdev_tracker); ++ netdev_hold(ndev, &pdata->netdev_tracker, GFP_ATOMIC); + spin_unlock_irqrestore(&pdata->netdev_lock, flags); + + add_ndev_hash(pdata); +- __dev_put(old_ndev); +- + return 0; + } + EXPORT_SYMBOL(ib_device_set_netdev); +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-check-atomic-wr-length.patch b/queue-6.10/rdma-hns-check-atomic-wr-length.patch new file mode 100644 index 00000000000..d666478c982 --- /dev/null +++ b/queue-6.10/rdma-hns-check-atomic-wr-length.patch @@ -0,0 +1,62 @@ +From 26e3141a16c91a60d17122f31c9a47e5c8ef24d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:36:58 +0800 +Subject: RDMA/hns: Check atomic wr length + +From: Junxian Huang + +[ Upstream commit 6afa2c0bfb8ef69f65715ae059e5bd5f9bbaf03b ] + +8 bytes is the only supported length of atomic. Add this check in +set_rc_wqe(). Besides, stop processing WQEs and return from +set_rc_wqe() if there is any error. + +Fixes: 384f88185112 ("RDMA/hns: Add atomic support") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 9 +++++++-- + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index ff0b3f68ee3a4..05005079258cf 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -91,6 +91,8 @@ + /* Configure to HW for PAGE_SIZE larger than 4KB */ + #define PG_SHIFT_OFFSET (PAGE_SHIFT - 12) + ++#define ATOMIC_WR_LEN 8 ++ + #define HNS_ROCE_IDX_QUE_ENTRY_SZ 4 + #define SRQ_DB_REG 0x230 + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 4287818a737f9..eb6052ee89383 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -591,11 +591,16 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, + (wr->send_flags & IB_SEND_SIGNALED) ? 1 : 0); + + if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP || +- wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ++ wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) { ++ if (msg_len != ATOMIC_WR_LEN) ++ return -EINVAL; + set_atomic_seg(wr, rc_sq_wqe, valid_num_sge); +- else if (wr->opcode != IB_WR_REG_MR) ++ } else if (wr->opcode != IB_WR_REG_MR) { + ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe, + &curr_idx, valid_num_sge); ++ if (ret) ++ return ret; ++ } + + /* + * The pipeline can sequentially post all valid WQEs into WQ buffer, +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-insufficient-extend-db-for-vfs.patch b/queue-6.10/rdma-hns-fix-insufficient-extend-db-for-vfs.patch new file mode 100644 index 00000000000..dddba0d0757 --- /dev/null +++ b/queue-6.10/rdma-hns-fix-insufficient-extend-db-for-vfs.patch @@ -0,0 +1,50 @@ +From 48ae1383d076738524e04a9e3c6b1b5b025edeef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:04 +0800 +Subject: RDMA/hns: Fix insufficient extend DB for VFs. + +From: Chengchang Tang + +[ Upstream commit 0b8e658f70ffd5dc7cda3872fd524d657d4796b7 ] + +VFs and its PF will share the memory of the extend DB. Currently, +the number of extend DB allocated by driver is only enough for PF. +This leads to a probability of DB loss and some other problems in +scenarios where both PF and VFs use a large number of QPs. + +Fixes: 6b63597d3540 ("RDMA/hns: Add TSQ link table support") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index cbbc142afc1be..aecd137c1e605 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -2463,14 +2463,16 @@ static int set_llm_cfg_to_hw(struct hns_roce_dev *hr_dev, + static struct hns_roce_link_table * + alloc_link_table_buf(struct hns_roce_dev *hr_dev) + { ++ u16 total_sl = hr_dev->caps.sl_num * hr_dev->func_num; + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_link_table *link_tbl; + u32 pg_shift, size, min_size; + + link_tbl = &priv->ext_llm; + pg_shift = hr_dev->caps.llm_buf_pg_sz + PAGE_SHIFT; +- size = hr_dev->caps.num_qps * HNS_ROCE_V2_EXT_LLM_ENTRY_SZ; +- min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(hr_dev->caps.sl_num) << pg_shift; ++ size = hr_dev->caps.num_qps * hr_dev->func_num * ++ HNS_ROCE_V2_EXT_LLM_ENTRY_SZ; ++ min_size = HNS_ROCE_EXT_LLM_MIN_PAGES(total_sl) << pg_shift; + + /* Alloc data table */ + size = max(size, min_size); +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-mbx-timing-out-before-cmd-execution-is-.patch b/queue-6.10/rdma-hns-fix-mbx-timing-out-before-cmd-execution-is-.patch new file mode 100644 index 00000000000..a4192321847 --- /dev/null +++ b/queue-6.10/rdma-hns-fix-mbx-timing-out-before-cmd-execution-is-.patch @@ -0,0 +1,110 @@ +From 915eab8d83c517eb7866be8f8218978c42d35054 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:05 +0800 +Subject: RDMA/hns: Fix mbx timing out before CMD execution is completed + +From: Chengchang Tang + +[ Upstream commit bbddfa2255dd0800209697fd12378e02ed05f833 ] + +When a large number of tasks are issued, the speed of HW processing +mbx will slow down. The standard for judging mbx timeout in the current +firmware is 30ms, and the current timeout standard for the driver is also +30ms. + +Considering that firmware scheduling in multi-function scenarios takes a +certain amount of time, this will cause the driver to time out too early +and report a failure before mbx execution times out. + +This patch introduces a new mechanism that can set different timeouts for +different cmds and extends the timeout of mbx to 35ms. + +Fixes: a04ff739f2a9 ("RDMA/hns: Add command queue support for hip08 RoCE driver") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-9-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 +++++++++++++++++----- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 6 ++++ + 2 files changed, 34 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index aecd137c1e605..621b057fb9daa 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -1275,12 +1275,38 @@ static int hns_roce_cmd_err_convert_errno(u16 desc_ret) + return -EIO; + } + ++static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout) ++{ ++ static const struct hns_roce_cmdq_tx_timeout_map cmdq_tx_timeout[] = { ++ {HNS_ROCE_OPC_POST_MB, HNS_ROCE_OPC_POST_MB_TIMEOUT}, ++ }; ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(cmdq_tx_timeout); i++) ++ if (cmdq_tx_timeout[i].opcode == opcode) ++ return cmdq_tx_timeout[i].tx_timeout; ++ ++ return tx_timeout; ++} ++ ++static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) ++{ ++ struct hns_roce_v2_priv *priv = hr_dev->priv; ++ u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); ++ u32 timeout = 0; ++ ++ do { ++ if (hns_roce_cmq_csq_done(hr_dev)) ++ break; ++ udelay(1); ++ } while (++timeout < tx_timeout); ++} ++ + static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, int num) + { + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; +- u32 timeout = 0; + u16 desc_ret; + u32 tail; + int ret; +@@ -1301,12 +1327,7 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + + atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]); + +- do { +- if (hns_roce_cmq_csq_done(hr_dev)) +- break; +- udelay(1); +- } while (++timeout < priv->cmq.tx_timeout); +- ++ hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode)); + if (hns_roce_cmq_csq_done(hr_dev)) { + ret = 0; + for (i = 0; i < num; i++) { +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index def1d15a03c7e..c65f68a14a260 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -224,6 +224,12 @@ enum hns_roce_opcode_type { + HNS_SWITCH_PARAMETER_CFG = 0x1033, + }; + ++#define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000 ++struct hns_roce_cmdq_tx_timeout_map { ++ u16 opcode; ++ u32 tx_timeout; ++}; ++ + enum { + TYPE_CRQ, + TYPE_CSQ, +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch b/queue-6.10/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch new file mode 100644 index 00000000000..db78e50476b --- /dev/null +++ b/queue-6.10/rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch @@ -0,0 +1,64 @@ +From a79b0bfe2b7150bc0d7ed09664b754051189a2db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:01 +0800 +Subject: RDMA/hns: Fix missing pagesize and alignment check in FRMR + +From: Chengchang Tang + +[ Upstream commit d387d4b54eb84208bd4ca13572e106851d0a0819 ] + +The offset requires 128B alignment and the page size ranges from +4K to 128M. + +Fixes: 68a997c5d28c ("RDMA/hns: Add FRMR support for hip08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-5-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++++ + drivers/infiniband/hw/hns/hns_roce_mr.c | 5 +++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index f8451e5ab107e..7d5931872f8a7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -83,6 +83,7 @@ + #define MR_TYPE_DMA 0x03 + + #define HNS_ROCE_FRMR_MAX_PA 512 ++#define HNS_ROCE_FRMR_ALIGN_SIZE 128 + + #define PKEY_ID 0xffff + #define NODE_DESC_SIZE 64 +@@ -189,6 +190,9 @@ enum { + #define HNS_HW_PAGE_SHIFT 12 + #define HNS_HW_PAGE_SIZE (1 << HNS_HW_PAGE_SHIFT) + ++#define HNS_HW_MAX_PAGE_SHIFT 27 ++#define HNS_HW_MAX_PAGE_SIZE (1 << HNS_HW_MAX_PAGE_SHIFT) ++ + struct hns_roce_uar { + u64 pfn; + unsigned long index; +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 1a61dceb33197..846da8c78b8b7 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -443,6 +443,11 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, + struct hns_roce_mtr *mtr = &mr->pbl_mtr; + int ret, sg_num = 0; + ++ if (!IS_ALIGNED(*sg_offset, HNS_ROCE_FRMR_ALIGN_SIZE) || ++ ibmr->page_size < HNS_HW_PAGE_SIZE || ++ ibmr->page_size > HNS_HW_MAX_PAGE_SIZE) ++ return sg_num; ++ + mr->npages = 0; + mr->page_list = kvcalloc(mr->pbl_mtr.hem_cfg.buf_pg_count, + sizeof(dma_addr_t), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch b/queue-6.10/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch new file mode 100644 index 00000000000..b0ad2682653 --- /dev/null +++ b/queue-6.10/rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch @@ -0,0 +1,83 @@ +From 21ce92e854c1ebb363c1627b935f637357373440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:02 +0800 +Subject: RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 + +From: Chengchang Tang + +[ Upstream commit 24c6291346d98c7ece4f4bfeb5733bec1d6c7b4f ] + +A shift-out-bounds may occur, if the max_inline_data has not been set. + +The related log: +UBSAN: shift-out-of-bounds in kernel/include/linux/log2.h:57:13 +shift exponent 64 is too large for 64-bit type 'long unsigned int' +Call trace: + dump_backtrace+0xb0/0x118 + show_stack+0x20/0x38 + dump_stack_lvl+0xbc/0x120 + dump_stack+0x1c/0x28 + __ubsan_handle_shift_out_of_bounds+0x104/0x240 + set_ext_sge_param+0x40c/0x420 [hns_roce_hw_v2] + hns_roce_create_qp+0xf48/0x1c40 [hns_roce_hw_v2] + create_qp.part.0+0x294/0x3c0 + ib_create_qp_kernel+0x7c/0x150 + create_mad_qp+0x11c/0x1e0 + ib_mad_init_device+0x834/0xc88 + add_client_context+0x248/0x318 + enable_device_and_get+0x158/0x280 + ib_register_device+0x4ac/0x610 + hns_roce_init+0x890/0xf98 [hns_roce_hw_v2] + __hns_roce_hw_v2_init_instance+0x398/0x720 [hns_roce_hw_v2] + hns_roce_hw_v2_init_instance+0x108/0x1e0 [hns_roce_hw_v2] + hclge_init_roce_client_instance+0x1a0/0x358 [hclge] + hclge_init_client_instance+0xa0/0x508 [hclge] + hnae3_register_client+0x18c/0x210 [hnae3] + hns_roce_hw_v2_init+0x28/0xff8 [hns_roce_hw_v2] + do_one_initcall+0xe0/0x510 + do_init_module+0x110/0x370 + load_module+0x2c6c/0x2f20 + init_module_from_file+0xe0/0x140 + idempotent_init_module+0x24c/0x350 + __arm64_sys_finit_module+0x88/0xf8 + invoke_syscall+0x68/0x1a0 + el0_svc_common.constprop.0+0x11c/0x150 + do_el0_svc+0x38/0x50 + el0_svc+0x50/0xa0 + el0t_64_sync_handler+0xc0/0xc8 + el0t_64_sync+0x1a4/0x1a8 + +Fixes: 0c5e259b06a8 ("RDMA/hns: Fix incorrect sge nums calculation") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index db34665d1dfbf..1de384ce4d0e1 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -532,13 +532,15 @@ static unsigned int get_sge_num_from_max_inl_data(bool is_ud_or_gsi, + { + unsigned int inline_sge; + +- inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE; ++ if (!max_inline_data) ++ return 0; + + /* + * if max_inline_data less than + * HNS_ROCE_SGE_IN_WQE * HNS_ROCE_SGE_SIZE, + * In addition to ud's mode, no need to extend sge. + */ ++ inline_sge = roundup_pow_of_two(max_inline_data) / HNS_ROCE_SGE_SIZE; + if (!is_ud_or_gsi && inline_sge <= HNS_ROCE_SGE_IN_WQE) + inline_sge = 0; + +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-soft-lockup-under-heavy-ceqe-load.patch b/queue-6.10/rdma-hns-fix-soft-lockup-under-heavy-ceqe-load.patch new file mode 100644 index 00000000000..ea6ea563620 --- /dev/null +++ b/queue-6.10/rdma-hns-fix-soft-lockup-under-heavy-ceqe-load.patch @@ -0,0 +1,198 @@ +From 028896bd8e7d179566e0f9a9e92200adb32a12ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:36:59 +0800 +Subject: RDMA/hns: Fix soft lockup under heavy CEQE load + +From: Junxian Huang + +[ Upstream commit 2fdf34038369c0a27811e7b4680662a14ada1d6b ] + +CEQEs are handled in interrupt handler currently. This may cause the +CPU core staying in interrupt context too long and lead to soft lockup +under heavy load. + +Handle CEQEs in BH workqueue and set an upper limit for the number of +CEQE handled by a single call of work handler. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_device.h | 1 + + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 89 ++++++++++++--------- + 2 files changed, 54 insertions(+), 36 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index 05005079258cf..f8451e5ab107e 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -717,6 +717,7 @@ struct hns_roce_eq { + int shift; + int event_type; + int sub_type; ++ struct work_struct work; + }; + + struct hns_roce_eq_table { +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index eb6052ee89383..2f16554c96bef 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -6140,33 +6141,11 @@ static struct hns_roce_ceqe *next_ceqe_sw_v2(struct hns_roce_eq *eq) + !!(eq->cons_index & eq->entries)) ? ceqe : NULL; + } + +-static irqreturn_t hns_roce_v2_ceq_int(struct hns_roce_dev *hr_dev, +- struct hns_roce_eq *eq) ++static irqreturn_t hns_roce_v2_ceq_int(struct hns_roce_eq *eq) + { +- struct hns_roce_ceqe *ceqe = next_ceqe_sw_v2(eq); +- irqreturn_t ceqe_found = IRQ_NONE; +- u32 cqn; +- +- while (ceqe) { +- /* Make sure we read CEQ entry after we have checked the +- * ownership bit +- */ +- dma_rmb(); +- +- cqn = hr_reg_read(ceqe, CEQE_CQN); +- +- hns_roce_cq_completion(hr_dev, cqn); +- +- ++eq->cons_index; +- ceqe_found = IRQ_HANDLED; +- atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CEQE_CNT]); +- +- ceqe = next_ceqe_sw_v2(eq); +- } ++ queue_work(system_bh_wq, &eq->work); + +- update_eq_db(eq); +- +- return IRQ_RETVAL(ceqe_found); ++ return IRQ_HANDLED; + } + + static irqreturn_t hns_roce_v2_msix_interrupt_eq(int irq, void *eq_ptr) +@@ -6177,7 +6156,7 @@ static irqreturn_t hns_roce_v2_msix_interrupt_eq(int irq, void *eq_ptr) + + if (eq->type_flag == HNS_ROCE_CEQ) + /* Completion event interrupt */ +- int_work = hns_roce_v2_ceq_int(hr_dev, eq); ++ int_work = hns_roce_v2_ceq_int(eq); + else + /* Asynchronous event interrupt */ + int_work = hns_roce_v2_aeq_int(hr_dev, eq); +@@ -6545,6 +6524,34 @@ static int hns_roce_v2_create_eq(struct hns_roce_dev *hr_dev, + return ret; + } + ++static void hns_roce_ceq_work(struct work_struct *work) ++{ ++ struct hns_roce_eq *eq = from_work(eq, work, work); ++ struct hns_roce_ceqe *ceqe = next_ceqe_sw_v2(eq); ++ struct hns_roce_dev *hr_dev = eq->hr_dev; ++ int ceqe_num = 0; ++ u32 cqn; ++ ++ while (ceqe && ceqe_num < hr_dev->caps.ceqe_depth) { ++ /* Make sure we read CEQ entry after we have checked the ++ * ownership bit ++ */ ++ dma_rmb(); ++ ++ cqn = hr_reg_read(ceqe, CEQE_CQN); ++ ++ hns_roce_cq_completion(hr_dev, cqn); ++ ++ ++eq->cons_index; ++ ++ceqe_num; ++ atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CEQE_CNT]); ++ ++ ceqe = next_ceqe_sw_v2(eq); ++ } ++ ++ update_eq_db(eq); ++} ++ + static int __hns_roce_request_irq(struct hns_roce_dev *hr_dev, int irq_num, + int comp_num, int aeq_num, int other_num) + { +@@ -6576,21 +6583,24 @@ static int __hns_roce_request_irq(struct hns_roce_dev *hr_dev, int irq_num, + j - other_num - aeq_num); + + for (j = 0; j < irq_num; j++) { +- if (j < other_num) ++ if (j < other_num) { + ret = request_irq(hr_dev->irq[j], + hns_roce_v2_msix_interrupt_abn, + 0, hr_dev->irq_names[j], hr_dev); +- +- else if (j < (other_num + comp_num)) ++ } else if (j < (other_num + comp_num)) { ++ INIT_WORK(&eq_table->eq[j - other_num].work, ++ hns_roce_ceq_work); + ret = request_irq(eq_table->eq[j - other_num].irq, + hns_roce_v2_msix_interrupt_eq, + 0, hr_dev->irq_names[j + aeq_num], + &eq_table->eq[j - other_num]); +- else ++ } else { + ret = request_irq(eq_table->eq[j - other_num].irq, + hns_roce_v2_msix_interrupt_eq, + 0, hr_dev->irq_names[j - comp_num], + &eq_table->eq[j - other_num]); ++ } ++ + if (ret) { + dev_err(hr_dev->dev, "request irq error!\n"); + goto err_request_failed; +@@ -6600,12 +6610,16 @@ static int __hns_roce_request_irq(struct hns_roce_dev *hr_dev, int irq_num, + return 0; + + err_request_failed: +- for (j -= 1; j >= 0; j--) +- if (j < other_num) ++ for (j -= 1; j >= 0; j--) { ++ if (j < other_num) { + free_irq(hr_dev->irq[j], hr_dev); +- else +- free_irq(eq_table->eq[j - other_num].irq, +- &eq_table->eq[j - other_num]); ++ continue; ++ } ++ free_irq(eq_table->eq[j - other_num].irq, ++ &eq_table->eq[j - other_num]); ++ if (j < other_num + comp_num) ++ cancel_work_sync(&eq_table->eq[j - other_num].work); ++ } + + err_kzalloc_failed: + for (i -= 1; i >= 0; i--) +@@ -6626,8 +6640,11 @@ static void __hns_roce_free_irq(struct hns_roce_dev *hr_dev) + for (i = 0; i < hr_dev->caps.num_other_vectors; i++) + free_irq(hr_dev->irq[i], hr_dev); + +- for (i = 0; i < eq_num; i++) ++ for (i = 0; i < eq_num; i++) { + free_irq(hr_dev->eq_table.eq[i].irq, &hr_dev->eq_table.eq[i]); ++ if (i < hr_dev->caps.num_comp_vectors) ++ cancel_work_sync(&hr_dev->eq_table.eq[i].work); ++ } + + for (i = 0; i < irq_num; i++) + kfree(hr_dev->irq_names[i]); +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch b/queue-6.10/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch new file mode 100644 index 00000000000..85937c5529a --- /dev/null +++ b/queue-6.10/rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch @@ -0,0 +1,38 @@ +From 96e55897c0daaec6d6bb34dfa88365a4981a2be7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:03 +0800 +Subject: RDMA/hns: Fix undifined behavior caused by invalid max_sge + +From: Chengchang Tang + +[ Upstream commit 36397b907355e2fdb5a25a02a7921a937fd8ef4c ] + +If max_sge has been set to 0, roundup_pow_of_two() in +set_srq_basic_param() may have undefined behavior. + +Fixes: 9dd052474a26 ("RDMA/hns: Allocate one more recv SGE for HIP08") +Signed-off-by: Chengchang Tang +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-7-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c +index f1997abc97cac..c9b8233f4b057 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_srq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c +@@ -297,7 +297,7 @@ static int set_srq_basic_param(struct hns_roce_srq *srq, + + max_sge = proc_srq_sge(hr_dev, srq, !!udata); + if (attr->max_wr > hr_dev->caps.max_srq_wrs || +- attr->max_sge > max_sge) { ++ attr->max_sge > max_sge || !attr->max_sge) { + ibdev_err(&hr_dev->ib_dev, + "invalid SRQ attr, depth = %u, sge = %u.\n", + attr->max_wr, attr->max_sge); +-- +2.43.0 + diff --git a/queue-6.10/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch b/queue-6.10/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch new file mode 100644 index 00000000000..78f19f68999 --- /dev/null +++ b/queue-6.10/rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch @@ -0,0 +1,83 @@ +From 05a065769b598fd548ba1e7bc2975ad4c0e23a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:37:00 +0800 +Subject: RDMA/hns: Fix unmatch exception handling when init eq table fails + +From: Junxian Huang + +[ Upstream commit 543fb987bd63ed27409b5dea3d3eec27b9c1eac9 ] + +The hw ctx should be destroyed when init eq table fails. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20240710133705.896445-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 +++++++++++----------- + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 2f16554c96bef..cbbc142afc1be 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -6368,9 +6368,16 @@ static void hns_roce_v2_int_mask_enable(struct hns_roce_dev *hr_dev, + roce_write(hr_dev, ROCEE_VF_ABN_INT_CFG_REG, enable_flag); + } + +-static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, u32 eqn) ++static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) ++{ ++ hns_roce_mtr_destroy(hr_dev, &eq->mtr); ++} ++ ++static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, ++ struct hns_roce_eq *eq) + { + struct device *dev = hr_dev->dev; ++ int eqn = eq->eqn; + int ret; + u8 cmd; + +@@ -6381,12 +6388,9 @@ static void hns_roce_v2_destroy_eqc(struct hns_roce_dev *hr_dev, u32 eqn) + + ret = hns_roce_destroy_hw_ctx(hr_dev, cmd, eqn & HNS_ROCE_V2_EQN_M); + if (ret) +- dev_err(dev, "[mailbox cmd] destroy eqc(%u) failed.\n", eqn); +-} ++ dev_err(dev, "[mailbox cmd] destroy eqc(%d) failed.\n", eqn); + +-static void free_eq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) +-{ +- hns_roce_mtr_destroy(hr_dev, &eq->mtr); ++ free_eq_buf(hr_dev, eq); + } + + static void init_eq_config(struct hns_roce_dev *hr_dev, struct hns_roce_eq *eq) +@@ -6733,7 +6737,7 @@ static int hns_roce_v2_init_eq_table(struct hns_roce_dev *hr_dev) + + err_create_eq_fail: + for (i -= 1; i >= 0; i--) +- free_eq_buf(hr_dev, &eq_table->eq[i]); ++ hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]); + kfree(eq_table->eq); + + return ret; +@@ -6753,11 +6757,8 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) + __hns_roce_free_irq(hr_dev); + destroy_workqueue(hr_dev->irq_workq); + +- for (i = 0; i < eq_num; i++) { +- hns_roce_v2_destroy_eqc(hr_dev, i); +- +- free_eq_buf(hr_dev, &eq_table->eq[i]); +- } ++ for (i = 0; i < eq_num; i++) ++ hns_roce_v2_destroy_eqc(hr_dev, &eq_table->eq[i]); + + kfree(eq_table->eq); + } +-- +2.43.0 + diff --git a/queue-6.10/rdma-mana_ib-set-correct-device-into-ib.patch b/queue-6.10/rdma-mana_ib-set-correct-device-into-ib.patch new file mode 100644 index 00000000000..7ffb2209466 --- /dev/null +++ b/queue-6.10/rdma-mana_ib-set-correct-device-into-ib.patch @@ -0,0 +1,110 @@ +From 0d79776d2dc5656bbe33ab11cfe58fbc373c5326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 06:37:57 -0700 +Subject: RDMA/mana_ib: Set correct device into ib + +From: Konstantin Taranov + +[ Upstream commit 1df03a4b44146c4f720d793915747272c7773a3e ] + +Add mana_get_primary_netdev_rcu helper to get a primary +netdevice for a given port. When mana is used with +netvsc, the VF netdev is controlled by an upper netvsc +device. In a baremetal case, the VF netdev is the +primary device. + +Use the mana_get_primary_netdev_rcu() helper in the mana_ib +to get the correct device for querying network states. + +Fixes: 8b184e4f1c32 ("RDMA/mana_ib: Enable RoCE on port 1") +Signed-off-by: Konstantin Taranov +Link: https://lore.kernel.org/r/1720705077-322-1-git-send-email-kotaranov@linux.microsoft.com +Reviewed-by: Long Li +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mana/device.c | 16 ++++++++-------- + drivers/net/ethernet/microsoft/mana/mana_en.c | 19 +++++++++++++++++++ + include/net/mana/mana.h | 2 ++ + 3 files changed, 29 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/mana/device.c b/drivers/infiniband/hw/mana/device.c +index 9a7da2ec9cdbb..7bb7e06392001 100644 +--- a/drivers/infiniband/hw/mana/device.c ++++ b/drivers/infiniband/hw/mana/device.c +@@ -56,7 +56,7 @@ static int mana_ib_probe(struct auxiliary_device *adev, + { + struct mana_adev *madev = container_of(adev, struct mana_adev, adev); + struct gdma_dev *mdev = madev->mdev; +- struct net_device *upper_ndev; ++ struct net_device *ndev; + struct mana_context *mc; + struct mana_ib_dev *dev; + u8 mac_addr[ETH_ALEN]; +@@ -84,17 +84,17 @@ static int mana_ib_probe(struct auxiliary_device *adev, + dev->ib_dev.num_comp_vectors = mdev->gdma_context->max_num_queues; + dev->ib_dev.dev.parent = mdev->gdma_context->dev; + +- rcu_read_lock(); /* required to get upper dev */ +- upper_ndev = netdev_master_upper_dev_get_rcu(mc->ports[0]); +- if (!upper_ndev) { ++ rcu_read_lock(); /* required to get primary netdev */ ++ ndev = mana_get_primary_netdev_rcu(mc, 0); ++ if (!ndev) { + rcu_read_unlock(); + ret = -ENODEV; +- ibdev_err(&dev->ib_dev, "Failed to get master netdev"); ++ ibdev_err(&dev->ib_dev, "Failed to get netdev for IB port 1"); + goto free_ib_device; + } +- ether_addr_copy(mac_addr, upper_ndev->dev_addr); +- addrconf_addr_eui48((u8 *)&dev->ib_dev.node_guid, upper_ndev->dev_addr); +- ret = ib_device_set_netdev(&dev->ib_dev, upper_ndev, 1); ++ ether_addr_copy(mac_addr, ndev->dev_addr); ++ addrconf_addr_eui48((u8 *)&dev->ib_dev.node_guid, ndev->dev_addr); ++ ret = ib_device_set_netdev(&dev->ib_dev, ndev, 1); + rcu_read_unlock(); + if (ret) { + ibdev_err(&dev->ib_dev, "Failed to set ib netdev, ret %d", ret); +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index 608ad31a97022..ad7ae7ba2b8fc 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -2950,3 +2950,22 @@ void mana_remove(struct gdma_dev *gd, bool suspending) + gd->gdma_context = NULL; + kfree(ac); + } ++ ++struct net_device *mana_get_primary_netdev_rcu(struct mana_context *ac, u32 port_index) ++{ ++ struct net_device *ndev; ++ ++ RCU_LOCKDEP_WARN(!rcu_read_lock_held(), ++ "Taking primary netdev without holding the RCU read lock"); ++ if (port_index >= ac->num_ports) ++ return NULL; ++ ++ /* When mana is used in netvsc, the upper netdevice should be returned. */ ++ if (ac->ports[port_index]->flags & IFF_SLAVE) ++ ndev = netdev_master_upper_dev_get_rcu(ac->ports[port_index]); ++ else ++ ndev = ac->ports[port_index]; ++ ++ return ndev; ++} ++EXPORT_SYMBOL_NS(mana_get_primary_netdev_rcu, NET_MANA); +diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h +index 561f6719fb4ec..f207a6e1042ae 100644 +--- a/include/net/mana/mana.h ++++ b/include/net/mana/mana.h +@@ -796,4 +796,6 @@ void mana_destroy_wq_obj(struct mana_port_context *apc, u32 wq_type, + int mana_cfg_vport(struct mana_port_context *apc, u32 protection_dom_id, + u32 doorbell_pg_id); + void mana_uncfg_vport(struct mana_port_context *apc); ++ ++struct net_device *mana_get_primary_netdev_rcu(struct mana_context *ac, u32 port_index); + #endif /* _MANA_H */ +-- +2.43.0 + diff --git a/queue-6.10/rdma-mana_ib-set-node_guid.patch b/queue-6.10/rdma-mana_ib-set-node_guid.patch new file mode 100644 index 00000000000..06aaed27a79 --- /dev/null +++ b/queue-6.10/rdma-mana_ib-set-node_guid.patch @@ -0,0 +1,44 @@ +From 149ad33cc955b323ba6014c26918f1d75ca8516c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 May 2024 04:55:16 -0700 +Subject: RDMA/mana_ib: set node_guid + +From: Konstantin Taranov + +[ Upstream commit 65357e2c164a08bf20849dd55f46aa71e00334fa ] + +Use the mac address for the node_guid of the IB device. + +Signed-off-by: Konstantin Taranov +Link: https://lore.kernel.org/r/1717070117-1234-2-git-send-email-kotaranov@linux.microsoft.com +Reviewed-by: Long Li +Signed-off-by: Leon Romanovsky +Stable-dep-of: 1df03a4b4414 ("RDMA/mana_ib: Set correct device into ib") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mana/device.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/mana/device.c b/drivers/infiniband/hw/mana/device.c +index 7e09ceb3da537..9a7da2ec9cdbb 100644 +--- a/drivers/infiniband/hw/mana/device.c ++++ b/drivers/infiniband/hw/mana/device.c +@@ -5,6 +5,7 @@ + + #include "mana_ib.h" + #include ++#include + + MODULE_DESCRIPTION("Microsoft Azure Network Adapter IB driver"); + MODULE_LICENSE("GPL"); +@@ -92,6 +93,7 @@ static int mana_ib_probe(struct auxiliary_device *adev, + goto free_ib_device; + } + ether_addr_copy(mac_addr, upper_ndev->dev_addr); ++ addrconf_addr_eui48((u8 *)&dev->ib_dev.node_guid, upper_ndev->dev_addr); + ret = ib_device_set_netdev(&dev->ib_dev, upper_ndev, 1); + rcu_read_unlock(); + if (ret) { +-- +2.43.0 + diff --git a/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch b/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch new file mode 100644 index 00000000000..12ece8172b9 --- /dev/null +++ b/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch @@ -0,0 +1,52 @@ +From 6da8376160f2586026a282351edb649e3512e104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:17:30 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in alias_GUID.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 5953e0647cec703ef436ead37fed48943507b433 ] + +drivers/infiniband/hw/mlx4/alias_GUID.c: In function ‘mlx4_ib_init_alias_guid_service’: +drivers/infiniband/hw/mlx4/alias_GUID.c:878:74: error: ‘%d’ directive +output may be truncated writing between 1 and 11 bytes into a region of +size 5 [-Werror=format-truncation=] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:63: note: directive argument in the range [-2147483641, 2147483646] + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/alias_GUID.c:878:17: note: ‘snprintf’ output +between 12 and 22 bytes into a destination of size 15 + 878 | snprintf(alias_wq_name, sizeof alias_wq_name, "alias_guid%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +Fixes: a0c64a17aba8 ("mlx4: Add alias_guid mechanism") +Link: https://lore.kernel.org/r/1951c9500109ca7e36dcd523f8a5f2d0d2a608d1.1718554641.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/alias_GUID.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c +index 111fa88a3be44..9a439569ffcf3 100644 +--- a/drivers/infiniband/hw/mlx4/alias_GUID.c ++++ b/drivers/infiniband/hw/mlx4/alias_GUID.c +@@ -829,7 +829,7 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev *dev) + + int mlx4_ib_init_alias_guid_service(struct mlx4_ib_dev *dev) + { +- char alias_wq_name[15]; ++ char alias_wq_name[22]; + int ret = 0; + int i, j; + union ib_gid gid; +-- +2.43.0 + diff --git a/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch b/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch new file mode 100644 index 00000000000..99918433c6f --- /dev/null +++ b/queue-6.10/rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch @@ -0,0 +1,82 @@ +From c7d3979aded1c37cbaed768a961ffc70596231b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:16:33 +0300 +Subject: RDMA/mlx4: Fix truncated output warning in mad.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 0d2e6992fc956e3308cd5376c18567def4cb3967 ] + +Increase size of the name array to avoid truncated output warning. + +drivers/infiniband/hw/mlx4/mad.c: In function ‘mlx4_ib_alloc_demux_ctx’: +drivers/infiniband/hw/mlx4/mad.c:2197:47: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 4 +[-Werror=format-truncation=] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2197:38: note: directive argument in +the range [-2147483645, 2147483647] + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2197:9: note: ‘snprintf’ output between +10 and 20 bytes into a destination of size 12 + 2197 | snprintf(name, sizeof(name), "mlx4_ibt%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2205:38: note: directive argument in +the range [-2147483645, 2147483647] + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2205:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2205 | snprintf(name, sizeof(name), "mlx4_ibwi%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:48: error: ‘%d’ directive output +may be truncated writing between 1 and 11 bytes into a region of size 3 +[-Werror=format-truncation=] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~ +drivers/infiniband/hw/mlx4/mad.c:2213:38: note: directive argument in +the range [-2147483645, 2147483647] + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~ +drivers/infiniband/hw/mlx4/mad.c:2213:9: note: ‘snprintf’ output between +11 and 21 bytes into a destination of size 12 + 2213 | snprintf(name, sizeof(name), "mlx4_ibud%d", port); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[6]: *** [scripts/Makefile.build:244: drivers/infiniband/hw/mlx4/mad.o] Error 1 + +Fixes: fc06573dfaf8 ("IB/mlx4: Initialize SR-IOV IB support for slaves in master context") +Link: https://lore.kernel.org/r/f3798b3ce9a410257d7e1ec7c9e285f1352e256a.1718554569.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/mad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index a37cfac5e23f9..dc9cf45d2d320 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -2158,7 +2158,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + struct mlx4_ib_demux_ctx *ctx, + int port) + { +- char name[12]; ++ char name[21]; + int ret = 0; + int i; + +-- +2.43.0 + diff --git a/queue-6.10/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch b/queue-6.10/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch new file mode 100644 index 00000000000..f0c301db406 --- /dev/null +++ b/queue-6.10/rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch @@ -0,0 +1,70 @@ +From 4bbed799e329587500391798da143cea94236f33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 21:01:42 +0300 +Subject: RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE + +From: Chiara Meiohas + +[ Upstream commit a4e540119be565f47c305f295ed43f8e0bc3f5c3 ] + +Set the mkey for dmabuf at PAGE_SIZE to support any SGL +after a move operation. + +ib_umem_find_best_pgsz returns 0 on error, so it is +incorrect to check the returned page_size against PAGE_SIZE + +Fixes: 90da7dc8206a ("RDMA/mlx5: Support dma-buf based userspace memory region") +Signed-off-by: Chiara Meiohas +Reviewed-by: Michael Guralnik +Link: https://lore.kernel.org/r/1e2289b9133e89f273a4e68d459057d032cbc2ce.1718301631.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 13 +++++++++++++ + drivers/infiniband/hw/mlx5/odp.c | 6 ++---- + 2 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index f255a12e26a02..f9abdca3493aa 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -115,6 +115,19 @@ unsigned long __mlx5_umem_find_best_quantized_pgoff( + __mlx5_bit_sz(typ, page_offset_fld), 0, scale, \ + page_offset_quantized) + ++static inline unsigned long ++mlx5_umem_dmabuf_find_best_pgsz(struct ib_umem_dmabuf *umem_dmabuf) ++{ ++ /* ++ * mkeys used for dmabuf are fixed at PAGE_SIZE because we must be able ++ * to hold any sgl after a move operation. Ideally the mkc page size ++ * could be changed at runtime to be optimal, but right now the driver ++ * cannot do that. ++ */ ++ return ib_umem_find_best_pgsz(&umem_dmabuf->umem, PAGE_SIZE, ++ umem_dmabuf->umem.iova); ++} ++ + enum { + MLX5_IB_MMAP_OFFSET_START = 9, + MLX5_IB_MMAP_OFFSET_END = 255, +diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c +index 4a04cbc5b78a4..a524181f34df9 100644 +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -705,10 +705,8 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt, + return err; + } + +- page_size = mlx5_umem_find_best_pgsz(&umem_dmabuf->umem, mkc, +- log_page_size, 0, +- umem_dmabuf->umem.iova); +- if (unlikely(page_size < PAGE_SIZE)) { ++ page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf); ++ if (!page_size) { + ib_umem_dmabuf_unmap_pages(umem_dmabuf); + err = -EINVAL; + } else { +-- +2.43.0 + diff --git a/queue-6.10/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch b/queue-6.10/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch new file mode 100644 index 00000000000..c0aa107b455 --- /dev/null +++ b/queue-6.10/rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch @@ -0,0 +1,62 @@ +From d253def278828519a741dbf9c7426db0a176b97e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jun 2024 19:10:36 +0300 +Subject: RDMA/mlx5: Use sq timestamp as QP timestamp when RoCE is disabled + +From: Or Har-Toov + +[ Upstream commit 0c5275bf75ec3708d95654195ae4ed80d946d088 ] + +When creating a QP, one of the attributes is TS format (timestamp). +In some devices, we have a limitation that all QPs should have the same +ts_format. The ts_format is chosen based on the device's capability. +The qp_ts_format cap resides under the RoCE caps table, and the +cap will be 0 when RoCE is disabled. So when RoCE is disabled, the +value that should be queried is sq_ts_format under HCA caps. + +Consider the case when the system supports REAL_TIME_TS format (0x2), +some QPs are created with REAL_TIME_TS as ts_format, and afterwards +RoCE gets disabled. When trying to construct a new QP, we can't use +the qp_ts_format, that is queried from the RoCE caps table, Since it +leads to passing 0x0 (FREE_RUNNING_TS) as the value of the qp_ts_format, +which is different than the ts_format of the previously allocated +QPs REAL_TIME_TS format (0x2). + +Thus, to resolve this, read the sq_ts_format, which also reflect +the supported ts format for the QP when RoCE is disabled. + +Fixes: 4806f1e2fee8 ("net/mlx5: Set QP timestamp mode to default") +Signed-off-by: Maher Sanalla +Signed-off-by: Or Har-Toov +Link: https://lore.kernel.org/r/32801966eb767c7fd62b8dea3b63991d5fbfe213.1718554199.git.leon@kernel.org +Reviewed-by: Simon Horman +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/qp.h | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h +index f0e55bf3ec8b5..ad1ce650146cb 100644 +--- a/include/linux/mlx5/qp.h ++++ b/include/linux/mlx5/qp.h +@@ -576,9 +576,12 @@ static inline const char *mlx5_qp_state_str(int state) + + static inline int mlx5_get_qp_default_ts(struct mlx5_core_dev *dev) + { +- return !MLX5_CAP_ROCE(dev, qp_ts_format) ? +- MLX5_TIMESTAMP_FORMAT_FREE_RUNNING : +- MLX5_TIMESTAMP_FORMAT_DEFAULT; ++ u8 supported_ts_cap = mlx5_get_roce_state(dev) ? ++ MLX5_CAP_ROCE(dev, qp_ts_format) : ++ MLX5_CAP_GEN(dev, sq_ts_format); ++ ++ return supported_ts_cap ? MLX5_TIMESTAMP_FORMAT_DEFAULT : ++ MLX5_TIMESTAMP_FORMAT_FREE_RUNNING; + } + + #endif /* MLX5_QP_H */ +-- +2.43.0 + diff --git a/queue-6.10/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch b/queue-6.10/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch new file mode 100644 index 00000000000..488df4460f3 --- /dev/null +++ b/queue-6.10/rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch @@ -0,0 +1,53 @@ +From bb7025ef4c6c1045cdee5b87c2c1dc2fe9b97dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 10:03:48 +0800 +Subject: RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs + +From: Honggang LI + +[ Upstream commit 4adcaf969d77d3d3aa3871bbadc196258a38aec6 ] + +BTH_ACK_MASK bit is used to indicate that an acknowledge +(for this packet) should be scheduled by the responder. +Both UC and UD QPs are unacknowledged, so don't set +BTH_ACK_MASK for UC or UD QPs. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Honggang LI +Link: https://lore.kernel.org/r/20240624020348.494338-1-honggangli@163.com +Reviewed-by: Zhu Yanjun +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index cd14c4c2dff9d..479c07e6e4ed3 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -424,7 +424,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + int paylen; + int solicited; + u32 qp_num; +- int ack_req; ++ int ack_req = 0; + + /* length from start of bth to end of icrc */ + paylen = rxe_opcode[opcode].length + payload + pad + RXE_ICRC_SIZE; +@@ -445,8 +445,9 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp, + qp_num = (pkt->mask & RXE_DETH_MASK) ? ibwr->wr.ud.remote_qpn : + qp->attr.dest_qp_num; + +- ack_req = ((pkt->mask & RXE_END_MASK) || +- (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); ++ if (qp_type(qp) != IB_QPT_UD && qp_type(qp) != IB_QPT_UC) ++ ack_req = ((pkt->mask & RXE_END_MASK) || ++ (qp->req.noack_pkts++ > RXE_MAX_PKT_PER_ACK)); + if (ack_req) + qp->req.noack_pkts = 0; + +-- +2.43.0 + diff --git a/queue-6.10/remoteproc-k3-r5-fix-ipc-only-mode-detection.patch b/queue-6.10/remoteproc-k3-r5-fix-ipc-only-mode-detection.patch new file mode 100644 index 00000000000..ee1db8b95e9 --- /dev/null +++ b/queue-6.10/remoteproc-k3-r5-fix-ipc-only-mode-detection.patch @@ -0,0 +1,88 @@ +From 4a06f277612fe320a4f7acd2fe5c420896c3e43d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 17:00:55 +0200 +Subject: remoteproc: k3-r5: Fix IPC-only mode detection + +From: Richard Genoud + +[ Upstream commit a8631f6d6344d976096b1efafdb2fbb3111bd790 ] + +ret variable was used to test reset status, get from +reset_control_status() call. But this variable was overwritten by +ti_sci_proc_get_status() a few lines bellow. +And as ti_sci_proc_get_status() returns 0 or a negative value (in this +latter case, followed by a return), the expression !ret was always true, + +Clearly, this was not what was intended: +In the comment above it's said that "requires both local and module +resets to be deasserted"; if reset_control_status() returns 0 it means +that the reset line is deasserted. +So, it's pretty clear that the return value of reset_control_status() +was intended to be used instead of ti_sci_proc_get_status() return +value. + +This could lead in an incorrect IPC-only mode detection if reset line is +asserted (so reset_control_status() return > 0) and c_state != 0 and +halted == 0. +In this case, the old code would have detected an IPC-only mode instead +of a mismatched mode. + +Fixes: 1168af40b1ad ("remoteproc: k3-r5: Add support for IPC-only mode for all R5Fs") +Signed-off-by: Richard Genoud +Reviewed-by: Hari Nagalla +Link: https://lore.kernel.org/r/20240621150058.319524-2-richard.genoud@bootlin.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/ti_k3_r5_remoteproc.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/ti_k3_r5_remoteproc.c b/drivers/remoteproc/ti_k3_r5_remoteproc.c +index 50e486bcfa103..39a47540c5900 100644 +--- a/drivers/remoteproc/ti_k3_r5_remoteproc.c ++++ b/drivers/remoteproc/ti_k3_r5_remoteproc.c +@@ -1144,6 +1144,7 @@ static int k3_r5_rproc_configure_mode(struct k3_r5_rproc *kproc) + u32 atcm_enable, btcm_enable, loczrama; + struct k3_r5_core *core0; + enum cluster_mode mode = cluster->mode; ++ int reset_ctrl_status; + int ret; + + core0 = list_first_entry(&cluster->cores, struct k3_r5_core, elem); +@@ -1160,11 +1161,11 @@ static int k3_r5_rproc_configure_mode(struct k3_r5_rproc *kproc) + r_state, c_state); + } + +- ret = reset_control_status(core->reset); +- if (ret < 0) { ++ reset_ctrl_status = reset_control_status(core->reset); ++ if (reset_ctrl_status < 0) { + dev_err(cdev, "failed to get initial local reset status, ret = %d\n", +- ret); +- return ret; ++ reset_ctrl_status); ++ return reset_ctrl_status; + } + + /* +@@ -1199,7 +1200,7 @@ static int k3_r5_rproc_configure_mode(struct k3_r5_rproc *kproc) + * irrelevant if module reset is asserted (POR value has local reset + * deasserted), and is deemed as remoteproc mode + */ +- if (c_state && !ret && !halted) { ++ if (c_state && !reset_ctrl_status && !halted) { + dev_info(cdev, "configured R5F for IPC-only mode\n"); + kproc->rproc->state = RPROC_DETACHED; + ret = 1; +@@ -1217,7 +1218,7 @@ static int k3_r5_rproc_configure_mode(struct k3_r5_rproc *kproc) + ret = 0; + } else { + dev_err(cdev, "mismatched mode: local_reset = %s, module_reset = %s, core_state = %s\n", +- !ret ? "deasserted" : "asserted", ++ !reset_ctrl_status ? "deasserted" : "asserted", + c_state ? "deasserted" : "asserted", + halted ? "halted" : "unhalted"); + ret = -EINVAL; +-- +2.43.0 + diff --git a/queue-6.10/remoteproc-mediatek-don-t-attempt-to-remap-l1tcm-mem.patch b/queue-6.10/remoteproc-mediatek-don-t-attempt-to-remap-l1tcm-mem.patch new file mode 100644 index 00000000000..8453b9ba5ac --- /dev/null +++ b/queue-6.10/remoteproc-mediatek-don-t-attempt-to-remap-l1tcm-mem.patch @@ -0,0 +1,61 @@ +From cfa0ca5e91cbacd0edd3935ecdbc3be7f8debb21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jun 2024 17:20:55 -0400 +Subject: remoteproc: mediatek: Don't attempt to remap l1tcm memory if missing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 67ca3f98070ffdf308b91e08a477fcb1e9684ae8 ] + +The current code doesn't check whether platform_get_resource_byname() +succeeded to get the l1tcm memory, which is optional, before attempting +to map it. This results in the following error message when it is +missing: + + mtk-scp 10500000.scp: error -EINVAL: invalid resource (null) + +Add a check so that the remapping is only attempted if the memory region +exists. This also allows to simplify the logic handling failure to +remap, since a failure then is always a failure. + +Fixes: ca23ecfdbd44 ("remoteproc/mediatek: support L1TCM") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: Tzung-Bi Shih +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20240627-scp-invalid-resource-l1tcm-v1-1-7d221e6c495a@collabora.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c +index b8498772dba17..3958f7b02d701 100644 +--- a/drivers/remoteproc/mtk_scp.c ++++ b/drivers/remoteproc/mtk_scp.c +@@ -1344,14 +1344,12 @@ static int scp_probe(struct platform_device *pdev) + + /* l1tcm is an optional memory region */ + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "l1tcm"); +- scp_cluster->l1tcm_base = devm_ioremap_resource(dev, res); +- if (IS_ERR(scp_cluster->l1tcm_base)) { +- ret = PTR_ERR(scp_cluster->l1tcm_base); +- if (ret != -EINVAL) +- return dev_err_probe(dev, ret, "Failed to map l1tcm memory\n"); ++ if (res) { ++ scp_cluster->l1tcm_base = devm_ioremap_resource(dev, res); ++ if (IS_ERR(scp_cluster->l1tcm_base)) ++ return dev_err_probe(dev, PTR_ERR(scp_cluster->l1tcm_base), ++ "Failed to map l1tcm memory\n"); + +- scp_cluster->l1tcm_base = NULL; +- } else { + scp_cluster->l1tcm_size = resource_size(res); + scp_cluster->l1tcm_phys = res->start; + } +-- +2.43.0 + diff --git a/queue-6.10/revert-drm-msm-dpu-drop-dpu_encoder_phys_ops.atomic_.patch b/queue-6.10/revert-drm-msm-dpu-drop-dpu_encoder_phys_ops.atomic_.patch new file mode 100644 index 00000000000..d5fb6f324ea --- /dev/null +++ b/queue-6.10/revert-drm-msm-dpu-drop-dpu_encoder_phys_ops.atomic_.patch @@ -0,0 +1,227 @@ +From 434f39efa49c26c5abef2b38bb3093d8a6283c98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 13:24:28 +0300 +Subject: Revert "drm/msm/dpu: drop dpu_encoder_phys_ops.atomic_mode_set" + +From: Dmitry Baryshkov + +[ Upstream commit 35322c39a653c775670f0713fb96ccc2cd91a747 ] + +In the DPU driver blank IRQ handling is called from a vblank worker and +can happen outside of the irq_enable / irq_disable pair. Using the +worker makes that completely asynchronous with the rest of the code. +Revert commit d13f638c9b88 ("drm/msm/dpu: drop +dpu_encoder_phys_ops.atomic_mode_set") to fix vblank IRQ assignment for +CMD DSI panels. + +Call trace: + dpu_encoder_phys_cmd_control_vblank_irq+0x218/0x294 + dpu_encoder_toggle_vblank_for_crtc+0x160/0x194 + dpu_crtc_vblank+0xbc/0x228 + dpu_kms_enable_vblank+0x18/0x24 + vblank_ctrl_worker+0x34/0x6c + process_one_work+0x218/0x620 + worker_thread+0x1ac/0x37c + kthread+0x114/0x118 + ret_from_fork+0x10/0x20 + +Fixes: d13f638c9b88 ("drm/msm/dpu: drop dpu_encoder_phys_ops.atomic_mode_set") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/595065/ +Link: https://lore.kernel.org/r/20240522-dpu-revert-ams-v2-1-b37825d708e1@linaro.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 ++ + .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 5 +++ + .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 32 +++++++++++-------- + .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 13 ++++++-- + .../drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 11 ++++++- + 5 files changed, 46 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index cf7d769ab3b95..708657598cce4 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -1200,6 +1200,8 @@ static void dpu_encoder_virt_atomic_mode_set(struct drm_encoder *drm_enc, + phys->hw_ctl = to_dpu_hw_ctl(hw_ctl[i]); + + phys->cached_mode = crtc_state->adjusted_mode; ++ if (phys->ops.atomic_mode_set) ++ phys->ops.atomic_mode_set(phys, crtc_state, conn_state); + } + } + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +index 002e89cc17058..30470cd15a484 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +@@ -69,6 +69,8 @@ struct dpu_encoder_phys; + * @is_master: Whether this phys_enc is the current master + * encoder. Can be switched at enable time. Based + * on split_role and current mode (CMD/VID). ++ * @atomic_mode_set: DRM Call. Set a DRM mode. ++ * This likely caches the mode, for use at enable. + * @enable: DRM Call. Enable a DRM mode. + * @disable: DRM Call. Disable mode. + * @control_vblank_irq Register/Deregister for VBLANK IRQ +@@ -93,6 +95,9 @@ struct dpu_encoder_phys; + struct dpu_encoder_phys_ops { + void (*prepare_commit)(struct dpu_encoder_phys *encoder); + bool (*is_master)(struct dpu_encoder_phys *encoder); ++ void (*atomic_mode_set)(struct dpu_encoder_phys *encoder, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state); + void (*enable)(struct dpu_encoder_phys *encoder); + void (*disable)(struct dpu_encoder_phys *encoder); + int (*control_vblank_irq)(struct dpu_encoder_phys *enc, bool enable); +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +index 489be1c0c7046..95cd39b496688 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +@@ -142,6 +142,23 @@ static void dpu_encoder_phys_cmd_underrun_irq(void *arg) + dpu_encoder_underrun_callback(phys_enc->parent, phys_enc); + } + ++static void dpu_encoder_phys_cmd_atomic_mode_set( ++ struct dpu_encoder_phys *phys_enc, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state) ++{ ++ phys_enc->irq[INTR_IDX_CTL_START] = phys_enc->hw_ctl->caps->intr_start; ++ ++ phys_enc->irq[INTR_IDX_PINGPONG] = phys_enc->hw_pp->caps->intr_done; ++ ++ if (phys_enc->has_intf_te) ++ phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_intf->cap->intr_tear_rd_ptr; ++ else ++ phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_pp->caps->intr_rdptr; ++ ++ phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun; ++} ++ + static int _dpu_encoder_phys_cmd_handle_ppdone_timeout( + struct dpu_encoder_phys *phys_enc) + { +@@ -280,14 +297,6 @@ static void dpu_encoder_phys_cmd_irq_enable(struct dpu_encoder_phys *phys_enc) + phys_enc->hw_pp->idx - PINGPONG_0, + phys_enc->vblank_refcount); + +- phys_enc->irq[INTR_IDX_CTL_START] = phys_enc->hw_ctl->caps->intr_start; +- phys_enc->irq[INTR_IDX_PINGPONG] = phys_enc->hw_pp->caps->intr_done; +- +- if (phys_enc->has_intf_te) +- phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_intf->cap->intr_tear_rd_ptr; +- else +- phys_enc->irq[INTR_IDX_RDPTR] = phys_enc->hw_pp->caps->intr_rdptr; +- + dpu_core_irq_register_callback(phys_enc->dpu_kms, + phys_enc->irq[INTR_IDX_PINGPONG], + dpu_encoder_phys_cmd_pp_tx_done_irq, +@@ -318,10 +327,6 @@ static void dpu_encoder_phys_cmd_irq_disable(struct dpu_encoder_phys *phys_enc) + dpu_core_irq_unregister_callback(phys_enc->dpu_kms, phys_enc->irq[INTR_IDX_UNDERRUN]); + dpu_encoder_phys_cmd_control_vblank_irq(phys_enc, false); + dpu_core_irq_unregister_callback(phys_enc->dpu_kms, phys_enc->irq[INTR_IDX_PINGPONG]); +- +- phys_enc->irq[INTR_IDX_CTL_START] = 0; +- phys_enc->irq[INTR_IDX_PINGPONG] = 0; +- phys_enc->irq[INTR_IDX_RDPTR] = 0; + } + + static void dpu_encoder_phys_cmd_tearcheck_config( +@@ -698,6 +703,7 @@ static void dpu_encoder_phys_cmd_init_ops( + struct dpu_encoder_phys_ops *ops) + { + ops->is_master = dpu_encoder_phys_cmd_is_master; ++ ops->atomic_mode_set = dpu_encoder_phys_cmd_atomic_mode_set; + ops->enable = dpu_encoder_phys_cmd_enable; + ops->disable = dpu_encoder_phys_cmd_disable; + ops->control_vblank_irq = dpu_encoder_phys_cmd_control_vblank_irq; +@@ -736,8 +742,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init(struct drm_device *dev, + + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); + phys_enc->intf_mode = INTF_MODE_CMD; +- phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun; +- + cmd_enc->stream_sel = 0; + + if (!phys_enc->hw_intf) { +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +index ef69c2f408c3e..636a97432d517 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +@@ -356,6 +356,16 @@ static bool dpu_encoder_phys_vid_needs_single_flush( + return phys_enc->split_role != ENC_ROLE_SOLO; + } + ++static void dpu_encoder_phys_vid_atomic_mode_set( ++ struct dpu_encoder_phys *phys_enc, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state) ++{ ++ phys_enc->irq[INTR_IDX_VSYNC] = phys_enc->hw_intf->cap->intr_vsync; ++ ++ phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun; ++} ++ + static int dpu_encoder_phys_vid_control_vblank_irq( + struct dpu_encoder_phys *phys_enc, + bool enable) +@@ -699,6 +709,7 @@ static int dpu_encoder_phys_vid_get_frame_count( + static void dpu_encoder_phys_vid_init_ops(struct dpu_encoder_phys_ops *ops) + { + ops->is_master = dpu_encoder_phys_vid_is_master; ++ ops->atomic_mode_set = dpu_encoder_phys_vid_atomic_mode_set; + ops->enable = dpu_encoder_phys_vid_enable; + ops->disable = dpu_encoder_phys_vid_disable; + ops->control_vblank_irq = dpu_encoder_phys_vid_control_vblank_irq; +@@ -737,8 +748,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init(struct drm_device *dev, + + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); + phys_enc->intf_mode = INTF_MODE_VIDEO; +- phys_enc->irq[INTR_IDX_VSYNC] = phys_enc->hw_intf->cap->intr_vsync; +- phys_enc->irq[INTR_IDX_UNDERRUN] = phys_enc->hw_intf->cap->intr_underrun; + + DPU_DEBUG_VIDENC(phys_enc, "created intf idx:%d\n", p->hw_intf->idx); + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +index d3ea91c1d7d2e..356dca5e5ea94 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c +@@ -404,6 +404,15 @@ static void dpu_encoder_phys_wb_irq_disable(struct dpu_encoder_phys *phys) + dpu_core_irq_unregister_callback(phys->dpu_kms, phys->irq[INTR_IDX_WB_DONE]); + } + ++static void dpu_encoder_phys_wb_atomic_mode_set( ++ struct dpu_encoder_phys *phys_enc, ++ struct drm_crtc_state *crtc_state, ++ struct drm_connector_state *conn_state) ++{ ++ ++ phys_enc->irq[INTR_IDX_WB_DONE] = phys_enc->hw_wb->caps->intr_wb_done; ++} ++ + static void _dpu_encoder_phys_wb_handle_wbdone_timeout( + struct dpu_encoder_phys *phys_enc) + { +@@ -640,6 +649,7 @@ static bool dpu_encoder_phys_wb_is_valid_for_commit(struct dpu_encoder_phys *phy + static void dpu_encoder_phys_wb_init_ops(struct dpu_encoder_phys_ops *ops) + { + ops->is_master = dpu_encoder_phys_wb_is_master; ++ ops->atomic_mode_set = dpu_encoder_phys_wb_atomic_mode_set; + ops->enable = dpu_encoder_phys_wb_enable; + ops->disable = dpu_encoder_phys_wb_disable; + ops->wait_for_commit_done = dpu_encoder_phys_wb_wait_for_commit_done; +@@ -685,7 +695,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_wb_init(struct drm_device *dev, + + dpu_encoder_phys_wb_init_ops(&phys_enc->ops); + phys_enc->intf_mode = INTF_MODE_WB_LINE; +- phys_enc->irq[INTR_IDX_WB_DONE] = phys_enc->hw_wb->caps->intr_wb_done; + + atomic_set(&wb_enc->wbirq_refcount, 0); + +-- +2.43.0 + diff --git a/queue-6.10/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch b/queue-6.10/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch new file mode 100644 index 00000000000..44e3147dbae --- /dev/null +++ b/queue-6.10/revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch @@ -0,0 +1,84 @@ +From ccab49464e788168ac9eae447ec722aba8cd9be2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 10:34:38 +0200 +Subject: Revert "leds: led-core: Fix refcount leak in of_led_get()" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Ceresoli + +[ Upstream commit 940b27161afc6ec53fc66245a4fb3518394cdc92 ] + +This reverts commit da1afe8e6099980fe1e2fd7436dca284af9d3f29. + +Commit 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()"), introduced in +5.5, added of_led_get() and led_put() but missed a put_device() in +led_put(), thus creating a leak in case the consumer device is removed. + +Arguably device removal was not very popular, so this went apparently +unnoticed until 2022. In January 2023 two different patches got merged to +fix the same bug: + + - commit da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()") + - commit 445110941eb9 ("leds: led-class: Add missing put_device() to led_put()") + +They fix the bug in two different ways, which creates no patch conflicts, +and both were merged in v6.2. The result is that now there is one more +put_device() than get_device()s, instead of one less. + +Arguably device removal is not very popular yet, so this apparently hasn't +been noticed as well up to now. But it blew up here while I'm working with +device tree overlay insertion and removal. The symptom is an apparently +unrelated list of oopses on device removal, with reasons: + + kernfs: can not remove 'uevent', no directory + kernfs: can not remove 'brightness', no directory + kernfs: can not remove 'max_brightness', no directory + ... + +Here sysfs fails removing attribute files, which is because the device name +changed and so the sysfs path. This is because the device name string got +corrupted, which is because it got freed too early and its memory reused. + +Different symptoms could appear in different use cases. + +Fix by removing one of the two fixes. + +The choice was to remove commit da1afe8e6099 because: + + * it is calling put_device() inside of_led_get() just after getting the + device, thus it is basically not refcounting the LED device at all + during its entire lifetime + * it does not add a corresponding put_device() in led_get(), so it fixes + only the OF case + +The other fix (445110941eb9) is adding the put_device() in led_put() so it +covers the entire lifetime, and it works even in the non-DT case. + +Fixes: da1afe8e6099 ("leds: led-core: Fix refcount leak in of_led_get()") +Co-developed-by: Hervé Codina +Signed-off-by: Hervé Codina +Signed-off-by: Luca Ceresoli +Link: https://lore.kernel.org/r/20240625-led-class-device-leak-v2-1-75fdccf47421@bootlin.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index ba1be15cfd8ea..c66d1bead0a4a 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -258,7 +258,6 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_dev = class_find_device_by_of_node(&leds_class, led_node); + of_node_put(led_node); +- put_device(led_dev); + + return led_module_get(led_dev); + } +-- +2.43.0 + diff --git a/queue-6.10/riscv-bpf-fix-out-of-bounds-issue-when-preparing-tra.patch b/queue-6.10/riscv-bpf-fix-out-of-bounds-issue-when-preparing-tra.patch new file mode 100644 index 00000000000..0c3f7b17be4 --- /dev/null +++ b/queue-6.10/riscv-bpf-fix-out-of-bounds-issue-when-preparing-tra.patch @@ -0,0 +1,90 @@ +From 1104961439ff4ca0b31af3e0ddbec58266c972da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 03:04:36 +0000 +Subject: riscv, bpf: Fix out-of-bounds issue when preparing trampoline image + +From: Pu Lehui + +[ Upstream commit 9f1e16fb1fc9826001c69e0551d51fbbcd2d74e9 ] + +We get the size of the trampoline image during the dry run phase and +allocate memory based on that size. The allocated image will then be +populated with instructions during the real patch phase. But after +commit 26ef208c209a ("bpf: Use arch_bpf_trampoline_size"), the `im` +argument is inconsistent in the dry run and real patch phase. This may +cause emit_imm in RV64 to generate a different number of instructions +when generating the 'im' address, potentially causing out-of-bounds +issues. Let's emit the maximum number of instructions for the "im" +address during dry run to fix this problem. + +Fixes: 26ef208c209a ("bpf: Use arch_bpf_trampoline_size") +Signed-off-by: Pu Lehui +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240622030437.3973492-3-pulehui@huaweicloud.com +Signed-off-by: Sasha Levin +--- + arch/riscv/net/bpf_jit_comp64.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c +index 79a001d5533ea..212b015e09b75 100644 +--- a/arch/riscv/net/bpf_jit_comp64.c ++++ b/arch/riscv/net/bpf_jit_comp64.c +@@ -16,6 +16,8 @@ + #include "bpf_jit.h" + + #define RV_FENTRY_NINSNS 2 ++/* imm that allows emit_imm to emit max count insns */ ++#define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF + + #define RV_REG_TCC RV_REG_A6 + #define RV_REG_TCC_SAVED RV_REG_S6 /* Store A6 in S6 if program do calls */ +@@ -915,7 +917,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + orig_call += RV_FENTRY_NINSNS * 4; + + if (flags & BPF_TRAMP_F_CALL_ORIG) { +- emit_imm(RV_REG_A0, (const s64)im, ctx); ++ emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); + ret = emit_call((const u64)__bpf_tramp_enter, true, ctx); + if (ret) + return ret; +@@ -976,7 +978,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, + + if (flags & BPF_TRAMP_F_CALL_ORIG) { + im->ip_epilogue = ctx->insns + ctx->ninsns; +- emit_imm(RV_REG_A0, (const s64)im, ctx); ++ emit_imm(RV_REG_A0, ctx->insns ? (const s64)im : RV_MAX_COUNT_IMM, ctx); + ret = emit_call((const u64)__bpf_tramp_exit, true, ctx); + if (ret) + goto out; +@@ -1045,6 +1047,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, + { + int ret; + struct rv_jit_context ctx; ++ u32 size = image_end - image; + + ctx.ninsns = 0; + /* +@@ -1058,11 +1061,16 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, + ctx.ro_insns = image; + ret = __arch_prepare_bpf_trampoline(im, m, tlinks, func_addr, flags, &ctx); + if (ret < 0) +- return ret; ++ goto out; + +- bpf_flush_icache(ctx.insns, ctx.insns + ctx.ninsns); ++ if (WARN_ON(size < ninsns_rvoff(ctx.ninsns))) { ++ ret = -E2BIG; ++ goto out; ++ } + +- return ninsns_rvoff(ret); ++ bpf_flush_icache(image, image_end); ++out: ++ return ret < 0 ? ret : size; + } + + int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx, +-- +2.43.0 + diff --git a/queue-6.10/riscv-smp-fail-booting-up-smp-if-inconsistent-vlen-i.patch b/queue-6.10/riscv-smp-fail-booting-up-smp-if-inconsistent-vlen-i.patch new file mode 100644 index 00000000000..47a80f0d45d --- /dev/null +++ b/queue-6.10/riscv-smp-fail-booting-up-smp-if-inconsistent-vlen-i.patch @@ -0,0 +1,107 @@ +From 9f82c7fddb31e13ae708f355a223f539e1989082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 00:26:52 +0800 +Subject: riscv: smp: fail booting up smp if inconsistent vlen is detected + +From: Andy Chiu + +[ Upstream commit 38a94c46660f5612c6ef37ec9754ec1543b038cd ] + +Currently we only support Vector for SMP platforms, that is, all SMP +cores have the same vlenb. If we happen to detect a mismatching vlen, it +is better to just fail bootting it up to prevent further race/scheduling +issues. + +Also, move .Lsecondary_park forward and chage `tail smp_callin` into a +regular call in the early assembly. So a core would be parked right +after a return from smp_callin. Note that a successful smp_callin +does not return. + +Fixes: 7017858eb2d7 ("riscv: Introduce riscv_v_vsize to record size of Vector context") +Reported-by: Conor Dooley +Closes: https://lore.kernel.org/linux-riscv/20240228-vicinity-cornstalk-4b8eb5fe5730@spud/ +Signed-off-by: Andy Chiu +Reviewed-by: Conor Dooley +Reviewed-by: Yunhui Cui +Link: https://lore.kernel.org/r/20240510-zve-detection-v5-2-0711bdd26c12@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/head.S | 19 ++++++++++++------- + arch/riscv/kernel/smpboot.c | 14 +++++++++----- + 2 files changed, 21 insertions(+), 12 deletions(-) + +diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S +index 4236a69c35cb3..a00f7523cb91f 100644 +--- a/arch/riscv/kernel/head.S ++++ b/arch/riscv/kernel/head.S +@@ -165,9 +165,20 @@ secondary_start_sbi: + #endif + call .Lsetup_trap_vector + scs_load_current +- tail smp_callin ++ call smp_callin + #endif /* CONFIG_SMP */ + ++.align 2 ++.Lsecondary_park: ++ /* ++ * Park this hart if we: ++ * - have too many harts on CONFIG_RISCV_BOOT_SPINWAIT ++ * - receive an early trap, before setup_trap_vector finished ++ * - fail in smp_callin(), as a successful one wouldn't return ++ */ ++ wfi ++ j .Lsecondary_park ++ + .align 2 + .Lsetup_trap_vector: + /* Set trap vector to exception handler */ +@@ -181,12 +192,6 @@ secondary_start_sbi: + csrw CSR_SCRATCH, zero + ret + +-.align 2 +-.Lsecondary_park: +- /* We lack SMP support or have too many harts, so park this hart */ +- wfi +- j .Lsecondary_park +- + SYM_CODE_END(_start) + + SYM_CODE_START(_start_kernel) +diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c +index 1319b29ce3b59..19baf0d574d35 100644 +--- a/arch/riscv/kernel/smpboot.c ++++ b/arch/riscv/kernel/smpboot.c +@@ -214,6 +214,15 @@ asmlinkage __visible void smp_callin(void) + struct mm_struct *mm = &init_mm; + unsigned int curr_cpuid = smp_processor_id(); + ++ if (has_vector()) { ++ /* ++ * Return as early as possible so the hart with a mismatching ++ * vlen won't boot. ++ */ ++ if (riscv_v_setup_vsize()) ++ return; ++ } ++ + /* All kernel threads share the same mm context. */ + mmgrab(mm); + current->active_mm = mm; +@@ -226,11 +235,6 @@ asmlinkage __visible void smp_callin(void) + numa_add_cpu(curr_cpuid); + set_cpu_online(curr_cpuid, true); + +- if (has_vector()) { +- if (riscv_v_setup_vsize()) +- elf_hwcap &= ~COMPAT_HWCAP_ISA_V; +- } +- + riscv_user_isa_enable(); + + /* +-- +2.43.0 + diff --git a/queue-6.10/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch b/queue-6.10/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch new file mode 100644 index 00000000000..ed973c9a41c --- /dev/null +++ b/queue-6.10/rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch @@ -0,0 +1,60 @@ +From ec2db3d686cd72cc8c8a3605a070b2be16e1c57b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 16:04:52 +0200 +Subject: rtc: interface: Add RTC offset to alarm after fix-up +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Csókás, Bence + +[ Upstream commit 463927a8902a9f22c3633960119410f57d4c8920 ] + +`rtc_add_offset()` is called by `__rtc_read_time()` +and `__rtc_read_alarm()` to add the RTC's offset to +the raw read-outs from the device drivers. However, +in the latter case, a fix-up algorithm is run if +the RTC device does not report a full `struct rtc_time` +alarm value. In that case, the offset was forgot to be +added. + +Fixes: fd6792bb022e ("rtc: fix alarm read and set offset") + +Signed-off-by: Csókás, Bence +Link: https://lore.kernel.org/r/20240619140451.2800578-1-csokas.bence@prolan.hu +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 5faafb4aa55cc..cca650b2e0b94 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -274,10 +274,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + return err; + + /* full-function RTCs won't have such missing fields */ +- if (rtc_valid_tm(&alarm->time) == 0) { +- rtc_add_offset(rtc, &alarm->time); +- return 0; +- } ++ err = rtc_valid_tm(&alarm->time); ++ if (!err) ++ goto done; + + /* get the "after" timestamp, to detect wrapped fields */ + err = rtc_read_time(rtc, &now); +@@ -379,6 +378,8 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + if (err && alarm->enabled) + dev_warn(&rtc->dev, "invalid alarm value: %ptR\n", + &alarm->time); ++ else ++ rtc_add_offset(rtc, &alarm->time); + + return err; + } +-- +2.43.0 + diff --git a/queue-6.10/rtc-tps6594-fix-memleak-in-probe.patch b/queue-6.10/rtc-tps6594-fix-memleak-in-probe.patch new file mode 100644 index 00000000000..33ff49634e7 --- /dev/null +++ b/queue-6.10/rtc-tps6594-fix-memleak-in-probe.patch @@ -0,0 +1,41 @@ +From 002abad5904abdfbb35cf04308a3aed847a61625 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 16:18:49 +0200 +Subject: rtc: tps6594: Fix memleak in probe + +From: Richard Genoud + +[ Upstream commit 94d4154792abf30ee6081d35beaeef035816e294 ] + +struct rtc_device is allocated twice in probe(), once with +devm_kzalloc(), and then with devm_rtc_allocate_device(). + +The allocation with devm_kzalloc() is lost and superfluous. + +Fixes: 9f67c1e63976 ("rtc: tps6594: Add driver for TPS6594 RTC") +Signed-off-by: Richard Genoud +Link: https://lore.kernel.org/r/20240618141851.1810000-2-richard.genoud@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-tps6594.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/rtc/rtc-tps6594.c b/drivers/rtc/rtc-tps6594.c +index 838ae8562a351..bc8dc735aa238 100644 +--- a/drivers/rtc/rtc-tps6594.c ++++ b/drivers/rtc/rtc-tps6594.c +@@ -360,10 +360,6 @@ static int tps6594_rtc_probe(struct platform_device *pdev) + int irq; + int ret; + +- rtc = devm_kzalloc(dev, sizeof(*rtc), GFP_KERNEL); +- if (!rtc) +- return -ENOMEM; +- + rtc = devm_rtc_allocate_device(dev); + if (IS_ERR(rtc)) + return PTR_ERR(rtc); +-- +2.43.0 + diff --git a/queue-6.10/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch b/queue-6.10/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch new file mode 100644 index 00000000000..92464c88fb7 --- /dev/null +++ b/queue-6.10/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch @@ -0,0 +1,57 @@ +From b2a6206e33571fa1f93d2f0c80dcbdf8fb43481f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2024 13:24:34 +0200 +Subject: s390/dasd: fix error checks in dasd_copy_pair_store() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Carlos López + +[ Upstream commit 8e64d2356cbc800b4cd0e3e614797f76bcf0cdb8 ] + +dasd_add_busid() can return an error via ERR_PTR() if an allocation +fails. However, two callsites in dasd_copy_pair_store() do not check +the result, potentially resulting in a NULL pointer dereference. Fix +this by checking the result with IS_ERR() and returning the error up +the stack. + +Fixes: a91ff09d39f9b ("s390/dasd: add copy pair setup") +Signed-off-by: Carlos López +Signed-off-by: Stefan Haberland +Link: https://lore.kernel.org/r/20240715112434.2111291-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_devmap.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c +index 0316c20823eec..6adaeb985dde1 100644 +--- a/drivers/s390/block/dasd_devmap.c ++++ b/drivers/s390/block/dasd_devmap.c +@@ -2248,13 +2248,19 @@ static ssize_t dasd_copy_pair_store(struct device *dev, + + /* allocate primary devmap if needed */ + prim_devmap = dasd_find_busid(prim_busid); +- if (IS_ERR(prim_devmap)) ++ if (IS_ERR(prim_devmap)) { + prim_devmap = dasd_add_busid(prim_busid, DASD_FEATURE_DEFAULT); ++ if (IS_ERR(prim_devmap)) ++ return PTR_ERR(prim_devmap); ++ } + + /* allocate secondary devmap if needed */ + sec_devmap = dasd_find_busid(sec_busid); +- if (IS_ERR(sec_devmap)) ++ if (IS_ERR(sec_devmap)) { + sec_devmap = dasd_add_busid(sec_busid, DASD_FEATURE_DEFAULT); ++ if (IS_ERR(sec_devmap)) ++ return PTR_ERR(sec_devmap); ++ } + + /* setting copy relation is only allowed for offline secondary */ + if (sec_devmap->device) +-- +2.43.0 + diff --git a/queue-6.10/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch b/queue-6.10/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch new file mode 100644 index 00000000000..5e79e0d9127 --- /dev/null +++ b/queue-6.10/s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch @@ -0,0 +1,53 @@ +From fa25510ed52658addb2e510fe117dcec0ee3e5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 20:29:46 +0200 +Subject: s390/uv: Don't call folio_wait_writeback() without a folio reference + +From: David Hildenbrand + +[ Upstream commit 3f29f6537f54d74e64bac0a390fb2e26da25800d ] + +folio_wait_writeback() requires that no spinlocks are held and that +a folio reference is held, as documented. After we dropped the PTL, the +folio could get freed concurrently. So grab a temporary reference. + +Fixes: 214d9bbcd3a6 ("s390/mm: provide memory management functions for protected KVM guests") +Reviewed-by: Claudio Imbrenda +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20240508182955.358628-2-david@redhat.com +Signed-off-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/uv.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c +index 265fea37e0308..016993e9eb72f 100644 +--- a/arch/s390/kernel/uv.c ++++ b/arch/s390/kernel/uv.c +@@ -318,6 +318,13 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + rc = make_folio_secure(folio, uvcb); + folio_unlock(folio); + } ++ ++ /* ++ * Once we drop the PTL, the folio may get unmapped and ++ * freed immediately. We need a temporary reference. ++ */ ++ if (rc == -EAGAIN) ++ folio_get(folio); + } + unlock: + pte_unmap_unlock(ptep, ptelock); +@@ -330,6 +337,7 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) + * completion, this is just a useless check, but it is safe. + */ + folio_wait_writeback(folio); ++ folio_put(folio); + } else if (rc == -EBUSY) { + /* + * If we have tried a local drain and the folio refcount +-- +2.43.0 + diff --git a/queue-6.10/saa7134-unchecked-i2c_transfer-function-result-fixed.patch b/queue-6.10/saa7134-unchecked-i2c_transfer-function-result-fixed.patch new file mode 100644 index 00000000000..f5b31effbbe --- /dev/null +++ b/queue-6.10/saa7134-unchecked-i2c_transfer-function-result-fixed.patch @@ -0,0 +1,51 @@ +From c089808d31438043f6864630e88c92e466f75a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Feb 2024 15:40:06 +0300 +Subject: saa7134: Unchecked i2c_transfer function result fixed + +From: Aleksandr Burakov + +[ Upstream commit 9d8683b3fd93f0e378f24dc3d9604e5d7d3e0a17 ] + +Return value of function 'i2c_transfer' is not checked that +may cause undefined behaviour. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2cf36ac44730 ("[PATCH] v4l: 656: added support for the following cards") +Signed-off-by: Aleksandr Burakov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-dvb.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-dvb.c b/drivers/media/pci/saa7134/saa7134-dvb.c +index 9c6cfef03331d..a66df6adfaad8 100644 +--- a/drivers/media/pci/saa7134/saa7134-dvb.c ++++ b/drivers/media/pci/saa7134/saa7134-dvb.c +@@ -466,7 +466,9 @@ static int philips_europa_tuner_sleep(struct dvb_frontend *fe) + /* switch the board to analog mode */ + if (fe->ops.i2c_gate_ctrl) + fe->ops.i2c_gate_ctrl(fe, 1); +- i2c_transfer(&dev->i2c_adap, &analog_msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, &analog_msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +@@ -1018,7 +1020,9 @@ static int md8800_set_voltage2(struct dvb_frontend *fe, + else + wbuf[1] = rbuf & 0xef; + msg[0].len = 2; +- i2c_transfer(&dev->i2c_adap, msg, 1); ++ if (i2c_transfer(&dev->i2c_adap, msg, 1) != 1) ++ return -EIO; ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch b/queue-6.10/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch new file mode 100644 index 00000000000..c193a624603 --- /dev/null +++ b/queue-6.10/sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch @@ -0,0 +1,162 @@ +From c8d18f0e9a5e7b155137b455ecd0a5d8e20a317b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 16:26:27 +0800 +Subject: sbitmap: fix io hung due to race on sbitmap_word::cleared + +From: Yang Yang + +[ Upstream commit 72d04bdcf3f7d7e07d82f9757946f68802a7270a ] + +Configuration for sbq: + depth=64, wake_batch=6, shift=6, map_nr=1 + +1. There are 64 requests in progress: + map->word = 0xFFFFFFFFFFFFFFFF +2. After all the 64 requests complete, and no more requests come: + map->word = 0xFFFFFFFFFFFFFFFF, map->cleared = 0xFFFFFFFFFFFFFFFF +3. Now two tasks try to allocate requests: + T1: T2: + __blk_mq_get_tag . + __sbitmap_queue_get . + sbitmap_get . + sbitmap_find_bit . + sbitmap_find_bit_in_word . + __sbitmap_get_word -> nr=-1 __blk_mq_get_tag + sbitmap_deferred_clear __sbitmap_queue_get + /* map->cleared=0xFFFFFFFFFFFFFFFF */ sbitmap_find_bit + if (!READ_ONCE(map->cleared)) sbitmap_find_bit_in_word + return false; __sbitmap_get_word -> nr=-1 + mask = xchg(&map->cleared, 0) sbitmap_deferred_clear + atomic_long_andnot() /* map->cleared=0 */ + if (!(map->cleared)) + return false; + /* + * map->cleared is cleared by T1 + * T2 fail to acquire the tag + */ + +4. T2 is the sole tag waiter. When T1 puts the tag, T2 cannot be woken +up due to the wake_batch being set at 6. If no more requests come, T1 +will wait here indefinitely. + +This patch achieves two purposes: +1. Check on ->cleared and update on both ->cleared and ->word need to +be done atomically, and using spinlock could be the simplest solution. +2. Add extra check in sbitmap_deferred_clear(), to identify whether +->word has free bits. + +Fixes: ea86ea2cdced ("sbitmap: ammortize cost of clearing bits") +Signed-off-by: Yang Yang +Reviewed-by: Ming Lei +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20240716082644.659566-1-yang.yang@vivo.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/sbitmap.h | 5 +++++ + lib/sbitmap.c | 36 +++++++++++++++++++++++++++++------- + 2 files changed, 34 insertions(+), 7 deletions(-) + +diff --git a/include/linux/sbitmap.h b/include/linux/sbitmap.h +index d662cf136021d..c09cdcc99471e 100644 +--- a/include/linux/sbitmap.h ++++ b/include/linux/sbitmap.h +@@ -36,6 +36,11 @@ struct sbitmap_word { + * @cleared: word holding cleared bits + */ + unsigned long cleared ____cacheline_aligned_in_smp; ++ ++ /** ++ * @swap_lock: serializes simultaneous updates of ->word and ->cleared ++ */ ++ spinlock_t swap_lock; + } ____cacheline_aligned_in_smp; + + /** +diff --git a/lib/sbitmap.c b/lib/sbitmap.c +index 1e453f825c05d..5e2e93307f0d0 100644 +--- a/lib/sbitmap.c ++++ b/lib/sbitmap.c +@@ -60,12 +60,30 @@ static inline void update_alloc_hint_after_get(struct sbitmap *sb, + /* + * See if we have deferred clears that we can batch move + */ +-static inline bool sbitmap_deferred_clear(struct sbitmap_word *map) ++static inline bool sbitmap_deferred_clear(struct sbitmap_word *map, ++ unsigned int depth, unsigned int alloc_hint, bool wrap) + { +- unsigned long mask; ++ unsigned long mask, word_mask; + +- if (!READ_ONCE(map->cleared)) +- return false; ++ guard(spinlock_irqsave)(&map->swap_lock); ++ ++ if (!map->cleared) { ++ if (depth == 0) ++ return false; ++ ++ word_mask = (~0UL) >> (BITS_PER_LONG - depth); ++ /* ++ * The current behavior is to always retry after moving ++ * ->cleared to word, and we change it to retry in case ++ * of any free bits. To avoid an infinite loop, we need ++ * to take wrap & alloc_hint into account, otherwise a ++ * soft lockup may occur. ++ */ ++ if (!wrap && alloc_hint) ++ word_mask &= ~((1UL << alloc_hint) - 1); ++ ++ return (READ_ONCE(map->word) & word_mask) != word_mask; ++ } + + /* + * First get a stable cleared mask, setting the old mask to 0. +@@ -85,6 +103,7 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift, + bool alloc_hint) + { + unsigned int bits_per_word; ++ int i; + + if (shift < 0) + shift = sbitmap_calculate_shift(depth); +@@ -116,6 +135,9 @@ int sbitmap_init_node(struct sbitmap *sb, unsigned int depth, int shift, + return -ENOMEM; + } + ++ for (i = 0; i < sb->map_nr; i++) ++ spin_lock_init(&sb->map[i].swap_lock); ++ + return 0; + } + EXPORT_SYMBOL_GPL(sbitmap_init_node); +@@ -126,7 +148,7 @@ void sbitmap_resize(struct sbitmap *sb, unsigned int depth) + unsigned int i; + + for (i = 0; i < sb->map_nr; i++) +- sbitmap_deferred_clear(&sb->map[i]); ++ sbitmap_deferred_clear(&sb->map[i], 0, 0, 0); + + sb->depth = depth; + sb->map_nr = DIV_ROUND_UP(sb->depth, bits_per_word); +@@ -179,7 +201,7 @@ static int sbitmap_find_bit_in_word(struct sbitmap_word *map, + alloc_hint, wrap); + if (nr != -1) + break; +- if (!sbitmap_deferred_clear(map)) ++ if (!sbitmap_deferred_clear(map, depth, alloc_hint, wrap)) + break; + } while (1); + +@@ -496,7 +518,7 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags, + unsigned int map_depth = __map_depth(sb, index); + unsigned long val; + +- sbitmap_deferred_clear(map); ++ sbitmap_deferred_clear(map, 0, 0, 0); + val = READ_ONCE(map->word); + if (val == (1UL << (map_depth - 1)) - 1) + goto next; +-- +2.43.0 + diff --git a/queue-6.10/sched-core-drop-spinlocks-on-contention-iff-kernel-i.patch b/queue-6.10/sched-core-drop-spinlocks-on-contention-iff-kernel-i.patch new file mode 100644 index 00000000000..d2da19a6e1f --- /dev/null +++ b/queue-6.10/sched-core-drop-spinlocks-on-contention-iff-kernel-i.patch @@ -0,0 +1,101 @@ +From d749ef13a448ab65128091d2d34100494e2d32ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 17:34:48 -0700 +Subject: sched/core: Drop spinlocks on contention iff kernel is preemptible + +From: Sean Christopherson + +[ Upstream commit c793a62823d1ce8f70d9cfc7803e3ea436277cda ] + +Use preempt_model_preemptible() to detect a preemptible kernel when +deciding whether or not to reschedule in order to drop a contended +spinlock or rwlock. Because PREEMPT_DYNAMIC selects PREEMPTION, kernels +built with PREEMPT_DYNAMIC=y will yield contended locks even if the live +preemption model is "none" or "voluntary". In short, make kernels with +dynamically selected models behave the same as kernels with statically +selected models. + +Somewhat counter-intuitively, NOT yielding a lock can provide better +latency for the relevant tasks/processes. E.g. KVM x86's mmu_lock, a +rwlock, is often contended between an invalidation event (takes mmu_lock +for write) and a vCPU servicing a guest page fault (takes mmu_lock for +read). For _some_ setups, letting the invalidation task complete even +if there is mmu_lock contention provides lower latency for *all* tasks, +i.e. the invalidation completes sooner *and* the vCPU services the guest +page fault sooner. + +But even KVM's mmu_lock behavior isn't uniform, e.g. the "best" behavior +can vary depending on the host VMM, the guest workload, the number of +vCPUs, the number of pCPUs in the host, why there is lock contention, etc. + +In other words, simply deleting the CONFIG_PREEMPTION guard (or doing the +opposite and removing contention yielding entirely) needs to come with a +big pile of data proving that changing the status quo is a net positive. + +Opportunistically document this side effect of preempt=full, as yielding +contended spinlocks can have significant, user-visible impact. + +Fixes: c597bfddc9e9 ("sched: Provide Kconfig support for default dynamic preempt mode") +Signed-off-by: Sean Christopherson +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Ankur Arora +Reviewed-by: Chen Yu +Link: https://lore.kernel.org/kvm/ef81ff36-64bb-4cfe-ae9b-e3acf47bff24@proxmox.com +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/kernel-parameters.txt | 4 +++- + include/linux/spinlock.h | 14 ++++++-------- + 2 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 27ec49af1bf27..2569e7f19b476 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -4749,7 +4749,9 @@ + none - Limited to cond_resched() calls + voluntary - Limited to cond_resched() and might_sleep() calls + full - Any section that isn't explicitly preempt disabled +- can be preempted anytime. ++ can be preempted anytime. Tasks will also yield ++ contended spinlocks (if the critical section isn't ++ explicitly preempt disabled beyond the lock itself). + + print-fatal-signals= + [KNL] debug: print fatal signals +diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h +index 3fcd20de6ca88..63dd8cf3c3c2b 100644 +--- a/include/linux/spinlock.h ++++ b/include/linux/spinlock.h +@@ -462,11 +462,10 @@ static __always_inline int spin_is_contended(spinlock_t *lock) + */ + static inline int spin_needbreak(spinlock_t *lock) + { +-#ifdef CONFIG_PREEMPTION ++ if (!preempt_model_preemptible()) ++ return 0; ++ + return spin_is_contended(lock); +-#else +- return 0; +-#endif + } + + /* +@@ -479,11 +478,10 @@ static inline int spin_needbreak(spinlock_t *lock) + */ + static inline int rwlock_needbreak(rwlock_t *lock) + { +-#ifdef CONFIG_PREEMPTION ++ if (!preempt_model_preemptible()) ++ return 0; ++ + return rwlock_is_contended(lock); +-#else +- return 0; +-#endif + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/sched-core-move-preempt_model_-helpers-from-sched.h-.patch b/queue-6.10/sched-core-move-preempt_model_-helpers-from-sched.h-.patch new file mode 100644 index 00000000000..64b114bfce8 --- /dev/null +++ b/queue-6.10/sched-core-move-preempt_model_-helpers-from-sched.h-.patch @@ -0,0 +1,131 @@ +From a195fdeb6c9d32d168e1b27b33dc8fd313aa8048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 17:34:47 -0700 +Subject: sched/core: Move preempt_model_*() helpers from sched.h to preempt.h + +From: Sean Christopherson + +[ Upstream commit f0dc887f21d18791037c0166f652c67da761f16f ] + +Move the declarations and inlined implementations of the preempt_model_*() +helpers to preempt.h so that they can be referenced in spinlock.h without +creating a potential circular dependency between spinlock.h and sched.h. + +No functional change intended. + +Signed-off-by: Sean Christopherson +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Ankur Arora +Link: https://lkml.kernel.org/r/20240528003521.979836-2-ankur.a.arora@oracle.com +Stable-dep-of: c793a62823d1 ("sched/core: Drop spinlocks on contention iff kernel is preemptible") +Signed-off-by: Sasha Levin +--- + include/linux/preempt.h | 41 +++++++++++++++++++++++++++++++++++++++++ + include/linux/sched.h | 41 ----------------------------------------- + 2 files changed, 41 insertions(+), 41 deletions(-) + +diff --git a/include/linux/preempt.h b/include/linux/preempt.h +index 7233e9cf1bab6..ce76f1a457225 100644 +--- a/include/linux/preempt.h ++++ b/include/linux/preempt.h +@@ -481,4 +481,45 @@ DEFINE_LOCK_GUARD_0(preempt, preempt_disable(), preempt_enable()) + DEFINE_LOCK_GUARD_0(preempt_notrace, preempt_disable_notrace(), preempt_enable_notrace()) + DEFINE_LOCK_GUARD_0(migrate, migrate_disable(), migrate_enable()) + ++#ifdef CONFIG_PREEMPT_DYNAMIC ++ ++extern bool preempt_model_none(void); ++extern bool preempt_model_voluntary(void); ++extern bool preempt_model_full(void); ++ ++#else ++ ++static inline bool preempt_model_none(void) ++{ ++ return IS_ENABLED(CONFIG_PREEMPT_NONE); ++} ++static inline bool preempt_model_voluntary(void) ++{ ++ return IS_ENABLED(CONFIG_PREEMPT_VOLUNTARY); ++} ++static inline bool preempt_model_full(void) ++{ ++ return IS_ENABLED(CONFIG_PREEMPT); ++} ++ ++#endif ++ ++static inline bool preempt_model_rt(void) ++{ ++ return IS_ENABLED(CONFIG_PREEMPT_RT); ++} ++ ++/* ++ * Does the preemption model allow non-cooperative preemption? ++ * ++ * For !CONFIG_PREEMPT_DYNAMIC kernels this is an exact match with ++ * CONFIG_PREEMPTION; for CONFIG_PREEMPT_DYNAMIC this doesn't work as the ++ * kernel is *built* with CONFIG_PREEMPTION=y but may run with e.g. the ++ * PREEMPT_NONE model. ++ */ ++static inline bool preempt_model_preemptible(void) ++{ ++ return preempt_model_full() || preempt_model_rt(); ++} ++ + #endif /* __LINUX_PREEMPT_H */ +diff --git a/include/linux/sched.h b/include/linux/sched.h +index a5f4b48fca184..76214d7c819de 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -2064,47 +2064,6 @@ extern int __cond_resched_rwlock_write(rwlock_t *lock); + __cond_resched_rwlock_write(lock); \ + }) + +-#ifdef CONFIG_PREEMPT_DYNAMIC +- +-extern bool preempt_model_none(void); +-extern bool preempt_model_voluntary(void); +-extern bool preempt_model_full(void); +- +-#else +- +-static inline bool preempt_model_none(void) +-{ +- return IS_ENABLED(CONFIG_PREEMPT_NONE); +-} +-static inline bool preempt_model_voluntary(void) +-{ +- return IS_ENABLED(CONFIG_PREEMPT_VOLUNTARY); +-} +-static inline bool preempt_model_full(void) +-{ +- return IS_ENABLED(CONFIG_PREEMPT); +-} +- +-#endif +- +-static inline bool preempt_model_rt(void) +-{ +- return IS_ENABLED(CONFIG_PREEMPT_RT); +-} +- +-/* +- * Does the preemption model allow non-cooperative preemption? +- * +- * For !CONFIG_PREEMPT_DYNAMIC kernels this is an exact match with +- * CONFIG_PREEMPTION; for CONFIG_PREEMPT_DYNAMIC this doesn't work as the +- * kernel is *built* with CONFIG_PREEMPTION=y but may run with e.g. the +- * PREEMPT_NONE model. +- */ +-static inline bool preempt_model_preemptible(void) +-{ +- return preempt_model_full() || preempt_model_rt(); +-} +- + static __always_inline bool need_resched(void) + { + return unlikely(tif_need_resched()); +-- +2.43.0 + diff --git a/queue-6.10/scsi-lpfc-fix-a-possible-null-pointer-dereference.patch b/queue-6.10/scsi-lpfc-fix-a-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..f0ed6cb2dc4 --- /dev/null +++ b/queue-6.10/scsi-lpfc-fix-a-possible-null-pointer-dereference.patch @@ -0,0 +1,46 @@ +From 5a042078b032669fb464f71febf9f2243301aeed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 16:25:45 +0800 +Subject: scsi: lpfc: Fix a possible null pointer dereference + +From: Huai-Yuan Liu + +[ Upstream commit 5e0bf3e8aec2cbc51123f84b29aaacbd91fc56fa ] + +In function lpfc_xcvr_data_show, the memory allocation with kmalloc might +fail, thereby making rdp_context a null pointer. In the following context +and functions that use this pointer, there are dereferencing operations, +leading to null pointer dereference. + +To fix this issue, a null pointer check should be added. If it is null, +use scnprintf to notify the user and return len. + +Fixes: 479b0917e447 ("scsi: lpfc: Create a sysfs entry called lpfc_xcvr_data for transceiver info") +Signed-off-by: Huai-Yuan Liu +Link: https://lore.kernel.org/r/20240621082545.449170-1-qq810974084@gmail.com +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_attr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index a46c73e8d7c40..0a9d6978cb0c3 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1907,6 +1907,11 @@ lpfc_xcvr_data_show(struct device *dev, struct device_attribute *attr, + + /* Get transceiver information */ + rdp_context = kmalloc(sizeof(*rdp_context), GFP_KERNEL); ++ if (!rdp_context) { ++ len = scnprintf(buf, PAGE_SIZE - len, ++ "SPF info NA: alloc failure\n"); ++ return len; ++ } + + rc = lpfc_get_sfp_info_wait(phba, rdp_context); + if (rc) { +-- +2.43.0 + diff --git a/queue-6.10/scsi-lpfc-revise-lpfc_prep_embed_io-routine-with-pro.patch b/queue-6.10/scsi-lpfc-revise-lpfc_prep_embed_io-routine-with-pro.patch new file mode 100644 index 00000000000..fbe4a0e4f98 --- /dev/null +++ b/queue-6.10/scsi-lpfc-revise-lpfc_prep_embed_io-routine-with-pro.patch @@ -0,0 +1,82 @@ +From 68d317051bb4b50b09b907b11aedc553c9be723b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 10:20:10 -0700 +Subject: scsi: lpfc: Revise lpfc_prep_embed_io routine with proper endian + macro usages + +From: Justin Tee + +[ Upstream commit 8bc7c617642db6d8d20ee671fb6c4513017e7a7e ] + +On big endian architectures, it is possible to run into a memory out of +bounds pointer dereference when FCP targets are zoned. + +In lpfc_prep_embed_io, the memcpy(ptr, fcp_cmnd, sgl->sge_len) is +referencing a little endian formatted sgl->sge_len value. So, the memcpy +can cause big endian systems to crash. + +Redefine the *sgl ptr as a struct sli4_sge_le to make it clear that we are +referring to a little endian formatted data structure. And, update the +routine with proper le32_to_cpu macro usages. + +Fixes: af20bb73ac25 ("scsi: lpfc: Add support for 32 byte CDBs") +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20240628172011.25921-8-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index f475e7ece41a4..3e55d5edd60ab 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -10579,10 +10579,11 @@ lpfc_prep_embed_io(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) + { + struct lpfc_iocbq *piocb = &lpfc_cmd->cur_iocbq; + union lpfc_wqe128 *wqe = &lpfc_cmd->cur_iocbq.wqe; +- struct sli4_sge *sgl; ++ struct sli4_sge_le *sgl; ++ u32 type_size; + + /* 128 byte wqe support here */ +- sgl = (struct sli4_sge *)lpfc_cmd->dma_sgl; ++ sgl = (struct sli4_sge_le *)lpfc_cmd->dma_sgl; + + if (phba->fcp_embed_io) { + struct fcp_cmnd *fcp_cmnd; +@@ -10591,9 +10592,9 @@ lpfc_prep_embed_io(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) + fcp_cmnd = lpfc_cmd->fcp_cmnd; + + /* Word 0-2 - FCP_CMND */ +- wqe->generic.bde.tus.f.bdeFlags = +- BUFF_TYPE_BDE_IMMED; +- wqe->generic.bde.tus.f.bdeSize = sgl->sge_len; ++ type_size = le32_to_cpu(sgl->sge_len); ++ type_size |= ULP_BDE64_TYPE_BDE_IMMED; ++ wqe->generic.bde.tus.w = type_size; + wqe->generic.bde.addrHigh = 0; + wqe->generic.bde.addrLow = 72; /* Word 18 */ + +@@ -10602,13 +10603,13 @@ lpfc_prep_embed_io(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) + + /* Word 18-29 FCP CMND Payload */ + ptr = &wqe->words[18]; +- memcpy(ptr, fcp_cmnd, sgl->sge_len); ++ lpfc_sli_pcimem_bcopy(fcp_cmnd, ptr, le32_to_cpu(sgl->sge_len)); + } else { + /* Word 0-2 - Inline BDE */ + wqe->generic.bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64; +- wqe->generic.bde.tus.f.bdeSize = sgl->sge_len; +- wqe->generic.bde.addrHigh = sgl->addr_hi; +- wqe->generic.bde.addrLow = sgl->addr_lo; ++ wqe->generic.bde.tus.f.bdeSize = le32_to_cpu(sgl->sge_len); ++ wqe->generic.bde.addrHigh = le32_to_cpu(sgl->addr_hi); ++ wqe->generic.bde.addrLow = le32_to_cpu(sgl->addr_lo); + + /* Word 10 */ + bf_set(wqe_dbde, &wqe->generic.wqe_com, 1); +-- +2.43.0 + diff --git a/queue-6.10/scsi-ufs-mcq-fix-missing-argument-hba-in-mcq_opr_off.patch b/queue-6.10/scsi-ufs-mcq-fix-missing-argument-hba-in-mcq_opr_off.patch new file mode 100644 index 00000000000..adbd333281f --- /dev/null +++ b/queue-6.10/scsi-ufs-mcq-fix-missing-argument-hba-in-mcq_opr_off.patch @@ -0,0 +1,84 @@ +From f169c53c5440c10fe0a31972062e003cc00ba850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 07:14:56 +0900 +Subject: scsi: ufs: mcq: Fix missing argument 'hba' in MCQ_OPR_OFFSET_n + +From: Minwoo Im + +[ Upstream commit 2fc39848952dfb91a9233563cc1444669b8e79c3 ] + +The MCQ_OPR_OFFSET_n macro takes 'hba' in the caller context without +receiving 'hba' instance as an argument. To prevent potential bugs in +future use cases, add an argument 'hba'. + +Fixes: 2468da61ea09 ("scsi: ufs: core: mcq: Configure operation and runtime interface") +Cc: Asutosh Das +Signed-off-by: Minwoo Im +Link: https://lore.kernel.org/r/20240519221457.772346-2-minwoo.im@samsung.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufs-mcq.c | 10 ++++------ + include/ufs/ufshcd.h | 6 ++++++ + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c +index c532416aec229..408fef9c6fd66 100644 +--- a/drivers/ufs/core/ufs-mcq.c ++++ b/drivers/ufs/core/ufs-mcq.c +@@ -230,8 +230,6 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba) + + /* Operation and runtime registers configuration */ + #define MCQ_CFG_n(r, i) ((r) + MCQ_QCFG_SIZE * (i)) +-#define MCQ_OPR_OFFSET_n(p, i) \ +- (hba->mcq_opr[(p)].offset + hba->mcq_opr[(p)].stride * (i)) + + static void __iomem *mcq_opr_base(struct ufs_hba *hba, + enum ufshcd_mcq_opr n, int i) +@@ -342,10 +340,10 @@ void ufshcd_mcq_make_queues_operational(struct ufs_hba *hba) + ufsmcq_writelx(hba, upper_32_bits(hwq->sqe_dma_addr), + MCQ_CFG_n(REG_SQUBA, i)); + /* Submission Queue Doorbell Address Offset */ +- ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_SQD, i), ++ ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_SQD, i), + MCQ_CFG_n(REG_SQDAO, i)); + /* Submission Queue Interrupt Status Address Offset */ +- ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_SQIS, i), ++ ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_SQIS, i), + MCQ_CFG_n(REG_SQISAO, i)); + + /* Completion Queue Lower Base Address */ +@@ -355,10 +353,10 @@ void ufshcd_mcq_make_queues_operational(struct ufs_hba *hba) + ufsmcq_writelx(hba, upper_32_bits(hwq->cqe_dma_addr), + MCQ_CFG_n(REG_CQUBA, i)); + /* Completion Queue Doorbell Address Offset */ +- ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_CQD, i), ++ ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_CQD, i), + MCQ_CFG_n(REG_CQDAO, i)); + /* Completion Queue Interrupt Status Address Offset */ +- ufsmcq_writelx(hba, MCQ_OPR_OFFSET_n(OPR_CQIS, i), ++ ufsmcq_writelx(hba, ufshcd_mcq_opr_offset(hba, OPR_CQIS, i), + MCQ_CFG_n(REG_CQISAO, i)); + + /* Save the base addresses for quicker access */ +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index bad88bd919951..d965e4d1277e6 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -1131,6 +1131,12 @@ static inline bool is_mcq_enabled(struct ufs_hba *hba) + return hba->mcq_enabled; + } + ++static inline unsigned int ufshcd_mcq_opr_offset(struct ufs_hba *hba, ++ enum ufshcd_mcq_opr opr, int idx) ++{ ++ return hba->mcq_opr[opr].offset + hba->mcq_opr[opr].stride * idx; ++} ++ + #ifdef CONFIG_SCSI_UFS_VARIABLE_SG_ENTRY_SIZE + static inline size_t ufshcd_sg_entry_size(const struct ufs_hba *hba) + { +-- +2.43.0 + diff --git a/queue-6.10/selftests-bpf-check-length-of-recv-in-test_sockmap.patch b/queue-6.10/selftests-bpf-check-length-of-recv-in-test_sockmap.patch new file mode 100644 index 00000000000..6a1ca32ebb5 --- /dev/null +++ b/queue-6.10/selftests-bpf-check-length-of-recv-in-test_sockmap.patch @@ -0,0 +1,40 @@ +From 31a29a05155e5ffb30d7fa90b0010e17d1f70cf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 14:50:03 +0800 +Subject: selftests/bpf: Check length of recv in test_sockmap + +From: Geliang Tang + +[ Upstream commit de1b5ea789dc28066cc8dc634b6825bd6148f38b ] + +The value of recv in msg_loop may be negative, like EWOULDBLOCK, so it's +necessary to check if it is positive before accumulating it to bytes_recvd. + +Fixes: 16962b2404ac ("bpf: sockmap, add selftests") +Signed-off-by: Geliang Tang +Signed-off-by: Daniel Borkmann +Tested-by: Jakub Sitnicki +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/5172563f7c7b2a2e953cef02e89fc34664a7b190.1716446893.git.tanggeliang@kylinos.cn +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index 4499b3cfc3a68..a709911cddd2f 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -680,7 +680,8 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt, + } + } + +- s->bytes_recvd += recv; ++ if (recv > 0) ++ s->bytes_recvd += recv; + + if (opt->check_recved_len && s->bytes_recvd > total_bytes) { + errno = EMSGSIZE; +-- +2.43.0 + diff --git a/queue-6.10/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch b/queue-6.10/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch new file mode 100644 index 00000000000..3f577f5e192 --- /dev/null +++ b/queue-6.10/selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch @@ -0,0 +1,40 @@ +From f32d22ce22949b2780f6533abb05692d0f0b80bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 17:16:19 +0800 +Subject: selftests/bpf: Close fd in error path in drop_on_reuseport + +From: Geliang Tang + +[ Upstream commit adae187ebedcd95d02f045bc37dfecfd5b29434b ] + +In the error path when update_lookup_map() fails in drop_on_reuseport in +prog_tests/sk_lookup.c, "server1", the fd of server 1, should be closed. +This patch fixes this by using "goto close_srv1" lable instead of "detach" +to close "server1" in this case. + +Fixes: 0ab5539f8584 ("selftests/bpf: Tests for BPF_SK_LOOKUP attach point") +Acked-by: Eduard Zingerman +Signed-off-by: Geliang Tang +Link: https://lore.kernel.org/r/86aed33b4b0ea3f04497c757845cff7e8e621a2d.1720515893.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c +index 597d0467a9267..de2466547efe0 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c ++++ b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c +@@ -994,7 +994,7 @@ static void drop_on_reuseport(const struct test *t) + + err = update_lookup_map(t->sock_map, SERVER_A, server1); + if (err) +- goto detach; ++ goto close_srv1; + + /* second server on destination address we should never reach */ + server2 = make_server(t->sotype, t->connect_to.ip, t->connect_to.port, +-- +2.43.0 + diff --git a/queue-6.10/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch b/queue-6.10/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch new file mode 100644 index 00000000000..4feae8996ac --- /dev/null +++ b/queue-6.10/selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch @@ -0,0 +1,38 @@ +From 53a1d44f587d68dbbf3afe7847fe6a47799c1271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:10:17 +0800 +Subject: selftests/bpf: Close obj in error path in xdp_adjust_tail + +From: Geliang Tang + +[ Upstream commit 52b49ec1b2c78deb258596c3b231201445ef5380 ] + +If bpf_object__load() fails in test_xdp_adjust_frags_tail_grow(), "obj" +opened before this should be closed. So use "goto out" to close it instead +of using "return" here. + +Fixes: 110221081aac ("bpf: selftests: update xdp_adjust_tail selftest to include xdp frags") +Signed-off-by: Geliang Tang +Link: https://lore.kernel.org/r/f282a1ed2d0e3fb38cceefec8e81cabb69cab260.1720615848.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c +index f09505f8b0386..53d6ad8c2257e 100644 +--- a/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c ++++ b/tools/testing/selftests/bpf/prog_tests/xdp_adjust_tail.c +@@ -222,7 +222,7 @@ static void test_xdp_adjust_frags_tail_grow(void) + + prog = bpf_object__next_program(obj, NULL); + if (bpf_object__load(obj)) +- return; ++ goto out; + + prog_fd = bpf_program__fd(prog); + +-- +2.43.0 + diff --git a/queue-6.10/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch b/queue-6.10/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch new file mode 100644 index 00000000000..1d981663575 --- /dev/null +++ b/queue-6.10/selftests-bpf-fix-prog-numbers-in-test_sockmap.patch @@ -0,0 +1,78 @@ +From 2d2da8bbd936e6950a72cac3b15ff1c55c844e76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 14:21:46 +0800 +Subject: selftests/bpf: Fix prog numbers in test_sockmap + +From: Geliang Tang + +[ Upstream commit 6c8d7598dfed759bf1d9d0322b4c2b42eb7252d8 ] + +bpf_prog5 and bpf_prog7 are removed from progs/test_sockmap_kern.h in +commit d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests"), +now there are only 9 progs in it, not 11: + + SEC("sk_skb1") + int bpf_prog1(struct __sk_buff *skb) + SEC("sk_skb2") + int bpf_prog2(struct __sk_buff *skb) + SEC("sk_skb3") + int bpf_prog3(struct __sk_buff *skb) + SEC("sockops") + int bpf_sockmap(struct bpf_sock_ops *skops) + SEC("sk_msg1") + int bpf_prog4(struct sk_msg_md *msg) + SEC("sk_msg2") + int bpf_prog6(struct sk_msg_md *msg) + SEC("sk_msg3") + int bpf_prog8(struct sk_msg_md *msg) + SEC("sk_msg4") + int bpf_prog9(struct sk_msg_md *msg) + SEC("sk_msg5") + int bpf_prog10(struct sk_msg_md *msg) + +This patch updates the array sizes of prog_fd[], prog_attach_type[] and +prog_type[] from 11 to 9 accordingly. + +Fixes: d79a32129b21 ("bpf: Selftests, remove prints from sockmap tests") +Signed-off-by: Geliang Tang +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/9c10d9f974f07fcb354a43a8eca67acb2fafc587.1715926605.git.tanggeliang@kylinos.cn +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_sockmap.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c +index 92752f5eededf..4499b3cfc3a68 100644 +--- a/tools/testing/selftests/bpf/test_sockmap.c ++++ b/tools/testing/selftests/bpf/test_sockmap.c +@@ -63,7 +63,7 @@ int passed; + int failed; + int map_fd[9]; + struct bpf_map *maps[9]; +-int prog_fd[11]; ++int prog_fd[9]; + + int txmsg_pass; + int txmsg_redir; +@@ -1793,8 +1793,6 @@ int prog_attach_type[] = { + BPF_SK_MSG_VERDICT, + BPF_SK_MSG_VERDICT, + BPF_SK_MSG_VERDICT, +- BPF_SK_MSG_VERDICT, +- BPF_SK_MSG_VERDICT, + }; + + int prog_type[] = { +@@ -1807,8 +1805,6 @@ int prog_type[] = { + BPF_PROG_TYPE_SK_MSG, + BPF_PROG_TYPE_SK_MSG, + BPF_PROG_TYPE_SK_MSG, +- BPF_PROG_TYPE_SK_MSG, +- BPF_PROG_TYPE_SK_MSG, + }; + + static int populate_progs(char *bpf_file) +-- +2.43.0 + diff --git a/queue-6.10/selftests-bpf-null-checks-for-links-in-bpf_tcp_ca.patch b/queue-6.10/selftests-bpf-null-checks-for-links-in-bpf_tcp_ca.patch new file mode 100644 index 00000000000..15615c3e3c1 --- /dev/null +++ b/queue-6.10/selftests-bpf-null-checks-for-links-in-bpf_tcp_ca.patch @@ -0,0 +1,151 @@ +From 58338c3ae04269b908786b949fa412f78845015d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 21:10:16 +0800 +Subject: selftests/bpf: Null checks for links in bpf_tcp_ca + +From: Geliang Tang + +[ Upstream commit eef0532e900c20a6760da829e82dac3ee18688c5 ] + +Run bpf_tcp_ca selftests (./test_progs -t bpf_tcp_ca) on a Loongarch +platform, some "Segmentation fault" errors occur: + +''' + test_dctcp:PASS:bpf_dctcp__open_and_load 0 nsec + test_dctcp:FAIL:bpf_map__attach_struct_ops unexpected error: -524 + #29/1 bpf_tcp_ca/dctcp:FAIL + test_cubic:PASS:bpf_cubic__open_and_load 0 nsec + test_cubic:FAIL:bpf_map__attach_struct_ops unexpected error: -524 + #29/2 bpf_tcp_ca/cubic:FAIL + test_dctcp_fallback:PASS:dctcp_skel 0 nsec + test_dctcp_fallback:PASS:bpf_dctcp__load 0 nsec + test_dctcp_fallback:FAIL:dctcp link unexpected error: -524 + #29/4 bpf_tcp_ca/dctcp_fallback:FAIL + test_write_sk_pacing:PASS:open_and_load 0 nsec + test_write_sk_pacing:FAIL:attach_struct_ops unexpected error: -524 + #29/6 bpf_tcp_ca/write_sk_pacing:FAIL + test_update_ca:PASS:open 0 nsec + test_update_ca:FAIL:attach_struct_ops unexpected error: -524 + settcpca:FAIL:setsockopt unexpected setsockopt: \ + actual -1 == expected -1 + (network_helpers.c:99: errno: No such file or directory) \ + Failed to call post_socket_cb + start_test:FAIL:start_server_str unexpected start_server_str: \ + actual -1 == expected -1 + test_update_ca:FAIL:ca1_ca1_cnt unexpected ca1_ca1_cnt: \ + actual 0 <= expected 0 + #29/9 bpf_tcp_ca/update_ca:FAIL + #29 bpf_tcp_ca:FAIL + Caught signal #11! + Stack trace: + ./test_progs(crash_handler+0x28)[0x5555567ed91c] + linux-vdso.so.1(__vdso_rt_sigreturn+0x0)[0x7ffffee408b0] + ./test_progs(bpf_link__update_map+0x80)[0x555556824a78] + ./test_progs(+0x94d68)[0x5555564c4d68] + ./test_progs(test_bpf_tcp_ca+0xe8)[0x5555564c6a88] + ./test_progs(+0x3bde54)[0x5555567ede54] + ./test_progs(main+0x61c)[0x5555567efd54] + /usr/lib64/libc.so.6(+0x22208)[0x7ffff2aaa208] + /usr/lib64/libc.so.6(__libc_start_main+0xac)[0x7ffff2aaa30c] + ./test_progs(_start+0x48)[0x55555646bca8] + Segmentation fault +''' + +This is because BPF trampoline is not implemented on Loongarch yet, +"link" returned by bpf_map__attach_struct_ops() is NULL. test_progs +crashs when this NULL link passes to bpf_link__update_map(). This +patch adds NULL checks for all links in bpf_tcp_ca to fix these errors. +If "link" is NULL, goto the newly added label "out" to destroy the skel. + +v2: + - use "goto out" instead of "return" as Eduard suggested. + +Fixes: 06da9f3bd641 ("selftests/bpf: Test switching TCP Congestion Control algorithms.") +Signed-off-by: Geliang Tang +Reviewed-by: Alan Maguire +Link: https://lore.kernel.org/r/b4c841492bd4ed97964e4e61e92827ce51bf1dc9.1720615848.git.tanggeliang@kylinos.cn +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/bpf_tcp_ca.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c +index 0aca025327948..3f0daf660703f 100644 +--- a/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c ++++ b/tools/testing/selftests/bpf/prog_tests/bpf_tcp_ca.c +@@ -307,7 +307,8 @@ static void test_update_ca(void) + return; + + link = bpf_map__attach_struct_ops(skel->maps.ca_update_1); +- ASSERT_OK_PTR(link, "attach_struct_ops"); ++ if (!ASSERT_OK_PTR(link, "attach_struct_ops")) ++ goto out; + + do_test("tcp_ca_update", NULL); + saved_ca1_cnt = skel->bss->ca1_cnt; +@@ -321,6 +322,7 @@ static void test_update_ca(void) + ASSERT_GT(skel->bss->ca2_cnt, 0, "ca2_ca2_cnt"); + + bpf_link__destroy(link); ++out: + tcp_ca_update__destroy(skel); + } + +@@ -336,7 +338,8 @@ static void test_update_wrong(void) + return; + + link = bpf_map__attach_struct_ops(skel->maps.ca_update_1); +- ASSERT_OK_PTR(link, "attach_struct_ops"); ++ if (!ASSERT_OK_PTR(link, "attach_struct_ops")) ++ goto out; + + do_test("tcp_ca_update", NULL); + saved_ca1_cnt = skel->bss->ca1_cnt; +@@ -349,6 +352,7 @@ static void test_update_wrong(void) + ASSERT_GT(skel->bss->ca1_cnt, saved_ca1_cnt, "ca2_ca1_cnt"); + + bpf_link__destroy(link); ++out: + tcp_ca_update__destroy(skel); + } + +@@ -363,7 +367,8 @@ static void test_mixed_links(void) + return; + + link_nl = bpf_map__attach_struct_ops(skel->maps.ca_no_link); +- ASSERT_OK_PTR(link_nl, "attach_struct_ops_nl"); ++ if (!ASSERT_OK_PTR(link_nl, "attach_struct_ops_nl")) ++ goto out; + + link = bpf_map__attach_struct_ops(skel->maps.ca_update_1); + ASSERT_OK_PTR(link, "attach_struct_ops"); +@@ -376,6 +381,7 @@ static void test_mixed_links(void) + + bpf_link__destroy(link); + bpf_link__destroy(link_nl); ++out: + tcp_ca_update__destroy(skel); + } + +@@ -418,7 +424,8 @@ static void test_link_replace(void) + bpf_link__destroy(link); + + link = bpf_map__attach_struct_ops(skel->maps.ca_update_2); +- ASSERT_OK_PTR(link, "attach_struct_ops_2nd"); ++ if (!ASSERT_OK_PTR(link, "attach_struct_ops_2nd")) ++ goto out; + + /* BPF_F_REPLACE with a wrong old map Fd. It should fail! + * +@@ -441,6 +448,7 @@ static void test_link_replace(void) + + bpf_link__destroy(link); + ++out: + tcp_ca_update__destroy(skel); + } + +-- +2.43.0 + diff --git a/queue-6.10/selftests-damon-access_memory-use-user-defined-regio.patch b/queue-6.10/selftests-damon-access_memory-use-user-defined-regio.patch new file mode 100644 index 00000000000..6a36dbd21bb --- /dev/null +++ b/queue-6.10/selftests-damon-access_memory-use-user-defined-regio.patch @@ -0,0 +1,65 @@ +From ce4b727f0fd94a46263892b5ac841556450dbc61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 11:05:31 -0700 +Subject: selftests/damon/access_memory: use user-defined region size + +From: SeongJae Park + +[ Upstream commit 34ec4344a5dabbb39e23e8daf30779892c0211a6 ] + +Patch series "selftests/damon: test DAMOS tried regions and +{min,max}_nr_regions". + +This patch series fix a minor issue in a program for DAMON selftest, and +implement new functionality selftests for DAMOS tried regions and +{min,max}_nr_regions. The test for max_nr_regions also test the recovery +from online tuning-caused limit violation, which was fixed by a previous +patch [1] titled "mm/damon/core: merge regions aggressively when +max_nr_regions is unmet". + +The first patch fixes a minor problem in the articial memory access +pattern generator for tests. Following 3 patches (2-4) implement schemes +tried regions test. Then a couple of patches (5-6) implementing static +setup based {min,max}_nr_regions functionality test follows. Final two +patches (7-8) implement dynamic max_nr_regions update test. + +[1] https://lore.kernel.org/20240624210650.53960C2BBFC@smtp.kernel.org + +This patch (of 8): + +'access_memory' is an artificial memory access pattern generator for DAMON +tests. It creates and accesses memory regions that the user specified the +number and size via the command line. However, real access part of the +program ignores the user-specified size of each region. Instead, it uses +a hard-coded value, 10 MiB. Fix it to use user-defined size. + +Note that all existing 'access_memory' users are setting the region size +as 10 MiB. Hence no real problem has happened so far. + +Link: https://lkml.kernel.org/r/20240625180538.73134-1-sj@kernel.org +Link: https://lkml.kernel.org/r/20240625180538.73134-2-sj@kernel.org +Fixes: b5906f5f7359 ("selftests/damon: add a test for update_schemes_tried_regions sysfs command") +Signed-off-by: SeongJae Park +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/damon/access_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/damon/access_memory.c b/tools/testing/selftests/damon/access_memory.c +index 585a2fa543295..56b17e8fe1be8 100644 +--- a/tools/testing/selftests/damon/access_memory.c ++++ b/tools/testing/selftests/damon/access_memory.c +@@ -35,7 +35,7 @@ int main(int argc, char *argv[]) + start_clock = clock(); + while ((clock() - start_clock) * 1000 / CLOCKS_PER_SEC < + access_time_ms) +- memset(regions[i], i, 1024 * 1024 * 10); ++ memset(regions[i], i, sz_region); + } + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/selftests-forwarding-devlink_lib-wait-for-udev-event.patch b/queue-6.10/selftests-forwarding-devlink_lib-wait-for-udev-event.patch new file mode 100644 index 00000000000..c9684d04aea --- /dev/null +++ b/queue-6.10/selftests-forwarding-devlink_lib-wait-for-udev-event.patch @@ -0,0 +1,77 @@ +From d8f3f4dccecf6b8cc8260128e360d0655338eb06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 17:27:02 +0200 +Subject: selftests: forwarding: devlink_lib: Wait for udev events after + reloading + +From: Amit Cohen + +[ Upstream commit f67a90a0c8f5b3d0acc18f10650d90fec44775f9 ] + +Lately, an additional locking was added by commit c0a40097f0bc +("drivers: core: synchronize really_probe() and dev_uevent()"). The +locking protects dev_uevent() calling. This function is used to send +messages from the kernel to user space. Uevent messages notify user space +about changes in device states, such as when a device is added, removed, +or changed. These messages are used by udev (or other similar user-space +tools) to apply device-specific rules. + +After reloading devlink instance, udev events should be processed. This +locking causes a short delay of udev events handling. + +One example for useful udev rule is renaming ports. 'forwading.config' +can be configured to use names after udev rules are applied. Some tests run +devlink_reload() and immediately use the updated names. This worked before +the above mentioned commit was pushed, but now the delay of uevent messages +causes that devlink_reload() returns before udev events are handled and +tests fail. + +Adjust devlink_reload() to not assume that udev events are already +processed when devlink reload is done, instead, wait for udev events to +ensure they are processed before returning from the function. + +Without this patch: +TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp1/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +sysctl: cannot stat /proc/sys/net/ipv6/conf/swp2/disable_ipv6: No such file or directory +Cannot find device "swp1" +Cannot find device "swp2" +TEST: setup_wait_dev (: Interface swp1 does not come up.) [FAIL] + +With this patch: +$ TESTS='rif_mac_profile' ./resource_scale.sh +TEST: 'rif_mac_profile' 4 [ OK ] +TEST: 'rif_mac_profile' overflow 5 [ OK ] + +This is relevant not only for this test. + +Fixes: bc7cbb1e9f4c ("selftests: forwarding: Add devlink_lib.sh") +Signed-off-by: Amit Cohen +Reviewed-by: Ido Schimmel +Signed-off-by: Petr Machata +Link: https://patch.msgid.link/89367666e04b38a8993027f1526801ca327ab96a.1720709333.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/devlink_lib.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/forwarding/devlink_lib.sh b/tools/testing/selftests/net/forwarding/devlink_lib.sh +index f1de525cfa55b..62a05bca1e825 100644 +--- a/tools/testing/selftests/net/forwarding/devlink_lib.sh ++++ b/tools/testing/selftests/net/forwarding/devlink_lib.sh +@@ -122,6 +122,8 @@ devlink_reload() + still_pending=$(devlink resource show "$DEVLINK_DEV" | \ + grep -c "size_new") + check_err $still_pending "Failed reload - There are still unset sizes" ++ ++ udevadm settle + } + + declare -A DEVLINK_ORIG +-- +2.43.0 + diff --git a/queue-6.10/selftests-resctrl-fix-closing-imc-fds-on-error-and-o.patch b/queue-6.10/selftests-resctrl-fix-closing-imc-fds-on-error-and-o.patch new file mode 100644 index 00000000000..ff8c7f99934 --- /dev/null +++ b/queue-6.10/selftests-resctrl-fix-closing-imc-fds-on-error-and-o.patch @@ -0,0 +1,142 @@ +From bbe921c4eea0090e72845071604eff717b69dc46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 18:14:42 +0300 +Subject: selftests/resctrl: Fix closing IMC fds on error and open-code R+W + instead of loops +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit c44000b6535dc9806b9128d1aed403862b2adab9 ] + +The imc perf fd close() calls are missing from all error paths. In +addition, get_mem_bw_imc() handles fds in a for loop but close() is +based on two fixed indexes READ and WRITE. + +Open code inner for loops to READ+WRITE entries for clarity and add a +function to close() IMC fds properly in all cases. + +Fixes: 7f4d257e3a2a ("selftests/resctrl: Add callback to start a benchmark") +Suggested-by: Reinette Chatre +Signed-off-by: Ilpo Järvinen +Tested-by: Babu Moger +Reviewed-by: Reinette Chatre +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/resctrl/resctrl_val.c | 54 ++++++++++++------- + 1 file changed, 36 insertions(+), 18 deletions(-) + +diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c +index 445f306d4c2fa..f55f5989de72b 100644 +--- a/tools/testing/selftests/resctrl/resctrl_val.c ++++ b/tools/testing/selftests/resctrl/resctrl_val.c +@@ -293,6 +293,18 @@ static int initialize_mem_bw_imc(void) + return 0; + } + ++static void perf_close_imc_mem_bw(void) ++{ ++ int mc; ++ ++ for (mc = 0; mc < imcs; mc++) { ++ if (imc_counters_config[mc][READ].fd != -1) ++ close(imc_counters_config[mc][READ].fd); ++ if (imc_counters_config[mc][WRITE].fd != -1) ++ close(imc_counters_config[mc][WRITE].fd); ++ } ++} ++ + /* + * get_mem_bw_imc: Memory band width as reported by iMC counters + * @cpu_no: CPU number that the benchmark PID is binded to +@@ -306,26 +318,33 @@ static int initialize_mem_bw_imc(void) + static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc) + { + float reads, writes, of_mul_read, of_mul_write; +- int imc, j, ret; ++ int imc, ret; ++ ++ for (imc = 0; imc < imcs; imc++) { ++ imc_counters_config[imc][READ].fd = -1; ++ imc_counters_config[imc][WRITE].fd = -1; ++ } + + /* Start all iMC counters to log values (both read and write) */ + reads = 0, writes = 0, of_mul_read = 1, of_mul_write = 1; + for (imc = 0; imc < imcs; imc++) { +- for (j = 0; j < 2; j++) { +- ret = open_perf_event(imc, cpu_no, j); +- if (ret) +- return -1; +- } +- for (j = 0; j < 2; j++) +- membw_ioctl_perf_event_ioc_reset_enable(imc, j); ++ ret = open_perf_event(imc, cpu_no, READ); ++ if (ret) ++ goto close_fds; ++ ret = open_perf_event(imc, cpu_no, WRITE); ++ if (ret) ++ goto close_fds; ++ ++ membw_ioctl_perf_event_ioc_reset_enable(imc, READ); ++ membw_ioctl_perf_event_ioc_reset_enable(imc, WRITE); + } + + sleep(1); + + /* Stop counters after a second to get results (both read and write) */ + for (imc = 0; imc < imcs; imc++) { +- for (j = 0; j < 2; j++) +- membw_ioctl_perf_event_ioc_disable(imc, j); ++ membw_ioctl_perf_event_ioc_disable(imc, READ); ++ membw_ioctl_perf_event_ioc_disable(imc, WRITE); + } + + /* +@@ -341,15 +360,13 @@ static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc) + if (read(r->fd, &r->return_value, + sizeof(struct membw_read_format)) == -1) { + ksft_perror("Couldn't get read b/w through iMC"); +- +- return -1; ++ goto close_fds; + } + + if (read(w->fd, &w->return_value, + sizeof(struct membw_read_format)) == -1) { + ksft_perror("Couldn't get write bw through iMC"); +- +- return -1; ++ goto close_fds; + } + + __u64 r_time_enabled = r->return_value.time_enabled; +@@ -369,10 +386,7 @@ static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc) + writes += w->return_value.value * of_mul_write * SCALE; + } + +- for (imc = 0; imc < imcs; imc++) { +- close(imc_counters_config[imc][READ].fd); +- close(imc_counters_config[imc][WRITE].fd); +- } ++ perf_close_imc_mem_bw(); + + if (strcmp(bw_report, "reads") == 0) { + *bw_imc = reads; +@@ -386,6 +400,10 @@ static int get_mem_bw_imc(int cpu_no, char *bw_report, float *bw_imc) + + *bw_imc = reads + writes; + return 0; ++ ++close_fds: ++ perf_close_imc_mem_bw(); ++ return -1; + } + + void set_mbm_path(const char *ctrlgrp, const char *mongrp, int domain_id) +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series new file mode 100644 index 00000000000..2bac512b767 --- /dev/null +++ b/queue-6.10/series @@ -0,0 +1,531 @@ +spi-spi-microchip-core-fix-the-number-of-chip-select.patch +spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch +edac-i10nm-make-skx_common.o-a-separate-module.patch +rcu-tasks-fix-stale-task-snaphot-for-tasks-trace.patch +md-fix-deadlock-between-mddev_suspend-and-flush-bio.patch +md-raid0-don-t-free-conf-on-raid0_run-failure.patch +md-raid1-don-t-free-conf-on-raid0_run-failure.patch +platform-chrome-cros_ec_debugfs-fix-wrong-ec-message.patch +ubd-refactor-the-interrupt-handler.patch +ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch +block-initialize-integrity-buffer-to-zero-before-wri.patch +dm-call-dm_revalidate_zones-after-setting-the-queue-.patch +io_uring-fix-probe-of-disabled-operations.patch +cgroup-cpuset-optimize-isolated-partition-only-gener.patch +cgroup-cpuset-fix-remote-root-partition-creation-pro.patch +x86-kconfig-add-as-instr64-macro-to-properly-evaluat.patch +hfsplus-fix-to-avoid-false-alarm-of-circular-locking.patch +x86-of-return-consistent-error-type-from-x86_of_pci_.patch +x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch +x86-pci-xen-fix-pcibios_-return-code-handling.patch +x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch +x86-syscall-mark-exit-_group-syscall-handlers-__nore.patch +cgroup-cpuset-prevent-uaf-in-proc_cpuset_show.patch +hwmon-adt7475-fix-default-duty-on-fan-is-disabled.patch +block-call-.limit_depth-after-.hctx-has-been-set.patch +block-mq-deadline-fix-the-tag-reservation-code.patch +xen-blkfront-fix-sector_size-propagation-to-the-bloc.patch +perf-arm_pmuv3-avoid-assigning-fixed-cycle-counter-w.patch +md-don-t-wait-for-md_recovery_needed-for-hot_remove_.patch +md-raid5-recheck-if-reshape-has-finished-with-device.patch +hwmon-ltc2991-re-order-conditions-to-fix-off-by-one-.patch +pwm-stm32-always-do-lazy-disabling.patch +drm-bridge-adv7511-fix-intermittent-edid-failures.patch +arm64-smp-fix-missing-ipi-statistics.patch +nvmet-auth-fix-nvmet_auth-hash-error-handling.patch +drm-meson-fix-canvas-release-in-bind-function.patch +pwm-atmel-tcb-fix-race-condition-and-convert-to-guar.patch +drm-xe-display-xe_hdcp_gsc-free-arbiter-on-driver-re.patch +hwmon-max6697-fix-underflow-when-writing-limit-attri.patch +hwmon-max6697-fix-swapped-temp-1-8-critical-alarms.patch +soc-qcom-socinfo-update-x1e-pmics.patch +arm64-dts-qcom-sc8180x-correct-pcie-slave-ports.patch +arm64-dts-qcom-sc7280-remove-cts-rts-configuration.patch +arm-dts-qcom-msm8226-microsoft-common-enable-smbb-ex.patch +arm64-dts-qcom-sc7180-drop-extra-ufs-phy-compat.patch +arm64-dts-qcom-sc8180x-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sdm845-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm6115-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm6350-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm8250-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm8350-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-sm8450-add-power-domain-to-ufs-phy.patch +arm64-dts-qcom-msm8996-xiaomi-common-drop-excton-fro.patch +arm64-dts-qcom-sdm850-lenovo-yoga-c630-fix-ipa-firmw.patch +arm64-dts-qcom-msm8998-enable-adreno_smmu-by-default.patch +soc-qcom-pmic_glink-handle-the-return-value-of-pmic_.patch +soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch +arm64-dts-rockchip-add-sdmmc-related-properties-on-r.patch +arm64-dts-rockchip-add-pinctrl-for-uart0-to-rk3308-r.patch +arm64-dts-rockchip-add-mdio-and-ethernet-phy-nodes-t.patch +arm64-dts-rockchip-update-wifi-bt-related-nodes-on-r.patch +cpufreq-sun50i-fix-memory-leak-in-dt_has_supported_h.patch +opp-fix-missing-cleanup-on-error-in-_opp_attach_genp.patch +arm64-dts-qcom-msm8996-specify-ufs-core_clk-frequenc.patch +arm64-dts-qcom-sa8775p-mark-ethernet-devices-as-dma-.patch +soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch +arm-dts-sunxi-remove-duplicated-entries-in-makefile.patch +arm-dts-stm32-add-arm-no-tick-in-suspend-to-stm32mp1.patch +arm64-dts-qcom-qrb4210-rb2-make-l9a-always-on.patch +cpufreq-ti-cpufreq-handle-deferred-probe-with-dev_er.patch +arm64-dts-qcom-sc8280xp-remove-thermal-zone-polling-.patch +arm64-dts-qcom-sc8280xp-throttle-the-gpu-when-overhe.patch +opp-ti-fix-ti_opp_supply_probe-wrong-return-values.patch +memory-fsl_ifc-make-fsl_ifc-config-visible-and-selec.patch +arm64-dts-ti-k3-am62-main-fix-the-reg-range-for-main.patch +arm64-dts-ti-k3-am62a-main-fix-the-reg-range-for-mai.patch +arm64-dts-ti-k3-am62p-main-fix-the-reg-range-for-mai.patch +arm64-dts-ti-k3-am642-hummingboard-t-correct-rs485-r.patch +arm64-dts-ti-k3-j722s-fix-main-domain-gpio-count.patch +arm64-dts-ti-k3-am62x-drop-mcasp-afifos.patch +arm64-dts-ti-k3-am62a7-drop-mcasp-afifos.patch +arm64-dts-ti-k3-am62p5-drop-mcasp-afifos.patch +arm64-dts-ti-k3-am625-beagleplay-drop-mcasp-afifos.patch +arm64-dts-ti-k3-am62-verdin-drop-mcasp-afifos.patch +arm64-dts-ti-k3-am625-phyboard-lyra-rdk-drop-mcasp-a.patch +arm64-dts-ti-k3-am62p5-sk-fix-pinmux-for-mcasp1-tx.patch +arm64-dts-qcom-sc7180-trogdor-disable-pwmleds-node-w.patch +arm64-dts-qcom-qdu1000-add-secure-qfprom-node.patch +soc-qcom-icc-bwmon-fix-refcount-imbalance-seen-durin.patch +soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch +soc-qcom-pdr-fix-parsing-of-domains-lists.patch +arm64-dts-rockchip-increase-vop-clk-rate-on-rk3328.patch +arm64-dts-amlogic-sm1-fix-spdif-compatibles.patch +arm-dts-imx6qdl-kontron-samx6i-fix-phy-mode.patch +arm-dts-imx6qdl-kontron-samx6i-fix-phy-reset.patch +arm-dts-imx6qdl-kontron-samx6i-fix-board-reset.patch +arm-dts-imx6qdl-kontron-samx6i-fix-spi0-chip-selects.patch +arm-dts-imx6qdl-kontron-samx6i-fix-pcie-reset-polari.patch +arm64-dts-mediatek-mt8195-fix-gpu-thermal-zone-name-.patch +arm64-dts-mediatek-mt8192-fix-gpu-thermal-zone-name-.patch +arm64-dts-medaitek-mt8395-nio-12l-set-i2c6-pins-to-b.patch +arm64-dts-mediatek-mt8183-kukui-drop-bogus-output-en.patch +arm64-dts-mediatek-mt8192-asurada-add-off-on-delay-u.patch +arm64-dts-mediatek-mt7981-fix-code-alignment-for-pwm.patch +arm64-dts-mediatek-mt7622-fix-emmc-pinctrl-mux.patch +arm64-dts-mediatek-mt8183-kukui-fix-the-value-of-dlg.patch +arm64-dts-mediatek-mt8183-pico6-fix-wake-on-x-event-.patch +arm64-dts-mediatek-mt8183-kukui-jacuzzi-add-ports-no.patch +soc-mediatek-mtk-mutex-add-mdp_tcc0-mod-to-mt8188-mu.patch +arm64-dts-amlogic-gx-correct-hdmi-clocks.patch +arm64-dts-amlogic-add-power-domain-to-hdmitx.patch +arm64-dts-amlogic-setup-hdmi-system-clock.patch +arm64-dts-rockchip-drop-invalid-mic-in-differential-.patch +arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch +arm64-dts-rockchip-fix-mic-in-differential-usage-on-.patch-16708 +arm64-dts-renesas-r8a779h0-drop-opp-shared-from-opp-.patch +arm64-dts-renesas-r8a779a0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r8a779f0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r8a779g0-add-missing-hypervisor-vi.patch +arm64-dts-renesas-r9a07g043u-add-missing-hypervisor-.patch +arm64-dts-renesas-r9a07g044-add-missing-hypervisor-v.patch +arm64-dts-renesas-r9a07g054-add-missing-hypervisor-v.patch +arm64-dts-renesas-r9a08g045-add-missing-hypervisor-v.patch +m68k-atari-fix-tt-bootup-freeze-unexpected-scu-inter.patch +arm64-dts-imx8mp-fix-pgc_mlmix-location.patch +arm64-dts-imx8mp-fix-pgc-vpu-locations.patch +arm64-dts-qcom-x1e80100-fix-usb-hs-phy-0.8v-supply.patch +x86-xen-convert-comma-to-semicolon.patch +arm64-dts-qcom-qrb4210-rb2-correct-max-current-draw-.patch +arm64-dts-rockchip-add-missing-power-domains-for-rk3.patch +arm64-dts-rockchip-fix-regulator-name-for-lunzn-fast.patch +arm64-dts-rockchip-fix-usb-regulator-for-lunzn-fastr.patch +arm64-dts-rockchip-fix-pmu_io-supply-for-lunzn-fastr.patch +arm64-dts-rockchip-remove-unused-usb2-nodes-for-lunz.patch +arm64-dts-rockchip-disable-display-subsystem-for-lun.patch +arm64-dts-rockchip-fixes-phy-reset-for-lunzn-fastrhi.patch +arm64-dts-qcom-sm6350-add-missing-qcom-non-secure-do.patch +cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch +cpufreq-amd-pstate-fix-the-scaling_max_freq-setting-.patch +m68k-cmpxchg-fix-return-value-for-default-case-in-__.patch +arm-spitz-fix-gpio-assignment-for-backlight.patch +arm-remove-address-checking-for-mmuless-devices.patch +x86-sev-do-rmp-memory-coverage-check-after-max_pfn-h.patch +vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch +firmware-turris-mox-rwtm-do-not-complete-if-there-ar.patch +firmware-turris-mox-rwtm-fix-checking-return-value-o.patch +firmware-turris-mox-rwtm-initialize-completion-befor.patch +wifi-ath12k-don-t-drop-tx_status-in-failure-case.patch +wifi-ath12k-drop-failed-transmitted-frames-from-metr.patch +wifi-ath12k-avoid-duplicated-vdev-stop.patch +wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch +wifi-ath12k-correct-6-ghz-frequency-value-in-rx-stat.patch +wifi-ath12k-fix-tx-completion-ring-wbm2sw-setup-fail.patch +wifi-ath12k-fix-smatch-warnings-on-ath12k_core_suspe.patch +bpftool-un-const-bpf_func_info-to-fix-it-for-llvm-17.patch +selftests-bpf-fix-prog-numbers-in-test_sockmap.patch +wifi-rtw89-8852b-restore-setting-for-rfe-type-5-afte.patch +net-esp-cleanup-esp_output_tail_tcp-in-case-of-unsup.patch +wifi-iwlwifi-mvm-don-t-skip-link-selection.patch +wifi-mac80211-fix-ttlm-teardown-work.patch +wifi-mac80211-cancel-multi-link-reconf-work-on-disco.patch +wifi-mac80211-cancel-ttlm-teardown-work-earlier.patch +wifi-mac80211-reset-negotiated-ttlm-on-disconnect.patch +wifi-ath11k-refactor-setting-country-code-logic.patch +wifi-ath11k-restore-country-code-during-resume.patch +wifi-ath12k-change-dma-direction-while-mapping-reinj.patch +wifi-ath12k-fix-invalid-memory-access-while-processi.patch +wifi-ath12k-fix-firmware-crash-during-reo-reinject.patch +wifi-rtw89-8852c-correct-logic-and-restore-pci-phy-e.patch +wifi-ath11k-fix-wrong-definition-of-ce-ring-s-base-a.patch +wifi-ath12k-fix-wrong-definition-of-ce-ring-s-base-a.patch +net-ethernet-cortina-restore-tso-support.patch +tcp-add-tcp_done_with_error-helper.patch +tcp-fix-race-in-tcp_write_err.patch +tcp-fix-races-in-tcp_abort.patch +tcp-fix-races-in-tcp_v-46-_err.patch +hns3-avoid-linking-objects-into-multiple-modules.patch +libbpf-keep-fd_cloexec-flag-when-dup-ing-fd.patch +net-smc-set-rmb-s-sg_max_single_alloc-limitation-onl.patch +selftests-bpf-check-length-of-recv-in-test_sockmap.patch +udf-fix-lock-ordering-in-udf_evict_inode.patch +sched-core-move-preempt_model_-helpers-from-sched.h-.patch +sched-core-drop-spinlocks-on-contention-iff-kernel-i.patch +lib-objagg-fix-general-protection-fault.patch +mlxsw-spectrum_acl_erp-fix-object-nesting-warning.patch +mlxsw-spectrum_acl-fix-acl-scale-regression-and-firm.patch +perf-x86-serialize-set_attr_rdpmc.patch +jump_label-fix-concurrency-issues-in-static_key_slow.patch +wifi-ath12k-fix-acpi-warning-when-resume.patch +wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch +wifi-ath12k-fix-per-pdev-debugfs-registration.patch +wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch +wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch +wifi-nl80211-expose-can-monitor-channel-property.patch +wifi-iwlwifi-mvm-fix-re-enabling-emlsr.patch +wifi-iwlwifi-mvm-separate-non-bss-roc-emlsr-blocking.patch +bpf-make-bpf_session_cookie-kfunc-return-long.patch +xfrm-fix-input-error-path-memory-access.patch +xfrm-log-input-direction-mismatch-error-in-one-place.patch +udf-fix-bogus-checksum-computation-in-udf_rename.patch +net-fec-fix-fec_ecr_en1588-being-cleared-on-link-dow.patch +net-dsa-ksz_common-allow-only-up-to-two-hsr-hw-offlo.patch +bpf-change-bpf_session_cookie-return-value-to-__u64.patch +libbpf-checking-the-btf_type-kind-when-fixing-variab.patch +libbpf-skip-base-btf-sanity-checks.patch +xfrm-fix-unregister-netdevice-hang-on-hardware-offlo.patch +ipvs-avoid-unnecessary-calls-to-skb_is_gso_sctp.patch +netfilter-nf_tables-rise-cap-on-selinux-secmark-cont.patch +wifi-mac80211-add-ieee80211_tdls_sta_link_id.patch +wifi-mac80211-correcty-limit-wider-bw-tdls-stas.patch +wifi-iwlwifi-fix-iwl_mvm_get_valid_rx_ant.patch +wifi-iwlwifi-mvm-always-unblock-emlsr-on-roc-end.patch +wifi-ath12k-advertise-driver-capabilities-for-mbssid.patch +wifi-ath12k-fix-peer-metadata-parsing.patch +wifi-rtw89-wow-fix-gtk-offload-h2c-skbuff-issue.patch +wifi-rtw89-8852b-fix-definition-of-kip-register-numb.patch +wifi-rtl8xxxu-8188f-limit-tx-power-index.patch +xfrm-export-symbol-xfrm_dev_state_delete.patch +riscv-bpf-fix-out-of-bounds-issue-when-preparing-tra.patch +bpftool-mount-bpffs-when-pinmaps-path-not-under-the-.patch +bpf-fix-atomic-probe-zero-extension.patch +perf-x86-intel-pt-fix-pt_topa_entry_for_page-address.patch +perf-fix-perf_aux_size-for-greater-than-32-bit-size.patch +perf-prevent-passing-zero-nr_pages-to-rb_alloc_aux.patch +perf-fix-default-aux_watermark-calculation.patch +perf-x86-intel-cstate-fix-alderlake-raptorlake-meteo.patch +perf-x86-amd-uncore-avoid-pmu-registration-if-counte.patch +perf-x86-amd-uncore-fix-df-and-umc-domain-identifica.patch +wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch +xfrm-fix-netdev-reference-count-imbalance.patch +xfrm-call-xfrm_dev_policy_delete-when-kill-policy.patch +wifi-virt_wifi-avoid-reporting-connection-success-wi.patch +bpf-helpers-fix-bpf_wq_set_callback_impl-signature.patch +nfsd-fix-nfsdcld-warning.patch +gss_krb5-fix-the-error-handling-path-for-crypto_sync.patch +net-page_pool-fix-warning-code.patch +wifi-virt_wifi-don-t-use-strlen-in-const-context.patch +locking-rwsem-add-__always_inline-annotation-to-__do.patch +selftests-bpf-close-fd-in-error-path-in-drop_on_reus.patch +selftests-bpf-null-checks-for-links-in-bpf_tcp_ca.patch +selftests-bpf-close-obj-in-error-path-in-xdp_adjust_.patch +bpf-arm64-fix-trampoline-for-bpf_tramp_f_call_orig.patch +selftests-resctrl-fix-closing-imc-fds-on-error-and-o.patch +bpf-annotate-btf-show-functions-with-__printf.patch +bna-adjust-name-buf-size-of-bna_tcb-and-bna_ccb-stru.patch +bpf-eliminate-remaining-make-w-1-warnings-in-kernel-.patch +bpf-fix-overflow-check-in-adjust_jmp_off.patch +nfsd-nfsd_file_lease_notifier_call-gets-a-file_lease.patch +bpf-fix-null-pointer-dereference-in-resolve_prog_typ.patch +net-pse-pd-do-not-return-eopnosupp-if-config-is-null.patch +net-ethtool-pse-pd-fix-possible-null-deref.patch +selftests-forwarding-devlink_lib-wait-for-udev-event.patch +bluetooth-hci_bcm4377-use-correct-unit-for-timeouts.patch +bluetooth-btintel-refactor-btintel_set_ppag.patch +bluetooth-btintel_pcie-fix-irq-leak.patch +bluetooth-btnxpuart-add-handling-for-boot-signature-.patch +bluetooth-hci_event-set-qos-encryption-from-biginfo-.patch +bluetooth-hci_core-hci_sync-cleanup-struct-discovery.patch +virtio_net-add-support-for-byte-queue-limits.patch +virtio_net-fix-napi_skb_cache_put-warning.patch +xdp-fix-invalid-wait-context-of-page_pool_destroy.patch +net-bridge-mst-check-vlan-state-for-egress-decision.patch +bluetooth-fix-usage-of-__hci_cmd_sync_status.patch +tcp-don-t-access-uninit-tcp_rsk-req-ao_keyid-in-tcp_.patch +drm-rockchip-vop2-fix-the-port-mux-of-vp2.patch +drm-arm-komeda-fix-komeda-probe-failing-if-there-are.patch +drm-amdkfd-fix-cu-masking-for-gfx-9.4.3.patch +drm-i915-psr-rename-has_psr2-as-has_sel_update.patch +drm-i915-display-do-not-print-psr-enabled-for-on-pan.patch +drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch +drm-mipi-dsi-fix-theoretical-int-overflow-in-mipi_ds.patch-622 +drm-panel-lg-sw43408-add-missing-error-handling.patch +drm-amd-pm-fix-aldebaran-pcie-speed-reporting.patch +drm-amdgpu-fix-memory-range-calculation.patch +drm-amdgpu-check-if-nbio-funcs-are-null-in-amdgpu_de.patch +drm-amdgpu-remove-gc-hw-ip-9.3.0-from-noretry-1.patch +drm-panel-himax-hx8394-handle-errors-from-mipi_dsi_d.patch +drm-panel-boe-tv101wum-nl6-if-prepare-fails-disable-.patch +drm-panel-boe-tv101wum-nl6-check-for-errors-on-the-n.patch +drm-panel-ilitek-ili9882t-if-prepare-fails-disable-g.patch +drm-panel-ilitek-ili9882t-check-for-errors-on-the-no.patch +drm-bridge-it6505-fix-hibernate-to-resume-no-display.patch +drm-amdgpu-fix-snprintf-usage-in-amdgpu_gfx_kiq_init.patch +drm-amd-display-dynamically-allocate-dml2_configurat.patch +drm-amd-display-fix-graphics_object_id-size.patch +drm-amd-display-move-struct-scaler_data-off-stack.patch +media-pci-ivtv-add-check-for-dma-map-result.patch +media-dvb-usb-fix-unexpected-infinite-loop-in-dvb_us.patch +media-imon-fix-race-getting-ictx-lock.patch +drm-i915-psr-use-enable-boolean-from-intel_crtc_stat.patch +media-i2c-fix-imx412-exposure-control.patch +media-i2c-hi846-fix-v4l2_subdev_format_try-get_selec.patch +media-v4l-async-fix-null-pointer-dereference-in-addi.patch +drm-amdgpu-fix-type-mismatch-in-amdgpu_gfx_kiq_init_.patch +s390-uv-don-t-call-folio_wait_writeback-without-a-fo.patch +drm-msm-dpu-fix-encoder-irq-wait-skip.patch +revert-drm-msm-dpu-drop-dpu_encoder_phys_ops.atomic_.patch +drm-msm-dpu-drop-duplicate-drm-formats-from-wb2_form.patch +drm-msm-dp-fix-runtime_pm-handling-in-dp_wait_hpd_as.patch +perf-maps-fix-use-after-free-in-__maps__fixup_overla.patch +media-mediatek-vcodec-handle-invalid-decoder-vsi.patch +media-mediatek-vcodec-fix-unreasonable-data-conversi.patch +drm-bridge-samsung-dsim-set-p-divider-based-on-min-m.patch +drm-i915-display-skip-panel-replay-on-pipe-compariso.patch +drm-i915-psr-print-panel-replay-status-instead-of-fr.patch +x86-shstk-make-return-uprobe-work-with-shadow-stack.patch +ipmi-ssif_bmc-prevent-integer-overflow-on-32bit-syst.patch +drm-amd-display-use-pre-allocated-temp-structure-for.patch +saa7134-unchecked-i2c_transfer-function-result-fixed.patch +media-c8sectpfe-add-missing-parameter-names.patch +media-i2c-imx219-fix-msr-access-command-sequence.patch +media-uvcvideo-quirk-for-invalid-dev_sof-in-logitech.patch +media-uvcvideo-add-quirk-for-invalid-dev_sof-in-logi.patch +media-uvcvideo-override-default-flags.patch +drm-zynqmp_dpsub-fix-an-error-handling-path-in-zynqm.patch +drm-zynqmp_kms-fix-aux-bus-not-getting-unregistered.patch +drm-i915-psr-set-su-area-width-as-pipe-src-width.patch +media-rcar-vin-fix-yuyv8_1x16-handling-for-csi-2.patch +media-rcar-csi2-disable-runtime_pm-in-probe-error.patch +media-rcar-csi2-cleanup-subdevice-in-remove.patch +media-renesas-vsp1-fix-_irqsave-and-_irq-mix.patch +media-renesas-vsp1-store-rpf-partition-configuration.patch +drm-ttm-tests-let-ttm_bo_test-consider-different-ww_.patch +drm-mediatek-add-missing-plane-settings-when-async-u.patch +drm-mediatek-use-8-bit-alpha-in-ethdr.patch +drm-mediatek-fix-xrgb-setting-error-in-ovl.patch +drm-mediatek-fix-xrgb-setting-error-in-mixer.patch +drm-mediatek-fix-destination-alpha-error-in-ovl.patch +drm-mediatek-turn-off-the-layers-with-zero-width-or-.patch +drm-mediatek-add-ovl-compatible-name-for-mt8195.patch +drm-mediatek-add-drm_mode_rotate_0-to-rotation-prope.patch +drm-mediatek-set-drm-mode-configs-accordingly.patch +drm-msm-a6xx-use-__unused__-to-fix-compiler-warnings.patch +drm-msm-a6xx-fix-a702-ubwc-mode.patch +media-imx-jpeg-drop-initial-source-change-event-if-c.patch +leds-trigger-unregister-sysfs-attributes-before-call.patch +drm-msm-dsi-set-video-mode-widebus-enable-bit-when-w.patch +drm-msm-dsi-set-video_compression_mode_ctrl_wc.patch +drm-msm-dpu-drop-validity-checks-for-clear_pending_f.patch +drm-ttm-tests-fix-a-warning-in-ttm_bo_unreserve_bulk.patch +drm-panic-only-draw-the-foreground-color-in-drm_pani.patch +drm-panic-fix-off-by-one-logo-size-checks.patch +platform-arm64-build-drivers-even-on-non-arm64-platf.patch +perf-test-make-test_arm_callgraph_fp.sh-more-robust.patch +tools-perf-fix-the-string-match-for-tmp-perf-pid.map.patch +perf-pmus-fixes-always-false-when-compare-duplicates.patch +perf-report-fix-condition-in-sort__sym_cmp.patch +drm-etnaviv-fix-dma-direction-handling-for-cached-rw.patch +drm-qxl-add-check-for-drm_cvt_mode.patch +leds-rgb-leds-qcom-lpg-add-ppg-check-for-setting-cle.patch +revert-leds-led-core-fix-refcount-leak-in-of_led_get.patch +drm-panic-depends-on-vt_console.patch +drm-panic-do-not-select-drm_kms_helper.patch +drm-mediatek-remove-less-than-zero-comparison-of-an-.patch +ext4-fix-infinite-loop-when-replaying-fast_commit.patch +drm-amd-display-add-null-check-before-access-structs.patch +perf-tests-add-some-pmu-core-functionality-tests.patch +perf-pmu-restore-full-pmu-name-wildcard-support.patch +drm-mediatek-dpi-dsi-fix-possible_crtcs-calculation.patch +drm-mediatek-dp-fix-spurious-kfree.patch +perf-stat-fix-a-segfault-with-per-cluster-metric-onl.patch +media-venus-flush-all-buffers-in-output-plane-stream.patch +perf-intel-pt-fix-aux_watermark-calculation-for-64-b.patch +perf-intel-pt-fix-exclude_guest-setting.patch +drm-panthor-record-devfreq-busy-as-soon-as-a-job-is-.patch +mfd-rsmu-split-core-code-into-separate-module.patch +mfd-omap-usb-tll-use-struct_size-to-allocate-tll.patch +xprtrdma-fix-rpcrdma_reqs_reset.patch +sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch +nfsv4.1-another-fix-for-exchgid4_flag_use_pnfs_ds-fo.patch +ext4-don-t-track-ranges-in-fast_commit-if-inode-has-.patch +ext4-avoid-writing-unitialized-memory-to-disk-in-ea-.patch +drm-qxl-pin-buffer-objects-for-internal-mappings.patch +leds-flash-leds-qcom-flash-test-the-correct-variable.patch +sparc64-fix-incorrect-function-signature-and-add-pro.patch +perf-dso-fix-address-sanitizer-build.patch +platform-x86-asus-wmi-fix-tuf-laptop-rgb-variant.patch +nfs-pass-explicit-offset-count-to-trace-events.patch +sunrpc-fixup-gss_status-tracepoint-error-output.patch +iio-fix-the-sorting-functionality-in-iio_gts_build_a.patch +pci-endpoint-pci-epf-test-make-use-of-cached-epc_fea.patch +pci-fix-resource-double-counting-on-remove-rescan.patch +pci-keystone-relocate-ks_pcie_set-clear_dbi_mode.patch +pci-keystone-don-t-enable-bar-0-for-am654x.patch +pci-keystone-fix-null-pointer-dereference-in-case-of.patch +pci-rcar-demote-warn-to-dev_warn_ratelimited-in-rcar.patch +pci-tegra194-set-ep-alignment-restriction-for-inboun.patch +riscv-smp-fail-booting-up-smp-if-inconsistent-vlen-i.patch +scsi-ufs-mcq-fix-missing-argument-hba-in-mcq_opr_off.patch +crypto-tegra-remove-an-incorrect-iommu_fwspec_free-c.patch +crypto-atmel-sha204a-fix-negated-return-value.patch +clk-qcom-gcc-sc7280-update-force-mem-core-bit-for-uf.patch +clk-qcom-camcc-sc7280-add-parent-dependency-to-all-c.patch +clk-meson-s4-fix-fixed_pll_dco-clock.patch +clk-meson-s4-fix-pwm_j_div-parent-clock.patch +iio-adc-ad9467-use-dma-safe-buffer-for-spi.patch +iio-frequency-adrf6780-rm-clk-provider-include.patch +iio-adc-adi-axi-adc-don-t-allow-concurrent-enable-di.patch +iommu-arm-smmu-v3-avoid-uninitialized-asid-in-case-o.patch +kvm-ppc-book3s-hv-fix-the-set_one_reg-for-mmcr3.patch +kvm-ppc-book3s-hv-fix-the-get_one_reg-of-sdar.patch +coresight-fix-ref-leak-when-of_coresight_parse_endpo.patch +rdma-mlx5-set-mkeys-for-dmabuf-at-page_size.patch +powerpc-kexec_file-fix-cpus-node-update-to-fdt.patch +asoc-tas2781-enable-rca-based-playback-without-dsp-f.patch +asoc-cs35l56-accept-values-greater-than-0-as-irq-num.patch +usb-typec-mux-ptn36502-unregister-typec-switch-on-pr.patch +usb-typec-mux-nb7vpq904m-unregister-typec-switch-on-.patch +asoc-pcm6240-return-directly-after-a-failed-devm_kza.patch +rdma-cache-release-gid-table-even-if-leak-is-detecte.patch +mtd-spi-nor-winbond-fix-w25q128-regression.patch +clk-qcom-gpucc-sm8350-park-rcg-s-clk-source-at-xo-du.patch +clk-qcom-gcc-sa8775p-update-the-gdsc-wait_val-fields.patch +clk-qcom-gpucc-sa8775p-remove-the-clk_is_critical-an.patch +clk-qcom-gpucc-sa8775p-park-rcg-s-clk-source-at-xo-d.patch +clk-qcom-gpucc-sa8775p-update-wait_val-fields-for-gp.patch +interconnect-qcom-qcm2290-fix-mas_snoc_bimc-rpm-mast.patch +input-qt1050-handle-chip_id-reading-error.patch +rdma-mlx4-fix-truncated-output-warning-in-mad.c.patch +rdma-mlx4-fix-truncated-output-warning-in-alias_guid.patch +rdma-mlx5-use-sq-timestamp-as-qp-timestamp-when-roce.patch +rdma-rxe-don-t-set-bth_ack_mask-for-uc-or-ud-qps.patch +asoc-qcom-adjust-issues-in-case-of-dt-error-in-asoc_.patch +scsi-lpfc-fix-a-possible-null-pointer-dereference.patch +hwrng-core-fix-wrong-quality-calculation-at-hw-rng-r.patch +powerpc-prom-add-cpu-info-to-hardware-description-st.patch +asoc-max98088-check-for-clk_prepare_enable-error.patch +iommufd-selftest-fix-dirty-bitmap-tests-with-u8-bitm.patch +iommufd-selftest-fix-iommufd_test_dirty-to-handle-u8.patch +iommufd-selftest-add-tests-for-u8-bitmap-sizes.patch +iommufd-selftest-fix-tests-to-use-mock_page_size-bas.patch +iommufd-iova_bitmap-check-iova_bitmap_done-after-set.patch +mtd-make-mtd_test.c-a-separate-module.patch +rdma-device-return-error-earlier-if-port-in-not-vali.patch +input-elan_i2c-do-not-leave-interrupt-disabled-on-su.patch +clk-qcom-gcc-x1e80100-fix-halt_check-for-all-pipe-cl.patch +dm-raid-fix-warn_on_once-check-for-sync_thread-in-ra.patch +kvm-s390-reject-memory-region-operations-for-ucontro.patch +eeprom-ee1004-call-i2c_new_scanned_device-to-instant.patch +asoc-amd-adjust-error-handling-in-case-of-absent-cod.patch +iommu-arm-smmu-qcom-register-the-tbu-driver-in-qcom_.patch +pci-endpoint-clean-up-error-handling-in-vpci_scan_bu.patch +pci-endpoint-fix-error-handling-in-epf_ntb_epc_clean.patch +vhost-vsock-always-initialize-seqpacket_allow.patch +net-missing-check-virtio.patch +scsi-lpfc-revise-lpfc_prep_embed_io-routine-with-pro.patch +nvmem-rockchip-otp-set-add_legacy_fixed_of_cells-con.patch +crypto-qat-extend-scope-of-lock-in-adf_cfg_add_key_v.patch +clk-qcom-kpss-xcc-return-of_clk_add_hw_provider-to-t.patch +clk-qcom-gcc-x1e80100-set-parent-rate-for-usb3-sec-a.patch +clk-qcom-park-shared-rcgs-upon-registration.patch +clk-en7523-fix-rate-divider-for-slic-and-spi-clocks.patch +mips-octeron-remove-source-file-executable-bit.patch +pci-qcom-ep-disable-resources-unconditionally-during.patch +pci-dwc-fix-index-0-incorrectly-being-interpreted-as.patch +iommu-vt-d-limit-max-address-mask-to-max_agaw_pfn_wi.patch +iommu-vt-d-fix-aligned-pages-in-calculate_psi_aligne.patch +powerpc-xmon-fix-disassembly-cpu-feature-checks.patch +macintosh-therm_windtunnel-fix-module-unload.patch +rdma-hns-check-atomic-wr-length.patch +rdma-hns-fix-soft-lockup-under-heavy-ceqe-load.patch +rdma-hns-fix-unmatch-exception-handling-when-init-eq.patch +rdma-hns-fix-missing-pagesize-and-alignment-check-in.patch +rdma-hns-fix-shift-out-bounds-when-max_inline_data-i.patch +rdma-hns-fix-undifined-behavior-caused-by-invalid-ma.patch +rdma-hns-fix-insufficient-extend-db-for-vfs.patch +rdma-hns-fix-mbx-timing-out-before-cmd-execution-is-.patch +iommu-vt-d-fix-identity-map-bounds-in-si_domain_init.patch +crypto-mxs-dcp-ensure-payload-is-zero-when-using-key.patch +rdma-fix-netdev-tracker-in-ib_device_set_netdev.patch +bnxt_re-fix-imm_data-endianness.patch +rdma-mana_ib-set-node_guid.patch +rdma-mana_ib-set-correct-device-into-ib.patch +mips-fix-fallback-march-for-sb1.patch +netfilter-ctnetlink-use-helper-function-to-calculate.patch +netfilter-nf_set_pipapo-fix-initial-map-fill.patch +ipvs-properly-dereference-pe-in-ip_vs_add_service.patch +gve-fix-xdp-tx-completion-handling-when-counters-ove.patch +net-flow_dissector-use-debug_net_warn_on_once.patch +ipv4-fix-incorrect-tos-in-route-get-reply.patch +ipv4-fix-incorrect-tos-in-fibmatch-route-get-reply.patch +net-dsa-mv88e6xxx-limit-chip-wide-frame-size-config-.patch +net-dsa-b53-limit-chip-wide-jumbo-frame-config-to-cp.patch +fs-ntfs3-merge-synonym-compression_unit-and-ntfs_lzn.patch +fs-ntfs3-fix-transform-resident-to-nonresident-for-c.patch +fs-ntfs3-deny-getting-attr-data-block-in-compressed-.patch +fs-ntfs3-missed-ni_flag_update_parent-setting.patch +fs-ntfs3-fix-getting-file-type.patch +fs-ntfs3-add-missing-.dirty_folio-in-address_space_o.patch +pinctrl-rockchip-update-rk3308-iomux-routes.patch +pinctrl-core-fix-possible-memory-leak-when-pinctrl_e.patch +pinctrl-single-fix-possible-memory-leak-when-pinctrl.patch +pinctrl-ti-ti-iodelay-fix-possible-memory-leak-when-.patch +pinctrl-freescale-mxs-fix-refcount-of-child.patch +fs-ntfs3-replace-inode_trylock-with-inode_lock.patch +fs-ntfs3-correct-undo-if-ntfs_create_inode-failed.patch +fs-ntfs3-drop-stray-backslash-in-formatting-string.patch +fs-ntfs3-fix-field-spanning-write-in-index_hdr.patch +rtc-tps6594-fix-memleak-in-probe.patch +pinctrl-renesas-r8a779g0-fix-canfd5-suffix.patch +pinctrl-renesas-r8a779g0-fix-fxr_txen-ab-suffixes.patch +pinctrl-renesas-r8a779g0-fix-h-scif1-suffixes.patch +pinctrl-renesas-r8a779g0-fix-h-scif3-suffixes.patch +pinctrl-renesas-r8a779g0-fix-irq-suffixes.patch +pinctrl-renesas-r8a779g0-fix-pwm-suffixes.patch +pinctrl-renesas-r8a779g0-fix-tclk-suffixes.patch +pinctrl-renesas-r8a779g0-fix-tpu-suffixes.patch +fs-proc-task_mmu-indicate-pm_file-for-pmd-mapped-fil.patch +fs-proc-task_mmu-don-t-indicate-pm_mmap_exclusive-wi.patch +fs-proc-task_mmu-properly-detect-pm_mmap_exclusive-p.patch +selftests-damon-access_memory-use-user-defined-regio.patch +nilfs2-avoid-undefined-behavior-in-nilfs_cnt32_ge-ma.patch +rtc-interface-add-rtc-offset-to-alarm-after-fix-up.patch +fs-ntfs3-fix-the-format-of-the-nocase-mount-option.patch +fs-ntfs3-missed-error-return.patch +fs-ntfs3-keep-runs-for-mft-attr_data-and-mft-attr_bi.patch +md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch +powerpc-8xx-fix-size-given-to-set_huge_pte_at.patch +s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch +lib-add-missing-newline-character-in-the-warning-mes.patch +lib-reuse-page_ext_data-to-obtain-codetag_ref.patch +alloc_tag-fix-page_ext_get-page_ext_put-sequence-dur.patch +sbitmap-fix-io-hung-due-to-race-on-sbitmap_word-clea.patch +loongarch-check-tif_load_watch-to-enable-user-space-.patch +power-supply-ab8500-fix-error-handling-when-calling-.patch +power-supply-ingenic-fix-some-error-handling-paths-i.patch +remoteproc-mediatek-don-t-attempt-to-remap-l1tcm-mem.patch +remoteproc-k3-r5-fix-ipc-only-mode-detection.patch +mailbox-omap-fix-mailbox-interrupt-sharing.patch +mailbox-imx-fix-txdb_v2-channel-race-condition.patch +mailbox-mtk-cmdq-move-devm_mbox_controller_register-.patch diff --git a/queue-6.10/soc-mediatek-mtk-mutex-add-mdp_tcc0-mod-to-mt8188-mu.patch b/queue-6.10/soc-mediatek-mtk-mutex-add-mdp_tcc0-mod-to-mt8188-mu.patch new file mode 100644 index 00000000000..818ba34845d --- /dev/null +++ b/queue-6.10/soc-mediatek-mtk-mutex-add-mdp_tcc0-mod-to-mt8188-mu.patch @@ -0,0 +1,36 @@ +From 1d4b3a662ccc2f39e2fb89ca24cbfac8dcdf392e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 12:30:34 +0200 +Subject: soc: mediatek: mtk-mutex: Add MDP_TCC0 mod to MT8188 mutex table + +From: AngeloGioacchino Del Regno + +[ Upstream commit 161ee1eb9ab2440553dac55ada8329de704b1ffd ] + +MT8188's MDP3 is able to use MDP_TCC0, this mutex_mod bit does +actually exist and it's the same as MT8195: add it to the table. + +Fixes: 26bb17dae6fa ("soc: mediatek: mtk-mutex: Add support for MT8188 VPPSYS") +Reviewed-by: Fei Shao +Link: https://lore.kernel.org/r/20240619103034.110377-1-angelogioacchino.delregno@collabora.com +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-mutex.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/mediatek/mtk-mutex.c b/drivers/soc/mediatek/mtk-mutex.c +index b5af1fb5847ea..01b129caf1eb2 100644 +--- a/drivers/soc/mediatek/mtk-mutex.c ++++ b/drivers/soc/mediatek/mtk-mutex.c +@@ -524,6 +524,7 @@ static const unsigned int mt8188_mdp_mutex_table_mod[MUTEX_MOD_IDX_MAX] = { + [MUTEX_MOD_IDX_MDP_PAD0] = MT8195_MUTEX_MOD_MDP_PAD0, + [MUTEX_MOD_IDX_MDP_PAD2] = MT8195_MUTEX_MOD_MDP_PAD2, + [MUTEX_MOD_IDX_MDP_PAD3] = MT8195_MUTEX_MOD_MDP_PAD3, ++ [MUTEX_MOD_IDX_MDP_TCC0] = MT8195_MUTEX_MOD_MDP_TCC0, + [MUTEX_MOD_IDX_MDP_WROT0] = MT8195_MUTEX_MOD_MDP_WROT0, + [MUTEX_MOD_IDX_MDP_WROT2] = MT8195_MUTEX_MOD_MDP_WROT2, + [MUTEX_MOD_IDX_MDP_WROT3] = MT8195_MUTEX_MOD_MDP_WROT3, +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-icc-bwmon-fix-refcount-imbalance-seen-durin.patch b/queue-6.10/soc-qcom-icc-bwmon-fix-refcount-imbalance-seen-durin.patch new file mode 100644 index 00000000000..c44852e28c8 --- /dev/null +++ b/queue-6.10/soc-qcom-icc-bwmon-fix-refcount-imbalance-seen-durin.patch @@ -0,0 +1,79 @@ +From 291cd445128f8d52469faa28cb96c090c7614c66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2024 22:15:06 +0530 +Subject: soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove + +From: Sibi Sankar + +[ Upstream commit 24086640ab39396eb1a92d1cb1cd2f31b2677c52 ] + +The following warning is seen during bwmon_remove due to refcount +imbalance, fix this by releasing the OPPs after use. + +Logs: +WARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158 +Hardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT) +... +Call trace: +_opp_table_kref_release+0x150/0x158 +dev_pm_opp_remove_table+0x100/0x1b4 +devm_pm_opp_of_table_release+0x10/0x1c +devm_action_release+0x14/0x20 +devres_release_all+0xa4/0x104 +device_unbind_cleanup+0x18/0x60 +device_release_driver_internal+0x1ec/0x228 +driver_detach+0x50/0x98 +bus_remove_driver+0x6c/0xbc +driver_unregister+0x30/0x60 +platform_driver_unregister+0x14/0x20 +bwmon_driver_exit+0x18/0x524 [icc_bwmon] +__arm64_sys_delete_module+0x184/0x264 +invoke_syscall+0x48/0x118 +el0_svc_common.constprop.0+0xc8/0xe8 +do_el0_svc+0x20/0x2c +el0_svc+0x34/0xdc +el0t_64_sync_handler+0x13c/0x158 +el0t_64_sync+0x190/0x194 +--[ end trace 0000000000000000 ]--- + +Fixes: 0276f69f13e2 ("soc: qcom: icc-bwmon: Set default thresholds dynamically") +Fixes: b9c2ae6cac40 ("soc: qcom: icc-bwmon: Add bandwidth monitoring driver") +Signed-off-by: Sibi Sankar +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240613164506.982068-1-quic_sibis@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/icc-bwmon.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/icc-bwmon.c b/drivers/soc/qcom/icc-bwmon.c +index fb323b3364db4..ecddb60bd6650 100644 +--- a/drivers/soc/qcom/icc-bwmon.c ++++ b/drivers/soc/qcom/icc-bwmon.c +@@ -565,7 +565,7 @@ static void bwmon_start(struct icc_bwmon *bwmon) + int window; + + /* No need to check for errors, as this must have succeeded before. */ +- dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_low, 0); ++ dev_pm_opp_put(dev_pm_opp_find_bw_ceil(bwmon->dev, &bw_low, 0)); + + bwmon_clear_counters(bwmon, true); + +@@ -772,11 +772,13 @@ static int bwmon_probe(struct platform_device *pdev) + opp = dev_pm_opp_find_bw_floor(dev, &bwmon->max_bw_kbps, 0); + if (IS_ERR(opp)) + return dev_err_probe(dev, PTR_ERR(opp), "failed to find max peak bandwidth\n"); ++ dev_pm_opp_put(opp); + + bwmon->min_bw_kbps = 0; + opp = dev_pm_opp_find_bw_ceil(dev, &bwmon->min_bw_kbps, 0); + if (IS_ERR(opp)) + return dev_err_probe(dev, PTR_ERR(opp), "failed to find min peak bandwidth\n"); ++ dev_pm_opp_put(opp); + + bwmon->dev = dev; + +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-pdr-fix-parsing-of-domains-lists.patch b/queue-6.10/soc-qcom-pdr-fix-parsing-of-domains-lists.patch new file mode 100644 index 00000000000..255a6377651 --- /dev/null +++ b/queue-6.10/soc-qcom-pdr-fix-parsing-of-domains-lists.patch @@ -0,0 +1,43 @@ +From 577fec849df273735092bbe9e1e647d4884b4a1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 01:03:41 +0300 +Subject: soc: qcom: pdr: fix parsing of domains lists + +From: Dmitry Baryshkov + +[ Upstream commit 57f20d51f35780f240ecf39d81cda23612800a92 ] + +While parsing the domains list, start offsets from 0 rather than from +domains_read. The domains_read is equal to the total count of the +domains we have seen, while the domains list in the message starts from +offset 0. + +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Tested-by: Steev Klimaszewski +Tested-by: Alexey Minnekhanov +Reviewed-by: Chris Lew +Tested-by: Neil Armstrong # on SM8550-QRD +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240622-qcom-pd-mapper-v9-2-a84ee3591c8e@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_interface.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c +index 76a62c2ecc58a..216166e98fae4 100644 +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -417,7 +417,7 @@ static int pdr_locate_service(struct pdr_handle *pdr, struct pdr_service *pds) + if (ret < 0) + goto out; + +- for (i = domains_read; i < resp->domain_list_len; i++) { ++ for (i = 0; i < resp->domain_list_len; i++) { + entry = &resp->domain_list[i]; + + if (strnlen(entry->name, sizeof(entry->name)) == sizeof(entry->name)) +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch b/queue-6.10/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch new file mode 100644 index 00000000000..cea8201342c --- /dev/null +++ b/queue-6.10/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch @@ -0,0 +1,73 @@ +From a07b6061c4826d7f40ec804deef392f87f340da7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jun 2024 01:03:40 +0300 +Subject: soc: qcom: pdr: protect locator_addr with the main mutex + +From: Dmitry Baryshkov + +[ Upstream commit 107924c14e3ddd85119ca43c26a4ee1056fa9b84 ] + +If the service locator server is restarted fast enough, the PDR can +rewrite locator_addr fields concurrently. Protect them by placing +modification of those fields under the main pdr->lock. + +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Tested-by: Neil Armstrong # on SM8550-QRD +Tested-by: Steev Klimaszewski +Tested-by: Alexey Minnekhanov +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240622-qcom-pd-mapper-v9-1-a84ee3591c8e@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_interface.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c +index a1b6a4081dea7..76a62c2ecc58a 100644 +--- a/drivers/soc/qcom/pdr_interface.c ++++ b/drivers/soc/qcom/pdr_interface.c +@@ -76,12 +76,12 @@ static int pdr_locator_new_server(struct qmi_handle *qmi, + locator_hdl); + struct pdr_service *pds; + ++ mutex_lock(&pdr->lock); + /* Create a local client port for QMI communication */ + pdr->locator_addr.sq_family = AF_QIPCRTR; + pdr->locator_addr.sq_node = svc->node; + pdr->locator_addr.sq_port = svc->port; + +- mutex_lock(&pdr->lock); + pdr->locator_init_complete = true; + mutex_unlock(&pdr->lock); + +@@ -104,10 +104,10 @@ static void pdr_locator_del_server(struct qmi_handle *qmi, + + mutex_lock(&pdr->lock); + pdr->locator_init_complete = false; +- mutex_unlock(&pdr->lock); + + pdr->locator_addr.sq_node = 0; + pdr->locator_addr.sq_port = 0; ++ mutex_unlock(&pdr->lock); + } + + static const struct qmi_ops pdr_locator_ops = { +@@ -365,12 +365,14 @@ static int pdr_get_domain_list(struct servreg_get_domain_list_req *req, + if (ret < 0) + return ret; + ++ mutex_lock(&pdr->lock); + ret = qmi_send_request(&pdr->locator_hdl, + &pdr->locator_addr, + &txn, SERVREG_GET_DOMAIN_LIST_REQ, + SERVREG_GET_DOMAIN_LIST_REQ_MAX_LEN, + servreg_get_domain_list_req_ei, + req); ++ mutex_unlock(&pdr->lock); + if (ret < 0) { + qmi_txn_cancel(&txn); + return ret; +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-pmic_glink-handle-the-return-value-of-pmic_.patch b/queue-6.10/soc-qcom-pmic_glink-handle-the-return-value-of-pmic_.patch new file mode 100644 index 00000000000..494a782d3cc --- /dev/null +++ b/queue-6.10/soc-qcom-pmic_glink-handle-the-return-value-of-pmic_.patch @@ -0,0 +1,50 @@ +From 448fd83b2e4f10b83f6f52a8ea2470d96bc31929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 16:31:56 +0800 +Subject: soc: qcom: pmic_glink: Handle the return value of pmic_glink_init + +From: Chen Ni + +[ Upstream commit 0780c836673b25f5aad306630afcb1172d694cb4 ] + +As platform_driver_register() and register_rpmsg_driver() can return +error numbers, it should be better to check the return value and deal +with the exception. + +Signed-off-by: Chen Ni +Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20240510083156.1996783-1-nichen@iscas.ac.cn +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pmic_glink.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/qcom/pmic_glink.c b/drivers/soc/qcom/pmic_glink.c +index 65279243072c3..9ebc0ba359477 100644 +--- a/drivers/soc/qcom/pmic_glink.c ++++ b/drivers/soc/qcom/pmic_glink.c +@@ -373,8 +373,17 @@ static struct platform_driver pmic_glink_driver = { + + static int pmic_glink_init(void) + { +- platform_driver_register(&pmic_glink_driver); +- register_rpmsg_driver(&pmic_glink_rpmsg_driver); ++ int ret; ++ ++ ret = platform_driver_register(&pmic_glink_driver); ++ if (ret < 0) ++ return ret; ++ ++ ret = register_rpmsg_driver(&pmic_glink_rpmsg_driver); ++ if (ret < 0) { ++ platform_driver_unregister(&pmic_glink_driver); ++ return ret; ++ } + + return 0; + } +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch b/queue-6.10/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch new file mode 100644 index 00000000000..9e40010b154 --- /dev/null +++ b/queue-6.10/soc-qcom-rpmh-rsc-ensure-irqs-aren-t-disabled-by-rpm.patch @@ -0,0 +1,84 @@ +From 54b336300073780290b6972e52371deef040da49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 11:41:28 -0700 +Subject: soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by + rpmh_rsc_send_data() callers + +From: Stephen Boyd + +[ Upstream commit e43111f52b9ec5c2d700f89a1d61c8d10dc2d9e9 ] + +Dan pointed out that Smatch is concerned about this code because it uses +spin_lock_irqsave() and then calls wait_event_lock_irq() which enables +irqs before going to sleep. The comment above the function says it +should be called with interrupts enabled, but we simply hope that's true +without really confirming that. Let's add a might_sleep() here to +confirm that interrupts and preemption aren't disabled. Once we do that, +we can change the lock to be non-saving, spin_lock_irq(), to clarify +that we don't expect irqs to be disabled. If irqs are disabled by +callers they're going to be enabled anyway in the wait_event_lock_irq() +call which would be bad. + +This should make Smatch happier and find bad callers faster with the +might_sleep(). We can drop the WARN_ON() in the caller because we have +the might_sleep() now, simplifying the code. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/911181ed-c430-4592-ad26-4dc948834e08@moroto.mountain +Fixes: 2bc20f3c8487 ("soc: qcom: rpmh-rsc: Sleep waiting for tcs slots to be free") +Cc: Douglas Anderson +Signed-off-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20240509184129.3924422-1-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 7 ++++--- + drivers/soc/qcom/rpmh.c | 1 - + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index 561d8037b50a0..de86009ecd913 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -646,13 +646,14 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) + { + struct tcs_group *tcs; + int tcs_id; +- unsigned long flags; ++ ++ might_sleep(); + + tcs = get_tcs_for_msg(drv, msg); + if (IS_ERR(tcs)) + return PTR_ERR(tcs); + +- spin_lock_irqsave(&drv->lock, flags); ++ spin_lock_irq(&drv->lock); + + /* Wait forever for a free tcs. It better be there eventually! */ + wait_event_lock_irq(drv->tcs_wait, +@@ -670,7 +671,7 @@ int rpmh_rsc_send_data(struct rsc_drv *drv, const struct tcs_request *msg) + write_tcs_reg_sync(drv, drv->regs[RSC_DRV_CMD_ENABLE], tcs_id, 0); + enable_tcs_irq(drv, tcs_id, true); + } +- spin_unlock_irqrestore(&drv->lock, flags); ++ spin_unlock_irq(&drv->lock); + + /* + * These two can be done after the lock is released because: +diff --git a/drivers/soc/qcom/rpmh.c b/drivers/soc/qcom/rpmh.c +index 9f26d7f9b9dc4..8903ed956312d 100644 +--- a/drivers/soc/qcom/rpmh.c ++++ b/drivers/soc/qcom/rpmh.c +@@ -183,7 +183,6 @@ static int __rpmh_write(const struct device *dev, enum rpmh_state state, + } + + if (state == RPMH_ACTIVE_ONLY_STATE) { +- WARN_ON(irqs_disabled()); + ret = rpmh_rsc_send_data(ctrlr_to_drv(ctrlr), &rpm_msg->msg); + } else { + /* Clean up our call by spoofing tx_done */ +-- +2.43.0 + diff --git a/queue-6.10/soc-qcom-socinfo-update-x1e-pmics.patch b/queue-6.10/soc-qcom-socinfo-update-x1e-pmics.patch new file mode 100644 index 00000000000..32f8ddd4170 --- /dev/null +++ b/queue-6.10/soc-qcom-socinfo-update-x1e-pmics.patch @@ -0,0 +1,38 @@ +From feac87a96973a6ae259faef9e4c02251695f7b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2024 13:33:43 +0200 +Subject: soc: qcom: socinfo: Update X1E PMICs + +From: Konrad Dybcio + +[ Upstream commit 85f5656a4f3f188cb950cf8dc88f3f0e4e656bae ] + +Assign the correct name to ID 82 and fix the ID of SMB2360. + +Fixes: e025171d1ab1 ("soc: qcom: socinfo: Add SMB2360 PMIC") +Signed-off-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20240522-topic-x1e_pmics_socinfo-v1-1-da8a097e5134@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/socinfo.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c +index 277c07a6603d4..41342c37916ae 100644 +--- a/drivers/soc/qcom/socinfo.c ++++ b/drivers/soc/qcom/socinfo.c +@@ -133,7 +133,8 @@ static const char *const pmic_models[] = { + [72] = "PMR735D", + [73] = "PM8550", + [74] = "PMK8550", +- [82] = "SMB2360", ++ [82] = "PMC8380", ++ [83] = "SMB2360", + }; + + struct socinfo_params { +-- +2.43.0 + diff --git a/queue-6.10/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch b/queue-6.10/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch new file mode 100644 index 00000000000..0207f2c55a5 --- /dev/null +++ b/queue-6.10/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch @@ -0,0 +1,105 @@ +From 83fdf02056840d2bb8c820d5a4ab18954bbec0c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 04:06:10 -0700 +Subject: soc: xilinx: rename cpu_number1 to dummy_cpu_number + +From: Jay Buddhabhatti + +[ Upstream commit 4a95449dd975e2ea6629a034f3e74b46c9634916 ] + +The per cpu variable cpu_number1 is passed to xlnx_event_handler as +argument "dev_id", but it is not used in this function. So drop the +initialization of this variable and rename it to dummy_cpu_number. +This patch is to fix the following call trace when the kernel option +CONFIG_DEBUG_ATOMIC_SLEEP is enabled: + +BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 + preempt_count: 1, expected: 0 + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53 + Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT) + Call trace: + dump_backtrace+0xd0/0xe0 + show_stack+0x18/0x40 + dump_stack_lvl+0x7c/0xa0 + dump_stack+0x18/0x34 + __might_resched+0x10c/0x140 + __might_sleep+0x4c/0xa0 + __kmem_cache_alloc_node+0xf4/0x168 + kmalloc_trace+0x28/0x38 + __request_percpu_irq+0x74/0x138 + xlnx_event_manager_probe+0xf8/0x298 + platform_probe+0x68/0xd8 + +Fixes: daed80ed0758 ("soc: xilinx: Fix for call trace due to the usage of smp_processor_id()") +Signed-off-by: Jay Buddhabhatti +Link: https://lore.kernel.org/r/20240408110610.15676-1-jay.buddhabhatti@amd.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + drivers/soc/xilinx/xlnx_event_manager.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c +index 253299e4214d0..366018f6a0ee0 100644 +--- a/drivers/soc/xilinx/xlnx_event_manager.c ++++ b/drivers/soc/xilinx/xlnx_event_manager.c +@@ -3,6 +3,7 @@ + * Xilinx Event Management Driver + * + * Copyright (C) 2021 Xilinx, Inc. ++ * Copyright (C) 2024 Advanced Micro Devices, Inc. + * + * Abhyuday Godhasara + */ +@@ -19,7 +20,7 @@ + #include + #include + +-static DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number1); ++static DEFINE_PER_CPU_READ_MOSTLY(int, dummy_cpu_number); + + static int virq_sgi; + static int event_manager_availability = -EACCES; +@@ -570,7 +571,6 @@ static void xlnx_disable_percpu_irq(void *data) + static int xlnx_event_init_sgi(struct platform_device *pdev) + { + int ret = 0; +- int cpu; + /* + * IRQ related structures are used for the following: + * for each SGI interrupt ensure its mapped by GIC IRQ domain +@@ -607,11 +607,8 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) + sgi_fwspec.param[0] = sgi_num; + virq_sgi = irq_create_fwspec_mapping(&sgi_fwspec); + +- cpu = get_cpu(); +- per_cpu(cpu_number1, cpu) = cpu; + ret = request_percpu_irq(virq_sgi, xlnx_event_handler, "xlnx_event_mgmt", +- &cpu_number1); +- put_cpu(); ++ &dummy_cpu_number); + + WARN_ON(ret); + if (ret) { +@@ -627,16 +624,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev) + + static void xlnx_event_cleanup_sgi(struct platform_device *pdev) + { +- int cpu = smp_processor_id(); +- +- per_cpu(cpu_number1, cpu) = cpu; +- + cpuhp_remove_state(CPUHP_AP_ONLINE_DYN); + + on_each_cpu(xlnx_disable_percpu_irq, NULL, 1); + + irq_clear_status_flags(virq_sgi, IRQ_PER_CPU); +- free_percpu_irq(virq_sgi, &cpu_number1); ++ free_percpu_irq(virq_sgi, &dummy_cpu_number); + irq_dispose_mapping(virq_sgi); + } + +-- +2.43.0 + diff --git a/queue-6.10/sparc64-fix-incorrect-function-signature-and-add-pro.patch b/queue-6.10/sparc64-fix-incorrect-function-signature-and-add-pro.patch new file mode 100644 index 00000000000..14f8d9f2f09 --- /dev/null +++ b/queue-6.10/sparc64-fix-incorrect-function-signature-and-add-pro.patch @@ -0,0 +1,75 @@ +From d9a2d35f83296700849fcadaa0f8ce2a7af526ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jul 2024 11:41:53 +0200 +Subject: sparc64: Fix incorrect function signature and add prototype for + prom_cif_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Larsson + +[ Upstream commit a6c3ea1ec96307dbfbb2f16d96c674c5cc80f445 ] + +Remove the unused cif_stack argument and add a protype in oplib_64.h +Commit ef3e035c3a9b ("sparc64: Fix register corruption in top-most +kernel stack frame during boot.") removed the cif_stack argument to +prom_cif init in the declaration at the caller site and the usage of it +within prom_cif_init, but not in the function signature of the function +itself. + +This also fixes the following warning: +arch/sparc/prom/p1275.c:52:6: warning: no previous prototype for ‘prom_cif_init’ + +Fixes: ef3e035c3a9b ("sparc64: Fix register corruption in top-most kernel stack frame during boot.") +Link: https://lore.kernel.org/r/20240710094155.458731-3-andreas@gaisler.com +Signed-off-by: Andreas Larsson +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/oplib_64.h | 1 + + arch/sparc/prom/init_64.c | 3 --- + arch/sparc/prom/p1275.c | 2 +- + 3 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h +index a67abebd43592..1b86d02a84556 100644 +--- a/arch/sparc/include/asm/oplib_64.h ++++ b/arch/sparc/include/asm/oplib_64.h +@@ -247,6 +247,7 @@ void prom_sun4v_guest_soft_state(void); + int prom_ihandle2path(int handle, char *buffer, int bufsize); + + /* Client interface level routines. */ ++void prom_cif_init(void *cif_handler); + void p1275_cmd_direct(unsigned long *); + + #endif /* !(__SPARC64_OPLIB_H) */ +diff --git a/arch/sparc/prom/init_64.c b/arch/sparc/prom/init_64.c +index 103aa91043185..f7b8a1a865b8f 100644 +--- a/arch/sparc/prom/init_64.c ++++ b/arch/sparc/prom/init_64.c +@@ -26,9 +26,6 @@ phandle prom_chosen_node; + * routines in the prom library. + * It gets passed the pointer to the PROM vector. + */ +- +-extern void prom_cif_init(void *); +- + void __init prom_init(void *cif_handler) + { + phandle node; +diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c +index 889aa602f8d86..51c3f984bbf72 100644 +--- a/arch/sparc/prom/p1275.c ++++ b/arch/sparc/prom/p1275.c +@@ -49,7 +49,7 @@ void p1275_cmd_direct(unsigned long *args) + local_irq_restore(flags); + } + +-void prom_cif_init(void *cif_handler, void *cif_stack) ++void prom_cif_init(void *cif_handler) + { + p1275buf.prom_cif_handler = (void (*)(long *))cif_handler; + } +-- +2.43.0 + diff --git a/queue-6.10/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch b/queue-6.10/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch new file mode 100644 index 00000000000..52c32e727c6 --- /dev/null +++ b/queue-6.10/spi-atmel-quadspi-add-missing-check-for-clk_prepare.patch @@ -0,0 +1,46 @@ +From e57deb6194d6ed55fe03003f9657fa12870f9ba7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 16:40:28 +0800 +Subject: spi: atmel-quadspi: Add missing check for clk_prepare + +From: Chen Ni + +[ Upstream commit ef901b38d3a4610c4067cd306c1a209f32e7ca31 ] + +Add check for the return value of clk_prepare() and return the error if +it fails in order to catch the error. + +Fixes: 4a2f83b7f780 ("spi: atmel-quadspi: add runtime pm support") +Signed-off-by: Chen Ni +Link: https://msgid.link/r/20240515084028.3210406-1-nichen@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/atmel-quadspi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/atmel-quadspi.c b/drivers/spi/atmel-quadspi.c +index 370c4d1572ed0..5aaff3bee1b78 100644 +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -756,8 +756,15 @@ static int __maybe_unused atmel_qspi_resume(struct device *dev) + struct atmel_qspi *aq = spi_controller_get_devdata(ctrl); + int ret; + +- clk_prepare(aq->pclk); +- clk_prepare(aq->qspick); ++ ret = clk_prepare(aq->pclk); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare(aq->qspick); ++ if (ret) { ++ clk_unprepare(aq->pclk); ++ return ret; ++ } + + ret = pm_runtime_force_resume(dev); + if (ret < 0) +-- +2.43.0 + diff --git a/queue-6.10/spi-spi-microchip-core-fix-the-number-of-chip-select.patch b/queue-6.10/spi-spi-microchip-core-fix-the-number-of-chip-select.patch new file mode 100644 index 00000000000..b9818e59c29 --- /dev/null +++ b/queue-6.10/spi-spi-microchip-core-fix-the-number-of-chip-select.patch @@ -0,0 +1,42 @@ +From cf00ffb93e25979aa6df97895de5fbbc1f35040d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 11:45:07 +0100 +Subject: spi: spi-microchip-core: Fix the number of chip selects supported + +From: Prajna Rajendra Kumar + +[ Upstream commit a7ed3a11202d90939a3d00ffcc8cf50703cb7b35 ] + +The SPI "hard" controller in PolarFire SoC has eight CS lines, but only +one CS line is wired. When the 'num-cs' property is not specified in +the device tree, the driver defaults to the MAX_CS value, which has +been fixed to 1 to match the hardware configuration; however, when the +'num-cs' property is explicitly defined in the device tree, it +overrides the default value. + +Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers") +Signed-off-by: Prajna Rajendra Kumar +Reviewed-by: Conor Dooley +Link: https://msgid.link/r/20240514104508.938448-3-prajna.rajendrakumar@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-microchip-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-microchip-core.c b/drivers/spi/spi-microchip-core.c +index 634364c7cfe61..c10de45aa4729 100644 +--- a/drivers/spi/spi-microchip-core.c ++++ b/drivers/spi/spi-microchip-core.c +@@ -21,7 +21,7 @@ + #include + + #define MAX_LEN (0xffff) +-#define MAX_CS (8) ++#define MAX_CS (1) + #define DEFAULT_FRAMESIZE (8) + #define FIFO_DEPTH (32) + #define CLK_GEN_MODE1_MAX (255) +-- +2.43.0 + diff --git a/queue-6.10/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch b/queue-6.10/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch new file mode 100644 index 00000000000..e252fd7ce9d --- /dev/null +++ b/queue-6.10/sunrpc-avoid-soft-lockup-when-transmitting-udp-to-re.patch @@ -0,0 +1,57 @@ +From e8bf1cb2a077f6960575924c8f5fed64e5800939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2024 11:05:13 +1000 +Subject: SUNRPC: avoid soft lockup when transmitting UDP to reachable server. + +From: NeilBrown + +[ Upstream commit 6258cf25d5e3155c3219ab5a79b970eef7996356 ] + +Prior to the commit identified below, call_transmit_status() would +handle -EPERM and other errors related to an unreachable server by +falling through to call_status() which added a 3-second delay and +handled the failure as a timeout. + +Since that commit, call_transmit_status() falls through to +handle_bind(). For UDP this moves straight on to handle_connect() and +handle_transmit() so we immediately retransmit - and likely get the same +error. + +This results in an indefinite loop in __rpc_execute() which triggers a +soft-lockup warning. + +For the errors that indicate an unreachable server, +call_transmit_status() should fall back to call_status() as it did +before. This cannot cause the thundering herd that the previous patch +was avoiding, as the call_status() will insert a delay. + +Fixes: ed7dc973bd91 ("SUNRPC: Prevent thundering herd when the socket is not connected") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index cfd1b1bf7e351..09f29a95f2bc3 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2326,12 +2326,13 @@ call_transmit_status(struct rpc_task *task) + task->tk_action = call_transmit; + task->tk_status = 0; + break; +- case -ECONNREFUSED: + case -EHOSTDOWN: + case -ENETDOWN: + case -EHOSTUNREACH: + case -ENETUNREACH: + case -EPERM: ++ break; ++ case -ECONNREFUSED: + if (RPC_IS_SOFTCONN(task)) { + if (!task->tk_msg.rpc_proc->p_proc) + trace_xprt_ping(task->tk_xprt, +-- +2.43.0 + diff --git a/queue-6.10/sunrpc-fixup-gss_status-tracepoint-error-output.patch b/queue-6.10/sunrpc-fixup-gss_status-tracepoint-error-output.patch new file mode 100644 index 00000000000..e3c6bae016f --- /dev/null +++ b/queue-6.10/sunrpc-fixup-gss_status-tracepoint-error-output.patch @@ -0,0 +1,36 @@ +From 667df0e50f1ffa48e0963893ac7421997762ef6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2024 13:21:00 -0400 +Subject: SUNRPC: Fixup gss_status tracepoint error output + +From: Benjamin Coddington + +[ Upstream commit b9fae9f06d84ffab0f3f9118f3a96bbcdc528bf6 ] + +The GSS routine errors are values, not flags. + +Fixes: 0c77668ddb4e ("SUNRPC: Introduce trace points in rpc_auth_gss.ko") +Signed-off-by: Benjamin Coddington +Reviewed-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/trace/events/rpcgss.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/trace/events/rpcgss.h b/include/trace/events/rpcgss.h +index 7f0c1ceae726b..b0b6300a0cabd 100644 +--- a/include/trace/events/rpcgss.h ++++ b/include/trace/events/rpcgss.h +@@ -54,7 +54,7 @@ TRACE_DEFINE_ENUM(GSS_S_UNSEQ_TOKEN); + TRACE_DEFINE_ENUM(GSS_S_GAP_TOKEN); + + #define show_gss_status(x) \ +- __print_flags(x, "|", \ ++ __print_symbolic(x, \ + { GSS_S_BAD_MECH, "GSS_S_BAD_MECH" }, \ + { GSS_S_BAD_NAME, "GSS_S_BAD_NAME" }, \ + { GSS_S_BAD_NAMETYPE, "GSS_S_BAD_NAMETYPE" }, \ +-- +2.43.0 + diff --git a/queue-6.10/tcp-add-tcp_done_with_error-helper.patch b/queue-6.10/tcp-add-tcp_done_with_error-helper.patch new file mode 100644 index 00000000000..b41c4e6b81d --- /dev/null +++ b/queue-6.10/tcp-add-tcp_done_with_error-helper.patch @@ -0,0 +1,115 @@ +From a7b58a1a0304051e77cf04f97e1944b137ac13c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:50 +0000 +Subject: tcp: add tcp_done_with_error() helper + +From: Eric Dumazet + +[ Upstream commit 5e514f1cba090e1c8fff03e92a175eccfe46305f ] + +tcp_reset() ends with a sequence that is carefuly ordered. + +We need to fix [e]poll bugs in the following patches, +it makes sense to use a common helper. + +Suggested-by: Neal Cardwell +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-2-edumazet@google.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 853c3bd7b791 ("tcp: fix race in tcp_write_err()") +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 + + net/ipv4/tcp.c | 2 +- + net/ipv4/tcp_input.c | 32 +++++++++++++++++++++----------- + 3 files changed, 23 insertions(+), 12 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 060e95b331a28..32815a40dea16 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -677,6 +677,7 @@ void tcp_skb_collapse_tstamp(struct sk_buff *skb, + /* tcp_input.c */ + void tcp_rearm_rto(struct sock *sk); + void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req); ++void tcp_done_with_error(struct sock *sk, int err); + void tcp_reset(struct sock *sk, struct sk_buff *skb); + void tcp_fin(struct sock *sk); + void tcp_check_space(struct sock *sk); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index e6790ea748773..cc36ff797484b 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -598,7 +598,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) + */ + mask |= EPOLLOUT | EPOLLWRNORM; + } +- /* This barrier is coupled with smp_wmb() in tcp_reset() */ ++ /* This barrier is coupled with smp_wmb() in tcp_done_with_error() */ + smp_rmb(); + if (READ_ONCE(sk->sk_err) || + !skb_queue_empty_lockless(&sk->sk_error_queue)) +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 38da23f991d60..570e87ad9a56e 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4469,9 +4469,26 @@ static enum skb_drop_reason tcp_sequence(const struct tcp_sock *tp, + return SKB_NOT_DROPPED_YET; + } + ++ ++void tcp_done_with_error(struct sock *sk, int err) ++{ ++ /* This barrier is coupled with smp_rmb() in tcp_poll() */ ++ WRITE_ONCE(sk->sk_err, err); ++ smp_wmb(); ++ ++ tcp_write_queue_purge(sk); ++ tcp_done(sk); ++ ++ if (!sock_flag(sk, SOCK_DEAD)) ++ sk_error_report(sk); ++} ++EXPORT_SYMBOL(tcp_done_with_error); ++ + /* When we get a reset we do this. */ + void tcp_reset(struct sock *sk, struct sk_buff *skb) + { ++ int err; ++ + trace_tcp_receive_reset(sk); + + /* mptcp can't tell us to ignore reset pkts, +@@ -4483,24 +4500,17 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb) + /* We want the right error as BSD sees it (and indeed as we do). */ + switch (sk->sk_state) { + case TCP_SYN_SENT: +- WRITE_ONCE(sk->sk_err, ECONNREFUSED); ++ err = ECONNREFUSED; + break; + case TCP_CLOSE_WAIT: +- WRITE_ONCE(sk->sk_err, EPIPE); ++ err = EPIPE; + break; + case TCP_CLOSE: + return; + default: +- WRITE_ONCE(sk->sk_err, ECONNRESET); ++ err = ECONNRESET; + } +- /* This barrier is coupled with smp_rmb() in tcp_poll() */ +- smp_wmb(); +- +- tcp_write_queue_purge(sk); +- tcp_done(sk); +- +- if (!sock_flag(sk, SOCK_DEAD)) +- sk_error_report(sk); ++ tcp_done_with_error(sk, err); + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/tcp-don-t-access-uninit-tcp_rsk-req-ao_keyid-in-tcp_.patch b/queue-6.10/tcp-don-t-access-uninit-tcp_rsk-req-ao_keyid-in-tcp_.patch new file mode 100644 index 00000000000..5de31768e6c --- /dev/null +++ b/queue-6.10/tcp-don-t-access-uninit-tcp_rsk-req-ao_keyid-in-tcp_.patch @@ -0,0 +1,202 @@ +From 1b73d118219c33b343c7e03647a51c9bc34b3f96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jul 2024 09:17:19 -0700 +Subject: tcp: Don't access uninit tcp_rsk(req)->ao_keyid in + tcp_create_openreq_child(). + +From: Kuniyuki Iwashima + +[ Upstream commit 3f45181358e4df50a40ea1bb51b00a1f295f915e ] + +syzkaller reported KMSAN splat in tcp_create_openreq_child(). [0] + +The uninit variable is tcp_rsk(req)->ao_keyid. + +tcp_rsk(req)->ao_keyid is initialised only when tcp_conn_request() finds +a valid TCP AO option in SYN. Then, tcp_rsk(req)->used_tcp_ao is set +accordingly. + +Let's not read tcp_rsk(req)->ao_keyid when tcp_rsk(req)->used_tcp_ao is +false. + +[0]: +BUG: KMSAN: uninit-value in tcp_create_openreq_child+0x198b/0x1ff0 net/ipv4/tcp_minisocks.c:610 + tcp_create_openreq_child+0x198b/0x1ff0 net/ipv4/tcp_minisocks.c:610 + tcp_v4_syn_recv_sock+0x18e/0x2170 net/ipv4/tcp_ipv4.c:1754 + tcp_check_req+0x1a3e/0x20c0 net/ipv4/tcp_minisocks.c:852 + tcp_v4_rcv+0x26a4/0x53a0 net/ipv4/tcp_ipv4.c:2265 + ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 + NF_HOOK include/linux/netfilter.h:314 [inline] + ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 + dst_input include/net/dst.h:460 [inline] + ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] + ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] + ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 + ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 + __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] + __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 + __netif_receive_skb_list net/core/dev.c:5803 [inline] + netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 + gro_normal_list include/net/gro.h:515 [inline] + napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 + e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 + __napi_poll+0xd9/0x990 net/core/dev.c:6771 + napi_poll net/core/dev.c:6840 [inline] + net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 + handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 + __do_softirq kernel/softirq.c:588 [inline] + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu kernel/softirq.c:637 [inline] + irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 + common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 + asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 + __msan_instrument_asm_store+0xd6/0xe0 + arch_atomic_inc arch/x86/include/asm/atomic.h:53 [inline] + raw_atomic_inc include/linux/atomic/atomic-arch-fallback.h:992 [inline] + atomic_inc include/linux/atomic/atomic-instrumented.h:436 [inline] + page_ref_inc include/linux/page_ref.h:153 [inline] + folio_ref_inc include/linux/page_ref.h:160 [inline] + filemap_map_order0_folio mm/filemap.c:3596 [inline] + filemap_map_pages+0x11c7/0x2270 mm/filemap.c:3644 + do_fault_around mm/memory.c:4879 [inline] + do_read_fault mm/memory.c:4912 [inline] + do_fault mm/memory.c:5051 [inline] + do_pte_missing mm/memory.c:3897 [inline] + handle_pte_fault mm/memory.c:5381 [inline] + __handle_mm_fault mm/memory.c:5524 [inline] + handle_mm_fault+0x3677/0x6f00 mm/memory.c:5689 + do_user_addr_fault+0x1373/0x2b20 arch/x86/mm/fault.c:1338 + handle_page_fault arch/x86/mm/fault.c:1481 [inline] + exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1539 + asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 + +Uninit was stored to memory at: + tcp_create_openreq_child+0x1984/0x1ff0 net/ipv4/tcp_minisocks.c:611 + tcp_v4_syn_recv_sock+0x18e/0x2170 net/ipv4/tcp_ipv4.c:1754 + tcp_check_req+0x1a3e/0x20c0 net/ipv4/tcp_minisocks.c:852 + tcp_v4_rcv+0x26a4/0x53a0 net/ipv4/tcp_ipv4.c:2265 + ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 + NF_HOOK include/linux/netfilter.h:314 [inline] + ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 + dst_input include/net/dst.h:460 [inline] + ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] + ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] + ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 + ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 + __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] + __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 + __netif_receive_skb_list net/core/dev.c:5803 [inline] + netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 + gro_normal_list include/net/gro.h:515 [inline] + napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 + e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 + __napi_poll+0xd9/0x990 net/core/dev.c:6771 + napi_poll net/core/dev.c:6840 [inline] + net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 + handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 + __do_softirq kernel/softirq.c:588 [inline] + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu kernel/softirq.c:637 [inline] + irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 + common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 + asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 + +Uninit was created at: + __alloc_pages_noprof+0x82d/0xcb0 mm/page_alloc.c:4706 + __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] + alloc_pages_node_noprof include/linux/gfp.h:296 [inline] + alloc_slab_page mm/slub.c:2265 [inline] + allocate_slab mm/slub.c:2428 [inline] + new_slab+0x2af/0x14e0 mm/slub.c:2481 + ___slab_alloc+0xf73/0x3150 mm/slub.c:3667 + __slab_alloc mm/slub.c:3757 [inline] + __slab_alloc_node mm/slub.c:3810 [inline] + slab_alloc_node mm/slub.c:3990 [inline] + kmem_cache_alloc_noprof+0x53a/0x9f0 mm/slub.c:4009 + reqsk_alloc_noprof net/ipv4/inet_connection_sock.c:920 [inline] + inet_reqsk_alloc+0x63/0x700 net/ipv4/inet_connection_sock.c:951 + tcp_conn_request+0x339/0x4860 net/ipv4/tcp_input.c:7177 + tcp_v4_conn_request+0x13b/0x190 net/ipv4/tcp_ipv4.c:1719 + tcp_rcv_state_process+0x2dd/0x4a10 net/ipv4/tcp_input.c:6711 + tcp_v4_do_rcv+0xbee/0x10d0 net/ipv4/tcp_ipv4.c:1932 + tcp_v4_rcv+0x3fad/0x53a0 net/ipv4/tcp_ipv4.c:2334 + ip_protocol_deliver_rcu+0x884/0x1270 net/ipv4/ip_input.c:205 + ip_local_deliver_finish+0x30f/0x530 net/ipv4/ip_input.c:233 + NF_HOOK include/linux/netfilter.h:314 [inline] + ip_local_deliver+0x230/0x4c0 net/ipv4/ip_input.c:254 + dst_input include/net/dst.h:460 [inline] + ip_sublist_rcv_finish net/ipv4/ip_input.c:580 [inline] + ip_list_rcv_finish net/ipv4/ip_input.c:631 [inline] + ip_sublist_rcv+0x10f7/0x13e0 net/ipv4/ip_input.c:639 + ip_list_rcv+0x952/0x9c0 net/ipv4/ip_input.c:674 + __netif_receive_skb_list_ptype net/core/dev.c:5703 [inline] + __netif_receive_skb_list_core+0xd92/0x11d0 net/core/dev.c:5751 + __netif_receive_skb_list net/core/dev.c:5803 [inline] + netif_receive_skb_list_internal+0xd8f/0x1350 net/core/dev.c:5895 + gro_normal_list include/net/gro.h:515 [inline] + napi_complete_done+0x3f2/0x990 net/core/dev.c:6246 + e1000_clean+0x1fa4/0x5e50 drivers/net/ethernet/intel/e1000/e1000_main.c:3808 + __napi_poll+0xd9/0x990 net/core/dev.c:6771 + napi_poll net/core/dev.c:6840 [inline] + net_rx_action+0x90f/0x17e0 net/core/dev.c:6962 + handle_softirqs+0x152/0x6b0 kernel/softirq.c:554 + __do_softirq kernel/softirq.c:588 [inline] + invoke_softirq kernel/softirq.c:428 [inline] + __irq_exit_rcu kernel/softirq.c:637 [inline] + irq_exit_rcu+0x5d/0x120 kernel/softirq.c:649 + common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:278 + asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 + +CPU: 0 PID: 239 Comm: modprobe Tainted: G B 6.10.0-rc7-01816-g852e42cc2dd4 #3 1107521f0c7b55c9309062382d0bda9f604dbb6d +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 + +Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") +Reported-by: syzkaller +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Acked-by: Dmitry Safonov <0x7f454c46@gmail.com> +Link: https://patch.msgid.link/20240714161719.6528-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_minisocks.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 538c06f95918d..0fbebf6266e91 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -515,9 +515,6 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + const struct tcp_sock *oldtp; + struct tcp_sock *newtp; + u32 seq; +-#ifdef CONFIG_TCP_AO +- struct tcp_ao_key *ao_key; +-#endif + + if (!newsk) + return NULL; +@@ -608,10 +605,14 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + #endif + #ifdef CONFIG_TCP_AO + newtp->ao_info = NULL; +- ao_key = treq->af_specific->ao_lookup(sk, req, +- tcp_rsk(req)->ao_keyid, -1); +- if (ao_key) +- newtp->tcp_header_len += tcp_ao_len_aligned(ao_key); ++ ++ if (tcp_rsk_used_ao(req)) { ++ struct tcp_ao_key *ao_key; ++ ++ ao_key = treq->af_specific->ao_lookup(sk, req, tcp_rsk(req)->ao_keyid, -1); ++ if (ao_key) ++ newtp->tcp_header_len += tcp_ao_len_aligned(ao_key); ++ } + #endif + if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len) + newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len; +-- +2.43.0 + diff --git a/queue-6.10/tcp-fix-race-in-tcp_write_err.patch b/queue-6.10/tcp-fix-race-in-tcp_write_err.patch new file mode 100644 index 00000000000..962c0de92d1 --- /dev/null +++ b/queue-6.10/tcp-fix-race-in-tcp_write_err.patch @@ -0,0 +1,64 @@ +From 0af04327bfbf395686087faf5a8e6f1d5b420118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:51 +0000 +Subject: tcp: fix race in tcp_write_err() + +From: Eric Dumazet + +[ Upstream commit 853c3bd7b7917670224c9fe5245bd045cac411dd ] + +I noticed flakes in a packetdrill test, expecting an epoll_wait() +to return EPOLLERR | EPOLLHUP on a failed connect() attempt, +after multiple SYN retransmits. It sometimes return EPOLLERR only. + +The issue is that tcp_write_err(): + 1) writes an error in sk->sk_err, + 2) calls sk_error_report(), + 3) then calls tcp_done(). + +tcp_done() is writing SHUTDOWN_MASK into sk->sk_shutdown, +among other things. + +Problem is that the awaken user thread (from 2) sk_error_report()) +might call tcp_poll() before tcp_done() has written sk->sk_shutdown. + +tcp_poll() only sees a non zero sk->sk_err and returns EPOLLERR. + +This patch fixes the issue by making sure to call sk_error_report() +after tcp_done(). + +tcp_write_err() also lacks an smp_wmb(). + +We can reuse tcp_done_with_error() to factor out the details, +as Neal suggested. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-3-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 892c86657fbc2..4d40615dc8fc2 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -74,11 +74,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) + + static void tcp_write_err(struct sock *sk) + { +- WRITE_ONCE(sk->sk_err, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT); +- sk_error_report(sk); +- +- tcp_write_queue_purge(sk); +- tcp_done(sk); ++ tcp_done_with_error(sk, READ_ONCE(sk->sk_err_soft) ? : ETIMEDOUT); + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT); + } + +-- +2.43.0 + diff --git a/queue-6.10/tcp-fix-races-in-tcp_abort.patch b/queue-6.10/tcp-fix-races-in-tcp_abort.patch new file mode 100644 index 00000000000..2a8e3c3126f --- /dev/null +++ b/queue-6.10/tcp-fix-races-in-tcp_abort.patch @@ -0,0 +1,50 @@ +From f2ca123ff4d1d455d3636d060cf543ddf2b6f35b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:52 +0000 +Subject: tcp: fix races in tcp_abort() + +From: Eric Dumazet + +[ Upstream commit 5ce4645c23cf5f048eb8e9ce49e514bababdee85 ] + +tcp_abort() has the same issue than the one fixed in the prior patch +in tcp_write_err(). + +In order to get consistent results from tcp_poll(), we must call +sk_error_report() after tcp_done(). + +We can use tcp_done_with_error() to centralize this logic. + +Fixes: c1e64e298b8c ("net: diag: Support destroying TCP sockets.") +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-4-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index cc36ff797484b..ec6911034138f 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -4583,14 +4583,10 @@ int tcp_abort(struct sock *sk, int err) + bh_lock_sock(sk); + + if (!sock_flag(sk, SOCK_DEAD)) { +- WRITE_ONCE(sk->sk_err, err); +- /* This barrier is coupled with smp_rmb() in tcp_poll() */ +- smp_wmb(); +- sk_error_report(sk); + if (tcp_need_reset(sk->sk_state)) + tcp_send_active_reset(sk, GFP_ATOMIC, + SK_RST_REASON_NOT_SPECIFIED); +- tcp_done(sk); ++ tcp_done_with_error(sk, err); + } + + bh_unlock_sock(sk); +-- +2.43.0 + diff --git a/queue-6.10/tcp-fix-races-in-tcp_v-46-_err.patch b/queue-6.10/tcp-fix-races-in-tcp_v-46-_err.patch new file mode 100644 index 00000000000..79a760cac54 --- /dev/null +++ b/queue-6.10/tcp-fix-races-in-tcp_v-46-_err.patch @@ -0,0 +1,83 @@ +From 004197ff705f47923932186d9b40129fe39125df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 12:52:53 +0000 +Subject: tcp: fix races in tcp_v[46]_err() + +From: Eric Dumazet + +[ Upstream commit fde6f897f2a184546bf5516ac736523ef24dc6a7 ] + +These functions have races when they: + +1) Write sk->sk_err +2) call sk_error_report(sk) +3) call tcp_done(sk) + +As described in prior patches in this series: + +An smp_wmb() is missing. +We should call tcp_done() before sk_error_report(sk) +to have consistent tcp_poll() results on SMP hosts. + +Use tcp_done_with_error() where we centralized the +correct sequence. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20240528125253.1966136-5-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_ipv4.c | 11 +++-------- + net/ipv6/tcp_ipv6.c | 10 +++------- + 2 files changed, 6 insertions(+), 15 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index b710958393e64..a541659b6562b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -611,15 +611,10 @@ int tcp_v4_err(struct sk_buff *skb, u32 info) + + ip_icmp_error(sk, skb, err, th->dest, info, (u8 *)th); + +- if (!sock_owned_by_user(sk)) { +- WRITE_ONCE(sk->sk_err, err); +- +- sk_error_report(sk); +- +- tcp_done(sk); +- } else { ++ if (!sock_owned_by_user(sk)) ++ tcp_done_with_error(sk, err); ++ else + WRITE_ONCE(sk->sk_err_soft, err); +- } + goto out; + } + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 729faf8bd366a..3385faf1d5dcb 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -490,14 +490,10 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + + ipv6_icmp_error(sk, skb, err, th->dest, ntohl(info), (u8 *)th); + +- if (!sock_owned_by_user(sk)) { +- WRITE_ONCE(sk->sk_err, err); +- sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */ +- +- tcp_done(sk); +- } else { ++ if (!sock_owned_by_user(sk)) ++ tcp_done_with_error(sk, err); ++ else + WRITE_ONCE(sk->sk_err_soft, err); +- } + goto out; + case TCP_LISTEN: + break; +-- +2.43.0 + diff --git a/queue-6.10/tools-perf-fix-the-string-match-for-tmp-perf-pid.map.patch b/queue-6.10/tools-perf-fix-the-string-match-for-tmp-perf-pid.map.patch new file mode 100644 index 00000000000..422c8010ac3 --- /dev/null +++ b/queue-6.10/tools-perf-fix-the-string-match-for-tmp-perf-pid.map.patch @@ -0,0 +1,146 @@ +From 4bee9b5489eca0c0c073f008024641d8100caa86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jun 2024 12:18:48 +0530 +Subject: tools/perf: Fix the string match for "/tmp/perf-$PID.map" files in + dso__load + +From: Athira Rajeev + +[ Upstream commit b0979f008f1352a44cd3c8877e3eb8a1e3e1c6f3 ] + +Perf test for perf probe of function from different CU fails +as below: + + ./perf test -vv "test perf probe of function from different CU" + 116: test perf probe of function from different CU: + --- start --- + test child forked, pid 2679 + Failed to find symbol foo in /tmp/perf-uprobe-different-cu-sh.Msa7iy89bx/testfile + Error: Failed to add events. + --- Cleaning up --- + "foo" does not hit any event. + Error: Failed to delete events. + ---- end(-1) ---- + 116: test perf probe of function from different CU : FAILED! + +The test does below to probe function "foo" : + + # gcc -g -Og -flto -c /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-foo.c + -o /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-foo.o + # gcc -g -Og -c /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-main.c + -o /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-main.o + # gcc -g -Og -o /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile + /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-foo.o + /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile-main.o + + # ./perf probe -x /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile foo + Failed to find symbol foo in /tmp/perf-uprobe-different-cu-sh.XniNxNEVT7/testfile + Error: Failed to add events. + +Perf probe fails to find symbol foo in the executable placed in +/tmp/perf-uprobe-different-cu-sh.XniNxNEVT7 + +Simple reproduce: + + # mktemp -d /tmp/perf-checkXXXXXXXXXX + /tmp/perf-checkcWpuLRQI8j + + # gcc -g -o test test.c + # cp test /tmp/perf-checkcWpuLRQI8j/ + # nm /tmp/perf-checkcWpuLRQI8j/test | grep foo + 00000000100006bc T foo + + # ./perf probe -x /tmp/perf-checkcWpuLRQI8j/test foo + Failed to find symbol foo in /tmp/perf-checkcWpuLRQI8j/test + Error: Failed to add events. + +But it works with any files like /tmp/perf/test. Only for +patterns with "/tmp/perf-", this fails. + +Further debugging, commit 80d496be89ed ("perf report: Add support +for profiling JIT generated code") added support for profiling JIT +generated code. This patch handles dso's of form +"/tmp/perf-$PID.map" . + +The check used "if (strncmp(self->name, "/tmp/perf-", 10) == 0)" +to match "/tmp/perf-$PID.map". With this commit, any dso in +/tmp/perf- folder will be considered separately for processing +(not only JIT created map files ). Fix this by changing the +string pattern to check for "/tmp/perf-%d.map". Add a helper +function is_perf_pid_map_name to do this check. In "struct dso", +dso->long_name holds the long name of the dso file. Since the +/tmp/perf-$PID.map check uses the complete name, use dso___long_name for +the string name. + +With the fix, + # ./perf test "test perf probe of function from different CU" + 117: test perf probe of function from different CU : Ok + +Fixes: 56cbeacf1435 ("perf probe: Add test for regression introduced by switch to die_get_decl_file()") +Signed-off-by: Athira Rajeev +Reviewed-by: Chaitanya S Prakash +Reviewed-by: Adrian Hunter +Cc: akanksha@linux.ibm.com +Cc: kjain@linux.ibm.com +Cc: maddy@linux.ibm.com +Cc: disgoel@linux.vnet.ibm.com +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Namhyung Kim +Link: https://lore.kernel.org/r/20240623064850.83720-1-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + tools/perf/util/dso.c | 12 ++++++++++++ + tools/perf/util/dso.h | 4 ++++ + tools/perf/util/symbol.c | 3 ++- + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index dde706b71da7b..2340c4f6d0c24 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -1652,3 +1652,15 @@ int dso__strerror_load(struct dso *dso, char *buf, size_t buflen) + scnprintf(buf, buflen, "%s", dso_load__error_str[idx]); + return 0; + } ++ ++bool perf_pid_map_tid(const char *dso_name, int *tid) ++{ ++ return sscanf(dso_name, "/tmp/perf-%d.map", tid) == 1; ++} ++ ++bool is_perf_pid_map_name(const char *dso_name) ++{ ++ int tid; ++ ++ return perf_pid_map_tid(dso_name, &tid); ++} +diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h +index df2c98402af3e..d72f3b8c37f6a 100644 +--- a/tools/perf/util/dso.h ++++ b/tools/perf/util/dso.h +@@ -809,4 +809,8 @@ void reset_fd_limit(void); + u64 dso__find_global_type(struct dso *dso, u64 addr); + u64 dso__findnew_global_type(struct dso *dso, u64 addr, u64 offset); + ++/* Check if dso name is of format "/tmp/perf-%d.map" */ ++bool perf_pid_map_tid(const char *dso_name, int *tid); ++bool is_perf_pid_map_name(const char *dso_name); ++ + #endif /* __PERF_DSO */ +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 9e5940b5bc591..aee0a4cfb3836 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -1799,7 +1799,8 @@ int dso__load(struct dso *dso, struct map *map) + const char *map_path = dso__long_name(dso); + + mutex_lock(dso__lock(dso)); +- perfmap = strncmp(dso__name(dso), "/tmp/perf-", 10) == 0; ++ perfmap = is_perf_pid_map_name(map_path); ++ + if (perfmap) { + if (dso__nsinfo(dso) && + (dso__find_perf_map(newmapname, sizeof(newmapname), +-- +2.43.0 + diff --git a/queue-6.10/ubd-refactor-the-interrupt-handler.patch b/queue-6.10/ubd-refactor-the-interrupt-handler.patch new file mode 100644 index 00000000000..fdb4be8ab08 --- /dev/null +++ b/queue-6.10/ubd-refactor-the-interrupt-handler.patch @@ -0,0 +1,93 @@ +From f4983914a37fa71fc8e32e6ee154897542aaac72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 09:47:56 +0200 +Subject: ubd: refactor the interrupt handler + +From: Christoph Hellwig + +[ Upstream commit 5db755fbb1a0de4a4cfd5d5edfaa19853b9c56e6 ] + +Instead of a separate handler function that leaves no work in the +interrupt hanler itself, split out a per-request end I/O helper and +clean up the coding style and variable naming while we're at it. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Acked-By: Anton Ivanov +Link: https://lore.kernel.org/r/20240531074837.1648501-2-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 31ade7d4fdcf ("ubd: untagle discard vs write zeroes not support handling") +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 49 ++++++++++++++------------------------ + 1 file changed, 18 insertions(+), 31 deletions(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index ef805eaa9e013..0c9542d58c01b 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -447,43 +447,30 @@ static int bulk_req_safe_read( + return n; + } + +-/* Called without dev->lock held, and only in interrupt context. */ +-static void ubd_handler(void) ++static void ubd_end_request(struct io_thread_req *io_req) + { +- int n; +- int count; +- +- while(1){ +- n = bulk_req_safe_read( +- thread_fd, +- irq_req_buffer, +- &irq_remainder, +- &irq_remainder_size, +- UBD_REQ_BUFFER_SIZE +- ); +- if (n < 0) { +- if(n == -EAGAIN) +- break; +- printk(KERN_ERR "spurious interrupt in ubd_handler, " +- "err = %d\n", -n); +- return; +- } +- for (count = 0; count < n/sizeof(struct io_thread_req *); count++) { +- struct io_thread_req *io_req = (*irq_req_buffer)[count]; +- +- if ((io_req->error == BLK_STS_NOTSUPP) && (req_op(io_req->req) == REQ_OP_DISCARD)) { +- blk_queue_max_discard_sectors(io_req->req->q, 0); +- blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); +- } +- blk_mq_end_request(io_req->req, io_req->error); +- kfree(io_req); +- } ++ if (io_req->error == BLK_STS_NOTSUPP && ++ req_op(io_req->req) == REQ_OP_DISCARD) { ++ blk_queue_max_discard_sectors(io_req->req->q, 0); ++ blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); + } ++ blk_mq_end_request(io_req->req, io_req->error); ++ kfree(io_req); + } + + static irqreturn_t ubd_intr(int irq, void *dev) + { +- ubd_handler(); ++ int len, i; ++ ++ while ((len = bulk_req_safe_read(thread_fd, irq_req_buffer, ++ &irq_remainder, &irq_remainder_size, ++ UBD_REQ_BUFFER_SIZE)) >= 0) { ++ for (i = 0; i < len / sizeof(struct io_thread_req *); i++) ++ ubd_end_request((*irq_req_buffer)[i]); ++ } ++ ++ if (len < 0 && len != -EAGAIN) ++ pr_err("spurious interrupt in %s, err = %d\n", __func__, len); + return IRQ_HANDLED; + } + +-- +2.43.0 + diff --git a/queue-6.10/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch b/queue-6.10/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch new file mode 100644 index 00000000000..22aac12e376 --- /dev/null +++ b/queue-6.10/ubd-untagle-discard-vs-write-zeroes-not-support-hand.patch @@ -0,0 +1,52 @@ +From 00e509a738b57c03b867e9a9d32a97311eb855d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 May 2024 09:47:57 +0200 +Subject: ubd: untagle discard vs write zeroes not support handling + +From: Christoph Hellwig + +[ Upstream commit 31ade7d4fdcf382beb8cb229a1f5d77e0f239672 ] + +Discard and Write Zeroes are different operation and implemented +by different fallocate opcodes for ubd. If one fails the other one +can work and vice versa. + +Split the code to disable the operations in ubd_handler to only +disable the operation that actually failed. + +Fixes: 50109b5a03b4 ("um: Add support for DISCARD in the UBD Driver") +Signed-off-by: Christoph Hellwig +Reviewed-by: Bart Van Assche +Reviewed-by: Damien Le Moal +Reviewed-by: Martin K. Petersen +Acked-By: Anton Ivanov +Link: https://lore.kernel.org/r/20240531074837.1648501-3-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index 0c9542d58c01b..093c87879d08b 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -449,10 +449,11 @@ static int bulk_req_safe_read( + + static void ubd_end_request(struct io_thread_req *io_req) + { +- if (io_req->error == BLK_STS_NOTSUPP && +- req_op(io_req->req) == REQ_OP_DISCARD) { +- blk_queue_max_discard_sectors(io_req->req->q, 0); +- blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); ++ if (io_req->error == BLK_STS_NOTSUPP) { ++ if (req_op(io_req->req) == REQ_OP_DISCARD) ++ blk_queue_max_discard_sectors(io_req->req->q, 0); ++ else if (req_op(io_req->req) == REQ_OP_WRITE_ZEROES) ++ blk_queue_max_write_zeroes_sectors(io_req->req->q, 0); + } + blk_mq_end_request(io_req->req, io_req->error); + kfree(io_req); +-- +2.43.0 + diff --git a/queue-6.10/udf-fix-bogus-checksum-computation-in-udf_rename.patch b/queue-6.10/udf-fix-bogus-checksum-computation-in-udf_rename.patch new file mode 100644 index 00000000000..335d6344d30 --- /dev/null +++ b/queue-6.10/udf-fix-bogus-checksum-computation-in-udf_rename.patch @@ -0,0 +1,45 @@ +From 61d5e666d782a6ddb932664aa6f778783cff4ae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 17:41:51 +0200 +Subject: udf: Fix bogus checksum computation in udf_rename() + +From: Jan Kara + +[ Upstream commit 27ab33854873e6fb958cb074681a0107cc2ecc4c ] + +Syzbot reports uninitialized memory access in udf_rename() when updating +checksum of '..' directory entry of a moved directory. This is indeed +true as we pass on-stack diriter.fi to the udf_update_tag() and because +that has only struct fileIdentDesc included in it and not the impUse or +name fields, the checksumming function is going to checksum random stack +contents beyond the end of the structure. This is actually harmless +because the following udf_fiiter_write_fi() will recompute the checksum +from on-disk buffers where everything is properly included. So all that +is needed is just removing the bogus calculation. + +Fixes: e9109a92d2a9 ("udf: Convert udf_rename() to new directory iteration code") +Link: https://lore.kernel.org/all/000000000000cf405f060d8f75a9@google.com/T/ +Link: https://patch.msgid.link/20240617154201.29512-1-jack@suse.cz +Reported-by: syzbot+d31185aa54170f7fc1f5@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/namei.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 1308109fd42d9..78a603129dd58 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -876,8 +876,6 @@ static int udf_rename(struct mnt_idmap *idmap, struct inode *old_dir, + if (has_diriter) { + diriter.fi.icb.extLocation = + cpu_to_lelb(UDF_I(new_dir)->i_location); +- udf_update_tag((char *)&diriter.fi, +- udf_dir_entry_len(&diriter.fi)); + udf_fiiter_write_fi(&diriter, NULL); + udf_fiiter_release(&diriter); + } +-- +2.43.0 + diff --git a/queue-6.10/udf-fix-lock-ordering-in-udf_evict_inode.patch b/queue-6.10/udf-fix-lock-ordering-in-udf_evict_inode.patch new file mode 100644 index 00000000000..f8c1504adad --- /dev/null +++ b/queue-6.10/udf-fix-lock-ordering-in-udf_evict_inode.patch @@ -0,0 +1,99 @@ +From a3d2b8e798b24395aaf5f70cae921ebf6fdcbcd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:23:37 +0200 +Subject: udf: Fix lock ordering in udf_evict_inode() + +From: Jan Kara + +[ Upstream commit 8832fc1e502687869606bb0a7b79848ed3bf036f ] + +udf_evict_inode() calls udf_setsize() to truncate deleted inode. +However inode deletion through udf_evict_inode() can happen from inode +reclaim context and udf_setsize() grabs mapping->invalidate_lock which +isn't generally safe to acquire from fs reclaim context since we +allocate pages under mapping->invalidate_lock for example in a page +fault path. This is however not a real deadlock possibility as by the +time udf_evict_inode() is called, nobody can be accessing the inode, +even less work with its page cache. So this is just a lockdep triggering +false positive. Fix the problem by moving mapping->invalidate_lock +locking outsize of udf_setsize() into udf_setattr() as grabbing +mapping->invalidate_lock from udf_evict_inode() is pointless. + +Reported-by: syzbot+0333a6f4b88bcd68a62f@syzkaller.appspotmail.com +Fixes: b9a861fd527a ("udf: Protect truncate and file type conversion with invalidate_lock") +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/file.c | 2 ++ + fs/udf/inode.c | 11 ++++------- + 2 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/fs/udf/file.c b/fs/udf/file.c +index 97c59585208ca..3a4179de316b4 100644 +--- a/fs/udf/file.c ++++ b/fs/udf/file.c +@@ -232,7 +232,9 @@ static int udf_setattr(struct mnt_idmap *idmap, struct dentry *dentry, + + if ((attr->ia_valid & ATTR_SIZE) && + attr->ia_size != i_size_read(inode)) { ++ filemap_invalidate_lock(inode->i_mapping); + error = udf_setsize(inode, attr->ia_size); ++ filemap_invalidate_unlock(inode->i_mapping); + if (error) + return error; + } +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 2fb21c5ffccfe..08767bd21eb7f 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1250,7 +1250,6 @@ int udf_setsize(struct inode *inode, loff_t newsize) + if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) + return -EPERM; + +- filemap_invalidate_lock(inode->i_mapping); + iinfo = UDF_I(inode); + if (newsize > inode->i_size) { + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { +@@ -1263,11 +1262,11 @@ int udf_setsize(struct inode *inode, loff_t newsize) + } + err = udf_expand_file_adinicb(inode); + if (err) +- goto out_unlock; ++ return err; + } + err = udf_extend_file(inode, newsize); + if (err) +- goto out_unlock; ++ return err; + set_size: + truncate_setsize(inode, newsize); + } else { +@@ -1285,14 +1284,14 @@ int udf_setsize(struct inode *inode, loff_t newsize) + err = block_truncate_page(inode->i_mapping, newsize, + udf_get_block); + if (err) +- goto out_unlock; ++ return err; + truncate_setsize(inode, newsize); + down_write(&iinfo->i_data_sem); + udf_clear_extent_cache(inode); + err = udf_truncate_extents(inode); + up_write(&iinfo->i_data_sem); + if (err) +- goto out_unlock; ++ return err; + } + update_time: + inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); +@@ -1300,8 +1299,6 @@ int udf_setsize(struct inode *inode, loff_t newsize) + udf_sync_inode(inode); + else + mark_inode_dirty(inode); +-out_unlock: +- filemap_invalidate_unlock(inode->i_mapping); + return err; + } + +-- +2.43.0 + diff --git a/queue-6.10/usb-typec-mux-nb7vpq904m-unregister-typec-switch-on-.patch b/queue-6.10/usb-typec-mux-nb7vpq904m-unregister-typec-switch-on-.patch new file mode 100644 index 00000000000..609ac658e07 --- /dev/null +++ b/queue-6.10/usb-typec-mux-nb7vpq904m-unregister-typec-switch-on-.patch @@ -0,0 +1,60 @@ +From f33342b6ebc1404d5d74d0f739d4d66c7515346d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 15:11:14 +0200 +Subject: usb: typec-mux: nb7vpq904m: unregister typec switch on probe error + and remove + +From: Neil Armstrong + +[ Upstream commit 74b64e760ee3433c0f8d95715038c869bcddacf7 ] + +Add the missing call to typec_switch_put() when probe fails and +the nb7vpq904m_remove() call is called. + +Fixes: 348359e7c232 ("usb: typec: nb7vpq904m: Add an error handling path in nb7vpq904m_probe()") +Signed-off-by: Neil Armstrong +Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver") +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20240606-topic-sm8x50-upstream-retimer-broadcast-mode-v2-2-c6f6eae479c3@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/mux/nb7vpq904m.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/mux/nb7vpq904m.c b/drivers/usb/typec/mux/nb7vpq904m.c +index b17826713753a..9fe4ce6f62ac0 100644 +--- a/drivers/usb/typec/mux/nb7vpq904m.c ++++ b/drivers/usb/typec/mux/nb7vpq904m.c +@@ -413,7 +413,7 @@ static int nb7vpq904m_probe(struct i2c_client *client) + + ret = nb7vpq904m_parse_data_lanes_mapping(nb7); + if (ret) +- return ret; ++ goto err_switch_put; + + ret = regulator_enable(nb7->vcc_supply); + if (ret) +@@ -456,6 +456,9 @@ static int nb7vpq904m_probe(struct i2c_client *client) + gpiod_set_value(nb7->enable_gpio, 0); + regulator_disable(nb7->vcc_supply); + ++err_switch_put: ++ typec_switch_put(nb7->typec_switch); ++ + return ret; + } + +@@ -469,6 +472,8 @@ static void nb7vpq904m_remove(struct i2c_client *client) + gpiod_set_value(nb7->enable_gpio, 0); + + regulator_disable(nb7->vcc_supply); ++ ++ typec_switch_put(nb7->typec_switch); + } + + static const struct i2c_device_id nb7vpq904m_table[] = { +-- +2.43.0 + diff --git a/queue-6.10/usb-typec-mux-ptn36502-unregister-typec-switch-on-pr.patch b/queue-6.10/usb-typec-mux-ptn36502-unregister-typec-switch-on-pr.patch new file mode 100644 index 00000000000..ef6d5977342 --- /dev/null +++ b/queue-6.10/usb-typec-mux-ptn36502-unregister-typec-switch-on-pr.patch @@ -0,0 +1,63 @@ +From be02221ca531ff6349c9f3a1a3819e4c04301224 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 15:11:13 +0200 +Subject: usb: typec-mux: ptn36502: unregister typec switch on probe error and + remove + +From: Neil Armstrong + +[ Upstream commit 2be53b0436fda455e1bf6968ebae53f5d4f3cb0b ] + +Add the missing call to typec_switch_put() when probe fails and +the ptn36502_remove() call is called. + +Fixes: 8e99dc783648 ("usb: typec: add support for PTN36502 redriver") +Signed-off-by: Neil Armstrong +Reviewed-by: Heikki Krogerus +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240606-topic-sm8x50-upstream-retimer-broadcast-mode-v2-1-c6f6eae479c3@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/mux/ptn36502.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/mux/ptn36502.c b/drivers/usb/typec/mux/ptn36502.c +index 0ec86ef32a871..88136a6d6f313 100644 +--- a/drivers/usb/typec/mux/ptn36502.c ++++ b/drivers/usb/typec/mux/ptn36502.c +@@ -322,8 +322,10 @@ static int ptn36502_probe(struct i2c_client *client) + "Failed to acquire orientation-switch\n"); + + ret = regulator_enable(ptn->vdd18_supply); +- if (ret) +- return dev_err_probe(dev, ret, "Failed to enable vdd18\n"); ++ if (ret) { ++ ret = dev_err_probe(dev, ret, "Failed to enable vdd18\n"); ++ goto err_switch_put; ++ } + + ret = ptn36502_detect(ptn); + if (ret) +@@ -363,6 +365,9 @@ static int ptn36502_probe(struct i2c_client *client) + err_disable_regulator: + regulator_disable(ptn->vdd18_supply); + ++err_switch_put: ++ typec_switch_put(ptn->typec_switch); ++ + return ret; + } + +@@ -374,6 +379,8 @@ static void ptn36502_remove(struct i2c_client *client) + typec_switch_unregister(ptn->sw); + + regulator_disable(ptn->vdd18_supply); ++ ++ typec_switch_put(ptn->typec_switch); + } + + static const struct i2c_device_id ptn36502_table[] = { +-- +2.43.0 + diff --git a/queue-6.10/vhost-vsock-always-initialize-seqpacket_allow.patch b/queue-6.10/vhost-vsock-always-initialize-seqpacket_allow.patch new file mode 100644 index 00000000000..06a21168a3b --- /dev/null +++ b/queue-6.10/vhost-vsock-always-initialize-seqpacket_allow.patch @@ -0,0 +1,68 @@ +From 3679f12cb0a8b0ded15e2d9d055903c2c0350c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Apr 2024 10:03:13 -0400 +Subject: vhost/vsock: always initialize seqpacket_allow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael S. Tsirkin + +[ Upstream commit 1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 ] + +There are two issues around seqpacket_allow: +1. seqpacket_allow is not initialized when socket is + created. Thus if features are never set, it will be + read uninitialized. +2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, + then seqpacket_allow will not be cleared appropriately + (existing apps I know about don't usually do this but + it's legal and there's no way to be sure no one relies + on this). + +To fix: + - initialize seqpacket_allow after allocation + - set it unconditionally in set_features + +Reported-by: syzbot+6c21aeb59d0e82eb2782@syzkaller.appspotmail.com +Reported-by: Jeongjun Park +Fixes: ced7b713711f ("vhost/vsock: support SEQPACKET for transport"). +Tested-by: Arseny Krasnov +Cc: David S. Miller +Cc: Stefan Hajnoczi +Message-ID: <20240422100010-mutt-send-email-mst@kernel.org> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Stefano Garzarella +Reviewed-by: Eugenio Pérez +Acked-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/vhost/vsock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index ec20ecff85c7f..bf664ec9341b3 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -667,6 +667,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) + } + + vsock->guest_cid = 0; /* no CID assigned yet */ ++ vsock->seqpacket_allow = false; + + atomic_set(&vsock->queued_replies, 0); + +@@ -810,8 +811,7 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features) + goto err; + } + +- if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET)) +- vsock->seqpacket_allow = true; ++ vsock->seqpacket_allow = features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET); + + for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { + vq = &vsock->vqs[i]; +-- +2.43.0 + diff --git a/queue-6.10/virtio_net-add-support-for-byte-queue-limits.patch b/queue-6.10/virtio_net-add-support-for-byte-queue-limits.patch new file mode 100644 index 00000000000..5e6acb501c2 --- /dev/null +++ b/queue-6.10/virtio_net-add-support-for-byte-queue-limits.patch @@ -0,0 +1,266 @@ +From 101b2472b191ddce8862c72a7517358794a3a98c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 16:44:56 +0200 +Subject: virtio_net: add support for Byte Queue Limits + +From: Jiri Pirko + +[ Upstream commit c8bd1f7f3e61fc6c562c806045f3ccd2cc819c01 ] + +Add support for Byte Queue Limits (BQL). + +Tested on qemu emulated virtio_net device with 1, 2 and 4 queues. +Tested with fq_codel and pfifo_fast. Super netperf with 50 threads is +running in background. Netperf TCP_RR results: + +NOBQL FQC 1q: 159.56 159.33 158.50 154.31 agv: 157.925 +NOBQL FQC 2q: 184.64 184.96 174.73 174.15 agv: 179.62 +NOBQL FQC 4q: 994.46 441.96 416.50 499.56 agv: 588.12 +NOBQL PFF 1q: 148.68 148.92 145.95 149.48 agv: 148.2575 +NOBQL PFF 2q: 171.86 171.20 170.42 169.42 agv: 170.725 +NOBQL PFF 4q: 1505.23 1137.23 2488.70 3507.99 agv: 2159.7875 + BQL FQC 1q: 1332.80 1297.97 1351.41 1147.57 agv: 1282.4375 + BQL FQC 2q: 768.30 817.72 864.43 974.40 agv: 856.2125 + BQL FQC 4q: 945.66 942.68 878.51 822.82 agv: 897.4175 + BQL PFF 1q: 149.69 151.49 149.40 147.47 agv: 149.5125 + BQL PFF 2q: 2059.32 798.74 1844.12 381.80 agv: 1270.995 + BQL PFF 4q: 1871.98 4420.02 4916.59 13268.16 agv: 6119.1875 + +Signed-off-by: Jiri Pirko +Acked-by: Michael S. Tsirkin +Signed-off-by: Michael S. Tsirkin +Link: https://lore.kernel.org/r/20240618144456.1688998-1-jiri@resnulli.us +Signed-off-by: Jakub Kicinski +Stable-dep-of: f8321fa75102 ("virtio_net: Fix napi_skb_cache_put warning") +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 81 ++++++++++++++++++++++++++++------------ + 1 file changed, 57 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index ea10db9a09fa2..b1f8b720733e5 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -47,7 +47,8 @@ module_param(napi_tx, bool, 0644); + #define VIRTIO_XDP_TX BIT(0) + #define VIRTIO_XDP_REDIR BIT(1) + +-#define VIRTIO_XDP_FLAG BIT(0) ++#define VIRTIO_XDP_FLAG BIT(0) ++#define VIRTIO_ORPHAN_FLAG BIT(1) + + /* RX packet size EWMA. The average packet size is used to determine the packet + * buffer size when refilling RX rings. As the entire RX ring may be refilled +@@ -85,6 +86,8 @@ struct virtnet_stat_desc { + struct virtnet_sq_free_stats { + u64 packets; + u64 bytes; ++ u64 napi_packets; ++ u64 napi_bytes; + }; + + struct virtnet_sq_stats { +@@ -506,29 +509,50 @@ static struct xdp_frame *ptr_to_xdp(void *ptr) + return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG); + } + +-static void __free_old_xmit(struct send_queue *sq, bool in_napi, +- struct virtnet_sq_free_stats *stats) ++static bool is_orphan_skb(void *ptr) ++{ ++ return (unsigned long)ptr & VIRTIO_ORPHAN_FLAG; ++} ++ ++static void *skb_to_ptr(struct sk_buff *skb, bool orphan) ++{ ++ return (void *)((unsigned long)skb | (orphan ? VIRTIO_ORPHAN_FLAG : 0)); ++} ++ ++static struct sk_buff *ptr_to_skb(void *ptr) ++{ ++ return (struct sk_buff *)((unsigned long)ptr & ~VIRTIO_ORPHAN_FLAG); ++} ++ ++static void __free_old_xmit(struct send_queue *sq, struct netdev_queue *txq, ++ bool in_napi, struct virtnet_sq_free_stats *stats) + { + unsigned int len; + void *ptr; + + while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) { +- ++stats->packets; +- + if (!is_xdp_frame(ptr)) { +- struct sk_buff *skb = ptr; ++ struct sk_buff *skb = ptr_to_skb(ptr); + + pr_debug("Sent skb %p\n", skb); + +- stats->bytes += skb->len; ++ if (is_orphan_skb(ptr)) { ++ stats->packets++; ++ stats->bytes += skb->len; ++ } else { ++ stats->napi_packets++; ++ stats->napi_bytes += skb->len; ++ } + napi_consume_skb(skb, in_napi); + } else { + struct xdp_frame *frame = ptr_to_xdp(ptr); + ++ stats->packets++; + stats->bytes += xdp_get_frame_len(frame); + xdp_return_frame(frame); + } + } ++ netdev_tx_completed_queue(txq, stats->napi_packets, stats->napi_bytes); + } + + /* Converting between virtqueue no. and kernel tx/rx queue no. +@@ -955,21 +979,22 @@ static void virtnet_rq_unmap_free_buf(struct virtqueue *vq, void *buf) + virtnet_rq_free_buf(vi, rq, buf); + } + +-static void free_old_xmit(struct send_queue *sq, bool in_napi) ++static void free_old_xmit(struct send_queue *sq, struct netdev_queue *txq, ++ bool in_napi) + { + struct virtnet_sq_free_stats stats = {0}; + +- __free_old_xmit(sq, in_napi, &stats); ++ __free_old_xmit(sq, txq, in_napi, &stats); + + /* Avoid overhead when no packets have been processed + * happens when called speculatively from start_xmit. + */ +- if (!stats.packets) ++ if (!stats.packets && !stats.napi_packets) + return; + + u64_stats_update_begin(&sq->stats.syncp); +- u64_stats_add(&sq->stats.bytes, stats.bytes); +- u64_stats_add(&sq->stats.packets, stats.packets); ++ u64_stats_add(&sq->stats.bytes, stats.bytes + stats.napi_bytes); ++ u64_stats_add(&sq->stats.packets, stats.packets + stats.napi_packets); + u64_stats_update_end(&sq->stats.syncp); + } + +@@ -1003,7 +1028,9 @@ static void check_sq_full_and_disable(struct virtnet_info *vi, + * early means 16 slots are typically wasted. + */ + if (sq->vq->num_free < 2+MAX_SKB_FRAGS) { +- netif_stop_subqueue(dev, qnum); ++ struct netdev_queue *txq = netdev_get_tx_queue(dev, qnum); ++ ++ netif_tx_stop_queue(txq); + u64_stats_update_begin(&sq->stats.syncp); + u64_stats_inc(&sq->stats.stop); + u64_stats_update_end(&sq->stats.syncp); +@@ -1012,7 +1039,7 @@ static void check_sq_full_and_disable(struct virtnet_info *vi, + virtqueue_napi_schedule(&sq->napi, sq->vq); + } else if (unlikely(!virtqueue_enable_cb_delayed(sq->vq))) { + /* More just got used, free them then recheck. */ +- free_old_xmit(sq, false); ++ free_old_xmit(sq, txq, false); + if (sq->vq->num_free >= 2+MAX_SKB_FRAGS) { + netif_start_subqueue(dev, qnum); + u64_stats_update_begin(&sq->stats.syncp); +@@ -1138,7 +1165,8 @@ static int virtnet_xdp_xmit(struct net_device *dev, + } + + /* Free up any pending old buffers before queueing new ones. */ +- __free_old_xmit(sq, false, &stats); ++ __free_old_xmit(sq, netdev_get_tx_queue(dev, sq - vi->sq), ++ false, &stats); + + for (i = 0; i < n; i++) { + struct xdp_frame *xdpf = frames[i]; +@@ -2331,7 +2359,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq) + + do { + virtqueue_disable_cb(sq->vq); +- free_old_xmit(sq, true); ++ free_old_xmit(sq, txq, true); + } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) { +@@ -2430,6 +2458,7 @@ static int virtnet_enable_queue_pair(struct virtnet_info *vi, int qp_index) + goto err_xdp_reg_mem_model; + + virtnet_napi_enable(vi->rq[qp_index].vq, &vi->rq[qp_index].napi); ++ netdev_tx_reset_queue(netdev_get_tx_queue(vi->dev, qp_index)); + virtnet_napi_tx_enable(vi, vi->sq[qp_index].vq, &vi->sq[qp_index].napi); + + return 0; +@@ -2489,7 +2518,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + txq = netdev_get_tx_queue(vi->dev, index); + __netif_tx_lock(txq, raw_smp_processor_id()); + virtqueue_disable_cb(sq->vq); +- free_old_xmit(sq, true); ++ free_old_xmit(sq, txq, true); + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) { + if (netif_tx_queue_stopped(txq)) { +@@ -2523,7 +2552,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + return 0; + } + +-static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) ++static int xmit_skb(struct send_queue *sq, struct sk_buff *skb, bool orphan) + { + struct virtio_net_hdr_mrg_rxbuf *hdr; + const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest; +@@ -2567,7 +2596,8 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) + return num_sg; + num_sg++; + } +- return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC); ++ return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, ++ skb_to_ptr(skb, orphan), GFP_ATOMIC); + } + + static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) +@@ -2577,24 +2607,25 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) + struct send_queue *sq = &vi->sq[qnum]; + int err; + struct netdev_queue *txq = netdev_get_tx_queue(dev, qnum); +- bool kick = !netdev_xmit_more(); ++ bool xmit_more = netdev_xmit_more(); + bool use_napi = sq->napi.weight; ++ bool kick; + + /* Free up any pending old buffers before queueing new ones. */ + do { + if (use_napi) + virtqueue_disable_cb(sq->vq); + +- free_old_xmit(sq, false); ++ free_old_xmit(sq, txq, false); + +- } while (use_napi && kick && ++ } while (use_napi && !xmit_more && + unlikely(!virtqueue_enable_cb_delayed(sq->vq))); + + /* timestamp packet in software */ + skb_tx_timestamp(skb); + + /* Try to transmit */ +- err = xmit_skb(sq, skb); ++ err = xmit_skb(sq, skb, !use_napi); + + /* This should not happen! */ + if (unlikely(err)) { +@@ -2616,7 +2647,9 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) + + check_sq_full_and_disable(vi, dev, sq); + +- if (kick || netif_xmit_stopped(txq)) { ++ kick = use_napi ? __netdev_tx_sent_queue(txq, skb->len, xmit_more) : ++ !xmit_more || netif_xmit_stopped(txq); ++ if (kick) { + if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { + u64_stats_update_begin(&sq->stats.syncp); + u64_stats_inc(&sq->stats.kicks); +-- +2.43.0 + diff --git a/queue-6.10/virtio_net-fix-napi_skb_cache_put-warning.patch b/queue-6.10/virtio_net-fix-napi_skb_cache_put-warning.patch new file mode 100644 index 00000000000..dbcbe5a1fbe --- /dev/null +++ b/queue-6.10/virtio_net-fix-napi_skb_cache_put-warning.patch @@ -0,0 +1,91 @@ +From 05b8d464fac54971f36a274ea61d6c8f7a23fe58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 04:53:25 -0700 +Subject: virtio_net: Fix napi_skb_cache_put warning + +From: Breno Leitao + +[ Upstream commit f8321fa75102246d7415a6af441872f6637c93ab ] + +After the commit bdacf3e34945 ("net: Use nested-BH locking for +napi_alloc_cache.") was merged, the following warning began to appear: + + WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 + + __warn+0x12f/0x340 + napi_skb_cache_put+0x82/0x4b0 + napi_skb_cache_put+0x82/0x4b0 + report_bug+0x165/0x370 + handle_bug+0x3d/0x80 + exc_invalid_op+0x1a/0x50 + asm_exc_invalid_op+0x1a/0x20 + __free_old_xmit+0x1c8/0x510 + napi_skb_cache_put+0x82/0x4b0 + __free_old_xmit+0x1c8/0x510 + __free_old_xmit+0x1c8/0x510 + __pfx___free_old_xmit+0x10/0x10 + +The issue arises because virtio is assuming it's running in NAPI context +even when it's not, such as in the netpoll case. + +To resolve this, modify virtnet_poll_tx() to only set NAPI when budget +is available. Same for virtnet_poll_cleantx(), which always assumed that +it was in a NAPI context. + +Fixes: df133f3f9625 ("virtio_net: bulk free tx skbs") +Suggested-by: Jakub Kicinski +Signed-off-by: Breno Leitao +Reviewed-by: Jakub Kicinski +Acked-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Heng Qi +Link: https://patch.msgid.link/20240712115325.54175-1-leitao@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index b1f8b720733e5..cd254a1fd88ec 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2341,7 +2341,7 @@ static int virtnet_receive(struct receive_queue *rq, int budget, + return packets; + } + +-static void virtnet_poll_cleantx(struct receive_queue *rq) ++static void virtnet_poll_cleantx(struct receive_queue *rq, int budget) + { + struct virtnet_info *vi = rq->vq->vdev->priv; + unsigned int index = vq2rxq(rq->vq); +@@ -2359,7 +2359,7 @@ static void virtnet_poll_cleantx(struct receive_queue *rq) + + do { + virtqueue_disable_cb(sq->vq); +- free_old_xmit(sq, txq, true); ++ free_old_xmit(sq, txq, !!budget); + } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) { +@@ -2403,7 +2403,7 @@ static int virtnet_poll(struct napi_struct *napi, int budget) + unsigned int xdp_xmit = 0; + bool napi_complete; + +- virtnet_poll_cleantx(rq); ++ virtnet_poll_cleantx(rq, budget); + + received = virtnet_receive(rq, budget, &xdp_xmit); + rq->packets_in_napi += received; +@@ -2518,7 +2518,7 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + txq = netdev_get_tx_queue(vi->dev, index); + __netif_tx_lock(txq, raw_smp_processor_id()); + virtqueue_disable_cb(sq->vq); +- free_old_xmit(sq, txq, true); ++ free_old_xmit(sq, txq, !!budget); + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) { + if (netif_tx_queue_stopped(txq)) { +-- +2.43.0 + diff --git a/queue-6.10/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch b/queue-6.10/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch new file mode 100644 index 00000000000..c5492f7de67 --- /dev/null +++ b/queue-6.10/vmlinux.lds.h-catch-.bss.l-sections-into-bss.patch @@ -0,0 +1,57 @@ +From 015cf53698273d5ca1fbc4fb982cebb607d5eef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 07:51:58 +0200 +Subject: vmlinux.lds.h: catch .bss..L* sections into BSS") + +From: Christophe Leroy + +[ Upstream commit 1a7b7326d587c9a5e8ff067e70d6aaf0333f4bb3 ] + +Commit 9a427556fb8e ("vmlinux.lds.h: catch compound literals into +data and BSS") added catches for .data..L* and .rodata..L* but missed +.bss..L* + +Since commit 5431fdd2c181 ("ptrace: Convert ptrace_attach() to use +lock guards") the following appears at build: + + LD .tmp_vmlinux.kallsyms1 +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + NM .tmp_vmlinux.kallsyms1.syms + KSYMS .tmp_vmlinux.kallsyms1.S + AS .tmp_vmlinux.kallsyms1.S + LD .tmp_vmlinux.kallsyms2 +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + NM .tmp_vmlinux.kallsyms2.syms + KSYMS .tmp_vmlinux.kallsyms2.S + AS .tmp_vmlinux.kallsyms2.S + LD vmlinux +powerpc64-linux-ld: warning: orphan section `.bss..Lubsan_data33' from `kernel/ptrace.o' being placed in section `.bss..Lubsan_data33' + +Lets add .bss..L* to BSS_MAIN macro to catch those sections into BSS. + +Fixes: 9a427556fb8e ("vmlinux.lds.h: catch compound literals into data and BSS") +Signed-off-by: Christophe Leroy +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202404031349.nmKhyuUG-lkp@intel.com/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/asm-generic/vmlinux.lds.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 5703526d6ebf1..70bf1004076b2 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -103,7 +103,7 @@ + #define DATA_MAIN .data .data.[0-9a-zA-Z_]* .data..L* .data..compoundliteral* .data.$__unnamed_* .data.$L* + #define SDATA_MAIN .sdata .sdata.[0-9a-zA-Z_]* + #define RODATA_MAIN .rodata .rodata.[0-9a-zA-Z_]* .rodata..L* +-#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..compoundliteral* ++#define BSS_MAIN .bss .bss.[0-9a-zA-Z_]* .bss..L* .bss..compoundliteral* + #define SBSS_MAIN .sbss .sbss.[0-9a-zA-Z_]* + #else + #define TEXT_MAIN .text +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath11k-fix-wrong-definition-of-ce-ring-s-base-a.patch b/queue-6.10/wifi-ath11k-fix-wrong-definition-of-ce-ring-s-base-a.patch new file mode 100644 index 00000000000..42ad38b2a3e --- /dev/null +++ b/queue-6.10/wifi-ath11k-fix-wrong-definition-of-ce-ring-s-base-a.patch @@ -0,0 +1,65 @@ +From 15e04bbc7bdb79e0c409f958d678516572429211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 10:15:58 +0800 +Subject: wifi: ath11k: fix wrong definition of CE ring's base address + +From: Baochen Qiang + +[ Upstream commit 5714e25f1d1875b300fb337dadfaa75324c1161a ] + +Base address of CE ring is defined as u32, currently this works +because coherent DMA mask configured as 32 bit: + + #define ATH11K_PCI_COHERENT_DMA_MASK 32 + +However this mask could be changed once firmware bugs are fixed +to fully support 36 bit DMA addressing. So to protect against any +future changes to the DMA mask, change the type of the fields that +are dependent upon it. + +This is found during code review. Compile tested only. + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240524021558.34452-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ce.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/ce.h b/drivers/net/wireless/ath/ath11k/ce.h +index 69946fc700777..bcde2fcf02cf7 100644 +--- a/drivers/net/wireless/ath/ath11k/ce.h ++++ b/drivers/net/wireless/ath/ath11k/ce.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. +- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #ifndef ATH11K_CE_H +@@ -146,7 +146,7 @@ struct ath11k_ce_ring { + /* Host address space */ + void *base_addr_owner_space_unaligned; + /* CE address space */ +- u32 base_addr_ce_space_unaligned; ++ dma_addr_t base_addr_ce_space_unaligned; + + /* Actual start of descriptors. + * Aligned to descriptor-size boundary. +@@ -156,7 +156,7 @@ struct ath11k_ce_ring { + void *base_addr_owner_space; + + /* CE address space */ +- u32 base_addr_ce_space; ++ dma_addr_t base_addr_ce_space; + + /* HAL ring id */ + u32 hal_ring_id; +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch b/queue-6.10/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch new file mode 100644 index 00000000000..aec67789e61 --- /dev/null +++ b/queue-6.10/wifi-ath11k-fix-wrong-handling-of-ccmp256-and-gcmp-c.patch @@ -0,0 +1,133 @@ +From db5f44b9fc58ed3e3905f5760106d3201efef74f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 09:42:34 +0300 +Subject: wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers + +From: Baochen Qiang + +[ Upstream commit d2b0ca38d362ebf16ca79cd7f309d5bb8b581deb ] + +Currently for CCMP256, GCMP128 and GCMP256 ciphers, in ath11k_install_key() +IEEE80211_KEY_FLAG_GENERATE_IV_MGMT is not set. And in ath11k_mac_mgmt_tx_wmi() +a length of IEEE80211_CCMP_MIC_LEN is reserved for all ciphers. + +This results in unexpected management frame drop in case either of above 3 ciphers +is used. The reason is, without IEEE80211_KEY_FLAG_GENERATE_IV_MGMT set, mac80211 +will not generate CCMP/GCMP headers in frame for ath11k. Also MIC length reserved +is wrong. Such frame is dropped later by hardware: + +ath11k_pci 0000:5a:00.0: mac tx mgmt frame, buf id 0 +ath11k_pci 0000:5a:00.0: mgmt tx compl ev pdev_id 1, desc_id 0, status 1 + +From user point of view, we have observed very low throughput due to this issue: +action frames are all dropped so ADDBA response from DUT never reaches AP. AP +can not use aggregation thus throughput is low. + +Fix this by setting IEEE80211_KEY_FLAG_GENERATE_IV_MGMT flag and by reserving proper +MIC length for those ciphers. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Reported-by: Yaroslav Isakov +Tested-by: Yaroslav Isakov +Closes: https://lore.kernel.org/all/CADS+iDX5=JtJr0apAtAQ02WWBxgOFEv8G063vuGYwDTC8AVZaw@mail.gmail.com +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240605014826.22498-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 3 +-- + drivers/net/wireless/ath/ath11k/dp_rx.h | 3 +++ + drivers/net/wireless/ath/ath11k/mac.c | 15 +++++++++++---- + 3 files changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index afd481f5858f0..aabde24d87632 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -1877,8 +1877,7 @@ static void ath11k_dp_rx_h_csum_offload(struct ath11k *ar, struct sk_buff *msdu) + CHECKSUM_NONE : CHECKSUM_UNNECESSARY; + } + +-static int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, +- enum hal_encrypt_type enctype) ++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype) + { + switch (enctype) { + case HAL_ENCRYPT_TYPE_OPEN: +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.h b/drivers/net/wireless/ath/ath11k/dp_rx.h +index 623da3bf9dc81..c322e30caa968 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.h ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.h +@@ -1,6 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. ++ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + #ifndef ATH11K_DP_RX_H + #define ATH11K_DP_RX_H +@@ -95,4 +96,6 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id + int ath11k_dp_rx_pktlog_start(struct ath11k_base *ab); + int ath11k_dp_rx_pktlog_stop(struct ath11k_base *ab, bool stop_timer); + ++int ath11k_dp_rx_crypto_mic_len(struct ath11k *ar, enum hal_encrypt_type enctype); ++ + #endif /* ATH11K_DP_RX_H */ +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 0c0444dc06f69..eaa53bc39ab2c 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -4229,6 +4229,7 @@ static int ath11k_install_key(struct ath11k_vif *arvif, + + switch (key->cipher) { + case WLAN_CIPHER_SUITE_CCMP: ++ case WLAN_CIPHER_SUITE_CCMP_256: + arg.key_cipher = WMI_CIPHER_AES_CCM; + /* TODO: Re-check if flag is valid */ + key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT; +@@ -4238,12 +4239,10 @@ static int ath11k_install_key(struct ath11k_vif *arvif, + arg.key_txmic_len = 8; + arg.key_rxmic_len = 8; + break; +- case WLAN_CIPHER_SUITE_CCMP_256: +- arg.key_cipher = WMI_CIPHER_AES_CCM; +- break; + case WLAN_CIPHER_SUITE_GCMP: + case WLAN_CIPHER_SUITE_GCMP_256: + arg.key_cipher = WMI_CIPHER_AES_GCM; ++ key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT; + break; + default: + ath11k_warn(ar->ab, "cipher %d is not supported\n", key->cipher); +@@ -5903,7 +5902,10 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, + { + struct ath11k_base *ab = ar->ab; + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; ++ struct ath11k_skb_cb *skb_cb = ATH11K_SKB_CB(skb); + struct ieee80211_tx_info *info; ++ enum hal_encrypt_type enctype; ++ unsigned int mic_len; + dma_addr_t paddr; + int buf_id; + int ret; +@@ -5927,7 +5929,12 @@ static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif, + ieee80211_is_deauth(hdr->frame_control) || + ieee80211_is_disassoc(hdr->frame_control)) && + ieee80211_has_protected(hdr->frame_control)) { +- skb_put(skb, IEEE80211_CCMP_MIC_LEN); ++ if (!(skb_cb->flags & ATH11K_SKB_CIPHER_SET)) ++ ath11k_warn(ab, "WMI management tx frame without ATH11K_SKB_CIPHER_SET"); ++ ++ enctype = ath11k_dp_tx_get_encrypt_type(skb_cb->cipher); ++ mic_len = ath11k_dp_rx_crypto_mic_len(ar, enctype); ++ skb_put(skb, mic_len); + } + } + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath11k-refactor-setting-country-code-logic.patch b/queue-6.10/wifi-ath11k-refactor-setting-country-code-logic.patch new file mode 100644 index 00000000000..91ad020c9f1 --- /dev/null +++ b/queue-6.10/wifi-ath11k-refactor-setting-country-code-logic.patch @@ -0,0 +1,155 @@ +From 83349bae9f38305a6ee8f30d40f182731d9569cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 11:08:10 +0300 +Subject: wifi: ath11k: refactor setting country code logic + +From: Baochen Qiang + +[ Upstream commit b363614c0c80f9e2f3ffe8e77270e783a0fb8ab5 ] + +ath11k_wmi_send_set_current_country_cmd() is called in several places +and all of them are just simply repeating the same logic. + +Refactor to make code clean. + +Compile tested only. + +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240520024148.5472-2-quic_bqiang@quicinc.com +Stable-dep-of: 7f0343b7b871 ("wifi: ath11k: restore country code during resume") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 19 ++++++++----------- + drivers/net/wireless/ath/ath11k/mac.c | 13 +++---------- + drivers/net/wireless/ath/ath11k/reg.c | 14 ++++++++++---- + drivers/net/wireless/ath/ath11k/reg.h | 4 ++-- + 4 files changed, 23 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index b82e8fb285413..a14d0c65000ad 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -1978,23 +1978,20 @@ static void ath11k_update_11d(struct work_struct *work) + struct ath11k_base *ab = container_of(work, struct ath11k_base, update_11d_work); + struct ath11k *ar; + struct ath11k_pdev *pdev; +- struct wmi_set_current_country_params set_current_param = {}; + int ret, i; + +- spin_lock_bh(&ab->base_lock); +- memcpy(&set_current_param.alpha2, &ab->new_alpha2, 2); +- spin_unlock_bh(&ab->base_lock); +- +- ath11k_dbg(ab, ATH11K_DBG_WMI, "update 11d new cc %c%c\n", +- set_current_param.alpha2[0], +- set_current_param.alpha2[1]); +- + for (i = 0; i < ab->num_radios; i++) { + pdev = &ab->pdevs[i]; + ar = pdev->ar; + +- memcpy(&ar->alpha2, &set_current_param.alpha2, 2); +- ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param); ++ spin_lock_bh(&ab->base_lock); ++ memcpy(&ar->alpha2, &ab->new_alpha2, 2); ++ spin_unlock_bh(&ab->base_lock); ++ ++ ath11k_dbg(ab, ATH11K_DBG_WMI, "update 11d new cc %c%c for pdev %d\n", ++ ar->alpha2[0], ar->alpha2[1], i); ++ ++ ret = ath11k_reg_set_cc(ar); + if (ret) + ath11k_warn(ar->ab, + "pdev id %d failed set current country code: %d\n", +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 9b96dbb21d833..0c0444dc06f69 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -8851,12 +8851,8 @@ ath11k_mac_op_reconfig_complete(struct ieee80211_hw *hw, + ieee80211_wake_queues(ar->hw); + + if (ar->ab->hw_params.current_cc_support && +- ar->alpha2[0] != 0 && ar->alpha2[1] != 0) { +- struct wmi_set_current_country_params set_current_param = {}; +- +- memcpy(&set_current_param.alpha2, ar->alpha2, 2); +- ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param); +- } ++ ar->alpha2[0] != 0 && ar->alpha2[1] != 0) ++ ath11k_reg_set_cc(ar); + + if (ab->is_reset) { + recovery_count = atomic_inc_return(&ab->recovery_count); +@@ -10325,11 +10321,8 @@ static int __ath11k_mac_register(struct ath11k *ar) + } + + if (ab->hw_params.current_cc_support && ab->new_alpha2[0]) { +- struct wmi_set_current_country_params set_current_param = {}; +- +- memcpy(&set_current_param.alpha2, ab->new_alpha2, 2); + memcpy(&ar->alpha2, ab->new_alpha2, 2); +- ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param); ++ ret = ath11k_reg_set_cc(ar); + if (ret) + ath11k_warn(ar->ab, + "failed set cc code for mac register: %d\n", ret); +diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c +index 737fcd450d4bd..39232b8f52bae 100644 +--- a/drivers/net/wireless/ath/ath11k/reg.c ++++ b/drivers/net/wireless/ath/ath11k/reg.c +@@ -49,7 +49,6 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) + { + struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy); + struct wmi_init_country_params init_country_param; +- struct wmi_set_current_country_params set_current_param = {}; + struct ath11k *ar = hw->priv; + int ret; + +@@ -83,9 +82,8 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) + * reg info + */ + if (ar->ab->hw_params.current_cc_support) { +- memcpy(&set_current_param.alpha2, request->alpha2, 2); +- memcpy(&ar->alpha2, &set_current_param.alpha2, 2); +- ret = ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param); ++ memcpy(&ar->alpha2, request->alpha2, 2); ++ ret = ath11k_reg_set_cc(ar); + if (ret) + ath11k_warn(ar->ab, + "failed set current country code: %d\n", ret); +@@ -1017,3 +1015,11 @@ void ath11k_reg_free(struct ath11k_base *ab) + kfree(ab->new_regd[i]); + } + } ++ ++int ath11k_reg_set_cc(struct ath11k *ar) ++{ ++ struct wmi_set_current_country_params set_current_param = {}; ++ ++ memcpy(&set_current_param.alpha2, ar->alpha2, 2); ++ return ath11k_wmi_send_set_current_country_cmd(ar, &set_current_param); ++} +diff --git a/drivers/net/wireless/ath/ath11k/reg.h b/drivers/net/wireless/ath/ath11k/reg.h +index 64edb794260ab..263ea90619483 100644 +--- a/drivers/net/wireless/ath/ath11k/reg.h ++++ b/drivers/net/wireless/ath/ath11k/reg.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2019 The Linux Foundation. All rights reserved. +- * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #ifndef ATH11K_REG_H +@@ -45,5 +45,5 @@ ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type); + int ath11k_reg_handle_chan_list(struct ath11k_base *ab, + struct cur_regulatory_info *reg_info, + enum ieee80211_ap_reg_power power_type); +- ++int ath11k_reg_set_cc(struct ath11k *ar); + #endif +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath11k-restore-country-code-during-resume.patch b/queue-6.10/wifi-ath11k-restore-country-code-during-resume.patch new file mode 100644 index 00000000000..4836091ce42 --- /dev/null +++ b/queue-6.10/wifi-ath11k-restore-country-code-during-resume.patch @@ -0,0 +1,78 @@ +From ac1d89ff8cef7152d24afad3291483b716d415cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 11:08:11 +0300 +Subject: wifi: ath11k: restore country code during resume + +From: Baochen Qiang + +[ Upstream commit 7f0343b7b8710436c1e6355c71782d32ada47e0c ] + +We got report that regdomain is not correct after +return from hibernation: + +Before hibernation: +% iw reg get +[...] +phy#0 (self-managed) +country CH: DFS-ETSI + (2402 - 2482 @ 40), (N/A, 20), (N/A) + (5170 - 5250 @ 80), (N/A, 23), (N/A), NO-OUTDOOR, AUTO-BW + (5250 - 5330 @ 80), (N/A, 23), (0 ms), NO-OUTDOOR, DFS, AUTO-BW + (5490 - 5590 @ 80), (N/A, 30), (0 ms), DFS, AUTO-BW + (5590 - 5650 @ 40), (N/A, 30), (600000 ms), DFS, AUTO-BW + (5650 - 5730 @ 80), (N/A, 30), (0 ms), DFS, AUTO-BW + (5735 - 5875 @ 80), (N/A, 14), (N/A), AUTO-BW + +After hibernation: +% iw reg get +[...] +phy#0 (self-managed) +country na: DFS-UNSET + (2402 - 2472 @ 40), (N/A, 20), (N/A) + (2457 - 2482 @ 20), (N/A, 20), (N/A), PASSIVE-SCAN + (5170 - 5330 @ 160), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN + (5490 - 5730 @ 160), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN + (5735 - 5895 @ 160), (N/A, 20), (N/A), AUTO-BW, PASSIVE-SCAN + (5945 - 7125 @ 160), (N/A, 30), (N/A), AUTO-BW, PASSIVE-SCAN + +The reason is, during resume, firmware is reinitialized but host does +not send current country code to firmware. So default reg rules with +country code set to 'na' is uploaded to host, as shown above. + +Fix it by restoring country code to firmware during resume. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 + +Fixes: 166a490f59ac ("wifi: ath11k: support hibernation") +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240520024148.5472-3-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index a14d0c65000ad..47554c3619633 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -1009,6 +1009,16 @@ int ath11k_core_resume(struct ath11k_base *ab) + return -ETIMEDOUT; + } + ++ if (ab->hw_params.current_cc_support && ++ ar->alpha2[0] != 0 && ar->alpha2[1] != 0) { ++ ret = ath11k_reg_set_cc(ar); ++ if (ret) { ++ ath11k_warn(ab, "failed to set country code during resume: %d\n", ++ ret); ++ return ret; ++ } ++ } ++ + ret = ath11k_dp_rx_pktlog_start(ab); + if (ret) + ath11k_warn(ab, "failed to start rx pktlog during resume: %d\n", +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-advertise-driver-capabilities-for-mbssid.patch b/queue-6.10/wifi-ath12k-advertise-driver-capabilities-for-mbssid.patch new file mode 100644 index 00000000000..a31d11f562f --- /dev/null +++ b/queue-6.10/wifi-ath12k-advertise-driver-capabilities-for-mbssid.patch @@ -0,0 +1,140 @@ +From e77b146f41ffa9e01e92f149908e217a4beb0b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 13:29:04 -0700 +Subject: wifi: ath12k: advertise driver capabilities for MBSSID and EMA + +From: Aloka Dixit + +[ Upstream commit 519a545cfee790024c623c7aacd165f7431773d5 ] + +Advertise the driver support for multiple BSSID (MBSSID) and +enhanced multi-BSSID advertisements (EMA) by setting extended +capabilities. + +Configure mbssid_max_interfaces and ema_max_profile_periodicity +fields in structure wiphy which are used to advertise maximum number +of interfaces and profile periodicity supported by the driver. + +Add new WMI fields to configure maximum vdev count supported for +MBSSID and profile periodicity in case of EMA. + +Set WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET flag to allow +firmware to track and update the DTIM counts for each nontransmitted +profile. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Aloka Dixit +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240508202912.11902-2-quic_alokad@quicinc.com +Stable-dep-of: 1eeafd64c7b4 ("wifi: ath12k: fix peer metadata parsing") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/hw.h | 1 + + drivers/net/wireless/ath/ath12k/mac.c | 7 +++++++ + drivers/net/wireless/ath/ath12k/wmi.c | 7 ++++++- + drivers/net/wireless/ath/ath12k/wmi.h | 3 +++ + 4 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h +index 3f450ee93f34b..2745bde0502c6 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.h ++++ b/drivers/net/wireless/ath/ath12k/hw.h +@@ -80,6 +80,7 @@ + #define TARGET_RX_BATCHMODE 1 + #define TARGET_RX_PEER_METADATA_VER_V1A 2 + #define TARGET_RX_PEER_METADATA_VER_V1B 3 ++#define TARGET_EMA_MAX_PROFILE_PERIOD 8 + + #define ATH12K_HW_DEFAULT_QUEUE 0 + #define ATH12K_HW_MAX_QUEUES 4 +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 2c68376a39fd3..0ed388a6fc804 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -8489,19 +8489,23 @@ static int ath12k_mac_setup_iface_combinations(struct ath12k_hw *ah) + + static const u8 ath12k_if_types_ext_capa[] = { + [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, ++ [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, + [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, + }; + + static const u8 ath12k_if_types_ext_capa_sta[] = { + [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, ++ [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, + [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, + [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT, + }; + + static const u8 ath12k_if_types_ext_capa_ap[] = { + [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, ++ [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, + [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, + [9] = WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT, ++ [10] = WLAN_EXT_CAPA11_EMA_SUPPORT, + }; + + static const struct wiphy_iftype_ext_capab ath12k_iftypes_ext_capa[] = { +@@ -8740,6 +8744,9 @@ static int ath12k_mac_hw_register(struct ath12k_hw *ah) + wiphy->iftype_ext_capab = ath12k_iftypes_ext_capa; + wiphy->num_iftype_ext_capab = ARRAY_SIZE(ath12k_iftypes_ext_capa); + ++ wiphy->mbssid_max_interfaces = TARGET_NUM_VDEVS; ++ wiphy->ema_max_profile_periodicity = TARGET_EMA_MAX_PROFILE_PERIOD; ++ + if (is_6ghz) { + wiphy_ext_feature_set(wiphy, + NL80211_EXT_FEATURE_FILS_DISCOVERY); +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index e88ec9e1201a9..bf33767af2c87 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -228,6 +228,9 @@ void ath12k_wmi_init_qcn9274(struct ath12k_base *ab, + config->peer_map_unmap_version = 0x32; + config->twt_ap_pdev_count = ab->num_radios; + config->twt_ap_sta_count = 1000; ++ config->ema_max_vap_cnt = ab->num_radios; ++ config->ema_max_profile_period = TARGET_EMA_MAX_PROFILE_PERIOD; ++ config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt; + + if (test_bit(WMI_TLV_SERVICE_PEER_METADATA_V1A_V1B_SUPPORT, ab->wmi_ab.svc_map)) + config->dp_peer_meta_data_ver = TARGET_RX_PEER_METADATA_VER_V1B; +@@ -3475,9 +3478,11 @@ ath12k_wmi_copy_resource_config(struct ath12k_wmi_resource_config_params *wmi_cf + wmi_cfg->twt_ap_sta_count = cpu_to_le32(tg_cfg->twt_ap_sta_count); + wmi_cfg->flags2 = le32_encode_bits(tg_cfg->dp_peer_meta_data_ver, + WMI_RSRC_CFG_FLAGS2_RX_PEER_METADATA_VERSION); +- + wmi_cfg->host_service_flags = cpu_to_le32(tg_cfg->is_reg_cc_ext_event_supported << + WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT); ++ wmi_cfg->ema_max_vap_cnt = cpu_to_le32(tg_cfg->ema_max_vap_cnt); ++ wmi_cfg->ema_max_profile_period = cpu_to_le32(tg_cfg->ema_max_profile_period); ++ wmi_cfg->flags2 |= cpu_to_le32(WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET); + } + + static int ath12k_init_cmd_send(struct ath12k_wmi_pdev *wmi, +diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h +index 496866673aead..e71e6c73f2495 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.h ++++ b/drivers/net/wireless/ath/ath12k/wmi.h +@@ -2356,6 +2356,8 @@ struct ath12k_wmi_resource_config_arg { + u32 twt_ap_sta_count; + bool is_reg_cc_ext_event_supported; + u8 dp_peer_meta_data_ver; ++ u32 ema_max_vap_cnt; ++ u32 ema_max_profile_period; + }; + + struct ath12k_wmi_init_cmd_arg { +@@ -2410,6 +2412,7 @@ struct wmi_init_cmd { + #define WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT 4 + #define WMI_RSRC_CFG_FLAGS2_RX_PEER_METADATA_VERSION GENMASK(5, 4) + #define WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64 BIT(5) ++#define WMI_RSRC_CFG_FLAGS2_CALC_NEXT_DTIM_COUNT_SET BIT(9) + + struct ath12k_wmi_resource_config_params { + __le32 tlv_header; +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-avoid-duplicated-vdev-stop.patch b/queue-6.10/wifi-ath12k-avoid-duplicated-vdev-stop.patch new file mode 100644 index 00000000000..1e8256c179e --- /dev/null +++ b/queue-6.10/wifi-ath12k-avoid-duplicated-vdev-stop.patch @@ -0,0 +1,44 @@ +From 6db87124d018da7da10e5a2de665f47d884e5efc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 16:15:22 +0800 +Subject: wifi: ath12k: avoid duplicated vdev stop + +From: Kang Yang + +[ Upstream commit 3b0989e925f38df733a03ff5a320d6841006b3f9 ] + +ath12k_mac_op_unassign_vif_chanctx() will do vdev stop in +ath12k_mac_monitor_stop(). This ath12k_mac_vdev_stop() will do vdev stop +again, then might trigger firmware crash. + +So add judgement to avoid duplicated vdev stop. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: c9e4e41e71ff ("wifi: ath12k: move peer delete after vdev stop of station for WCN7850") +Signed-off-by: Kang Yang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240429081525.983-3-quic_kangyang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index 805cb084484a4..b3530d1dd728b 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -7386,7 +7386,8 @@ ath12k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + arvif->is_started = false; + } + +- if (arvif->vdev_type != WMI_VDEV_TYPE_STA) { ++ if (arvif->vdev_type != WMI_VDEV_TYPE_STA && ++ arvif->vdev_type != WMI_VDEV_TYPE_MONITOR) { + ath12k_bss_disassoc(ar, arvif); + ret = ath12k_mac_vdev_stop(arvif); + if (ret) +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-change-dma-direction-while-mapping-reinj.patch b/queue-6.10/wifi-ath12k-change-dma-direction-while-mapping-reinj.patch new file mode 100644 index 00000000000..3898d702bb3 --- /dev/null +++ b/queue-6.10/wifi-ath12k-change-dma-direction-while-mapping-reinj.patch @@ -0,0 +1,61 @@ +From 99329f18b6f1394f2ee34c7061ac664d85b4356e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 12:30:43 +0530 +Subject: wifi: ath12k: change DMA direction while mapping reinjected packets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: P Praneesh + +[ Upstream commit 33322e3ef07409278a18c6919c448e369d66a18e ] + +For fragmented packets, ath12k reassembles each fragment as a normal +packet and then reinjects it into HW ring. In this case, the DMA +direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE. Otherwise, +an invalid payload may be reinjected into the HW and +subsequently delivered to the host. + +Given that arbitrary memory can be allocated to the skb buffer, +knowledge about the data contained in the reinjected buffer is lacking. +Consequently, there’s a risk of private information being leaked. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Co-developed-by: Baochen Qiang +Signed-off-by: Baochen Qiang +Signed-off-by: P Praneesh +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240520070045.631029-2-quic_ppranees@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index e5fb5cb000f04..37e5bca9570fe 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -3030,7 +3030,7 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar, + + buf_paddr = dma_map_single(ab->dev, defrag_skb->data, + defrag_skb->len + skb_tailroom(defrag_skb), +- DMA_FROM_DEVICE); ++ DMA_TO_DEVICE); + if (dma_mapping_error(ab->dev, buf_paddr)) + return -ENOMEM; + +@@ -3116,7 +3116,7 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar, + spin_unlock_bh(&dp->rx_desc_lock); + err_unmap_dma: + dma_unmap_single(ab->dev, buf_paddr, defrag_skb->len + skb_tailroom(defrag_skb), +- DMA_FROM_DEVICE); ++ DMA_TO_DEVICE); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-correct-6-ghz-frequency-value-in-rx-stat.patch b/queue-6.10/wifi-ath12k-correct-6-ghz-frequency-value-in-rx-stat.patch new file mode 100644 index 00000000000..457226ecdbe --- /dev/null +++ b/queue-6.10/wifi-ath12k-correct-6-ghz-frequency-value-in-rx-stat.patch @@ -0,0 +1,88 @@ +From cf24c31961087d5f19a7ac450365d2632991991f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 May 2024 10:36:51 -0700 +Subject: wifi: ath12k: Correct 6 GHz frequency value in rx status + +From: Pradeep Kumar Chitrapu + +[ Upstream commit c3c84a74bd797f76d7da036c9fef947d674bbc18 ] + +The frequency in the rx status is currently being filled +incorrectly for the 6 GHz band. The channel number received is +invalid in this case, resulting in packet drops. Fix this +issue by correcting the frequency calculation. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Pradeep Kumar Chitrapu +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240508173655.22191-3-quic_pradeepc@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 9 ++++++--- + drivers/net/wireless/ath/ath12k/wmi.c | 10 +++++++--- + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 75df622f25d85..e5fb5cb000f04 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2383,8 +2383,10 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct hal_rx_desc *rx_desc, + channel_num = meta_data; + center_freq = meta_data >> 16; + +- if (center_freq >= 5935 && center_freq <= 7105) { ++ if (center_freq >= ATH12K_MIN_6G_FREQ && ++ center_freq <= ATH12K_MAX_6G_FREQ) { + rx_status->band = NL80211_BAND_6GHZ; ++ rx_status->freq = center_freq; + } else if (channel_num >= 1 && channel_num <= 14) { + rx_status->band = NL80211_BAND_2GHZ; + } else if (channel_num >= 36 && channel_num <= 173) { +@@ -2402,8 +2404,9 @@ void ath12k_dp_rx_h_ppdu(struct ath12k *ar, struct hal_rx_desc *rx_desc, + rx_desc, sizeof(*rx_desc)); + } + +- rx_status->freq = ieee80211_channel_to_frequency(channel_num, +- rx_status->band); ++ if (rx_status->band != NL80211_BAND_6GHZ) ++ rx_status->freq = ieee80211_channel_to_frequency(channel_num, ++ rx_status->band); + + ath12k_dp_rx_h_rate(ar, rx_desc, rx_status); + } +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 7a52d2082b792..e88ec9e1201a9 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -6022,8 +6022,10 @@ static void ath12k_mgmt_rx_event(struct ath12k_base *ab, struct sk_buff *skb) + if (rx_ev.status & WMI_RX_STATUS_ERR_MIC) + status->flag |= RX_FLAG_MMIC_ERROR; + +- if (rx_ev.chan_freq >= ATH12K_MIN_6G_FREQ) { ++ if (rx_ev.chan_freq >= ATH12K_MIN_6G_FREQ && ++ rx_ev.chan_freq <= ATH12K_MAX_6G_FREQ) { + status->band = NL80211_BAND_6GHZ; ++ status->freq = rx_ev.chan_freq; + } else if (rx_ev.channel >= 1 && rx_ev.channel <= 14) { + status->band = NL80211_BAND_2GHZ; + } else if (rx_ev.channel >= 36 && rx_ev.channel <= ATH12K_MAX_5G_CHAN) { +@@ -6044,8 +6046,10 @@ static void ath12k_mgmt_rx_event(struct ath12k_base *ab, struct sk_buff *skb) + + sband = &ar->mac.sbands[status->band]; + +- status->freq = ieee80211_channel_to_frequency(rx_ev.channel, +- status->band); ++ if (status->band != NL80211_BAND_6GHZ) ++ status->freq = ieee80211_channel_to_frequency(rx_ev.channel, ++ status->band); ++ + status->signal = rx_ev.snr + ATH12K_DEFAULT_NOISE_FLOOR; + status->rate_idx = ath12k_mac_bitrate_to_idx(sband, rx_ev.rate / 100); + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-don-t-drop-tx_status-in-failure-case.patch b/queue-6.10/wifi-ath12k-don-t-drop-tx_status-in-failure-case.patch new file mode 100644 index 00000000000..f4ea6ae10db --- /dev/null +++ b/queue-6.10/wifi-ath12k-don-t-drop-tx_status-in-failure-case.patch @@ -0,0 +1,92 @@ +From f1251555b742aaafd6aca04faf3ad04af4fa5676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 13:34:39 +0300 +Subject: wifi: ath12k: Don't drop tx_status in failure case + +From: Sven Eckelmann + +[ Upstream commit 5453bbd6fef4ca2fea3b4b338fc715d7135afc6f ] + +When a station idles for a long time, hostapd will try to send +a QoS Null frame to the station as "poll". NL80211_CMD_PROBE_CLIENT +is used for this purpose. +And the skb will be added to ack_status_frame - waiting for a +completion via ieee80211_report_ack_skb(). + +But when the peer was already removed before the tx_complete arrives, +the peer will be missing. And when using dev_kfree_skb_any (instead +of going through mac80211), the entry will stay inside +ack_status_frames thus not clean up related information in its +internal data structures. This IDR will therefore run full after +8K request were generated for such clients. +At this point, the access point will then just stall and not allow +any new clients because idr_alloc() for ack_status_frame will fail. + +ieee80211_free_txskb() on the other hand will (when required) call +ieee80211_report_ack_skb() and make sure that (when required) remove +the entry from the ack_status_frame and clean up related +information in its internal data structures. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Sven Eckelmann +Signed-off-by: Sarika Sharma +Signed-off-by: Karthikeyan Kathirvel +Link: https://lore.kernel.org/r/20230802-ath11k-ack_status_leak-v2-1-c0af729d6229@narfation.org +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240430074313.885807-2-quic_kathirve@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_tx.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c +index 9b6d7d72f57c4..81a85d5946f5a 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_tx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_tx.c +@@ -352,15 +352,15 @@ static void ath12k_dp_tx_free_txbuf(struct ath12k_base *ab, + u8 pdev_id = ath12k_hw_mac_id_to_pdev_id(ab->hw_params, mac_id); + + skb_cb = ATH12K_SKB_CB(msdu); ++ ar = ab->pdevs[pdev_id].ar; + + dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); + if (skb_cb->paddr_ext_desc) + dma_unmap_single(ab->dev, skb_cb->paddr_ext_desc, + sizeof(struct hal_tx_msdu_ext_desc), DMA_TO_DEVICE); + +- dev_kfree_skb_any(msdu); ++ ieee80211_free_txskb(ar->ah->hw, msdu); + +- ar = ab->pdevs[pdev_id].ar; + if (atomic_dec_and_test(&ar->dp.num_tx_pending)) + wake_up(&ar->dp.tx_empty_waitq); + } +@@ -448,6 +448,7 @@ static void ath12k_dp_tx_complete_msdu(struct ath12k *ar, + struct hal_tx_status *ts) + { + struct ath12k_base *ab = ar->ab; ++ struct ath12k_hw *ah = ar->ah; + struct ieee80211_tx_info *info; + struct ath12k_skb_cb *skb_cb; + +@@ -466,12 +467,12 @@ static void ath12k_dp_tx_complete_msdu(struct ath12k *ar, + rcu_read_lock(); + + if (!rcu_dereference(ab->pdevs_active[ar->pdev_idx])) { +- dev_kfree_skb_any(msdu); ++ ieee80211_free_txskb(ah->hw, msdu); + goto exit; + } + + if (!skb_cb->vif) { +- dev_kfree_skb_any(msdu); ++ ieee80211_free_txskb(ah->hw, msdu); + goto exit; + } + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-drop-failed-transmitted-frames-from-metr.patch b/queue-6.10/wifi-ath12k-drop-failed-transmitted-frames-from-metr.patch new file mode 100644 index 00000000000..571ad997167 --- /dev/null +++ b/queue-6.10/wifi-ath12k-drop-failed-transmitted-frames-from-metr.patch @@ -0,0 +1,131 @@ +From 9ab76caf18230598a25cfd55ecf74c824775e9ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 13:34:39 +0300 +Subject: wifi: ath12k: drop failed transmitted frames from metric calculation. + +From: Karthikeyan Kathirvel + +[ Upstream commit 50971dc6694c0845fcddfe337ea39c5b723d5a92 ] + +In mesh node traffic, internal firmware-transmitted failures are +reported as transmitted failures in mesh metric calculation, leading +to the breakage of the mesh link. + +Fix the issue by dropping the internal firmware-transmitted failures +before updating the TX completion status to mac80211, in order to +prevent false failure averaging in mesh metric calculation. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Karthikeyan Kathirvel +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240430074313.885807-3-quic_kathirve@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_tx.c | 38 ++++++++++++++++------ + drivers/net/wireless/ath/ath12k/hal_desc.h | 22 ++++++++++++- + 2 files changed, 49 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_tx.c b/drivers/net/wireless/ath/ath12k/dp_tx.c +index 81a85d5946f5a..a7c7a868c14ce 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_tx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_tx.c +@@ -482,18 +482,36 @@ static void ath12k_dp_tx_complete_msdu(struct ath12k *ar, + /* skip tx rate update from ieee80211_status*/ + info->status.rates[0].idx = -1; + +- if (ts->status == HAL_WBM_TQM_REL_REASON_FRAME_ACKED && +- !(info->flags & IEEE80211_TX_CTL_NO_ACK)) { +- info->flags |= IEEE80211_TX_STAT_ACK; +- info->status.ack_signal = ATH12K_DEFAULT_NOISE_FLOOR + +- ts->ack_rssi; +- info->status.flags = IEEE80211_TX_STATUS_ACK_SIGNAL_VALID; ++ switch (ts->status) { ++ case HAL_WBM_TQM_REL_REASON_FRAME_ACKED: ++ if (!(info->flags & IEEE80211_TX_CTL_NO_ACK)) { ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ info->status.ack_signal = ATH12K_DEFAULT_NOISE_FLOOR + ++ ts->ack_rssi; ++ info->status.flags = IEEE80211_TX_STATUS_ACK_SIGNAL_VALID; ++ } ++ break; ++ case HAL_WBM_TQM_REL_REASON_CMD_REMOVE_TX: ++ if (info->flags & IEEE80211_TX_CTL_NO_ACK) { ++ info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED; ++ break; ++ } ++ fallthrough; ++ case HAL_WBM_TQM_REL_REASON_CMD_REMOVE_MPDU: ++ case HAL_WBM_TQM_REL_REASON_DROP_THRESHOLD: ++ case HAL_WBM_TQM_REL_REASON_CMD_REMOVE_AGED_FRAMES: ++ /* The failure status is due to internal firmware tx failure ++ * hence drop the frame; do not update the status of frame to ++ * the upper layer ++ */ ++ ieee80211_free_txskb(ah->hw, msdu); ++ goto exit; ++ default: ++ ath12k_dbg(ab, ATH12K_DBG_DP_TX, "tx frame is not acked status %d\n", ++ ts->status); ++ break; + } + +- if (ts->status == HAL_WBM_TQM_REL_REASON_CMD_REMOVE_TX && +- (info->flags & IEEE80211_TX_CTL_NO_ACK)) +- info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED; +- + /* NOTE: Tx rate status reporting. Tx completion status does not have + * necessary information (for example nss) to build the tx rate. + * Might end up reporting it out-of-band from HTT stats. +diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h +index 63340256d3f64..814c02f876d64 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_desc.h ++++ b/drivers/net/wireless/ath/ath12k/hal_desc.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + #include "core.h" + +@@ -2048,6 +2048,19 @@ struct hal_wbm_release_ring { + * fw with fw_reason2. + * @HAL_WBM_TQM_REL_REASON_CMD_REMOVE_RESEAON3: Remove command initiated by + * fw with fw_reason3. ++ * @HAL_WBM_TQM_REL_REASON_CMD_DISABLE_QUEUE: Remove command initiated by ++ * fw with disable queue. ++ * @HAL_WBM_TQM_REL_REASON_CMD_TILL_NONMATCHING: Remove command initiated by ++ * fw to remove all mpdu until 1st non-match. ++ * @HAL_WBM_TQM_REL_REASON_DROP_THRESHOLD: Dropped due to drop threshold ++ * criteria ++ * @HAL_WBM_TQM_REL_REASON_DROP_LINK_DESC_UNAVAIL: Dropped due to link desc ++ * not available ++ * @HAL_WBM_TQM_REL_REASON_DROP_OR_INVALID_MSDU: Dropped due drop bit set or ++ * null flow ++ * @HAL_WBM_TQM_REL_REASON_MULTICAST_DROP: Dropped due mcast drop set for VDEV ++ * @HAL_WBM_TQM_REL_REASON_VDEV_MISMATCH_DROP: Dropped due to being set with ++ * 'TCL_drop_reason' + */ + enum hal_wbm_tqm_rel_reason { + HAL_WBM_TQM_REL_REASON_FRAME_ACKED, +@@ -2058,6 +2071,13 @@ enum hal_wbm_tqm_rel_reason { + HAL_WBM_TQM_REL_REASON_CMD_REMOVE_RESEAON1, + HAL_WBM_TQM_REL_REASON_CMD_REMOVE_RESEAON2, + HAL_WBM_TQM_REL_REASON_CMD_REMOVE_RESEAON3, ++ HAL_WBM_TQM_REL_REASON_CMD_DISABLE_QUEUE, ++ HAL_WBM_TQM_REL_REASON_CMD_TILL_NONMATCHING, ++ HAL_WBM_TQM_REL_REASON_DROP_THRESHOLD, ++ HAL_WBM_TQM_REL_REASON_DROP_LINK_DESC_UNAVAIL, ++ HAL_WBM_TQM_REL_REASON_DROP_OR_INVALID_MSDU, ++ HAL_WBM_TQM_REL_REASON_MULTICAST_DROP, ++ HAL_WBM_TQM_REL_REASON_VDEV_MISMATCH_DROP, + }; + + struct hal_wbm_buffer_ring { +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-acpi-warning-when-resume.patch b/queue-6.10/wifi-ath12k-fix-acpi-warning-when-resume.patch new file mode 100644 index 00000000000..867fa6e349d --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-acpi-warning-when-resume.patch @@ -0,0 +1,63 @@ +From 9072c590e2fb4ded7ccd6424426e490dcb217054 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 09:42:33 +0300 +Subject: wifi: ath12k: fix ACPI warning when resume + +From: Baochen Qiang + +[ Upstream commit 8b2a12749b08726f006303814ecc1c37024d3617 ] + +Currently ACPI notification handler is installed when driver loads and only +gets removed when driver unloads. During resume after firmware is reloaded, +ath12k tries to install it by default. Since it is installed already, ACPI +subsystem rejects it and returns an error: + +[ 83.094206] ath12k_pci 0000:03:00.0: failed to install DSM notify callback: 7 + +Fix it by removing that handler when going to suspend. This also avoid any +possible ACPI call to firmware before firmware is reloaded/reinitialized. + +Note ab->acpi also needs to be cleared in ath12k_acpi_stop() such that we +are in a clean state when ACPI structures are reinitialized in +ath12k_acpi_start(). + +Tested-on: WCN7850 HW2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: 576771c9fa21 ("wifi: ath12k: ACPI TAS support") +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240531024000.9291-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/acpi.c | 2 ++ + drivers/net/wireless/ath/ath12k/core.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath12k/acpi.c b/drivers/net/wireless/ath/ath12k/acpi.c +index 443ba12e01f37..0555d35aab477 100644 +--- a/drivers/net/wireless/ath/ath12k/acpi.c ++++ b/drivers/net/wireless/ath/ath12k/acpi.c +@@ -391,4 +391,6 @@ void ath12k_acpi_stop(struct ath12k_base *ab) + acpi_remove_notify_handler(ACPI_HANDLE(ab->dev), + ACPI_DEVICE_NOTIFY, + ath12k_acpi_dsm_notify); ++ ++ memset(&ab->acpi, 0, sizeof(ab->acpi)); + } +diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c +index 527cfa3a01ad3..52969a1bb5a56 100644 +--- a/drivers/net/wireless/ath/ath12k/core.c ++++ b/drivers/net/wireless/ath/ath12k/core.c +@@ -83,6 +83,8 @@ int ath12k_core_suspend_late(struct ath12k_base *ab) + if (!ab->hw_params->supports_suspend) + return -EOPNOTSUPP; + ++ ath12k_acpi_stop(ab); ++ + ath12k_hif_irq_disable(ab); + ath12k_hif_ce_irq_disable(ab); + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-firmware-crash-during-reo-reinject.patch b/queue-6.10/wifi-ath12k-fix-firmware-crash-during-reo-reinject.patch new file mode 100644 index 00000000000..f8ca9f83026 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-firmware-crash-during-reo-reinject.patch @@ -0,0 +1,67 @@ +From de4b633efc5a8774c8ab74aa4f3ed2149dc2409f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 12:30:45 +0530 +Subject: wifi: ath12k: fix firmware crash during reo reinject +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: P Praneesh + +[ Upstream commit a57ab7cced454f69b8ee8aa5f5019ea8de4674da ] + +When handling fragmented packets, the ath12k driver reassembles each +fragment into a normal packet and then reinjects it into the HW ring. +However, a firmware crash occurs during this reinjection process. +The issue arises because the driver populates peer metadata in +reo_ent_ring->queue_addr_lo, while the firmware expects the physical +address obtained from the corresponding peer’s queue descriptor. Fix it +by filling peer's queue descriptor's physical address in queue_addr_lo. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: P Praneesh +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240520070045.631029-4-quic_ppranees@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp_rx.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 37e5bca9570fe..44e8d9d7834c4 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2994,7 +2994,7 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar, + struct hal_srng *srng; + dma_addr_t link_paddr, buf_paddr; + u32 desc_bank, msdu_info, msdu_ext_info, mpdu_info; +- u32 cookie, hal_rx_desc_sz, dest_ring_info0; ++ u32 cookie, hal_rx_desc_sz, dest_ring_info0, queue_addr_hi; + int ret; + struct ath12k_rx_desc_info *desc_info; + u8 dst_ind; +@@ -3086,13 +3086,11 @@ static int ath12k_dp_rx_h_defrag_reo_reinject(struct ath12k *ar, + reo_ent_ring->rx_mpdu_info.peer_meta_data = + reo_dest_ring->rx_mpdu_info.peer_meta_data; + +- /* Firmware expects physical address to be filled in queue_addr_lo in +- * the MLO scenario and in case of non MLO peer meta data needs to be +- * filled. +- * TODO: Need to handle for MLO scenario. +- */ +- reo_ent_ring->queue_addr_lo = reo_dest_ring->rx_mpdu_info.peer_meta_data; +- reo_ent_ring->info0 = le32_encode_bits(dst_ind, ++ reo_ent_ring->queue_addr_lo = cpu_to_le32(lower_32_bits(rx_tid->paddr)); ++ queue_addr_hi = upper_32_bits(rx_tid->paddr); ++ reo_ent_ring->info0 = le32_encode_bits(queue_addr_hi, ++ HAL_REO_ENTR_RING_INFO0_QUEUE_ADDR_HI) | ++ le32_encode_bits(dst_ind, + HAL_REO_ENTR_RING_INFO0_DEST_IND); + + reo_ent_ring->info1 = le32_encode_bits(rx_tid->cur_sn, +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-invalid-memory-access-while-processi.patch b/queue-6.10/wifi-ath12k-fix-invalid-memory-access-while-processi.patch new file mode 100644 index 00000000000..c50efd641e1 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-invalid-memory-access-while-processi.patch @@ -0,0 +1,55 @@ +From 8a34a5c32e6d10f31e98d351e8f8a8e3adb4186a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 12:30:44 +0530 +Subject: wifi: ath12k: fix invalid memory access while processing fragmented + packets + +From: P Praneesh + +[ Upstream commit 073f9f249eecd64ab9d59c91c4a23cfdcc02afe4 ] + +The monitor ring and the reo reinject ring share the same ring mask index. +When the driver receives an interrupt for the reo reinject ring, the +monitor ring is also processed, leading to invalid memory access. Since +monitor support is not yet enabled in ath12k, the ring mask for the monitor +ring should be removed. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: P Praneesh +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240520070045.631029-3-quic_ppranees@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/hw.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c +index 5ed06c0d90e2b..bff8cf97a18c6 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.c ++++ b/drivers/net/wireless/ath/ath12k/hw.c +@@ -544,9 +544,6 @@ static const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9274 = { + }, + .rx_mon_dest = { + 0, 0, 0, +- ATH12K_RX_MON_RING_MASK_0, +- ATH12K_RX_MON_RING_MASK_1, +- ATH12K_RX_MON_RING_MASK_2, + }, + .rx = { + 0, 0, 0, 0, +@@ -572,8 +569,7 @@ static const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9274 = { + ATH12K_HOST2RXDMA_RING_MASK_0, + }, + .tx_mon_dest = { +- ATH12K_TX_MON_RING_MASK_0, +- ATH12K_TX_MON_RING_MASK_1, ++ 0, 0, 0, + }, + }; + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-peer-metadata-parsing.patch b/queue-6.10/wifi-ath12k-fix-peer-metadata-parsing.patch new file mode 100644 index 00000000000..ee06193e842 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-peer-metadata-parsing.patch @@ -0,0 +1,229 @@ +From 3670d9c1b4a256483a668faae6a8f72e33d96815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 20:24:18 +0530 +Subject: wifi: ath12k: fix peer metadata parsing + +From: Karthikeyan Periyasamy + +[ Upstream commit 1eeafd64c7b455381b77c546e41bc267e13e2809 ] + +Currently, the Rx data path only supports parsing peer metadata of version +zero. However, the QCN9274 platform configures the peer metadata version +as V1B. When V1B peer metadata is parsed using the version zero logic, +invalid data is populated, causing valid packets to be dropped. To address +this issue, refactor the peer metadata version and add the version based +parsing to populate the data from peer metadata correctly. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: 287033810990 ("wifi: ath12k: add support for peer meta data version") +Signed-off-by: Karthikeyan Periyasamy +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240624145418.2043461-1-quic_periyasa@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp.h | 1 + + drivers/net/wireless/ath/ath12k/dp_rx.c | 40 ++++++++++++++++++---- + drivers/net/wireless/ath/ath12k/hal_desc.h | 26 ++++++++++++-- + drivers/net/wireless/ath/ath12k/hw.h | 2 -- + drivers/net/wireless/ath/ath12k/wmi.c | 6 ++-- + drivers/net/wireless/ath/ath12k/wmi.h | 11 ++++-- + 6 files changed, 72 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h +index 5cf0d21ef184b..4dfbff326030e 100644 +--- a/drivers/net/wireless/ath/ath12k/dp.h ++++ b/drivers/net/wireless/ath/ath12k/dp.h +@@ -334,6 +334,7 @@ struct ath12k_dp { + struct dp_srng reo_except_ring; + struct dp_srng reo_cmd_ring; + struct dp_srng reo_status_ring; ++ enum ath12k_peer_metadata_version peer_metadata_ver; + struct dp_srng reo_dst_ring[DP_REO_DST_RING_MAX]; + struct dp_tx_ring tx_ring[DP_TCL_NUM_RING_MAX]; + struct hal_wbm_idle_scatter_list scatter_list[DP_IDLE_SCATTER_BUFS_MAX]; +diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c +index 44e8d9d7834c4..121f27284be59 100644 +--- a/drivers/net/wireless/ath/ath12k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath12k/dp_rx.c +@@ -2607,6 +2607,29 @@ static void ath12k_dp_rx_process_received_packets(struct ath12k_base *ab, + rcu_read_unlock(); + } + ++static u16 ath12k_dp_rx_get_peer_id(struct ath12k_base *ab, ++ enum ath12k_peer_metadata_version ver, ++ __le32 peer_metadata) ++{ ++ switch (ver) { ++ default: ++ ath12k_warn(ab, "Unknown peer metadata version: %d", ver); ++ fallthrough; ++ case ATH12K_PEER_METADATA_V0: ++ return le32_get_bits(peer_metadata, ++ RX_MPDU_DESC_META_DATA_V0_PEER_ID); ++ case ATH12K_PEER_METADATA_V1: ++ return le32_get_bits(peer_metadata, ++ RX_MPDU_DESC_META_DATA_V1_PEER_ID); ++ case ATH12K_PEER_METADATA_V1A: ++ return le32_get_bits(peer_metadata, ++ RX_MPDU_DESC_META_DATA_V1A_PEER_ID); ++ case ATH12K_PEER_METADATA_V1B: ++ return le32_get_bits(peer_metadata, ++ RX_MPDU_DESC_META_DATA_V1B_PEER_ID); ++ } ++} ++ + int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, + struct napi_struct *napi, int budget) + { +@@ -2635,6 +2658,8 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, + ath12k_hal_srng_access_begin(ab, srng); + + while ((desc = ath12k_hal_srng_dst_get_next_entry(ab, srng))) { ++ struct rx_mpdu_desc *mpdu_info; ++ struct rx_msdu_desc *msdu_info; + enum hal_reo_dest_ring_push_reason push_reason; + u32 cookie; + +@@ -2681,16 +2706,19 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, + continue; + } + +- rxcb->is_first_msdu = !!(le32_to_cpu(desc->rx_msdu_info.info0) & ++ msdu_info = &desc->rx_msdu_info; ++ mpdu_info = &desc->rx_mpdu_info; ++ ++ rxcb->is_first_msdu = !!(le32_to_cpu(msdu_info->info0) & + RX_MSDU_DESC_INFO0_FIRST_MSDU_IN_MPDU); +- rxcb->is_last_msdu = !!(le32_to_cpu(desc->rx_msdu_info.info0) & ++ rxcb->is_last_msdu = !!(le32_to_cpu(msdu_info->info0) & + RX_MSDU_DESC_INFO0_LAST_MSDU_IN_MPDU); +- rxcb->is_continuation = !!(le32_to_cpu(desc->rx_msdu_info.info0) & ++ rxcb->is_continuation = !!(le32_to_cpu(msdu_info->info0) & + RX_MSDU_DESC_INFO0_MSDU_CONTINUATION); + rxcb->mac_id = mac_id; +- rxcb->peer_id = le32_get_bits(desc->rx_mpdu_info.peer_meta_data, +- RX_MPDU_DESC_META_DATA_PEER_ID); +- rxcb->tid = le32_get_bits(desc->rx_mpdu_info.info0, ++ rxcb->peer_id = ath12k_dp_rx_get_peer_id(ab, dp->peer_metadata_ver, ++ mpdu_info->peer_meta_data); ++ rxcb->tid = le32_get_bits(mpdu_info->info0, + RX_MPDU_DESC_INFO0_TID); + + __skb_queue_tail(&msdu_list, msdu); +diff --git a/drivers/net/wireless/ath/ath12k/hal_desc.h b/drivers/net/wireless/ath/ath12k/hal_desc.h +index 814c02f876d64..072e36365808e 100644 +--- a/drivers/net/wireless/ath/ath12k/hal_desc.h ++++ b/drivers/net/wireless/ath/ath12k/hal_desc.h +@@ -597,8 +597,30 @@ struct hal_tlv_64_hdr { + #define RX_MPDU_DESC_INFO0_MPDU_QOS_CTRL_VALID BIT(27) + #define RX_MPDU_DESC_INFO0_TID GENMASK(31, 28) + +-/* TODO revisit after meta data is concluded */ +-#define RX_MPDU_DESC_META_DATA_PEER_ID GENMASK(15, 0) ++/* Peer Metadata classification */ ++ ++/* Version 0 */ ++#define RX_MPDU_DESC_META_DATA_V0_PEER_ID GENMASK(15, 0) ++#define RX_MPDU_DESC_META_DATA_V0_VDEV_ID GENMASK(23, 16) ++ ++/* Version 1 */ ++#define RX_MPDU_DESC_META_DATA_V1_PEER_ID GENMASK(13, 0) ++#define RX_MPDU_DESC_META_DATA_V1_LOGICAL_LINK_ID GENMASK(15, 14) ++#define RX_MPDU_DESC_META_DATA_V1_VDEV_ID GENMASK(23, 16) ++#define RX_MPDU_DESC_META_DATA_V1_LMAC_ID GENMASK(25, 24) ++#define RX_MPDU_DESC_META_DATA_V1_DEVICE_ID GENMASK(28, 26) ++ ++/* Version 1A */ ++#define RX_MPDU_DESC_META_DATA_V1A_PEER_ID GENMASK(13, 0) ++#define RX_MPDU_DESC_META_DATA_V1A_VDEV_ID GENMASK(21, 14) ++#define RX_MPDU_DESC_META_DATA_V1A_LOGICAL_LINK_ID GENMASK(25, 22) ++#define RX_MPDU_DESC_META_DATA_V1A_DEVICE_ID GENMASK(28, 26) ++ ++/* Version 1B */ ++#define RX_MPDU_DESC_META_DATA_V1B_PEER_ID GENMASK(13, 0) ++#define RX_MPDU_DESC_META_DATA_V1B_VDEV_ID GENMASK(21, 14) ++#define RX_MPDU_DESC_META_DATA_V1B_HW_LINK_ID GENMASK(25, 22) ++#define RX_MPDU_DESC_META_DATA_V1B_DEVICE_ID GENMASK(28, 26) + + struct rx_mpdu_desc { + __le32 info0; /* %RX_MPDU_DESC_INFO */ +diff --git a/drivers/net/wireless/ath/ath12k/hw.h b/drivers/net/wireless/ath/ath12k/hw.h +index 2745bde0502c6..2a314cfc8cb84 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.h ++++ b/drivers/net/wireless/ath/ath12k/hw.h +@@ -78,8 +78,6 @@ + #define TARGET_NUM_WDS_ENTRIES 32 + #define TARGET_DMA_BURST_SIZE 1 + #define TARGET_RX_BATCHMODE 1 +-#define TARGET_RX_PEER_METADATA_VER_V1A 2 +-#define TARGET_RX_PEER_METADATA_VER_V1B 3 + #define TARGET_EMA_MAX_PROFILE_PERIOD 8 + + #define ATH12K_HW_DEFAULT_QUEUE 0 +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index bf33767af2c87..ef775af25093c 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -233,7 +233,7 @@ void ath12k_wmi_init_qcn9274(struct ath12k_base *ab, + config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt; + + if (test_bit(WMI_TLV_SERVICE_PEER_METADATA_V1A_V1B_SUPPORT, ab->wmi_ab.svc_map)) +- config->dp_peer_meta_data_ver = TARGET_RX_PEER_METADATA_VER_V1B; ++ config->peer_metadata_ver = ATH12K_PEER_METADATA_V1B; + } + + void ath12k_wmi_init_wcn7850(struct ath12k_base *ab, +@@ -3476,7 +3476,7 @@ ath12k_wmi_copy_resource_config(struct ath12k_wmi_resource_config_params *wmi_cf + wmi_cfg->sched_params = cpu_to_le32(tg_cfg->sched_params); + wmi_cfg->twt_ap_pdev_count = cpu_to_le32(tg_cfg->twt_ap_pdev_count); + wmi_cfg->twt_ap_sta_count = cpu_to_le32(tg_cfg->twt_ap_sta_count); +- wmi_cfg->flags2 = le32_encode_bits(tg_cfg->dp_peer_meta_data_ver, ++ wmi_cfg->flags2 = le32_encode_bits(tg_cfg->peer_metadata_ver, + WMI_RSRC_CFG_FLAGS2_RX_PEER_METADATA_VERSION); + wmi_cfg->host_service_flags = cpu_to_le32(tg_cfg->is_reg_cc_ext_event_supported << + WMI_RSRC_CFG_HOST_SVC_FLAG_REG_CC_EXT_SUPPORT_BIT); +@@ -3706,6 +3706,8 @@ int ath12k_wmi_cmd_init(struct ath12k_base *ab) + arg.num_band_to_mac = ab->num_radios; + ath12k_fill_band_to_mac_param(ab, arg.band_to_mac); + ++ ab->dp.peer_metadata_ver = arg.res_cfg.peer_metadata_ver; ++ + return ath12k_init_cmd_send(&wmi_ab->wmi[0], &arg); + } + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.h b/drivers/net/wireless/ath/ath12k/wmi.h +index e71e6c73f2495..742fe0b36cf20 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.h ++++ b/drivers/net/wireless/ath/ath12k/wmi.h +@@ -2292,6 +2292,13 @@ struct ath12k_wmi_host_mem_chunk_arg { + u32 req_id; + }; + ++enum ath12k_peer_metadata_version { ++ ATH12K_PEER_METADATA_V0, ++ ATH12K_PEER_METADATA_V1, ++ ATH12K_PEER_METADATA_V1A, ++ ATH12K_PEER_METADATA_V1B ++}; ++ + struct ath12k_wmi_resource_config_arg { + u32 num_vdevs; + u32 num_peers; +@@ -2354,10 +2361,10 @@ struct ath12k_wmi_resource_config_arg { + u32 sched_params; + u32 twt_ap_pdev_count; + u32 twt_ap_sta_count; +- bool is_reg_cc_ext_event_supported; +- u8 dp_peer_meta_data_ver; ++ enum ath12k_peer_metadata_version peer_metadata_ver; + u32 ema_max_vap_cnt; + u32 ema_max_profile_period; ++ bool is_reg_cc_ext_event_supported; + }; + + struct ath12k_wmi_init_cmd_arg { +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-per-pdev-debugfs-registration.patch b/queue-6.10/wifi-ath12k-fix-per-pdev-debugfs-registration.patch new file mode 100644 index 00000000000..bb7d2d7f96e --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-per-pdev-debugfs-registration.patch @@ -0,0 +1,47 @@ +From afd8e9d4c53baa7ad3be14121a6a30afb3f437c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 09:42:32 +0300 +Subject: wifi: ath12k: fix per pdev debugfs registration + +From: Aditya Kumar Singh + +[ Upstream commit 8dd65ccbdf91e2fe3ab6e4da158b38f81746c3b4 ] + +Function ath12k_debugfs_register() is called once inside the function +ath12k_mac_hw_register(). However, with single wiphy model, there could +be multiple pdevs registered under single hardware. Hence, need to register +debugfs for each one of them. + +Move the caller inside the loop which iterates over all underlying pdevs. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 + +Fixes: f8bde02a26b9 ("wifi: ath12k: initial debugfs support") +Signed-off-by: Aditya Kumar Singh +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240529043043.2488031-2-quic_adisi@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/mac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c +index b3530d1dd728b..2c68376a39fd3 100644 +--- a/drivers/net/wireless/ath/ath12k/mac.c ++++ b/drivers/net/wireless/ath/ath12k/mac.c +@@ -8778,9 +8778,9 @@ static int ath12k_mac_hw_register(struct ath12k_hw *ah) + ath12k_err(ar->ab, "ath12k regd update failed: %d\n", ret); + goto err_unregister_hw; + } +- } + +- ath12k_debugfs_register(ar); ++ ath12k_debugfs_register(ar); ++ } + + return 0; + +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-smatch-warnings-on-ath12k_core_suspe.patch b/queue-6.10/wifi-ath12k-fix-smatch-warnings-on-ath12k_core_suspe.patch new file mode 100644 index 00000000000..fa25f266d19 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-smatch-warnings-on-ath12k_core_suspe.patch @@ -0,0 +1,101 @@ +From cd986b4915850937aa214ab6a03fddbc74484cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 14:58:28 +0300 +Subject: wifi: ath12k: fix Smatch warnings on ath12k_core_suspend() + +From: Baochen Qiang + +[ Upstream commit 33370412eced2dc7f81f4324e109d69319cafd82 ] + +Smatch is throwing below warning: + +Commit 692921ead832 ("wifi: ath12k: flush all packets before +suspend") leads to the following Smatch static checker warning: + + drivers/net/wireless/ath/ath12k/core.c:58 ath12k_core_suspend() + warn: sleeping in atomic context + +and also gives the reason: + +drivers/net/wireless/ath/ath12k/core.c + 48 int ret, i; + 49 + 50 if (!ab->hw_params->supports_suspend) + 51 return -EOPNOTSUPP; + 52 + 53 rcu_read_lock(); + ^^^^^^^^^^^^^^^ +Disables preemption. + + 54 for (i = 0; i < ab->num_radios; i++) { + 55 ar = ath12k_mac_get_ar_by_pdev_id(ab, i); + 56 if (!ar) + 57 continue; +--> 58 ret = ath12k_mac_wait_tx_complete(ar); + ^^^^^^^ +Sleeping in atomic context. + + 59 if (ret) { + 60 ath12k_warn(ab, "failed to wait tx complete: %d\n", ret); + 61 rcu_read_unlock(); + 62 return ret; + 63 } + 64 } + 65 rcu_read_unlock(); + +But it is weird that no warning on this in run time even with +CONFIG_DEBUG_ATOMIC_SLEEP=y. With some debug it is found that this is +because: when system goes to suspend, ath12k_mac_op_stop() gets called +where then in ath12k_mac_stop() ab->pdevs_active[ar->pdev_idx] is cleared. +This results in ath12k_mac_get_ar_by_pdev_id() always returning a NULL ar, +and thereby ath12k_mac_wait_tx_complete() never gets a chance to run. + +Fix it by retrieving ar directly from ab->pdevs[].ar instead of using +ath12k_mac_get_ar_by_pdev_id(). Since ab->pdevs[].ar is set at boot time +and won't get cleared when suspend, ath12k_mac_wait_tx_complete() won't +be skipped. In addition, with ath12k_mac_get_ar_by_pdev_id() removed, +rcu_read_lock()/unlock() are not needed any more, so remove them. This +also fixes the warning above. + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 + +Fixes: 692921ead832 ("wifi: ath12k: flush all packets before suspend") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/ath12k/7a96ca11-80b5-4751-8cfc-fa637f3aa63a@moroto.mountain/ +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240511095045.9623-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/core.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c +index 6663f4e1792de..527cfa3a01ad3 100644 +--- a/drivers/net/wireless/ath/ath12k/core.c ++++ b/drivers/net/wireless/ath/ath12k/core.c +@@ -50,19 +50,16 @@ int ath12k_core_suspend(struct ath12k_base *ab) + if (!ab->hw_params->supports_suspend) + return -EOPNOTSUPP; + +- rcu_read_lock(); + for (i = 0; i < ab->num_radios; i++) { +- ar = ath12k_mac_get_ar_by_pdev_id(ab, i); ++ ar = ab->pdevs[i].ar; + if (!ar) + continue; + ret = ath12k_mac_wait_tx_complete(ar); + if (ret) { + ath12k_warn(ab, "failed to wait tx complete: %d\n", ret); +- rcu_read_unlock(); + return ret; + } + } +- rcu_read_unlock(); + + /* PM framework skips suspend_late/resume_early callbacks + * if other devices report errors in their suspend callbacks. +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-tx-completion-ring-wbm2sw-setup-fail.patch b/queue-6.10/wifi-ath12k-fix-tx-completion-ring-wbm2sw-setup-fail.patch new file mode 100644 index 00000000000..c7f8a2d7849 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-tx-completion-ring-wbm2sw-setup-fail.patch @@ -0,0 +1,117 @@ +From 163c52521e85078e28f4f66c89070a970543e45a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 12:34:27 +0530 +Subject: wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure + +From: Nithyanantham Paramasivam + +[ Upstream commit 0ce9ab2785e4e9ca0752390d8e5ab65bd08f0e78 ] + +We observe intermittent ping failures from the access point (AP) to +station (STA) in any mode (AP-STA or Mesh) configured. Specifically, +the transmission completion status is not received at tx completion +ring id 4 (WBM2SW ring4) for the packets transmitted via TCL DATA +ring id 3. This prevents freeing up tx descriptors and leads +to buffer exhaustion. + +Currently, during initialization of the WBM2SW ring, we are directly +mapping the ring number to the ring mask to obtain the ring mask +group index. This approach is causing setup failures for WBM2SW +ring 4. Similarly, during runtime, when receiving incoming +transmission completion status, the validation of the ring number by +mapping the interrupted ring mask. This is resulting in +validation failure. Thereby preventing entry into the completion +handler ath12k_dp_tx_completion_handler(). + +The existing design assumed that the ring numbers would always be +sequential and could be directly mapped with the ring mask. However, +this assumption does not hold true for WBM2SW ring 4. Therefore, +modify the design such that, instead of mapping the ring number, +the ring ID is mapped with the ring mask. + +According to this design: + +1. During initialization of the WBM2SW ring, mapping the ring ID +to the ring mask will ensure obtaining the correct ring mask group +ID. + +2. During runtime, validating the interrupted ring mask group ID +within the transmission completion group is sufficient. This +approach allows the ring ID to be derived from the interrupted ring +mask and enables entry into the completion handler. + +Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Nithyanantham Paramasivam +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240510070427.206152-1-quic_nithp@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/dp.c | 18 +++++++++++++----- + drivers/net/wireless/ath/ath12k/hw.c | 2 +- + 2 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c +index 7843c76a82c17..90476f38e8d46 100644 +--- a/drivers/net/wireless/ath/ath12k/dp.c ++++ b/drivers/net/wireless/ath/ath12k/dp.c +@@ -132,7 +132,9 @@ static int ath12k_dp_srng_find_ring_in_mask(int ring_num, const u8 *grp_mask) + static int ath12k_dp_srng_calculate_msi_group(struct ath12k_base *ab, + enum hal_ring_type type, int ring_num) + { ++ const struct ath12k_hal_tcl_to_wbm_rbm_map *map; + const u8 *grp_mask; ++ int i; + + switch (type) { + case HAL_WBM2SW_RELEASE: +@@ -140,6 +142,14 @@ static int ath12k_dp_srng_calculate_msi_group(struct ath12k_base *ab, + grp_mask = &ab->hw_params->ring_mask->rx_wbm_rel[0]; + ring_num = 0; + } else { ++ map = ab->hw_params->hal_ops->tcl_to_wbm_rbm_map; ++ for (i = 0; i < ab->hw_params->max_tx_ring; i++) { ++ if (ring_num == map[i].wbm_ring_num) { ++ ring_num = i; ++ break; ++ } ++ } ++ + grp_mask = &ab->hw_params->ring_mask->tx[0]; + } + break; +@@ -881,11 +891,9 @@ int ath12k_dp_service_srng(struct ath12k_base *ab, + enum dp_monitor_mode monitor_mode; + u8 ring_mask; + +- while (i < ab->hw_params->max_tx_ring) { +- if (ab->hw_params->ring_mask->tx[grp_id] & +- BIT(ab->hw_params->hal_ops->tcl_to_wbm_rbm_map[i].wbm_ring_num)) +- ath12k_dp_tx_completion_handler(ab, i); +- i++; ++ if (ab->hw_params->ring_mask->tx[grp_id]) { ++ i = fls(ab->hw_params->ring_mask->tx[grp_id]) - 1; ++ ath12k_dp_tx_completion_handler(ab, i); + } + + if (ab->hw_params->ring_mask->rx_err[grp_id]) { +diff --git a/drivers/net/wireless/ath/ath12k/hw.c b/drivers/net/wireless/ath/ath12k/hw.c +index f4c8270158215..5ed06c0d90e2b 100644 +--- a/drivers/net/wireless/ath/ath12k/hw.c ++++ b/drivers/net/wireless/ath/ath12k/hw.c +@@ -580,8 +580,8 @@ static const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9274 = { + static const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850 = { + .tx = { + ATH12K_TX_RING_MASK_0, ++ ATH12K_TX_RING_MASK_1, + ATH12K_TX_RING_MASK_2, +- ATH12K_TX_RING_MASK_4, + }, + .rx_mon_dest = { + }, +-- +2.43.0 + diff --git a/queue-6.10/wifi-ath12k-fix-wrong-definition-of-ce-ring-s-base-a.patch b/queue-6.10/wifi-ath12k-fix-wrong-definition-of-ce-ring-s-base-a.patch new file mode 100644 index 00000000000..8b893708f93 --- /dev/null +++ b/queue-6.10/wifi-ath12k-fix-wrong-definition-of-ce-ring-s-base-a.patch @@ -0,0 +1,65 @@ +From d64f74fc8c587d250407a17eb382570892fd4237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2024 10:40:21 +0800 +Subject: wifi: ath12k: fix wrong definition of CE ring's base address + +From: Baochen Qiang + +[ Upstream commit 0ae570703754858a77cc42b3c9fff42e9f084608 ] + +Base address of CE ring is defined as u32, currently this works +because DMA mask configured as 32 bit: + + #define ATH12K_PCI_DMA_MASK 32 + +However this mask could be changed once firmware bugs are fixed +to fully support 36 bit DMA addressing. So to protect against any +future changes to the DMA mask, change the type of the fields that +are dependent upon it. + +This is found during code review. Compile tested only. + +Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") +Signed-off-by: Baochen Qiang +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240524024021.37711-1-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/ce.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h +index 79af3b6159f1c..857bc5f9e946a 100644 +--- a/drivers/net/wireless/ath/ath12k/ce.h ++++ b/drivers/net/wireless/ath/ath12k/ce.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: BSD-3-Clause-Clear */ + /* + * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved. +- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved. ++ * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved. + */ + + #ifndef ATH12K_CE_H +@@ -119,7 +119,7 @@ struct ath12k_ce_ring { + /* Host address space */ + void *base_addr_owner_space_unaligned; + /* CE address space */ +- u32 base_addr_ce_space_unaligned; ++ dma_addr_t base_addr_ce_space_unaligned; + + /* Actual start of descriptors. + * Aligned to descriptor-size boundary. +@@ -129,7 +129,7 @@ struct ath12k_ce_ring { + void *base_addr_owner_space; + + /* CE address space */ +- u32 base_addr_ce_space; ++ dma_addr_t base_addr_ce_space; + + /* HAL ring id */ + u32 hal_ring_id; +-- +2.43.0 + diff --git a/queue-6.10/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch b/queue-6.10/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch new file mode 100644 index 00000000000..5f4a305a79d --- /dev/null +++ b/queue-6.10/wifi-brcmsmac-lcn-phy-code-is-used-for-bcm4313-2g-on.patch @@ -0,0 +1,75 @@ +From abb5edd943d98844caf2b8c1003144d72fd92c06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 16:10:37 -0700 +Subject: wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device + +From: Samasth Norway Ananda + +[ Upstream commit c636fa85feb450ca414a10010ed05361a73c93a6 ] + +The band_idx variable in the function wlc_lcnphy_tx_iqlo_cal() will +never be set to 1 as BCM4313 is the only device for which the LCN PHY +code is used. This is a 2G-only device. + +Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") +Signed-off-by: Samasth Norway Ananda +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240509231037.2014109-1-samasth.norway.ananda@oracle.com +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +index aae2cf95fe958..e472591f321bd 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +@@ -2567,7 +2567,6 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + + struct lcnphy_txgains cal_gains, temp_gains; + u16 hash; +- u8 band_idx; + int j; + u16 ncorr_override[5]; + u16 syst_coeffs[] = { 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, +@@ -2599,6 +2598,9 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + u16 *values_to_save; + struct brcms_phy_lcnphy *pi_lcn = pi->u.pi_lcnphy; + ++ if (WARN_ON(CHSPEC_IS5G(pi->radio_chanspec))) ++ return; ++ + values_to_save = kmalloc_array(20, sizeof(u16), GFP_ATOMIC); + if (NULL == values_to_save) + return; +@@ -2662,20 +2664,18 @@ wlc_lcnphy_tx_iqlo_cal(struct brcms_phy *pi, + hash = (target_gains->gm_gain << 8) | + (target_gains->pga_gain << 4) | (target_gains->pad_gain); + +- band_idx = (CHSPEC_IS5G(pi->radio_chanspec) ? 1 : 0); +- + cal_gains = *target_gains; + memset(ncorr_override, 0, sizeof(ncorr_override)); +- for (j = 0; j < iqcal_gainparams_numgains_lcnphy[band_idx]; j++) { +- if (hash == tbl_iqcal_gainparams_lcnphy[band_idx][j][0]) { ++ for (j = 0; j < iqcal_gainparams_numgains_lcnphy[0]; j++) { ++ if (hash == tbl_iqcal_gainparams_lcnphy[0][j][0]) { + cal_gains.gm_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][1]; ++ tbl_iqcal_gainparams_lcnphy[0][j][1]; + cal_gains.pga_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][2]; ++ tbl_iqcal_gainparams_lcnphy[0][j][2]; + cal_gains.pad_gain = +- tbl_iqcal_gainparams_lcnphy[band_idx][j][3]; ++ tbl_iqcal_gainparams_lcnphy[0][j][3]; + memcpy(ncorr_override, +- &tbl_iqcal_gainparams_lcnphy[band_idx][j][3], ++ &tbl_iqcal_gainparams_lcnphy[0][j][3], + sizeof(ncorr_override)); + break; + } +-- +2.43.0 + diff --git a/queue-6.10/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch b/queue-6.10/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch new file mode 100644 index 00000000000..a5c4f16ef82 --- /dev/null +++ b/queue-6.10/wifi-cfg80211-fix-typo-in-cfg80211_calculate_bitrate.patch @@ -0,0 +1,45 @@ +From e0b4f55a675fda2b9d67b271796b9a1d25e6bb4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:52 +0800 +Subject: wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit 9ee0d44f055276fe2802b2f65058e920853f4f99 ] + +rates_996 is mistakenly written as rates_969, fix it. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-2-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 082c6f9c5416e..d262d37c15193 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1504,7 +1504,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + 5120, /* 0.833333... */ + }; + u32 rates_160M[3] = { 960777777, 907400000, 816666666 }; +- u32 rates_969[3] = { 480388888, 453700000, 408333333 }; ++ u32 rates_996[3] = { 480388888, 453700000, 408333333 }; + u32 rates_484[3] = { 229411111, 216666666, 195000000 }; + u32 rates_242[3] = { 114711111, 108333333, 97500000 }; + u32 rates_106[3] = { 40000000, 37777777, 34000000 }; +@@ -1529,7 +1529,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_996)) +- result = rates_969[rate->he_gi]; ++ result = rates_996[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_40 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_484)) +-- +2.43.0 + diff --git a/queue-6.10/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch b/queue-6.10/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch new file mode 100644 index 00000000000..3cf6deac9ba --- /dev/null +++ b/queue-6.10/wifi-cfg80211-handle-2x996-ru-allocation-in-cfg80211.patch @@ -0,0 +1,45 @@ +From be8f8b06bc28d020443735e2319104abed245f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 10:06:53 +0800 +Subject: wifi: cfg80211: handle 2x996 RU allocation in + cfg80211_calculate_bitrate_he() + +From: Baochen Qiang + +[ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] + +Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in +cfg80211_calculate_bitrate_he(), leading to below warning: + +kernel: invalid HE MCS: bw:6, ru:6 +kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] + +Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. + +Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") +Signed-off-by: Baochen Qiang +Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index d262d37c15193..af6ec719567fc 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1524,7 +1524,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) + return 0; + +- if (rate->bw == RATE_INFO_BW_160) ++ if (rate->bw == RATE_INFO_BW_160 || ++ (rate->bw == RATE_INFO_BW_HE_RU && ++ rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) + result = rates_160M[rate->he_gi]; + else if (rate->bw == RATE_INFO_BW_80 || + (rate->bw == RATE_INFO_BW_HE_RU && +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-fix-iwl_mvm_get_valid_rx_ant.patch b/queue-6.10/wifi-iwlwifi-fix-iwl_mvm_get_valid_rx_ant.patch new file mode 100644 index 00000000000..362c065751c --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-fix-iwl_mvm_get_valid_rx_ant.patch @@ -0,0 +1,42 @@ +From 40a98ff27ad587105c43bf88a8adb9757210900b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2024 20:03:03 +0300 +Subject: wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant() + +From: Daniel Gabay + +[ Upstream commit 0091eda01412805e0d2c8025638ac0992102a7fc ] + +Fix incorrect use of _tx_ valid ant data in the function. + +Fixes: 4ea1ed1d14d8 ("wifi: iwlwifi: mvm: support set_antenna()") +Signed-off-by: Daniel Gabay +Reviewed-by: Emmanuel Grumbach +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240618200104.b7c6a320c7dc.I3092eb5275056f2162b9694e583c310c38568b2a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 6837d8afb9877..ded094b6b63df 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -1863,10 +1863,10 @@ static inline u8 iwl_mvm_get_valid_tx_ant(struct iwl_mvm *mvm) + + static inline u8 iwl_mvm_get_valid_rx_ant(struct iwl_mvm *mvm) + { +- u8 rx_ant = mvm->fw->valid_tx_ant; ++ u8 rx_ant = mvm->fw->valid_rx_ant; + + if (mvm->nvm_data && mvm->nvm_data->valid_rx_ant) +- rx_ant &= mvm->nvm_data->valid_tx_ant; ++ rx_ant &= mvm->nvm_data->valid_rx_ant; + + if (mvm->set_rx_ant) + rx_ant &= mvm->set_rx_ant; +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-mvm-always-unblock-emlsr-on-roc-end.patch b/queue-6.10/wifi-iwlwifi-mvm-always-unblock-emlsr-on-roc-end.patch new file mode 100644 index 00000000000..ccf93ddedec --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-mvm-always-unblock-emlsr-on-roc-end.patch @@ -0,0 +1,39 @@ +From c92460ebc84f3688772d9b9c2d49f7999dc16ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 19:51:10 +0300 +Subject: wifi: iwlwifi: mvm: always unblock EMLSR on ROC end + +From: Johannes Berg + +[ Upstream commit f9068fe4fd49f9e4409c30546d7e16238942ce62 ] + +Since we always block EMLSR for ROC, we also need to always +unblock it, even if we don't have a P2P device interface. +Fix this. + +Fixes: a1efeb823084 ("wifi: iwlwifi: mvm: Block EMLSR when a p2p/softAP vif is active") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://patch.msgid.link/20240625194805.96bbf98b716d.Id5a36954f8ebaa95142fd3d3a7a52bab5363b0bd@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index c0322349bfcd8..9d681377cbab3 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -120,7 +120,7 @@ static void iwl_mvm_cleanup_roc(struct iwl_mvm *mvm) + iwl_mvm_rm_aux_sta(mvm); + } + +- if (vif && !IS_ERR_OR_NULL(bss_vif)) ++ if (!IS_ERR_OR_NULL(bss_vif)) + iwl_mvm_unblock_esr(mvm, bss_vif, IWL_MVM_ESR_BLOCKED_ROC); + mutex_unlock(&mvm->mutex); + } +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-mvm-don-t-skip-link-selection.patch b/queue-6.10/wifi-iwlwifi-mvm-don-t-skip-link-selection.patch new file mode 100644 index 00000000000..efcb3c3c01b --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-mvm-don-t-skip-link-selection.patch @@ -0,0 +1,47 @@ +From d861008e1c05d8738eca184c15bff361c9285bc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 May 2024 15:24:59 +0300 +Subject: wifi: iwlwifi: mvm: don't skip link selection + +From: Miri Korenblit + +[ Upstream commit 46144103ace2863e26f4e911aa45200753b7dbca ] + +If we exit EMLSR due to a IWL_MVM_ESR_EXIT*, a MLO scan followed by a +link selection is scheduled with a delay of 30 seconds. +If during that 30 seconds EMLSR was blocked and unblocked +(IWL_MVM_ESR_BLOCKED*), we would still want to get the needed data from +the MLO scan and select link accordingly, and not return immediately to +EMLSR. + +Fixes: 2f33561ea8f9 ("wifi: iwlwifi: mvm: trigger link selection after exiting EMLSR") +Signed-off-by: Miri Korenblit +Reviewed-by: Johannes Berg +Link: https://msgid.link/20240512152312.caab27a8dd8f.I63f67e213d5e05416f71513a8d914917d59aa44f@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/link.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/link.c b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +index 6ec9a8e21a34e..b4a4d25b31cd2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/link.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +@@ -1082,6 +1082,13 @@ static void iwl_mvm_esr_unblocked(struct iwl_mvm *mvm, + + IWL_DEBUG_INFO(mvm, "EMLSR is unblocked\n"); + ++ /* We exited due to an EXIT reason, so MLO scan was scheduled already */ ++ if (mvmvif->last_esr_exit.reason && ++ !(mvmvif->last_esr_exit.reason & IWL_MVM_BLOCK_ESR_REASONS)) { ++ IWL_DEBUG_INFO(mvm, "Wait for MLO scan\n"); ++ return; ++ } ++ + /* + * If EMLSR was blocked for more than 30 seconds, or the last link + * selection decided to not enter EMLSR, trigger a new scan. +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-mvm-fix-re-enabling-emlsr.patch b/queue-6.10/wifi-iwlwifi-mvm-fix-re-enabling-emlsr.patch new file mode 100644 index 00000000000..7ef8337cc96 --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-mvm-fix-re-enabling-emlsr.patch @@ -0,0 +1,58 @@ +From f1a3353a26218c32e529dbb9f19bed000ce38f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 14:05:06 +0300 +Subject: wifi: iwlwifi: mvm: fix re-enabling EMLSR + +From: Miri Korenblit + +[ Upstream commit bd40215b19d255b433a91a8bb8088937e5db4284 ] + +When EMLSR gets unblocked, the current code checks if the last exit was +due to an EXIT reason (as opposed to a BLOCKING one), and if so, it +does nothing, as in this case a MLO scan was scheduled to run in 30 +seconds. + +But the code doesn't consider the time that passed from the last exit, +so if immediately after the exit a blocker occurred (e.g. non-BSS +interface), and lasts for more than 30 seconds, then the MLO scan and the +following link selection will decide not to enter EMLSR, and when the +unblocking event finally happens, the reason is still set to the EXIT one, +so it will do nothing, and we will not have the chance to re-enable EMLSR. + +Fix this by checking also the time that has passed since the last exit, +only if it is less than 30 seconds, we can count on the scheduled MLO +scan. + +Note that clearing the reason itself can't be done since it is needed +for the EMLSR prevention mechanism. + +Fixes: 2f33561ea8f9 ("wifi: iwlwifi: mvm: trigger link selection after exiting EMLSR") +Signed-off-by: Miri Korenblit +Reviewed-by: Johannes Berg +Link: https://msgid.link/20240605140327.58556fc4cfa9.I4c55b3cd9f20b21b37f28258d0fb6842ba413966@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/link.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/link.c b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +index b4a4d25b31cd2..92ac6cc40faa7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/link.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/link.c +@@ -1082,8 +1082,10 @@ static void iwl_mvm_esr_unblocked(struct iwl_mvm *mvm, + + IWL_DEBUG_INFO(mvm, "EMLSR is unblocked\n"); + +- /* We exited due to an EXIT reason, so MLO scan was scheduled already */ +- if (mvmvif->last_esr_exit.reason && ++ /* If we exited due to an EXIT reason, and the exit was in less than ++ * 30 seconds, then a MLO scan was scheduled already. ++ */ ++ if (!need_new_sel && + !(mvmvif->last_esr_exit.reason & IWL_MVM_BLOCK_ESR_REASONS)) { + IWL_DEBUG_INFO(mvm, "Wait for MLO scan\n"); + return; +-- +2.43.0 + diff --git a/queue-6.10/wifi-iwlwifi-mvm-separate-non-bss-roc-emlsr-blocking.patch b/queue-6.10/wifi-iwlwifi-mvm-separate-non-bss-roc-emlsr-blocking.patch new file mode 100644 index 00000000000..8cdbca81070 --- /dev/null +++ b/queue-6.10/wifi-iwlwifi-mvm-separate-non-bss-roc-emlsr-blocking.patch @@ -0,0 +1,104 @@ +From f842d0e598420f46b5f47e66b47fa1b12748a591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jun 2024 14:07:36 +0300 +Subject: wifi: iwlwifi: mvm: separate non-BSS/ROC EMLSR blocking + +From: Johannes Berg + +[ Upstream commit 5f1fee9644759d07f3d3a468389c7c18027083d7 ] + +If non-BSS and remain-on-channel (ROC) blocking were to occur +simultaneously, they'd step on each other's toes, unblocking +when not yet supported. Disentangle these bits, and ROC doesn't +need to use the non_bss_link() function then. + +Fixes: a1efeb823084 ("wifi: iwlwifi: mvm: Block EMLSR when a p2p/softAP vif is active") +Signed-off-by: Johannes Berg +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20240605140556.461fcf7b95bb.Id0d21dcb739d426ff15ec068b5df8abaab58884d@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 10 +++++++--- + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 5 ++++- + drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 5 +++-- + 3 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index dac6155ae1bd0..259afecd1a98d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -4861,6 +4861,7 @@ int iwl_mvm_roc_common(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + const struct iwl_mvm_roc_ops *ops) + { + struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); ++ struct ieee80211_vif *bss_vif = iwl_mvm_get_bss_vif(mvm); + u32 lmac_id; + int ret; + +@@ -4873,9 +4874,12 @@ int iwl_mvm_roc_common(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + */ + flush_work(&mvm->roc_done_wk); + +- ret = iwl_mvm_esr_non_bss_link(mvm, vif, 0, true); +- if (ret) +- return ret; ++ if (!IS_ERR_OR_NULL(bss_vif)) { ++ ret = iwl_mvm_block_esr_sync(mvm, bss_vif, ++ IWL_MVM_ESR_BLOCKED_ROC); ++ if (ret) ++ return ret; ++ } + + mutex_lock(&mvm->mutex); + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 0a1959bd40799..6837d8afb9877 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -360,7 +360,9 @@ struct iwl_mvm_vif_link_info { + * @IWL_MVM_ESR_BLOCKED_WOWLAN: WOWLAN is preventing the enablement of EMLSR + * @IWL_MVM_ESR_BLOCKED_TPT: block EMLSR when there is not enough traffic + * @IWL_MVM_ESR_BLOCKED_FW: FW didn't recommended/forced exit from EMLSR +- * @IWL_MVM_ESR_BLOCKED_NON_BSS: An active non-bssid link's preventing EMLSR ++ * @IWL_MVM_ESR_BLOCKED_NON_BSS: An active non-BSS interface's link is ++ * preventing EMLSR ++ * @IWL_MVM_ESR_BLOCKED_ROC: remain-on-channel is preventing EMLSR + * @IWL_MVM_ESR_EXIT_MISSED_BEACON: exited EMLSR due to missed beacons + * @IWL_MVM_ESR_EXIT_LOW_RSSI: link is deactivated/not allowed for EMLSR + * due to low RSSI. +@@ -377,6 +379,7 @@ enum iwl_mvm_esr_state { + IWL_MVM_ESR_BLOCKED_TPT = 0x4, + IWL_MVM_ESR_BLOCKED_FW = 0x8, + IWL_MVM_ESR_BLOCKED_NON_BSS = 0x10, ++ IWL_MVM_ESR_BLOCKED_ROC = 0x20, + IWL_MVM_ESR_EXIT_MISSED_BEACON = 0x10000, + IWL_MVM_ESR_EXIT_LOW_RSSI = 0x20000, + IWL_MVM_ESR_EXIT_COEX = 0x40000, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index 31bc80cdcb7d5..c0322349bfcd8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -47,6 +47,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm, + + static void iwl_mvm_cleanup_roc(struct iwl_mvm *mvm) + { ++ struct ieee80211_vif *bss_vif = iwl_mvm_get_bss_vif(mvm); + struct ieee80211_vif *vif = mvm->p2p_device_vif; + + lockdep_assert_held(&mvm->mutex); +@@ -119,9 +120,9 @@ static void iwl_mvm_cleanup_roc(struct iwl_mvm *mvm) + iwl_mvm_rm_aux_sta(mvm); + } + ++ if (vif && !IS_ERR_OR_NULL(bss_vif)) ++ iwl_mvm_unblock_esr(mvm, bss_vif, IWL_MVM_ESR_BLOCKED_ROC); + mutex_unlock(&mvm->mutex); +- if (vif) +- iwl_mvm_esr_non_bss_link(mvm, vif, 0, false); + } + + void iwl_mvm_roc_done_wk(struct work_struct *wk) +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-add-ieee80211_tdls_sta_link_id.patch b/queue-6.10/wifi-mac80211-add-ieee80211_tdls_sta_link_id.patch new file mode 100644 index 00000000000..f51ef385121 --- /dev/null +++ b/queue-6.10/wifi-mac80211-add-ieee80211_tdls_sta_link_id.patch @@ -0,0 +1,67 @@ +From 3bdf99157fe709b961a45e9b82e9be05e407a8bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 14:35:56 +0200 +Subject: wifi: mac80211: add ieee80211_tdls_sta_link_id() + +From: Johannes Berg + +[ Upstream commit d42fcaece03654a4b21d2da88d68ed913e0b6c46 ] + +We've open-coded this twice and will need it again, +add ieee80211_tdls_sta_link_id() to get the one link +ID for a TDLS STA. + +Reviewed-by: Miriam Rachel Korenblit +Link: https://patch.msgid.link/20240612143707.9f8141ae1725.I343822bbba0ae08dedb2f54a0ce87f2ae5ebeb2b@changeid +Signed-off-by: Johannes Berg +Stable-dep-of: 0b2d9d9aec2b ("wifi: mac80211: correcty limit wider BW TDLS STAs") +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.h | 6 ++++++ + net/mac80211/tx.c | 6 ++---- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h +index bd5e2f7146f67..9195d5a2de0a8 100644 +--- a/net/mac80211/sta_info.h ++++ b/net/mac80211/sta_info.h +@@ -727,6 +727,12 @@ struct sta_info { + struct ieee80211_sta sta; + }; + ++static inline int ieee80211_tdls_sta_link_id(struct sta_info *sta) ++{ ++ /* TDLS STA can only have a single link */ ++ return sta->sta.valid_links ? __ffs(sta->sta.valid_links) : 0; ++} ++ + static inline enum nl80211_plink_state sta_plink_state(struct sta_info *sta) + { + #ifdef CONFIG_MAC80211_MESH +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index f861d99e5f055..72a9ba8bc5fd9 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2774,8 +2774,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, + + if (tdls_peer) { + /* For TDLS only one link can be valid with peer STA */ +- int tdls_link_id = sta->sta.valid_links ? +- __ffs(sta->sta.valid_links) : 0; ++ int tdls_link_id = ieee80211_tdls_sta_link_id(sta); + struct ieee80211_link_data *link; + + /* DA SA BSSID */ +@@ -3101,8 +3100,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) + case NL80211_IFTYPE_STATION: + if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) { + /* For TDLS only one link can be valid with peer STA */ +- int tdls_link_id = sta->sta.valid_links ? +- __ffs(sta->sta.valid_links) : 0; ++ int tdls_link_id = ieee80211_tdls_sta_link_id(sta); + struct ieee80211_link_data *link; + + /* DA SA BSSID */ +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-cancel-multi-link-reconf-work-on-disco.patch b/queue-6.10/wifi-mac80211-cancel-multi-link-reconf-work-on-disco.patch new file mode 100644 index 00000000000..06acdf33dc9 --- /dev/null +++ b/queue-6.10/wifi-mac80211-cancel-multi-link-reconf-work-on-disco.patch @@ -0,0 +1,50 @@ +From 28f17ac810de47c0360a0cc851d46a65b532b814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:10:33 +0200 +Subject: wifi: mac80211: cancel multi-link reconf work on disconnect + +From: Johannes Berg + +[ Upstream commit 53b739fd46462dc40fd18390d76f2ee05c18ea3a ] + +This work shouldn't run after we're disconnecting. Cancel it earlier +(and then don't cancel it in stop later.) + +Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element") +Reviewed-by: Ilan Peer +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240506211034.ac754794279f.Ib9fbb1dab50c6b67f6de9be09a6c452ce89bbd50@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index edac1578d425c..72e38e42f6da0 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3289,6 +3289,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, + + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &ifmgd->neg_ttlm_timeout_work); ++ ++ sdata->u.mgd.removed_links = 0; ++ wiphy_delayed_work_cancel(sdata->local->hw.wiphy, ++ &sdata->u.mgd.ml_reconf_work); ++ + ieee80211_vif_set_links(sdata, 0, 0); + + ifmgd->mcast_seq_last = IEEE80211_SN_MODULO; +@@ -8708,8 +8713,6 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) + &ifmgd->teardown_ttlm_work); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &ifmgd->tdls_peer_del_work); +- wiphy_delayed_work_cancel(sdata->local->hw.wiphy, +- &ifmgd->ml_reconf_work); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &ifmgd->neg_ttlm_timeout_work); +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-cancel-ttlm-teardown-work-earlier.patch b/queue-6.10/wifi-mac80211-cancel-ttlm-teardown-work-earlier.patch new file mode 100644 index 00000000000..f1ee77a363d --- /dev/null +++ b/queue-6.10/wifi-mac80211-cancel-ttlm-teardown-work-earlier.patch @@ -0,0 +1,47 @@ +From cf87b0c1b0534a133862015f9a582b478ca1ff9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:10:34 +0200 +Subject: wifi: mac80211: cancel TTLM teardown work earlier + +From: Johannes Berg + +[ Upstream commit 3567bd6dcd1467d2ad0f597be94114c6f9c62680 ] + +It shouldn't be possible to run this after disconnecting, so +cancel the work earlier. + +Fixes: a17a58ad2ff2 ("wifi: mac80211: add support for tearing down negotiated TTLM") +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240506211034.096a10ccebec.I5584a21c27eb9b3e87b9e26380b627114b32ccba@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 72e38e42f6da0..0a9949bbd7576 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3294,6 +3294,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &sdata->u.mgd.ml_reconf_work); + ++ wiphy_work_cancel(sdata->local->hw.wiphy, ++ &ifmgd->teardown_ttlm_work); ++ + ieee80211_vif_set_links(sdata, 0, 0); + + ifmgd->mcast_seq_last = IEEE80211_SN_MODULO; +@@ -8709,8 +8712,6 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata) + &ifmgd->beacon_connection_loss_work); + wiphy_work_cancel(sdata->local->hw.wiphy, + &ifmgd->csa_connection_drop_work); +- wiphy_work_cancel(sdata->local->hw.wiphy, +- &ifmgd->teardown_ttlm_work); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &ifmgd->tdls_peer_del_work); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work); +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-correcty-limit-wider-bw-tdls-stas.patch b/queue-6.10/wifi-mac80211-correcty-limit-wider-bw-tdls-stas.patch new file mode 100644 index 00000000000..e4fbc8e941d --- /dev/null +++ b/queue-6.10/wifi-mac80211-correcty-limit-wider-bw-tdls-stas.patch @@ -0,0 +1,59 @@ +From d4978a9d94e9f12f17f909eeee4de4bfbd3ce46f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 14:35:57 +0200 +Subject: wifi: mac80211: correcty limit wider BW TDLS STAs + +From: Johannes Berg + +[ Upstream commit 0b2d9d9aec2be212a28b7d14b5462c56d9adc3a3 ] + +When updating a channel context, the code can apply wider +bandwidth TDLS STA channel definitions to each and every +channel context used by the device, an approach that will +surely lead to problems if there is ever more than one. + +Restrict the wider BW TDLS STA consideration to only TDLS +STAs that are actually related to links using the channel +context being updated. + +Fixes: 0fabfaafec3a ("mac80211: upgrade BW of TDLS peers when possible") +Reviewed-by: Miriam Rachel Korenblit +Link: https://patch.msgid.link/20240612143707.1ad989acecde.I5c75c94d95c3f4ea84f8ff4253189f4b13bad5c3@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/chan.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c +index 380695fdc32fa..e6a7ff6ca6797 100644 +--- a/net/mac80211/chan.c ++++ b/net/mac80211/chan.c +@@ -775,13 +775,24 @@ void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local, + + /* TDLS peers can sometimes affect the chandef width */ + list_for_each_entry(sta, &local->sta_list, list) { ++ struct ieee80211_sub_if_data *sdata = sta->sdata; + struct ieee80211_chan_req tdls_chanreq = {}; ++ int tdls_link_id; ++ + if (!sta->uploaded || + !test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) || + !test_sta_flag(sta, WLAN_STA_AUTHORIZED) || + !sta->tdls_chandef.chan) + continue; + ++ tdls_link_id = ieee80211_tdls_sta_link_id(sta); ++ link = sdata_dereference(sdata->link[tdls_link_id], sdata); ++ if (!link) ++ continue; ++ ++ if (rcu_access_pointer(link->conf->chanctx_conf) != conf) ++ continue; ++ + tdls_chanreq.oper = sta->tdls_chandef; + + /* note this always fills and returns &tmp if compat */ +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-fix-ttlm-teardown-work.patch b/queue-6.10/wifi-mac80211-fix-ttlm-teardown-work.patch new file mode 100644 index 00000000000..69f7df2f3e2 --- /dev/null +++ b/queue-6.10/wifi-mac80211-fix-ttlm-teardown-work.patch @@ -0,0 +1,37 @@ +From 23e404defccf56ce26b1d708eb97fdf1e03d369a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:18:52 +0200 +Subject: wifi: mac80211: fix TTLM teardown work + +From: Johannes Berg + +[ Upstream commit 2fe0a605d083b884490ee4de02be071b5b4291b1 ] + +The worker calculates the wrong sdata pointer, so if it ever +runs, it'll crash. Fix that. + +Fixes: a17a58ad2ff2 ("wifi: mac80211: add support for tearing down negotiated TTLM") +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240506211853.e6471800c76d.I8b7c2d6984c89a11cd33d1a610e9645fa965f6e1@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index a5f2d3cfe60d2..edac1578d425c 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -6834,7 +6834,7 @@ static void ieee80211_teardown_ttlm_work(struct wiphy *wiphy, + u16 new_dormant_links; + struct ieee80211_sub_if_data *sdata = + container_of(work, struct ieee80211_sub_if_data, +- u.mgd.neg_ttlm_timeout_work.work); ++ u.mgd.teardown_ttlm_work); + + if (!sdata->vif.neg_ttlm.valid) + return; +-- +2.43.0 + diff --git a/queue-6.10/wifi-mac80211-reset-negotiated-ttlm-on-disconnect.patch b/queue-6.10/wifi-mac80211-reset-negotiated-ttlm-on-disconnect.patch new file mode 100644 index 00000000000..199600a7e02 --- /dev/null +++ b/queue-6.10/wifi-mac80211-reset-negotiated-ttlm-on-disconnect.patch @@ -0,0 +1,36 @@ +From e340774595460c88ee212ba6ad803e97020ab880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 21:18:59 +0200 +Subject: wifi: mac80211: reset negotiated TTLM on disconnect + +From: Johannes Berg + +[ Upstream commit 609c12a2af046c3674af2d5c7978b025718de5e8 ] + +The negotiated TTLM data must be reset on disconnect, otherwise +it may end up getting reused on another connection. Fix that. + +Fixes: 8f500fbc6c65 ("wifi: mac80211: process and save negotiated TID to Link mapping request") +Reviewed-by: Miriam Rachel Korenblit +Link: https://msgid.link/20240506211858.04142e8fe01c.Ia144457e086ebd8ddcfa31bdf5ff210b4b351c22@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mlme.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 0a9949bbd7576..ad2ce9c92ba8a 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3287,6 +3287,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata, + sizeof(sdata->u.mgd.ttlm_info)); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, &ifmgd->ttlm_work); + ++ memset(&sdata->vif.neg_ttlm, 0, sizeof(sdata->vif.neg_ttlm)); + wiphy_delayed_work_cancel(sdata->local->hw.wiphy, + &ifmgd->neg_ttlm_timeout_work); + +-- +2.43.0 + diff --git a/queue-6.10/wifi-nl80211-expose-can-monitor-channel-property.patch b/queue-6.10/wifi-nl80211-expose-can-monitor-channel-property.patch new file mode 100644 index 00000000000..ee5be6d114d --- /dev/null +++ b/queue-6.10/wifi-nl80211-expose-can-monitor-channel-property.patch @@ -0,0 +1,41 @@ +From 8a56d50cdfed19c3cd24e5d6b078ec90408fec0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 May 2024 12:09:42 +0200 +Subject: wifi: nl80211: expose can-monitor channel property + +From: Johannes Berg + +[ Upstream commit f3269b7912f75b6e34926334377ede45656a8950 ] + +It may be possible to monitor on disabled channels per the +can-monitor flag, but evidently I forgot to expose that out +to userspace. Fix that. + +Fixes: a110a3b79177 ("wifi: cfg80211: optionally support monitor on disabled channels") +Reviewed-by: Miriam Rachel Korenblit +Reviewed-by: Ilan Peer +Signed-off-by: Johannes Berg +Link: https://msgid.link/20240523120945.9a2c19a51e53.I50fa1b1a18b70f63a5095131ac23dc2e71f3d426@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 72c7bf5585816..0fd075238fc74 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -1208,6 +1208,9 @@ static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, + if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) && + nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT)) + goto nla_put_failure; ++ if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) && ++ nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR)) ++ goto nla_put_failure; + } + + if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtl8xxxu-8188f-limit-tx-power-index.patch b/queue-6.10/wifi-rtl8xxxu-8188f-limit-tx-power-index.patch new file mode 100644 index 00000000000..1468c716f9e --- /dev/null +++ b/queue-6.10/wifi-rtl8xxxu-8188f-limit-tx-power-index.patch @@ -0,0 +1,69 @@ +From 76ab450354f09dabad58b8e3841e9b8d5943a113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2024 16:00:37 +0200 +Subject: wifi: rtl8xxxu: 8188f: Limit TX power index + +From: Martin Kaistra + +[ Upstream commit d0b4b8ef083ca46d5d318e66a30fb80e0abbb90d ] + +TX power index is read from the efuse on init, the values get written to +the TX power registers when the channel gets switched. + +When the chip has not yet been calibrated, the efuse values are 0xFF, +which on some boards leads to USB timeouts for reading/writing registers +after the first frames have been sent. + +The vendor driver (v5.11.5-1) checks for these invalid values and sets +default values instead. Implement something similar in +rtl8188fu_parse_efuse(). + +Fixes: c888183b21f3 ("wifi: rtl8xxxu: Support new chip RTL8188FU") +Signed-off-by: Martin Kaistra +Reviewed-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240624140037.231657-1-martin.kaistra@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/8188f.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/8188f.c b/drivers/net/wireless/realtek/rtl8xxxu/8188f.c +index bd5a0603b4a23..3abf14d7044f3 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/8188f.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/8188f.c +@@ -697,9 +697,14 @@ static void rtl8188fu_init_statistics(struct rtl8xxxu_priv *priv) + rtl8xxxu_write32(priv, REG_OFDM0_FA_RSTC, val32); + } + ++#define TX_POWER_INDEX_MAX 0x3F ++#define TX_POWER_INDEX_DEFAULT_CCK 0x22 ++#define TX_POWER_INDEX_DEFAULT_HT40 0x27 ++ + static int rtl8188fu_parse_efuse(struct rtl8xxxu_priv *priv) + { + struct rtl8188fu_efuse *efuse = &priv->efuse_wifi.efuse8188fu; ++ int i; + + if (efuse->rtl_id != cpu_to_le16(0x8129)) + return -EINVAL; +@@ -713,6 +718,16 @@ static int rtl8188fu_parse_efuse(struct rtl8xxxu_priv *priv) + efuse->tx_power_index_A.ht40_base, + sizeof(efuse->tx_power_index_A.ht40_base)); + ++ for (i = 0; i < ARRAY_SIZE(priv->cck_tx_power_index_A); i++) { ++ if (priv->cck_tx_power_index_A[i] > TX_POWER_INDEX_MAX) ++ priv->cck_tx_power_index_A[i] = TX_POWER_INDEX_DEFAULT_CCK; ++ } ++ ++ for (i = 0; i < ARRAY_SIZE(priv->ht40_1s_tx_power_index_A); i++) { ++ if (priv->ht40_1s_tx_power_index_A[i] > TX_POWER_INDEX_MAX) ++ priv->ht40_1s_tx_power_index_A[i] = TX_POWER_INDEX_DEFAULT_HT40; ++ } ++ + priv->ofdm_tx_power_diff[0].a = efuse->tx_power_index_A.ht20_ofdm_1s_diff.a; + priv->ht20_tx_power_diff[0].a = efuse->tx_power_index_A.ht20_ofdm_1s_diff.b; + +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-8852b-fix-definition-of-kip-register-numb.patch b/queue-6.10/wifi-rtw89-8852b-fix-definition-of-kip-register-numb.patch new file mode 100644 index 00000000000..66ba8f67a7c --- /dev/null +++ b/queue-6.10/wifi-rtw89-8852b-fix-definition-of-kip-register-numb.patch @@ -0,0 +1,38 @@ +From 527710f83668f6300658735e5401cc83e794da33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 20:36:17 +0800 +Subject: wifi: rtw89: 8852b: fix definition of KIP register number + +From: Kuan-Chung Chen + +[ Upstream commit 2f35712ab82683554c660bc2456f05785835efbe ] + +An incorrect definition caused DPK to fail to backup and +restore a set of KIP registers. Fixing this will improve +RX throughput from 902 to 997 Mbps. + +Fixes: 5b8471ace5b1 ("wifi: rtw89: 8852b: rfk: add DPK") +Signed-off-by: Kuan-Chung Chen +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240621123617.6687-2-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c +index 259df67836a0e..a2fa1d339bc21 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852b_rfk.c +@@ -20,7 +20,7 @@ + #define RTW8852B_RF_REL_VERSION 34 + #define RTW8852B_DPK_VER 0x0d + #define RTW8852B_DPK_RF_PATH 2 +-#define RTW8852B_DPK_KIP_REG_NUM 2 ++#define RTW8852B_DPK_KIP_REG_NUM 3 + + #define _TSSI_DE_MASK GENMASK(21, 12) + #define ADDC_T_AVG 100 +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-8852b-restore-setting-for-rfe-type-5-afte.patch b/queue-6.10/wifi-rtw89-8852b-restore-setting-for-rfe-type-5-afte.patch new file mode 100644 index 00000000000..aaf8d53abe0 --- /dev/null +++ b/queue-6.10/wifi-rtw89-8852b-restore-setting-for-rfe-type-5-afte.patch @@ -0,0 +1,49 @@ +From 235855baefaa47bd93784ee73827f1b66e1278f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2024 09:35:43 +0800 +Subject: wifi: rtw89: 8852b: restore setting for RFE type 5 after device + resume + +From: Ping-Ke Shih + +[ Upstream commit 2c1fc7c24cd47396580c5a7b238673da618aeedd ] + +The RFE type 5 set SPS analog parameters only once at probe stage, but the +setting is missing after suspend/resume, so remove restriction and set the +value when card power on/off. + +Fixes: 3ef60f44830a ("wifi: rtw89: 8852b: update hardware parameters for RFE type 5") +Signed-off-by: Ping-Ke Shih +Link: https://msgid.link/20240517013543.11533-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/rtw8852b.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852b.c b/drivers/net/wireless/realtek/rtw89/rtw8852b.c +index d351096fa4b41..767de9a2de7e4 100644 +--- a/drivers/net/wireless/realtek/rtw89/rtw8852b.c ++++ b/drivers/net/wireless/realtek/rtw89/rtw8852b.c +@@ -403,6 +403,8 @@ static int rtw8852b_pwr_on_func(struct rtw89_dev *rtwdev) + u32 val32; + u32 ret; + ++ rtw8852b_pwr_sps_ana(rtwdev); ++ + rtw89_write32_clr(rtwdev, R_AX_SYS_PW_CTRL, B_AX_AFSM_WLSUS_EN | + B_AX_AFSM_PCIE_SUS_EN); + rtw89_write32_set(rtwdev, R_AX_SYS_PW_CTRL, B_AX_DIS_WLBT_PDNSUSEN_SOPC); +@@ -530,9 +532,7 @@ static int rtw8852b_pwr_off_func(struct rtw89_dev *rtwdev) + u32 val32; + u32 ret; + +- /* Only do once during probe stage after reading efuse */ +- if (!test_bit(RTW89_FLAG_PROBE_DONE, rtwdev->flags)) +- rtw8852b_pwr_sps_ana(rtwdev); ++ rtw8852b_pwr_sps_ana(rtwdev); + + ret = rtw89_mac_write_xtal_si(rtwdev, XTAL_SI_ANAPAR_WL, XTAL_SI_RFC2RF, + XTAL_SI_RFC2RF); +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-8852c-correct-logic-and-restore-pci-phy-e.patch b/queue-6.10/wifi-rtw89-8852c-correct-logic-and-restore-pci-phy-e.patch new file mode 100644 index 00000000000..9242a3741a1 --- /dev/null +++ b/queue-6.10/wifi-rtw89-8852c-correct-logic-and-restore-pci-phy-e.patch @@ -0,0 +1,104 @@ +From 3de7b0dad745edd61ba5820532a21f7749028c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 12:01:39 +0800 +Subject: wifi: rtw89: 8852c: correct logic and restore PCI PHY EQ after device + resume + +From: Ping-Ke Shih + +[ Upstream commit 9e305a6f01ad539dc134b8017521495378d8e00e ] + +PCI PHY EQ value is missing after card off/on, so update the value after +device resume. The original commit only updates once at probe stage, which +could lead problem after suspend/resume. + +The logic should be read a value from one register and write to another +register with a mask to avoid affecting unrelated bits. + +Fixes: a78d33a1286c ("wifi: rtw89: 8852c: disable PCI PHY EQ to improve compatibility") +Signed-off-by: Ping-Ke Shih +Link: https://msgid.link/20240521040139.20311-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/pci.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index 03bbcf9b6737c..b36aa9a6bb3fc 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -2330,21 +2330,20 @@ static void rtw89_pci_disable_eq(struct rtw89_dev *rtwdev) + u32 backup_aspm; + u32 phy_offset; + u16 oobs_val; +- u16 val16; + int ret; + + if (rtwdev->chip->chip_id != RTL8852C) + return; + +- backup_aspm = rtw89_read32(rtwdev, R_AX_PCIE_MIX_CFG_V1); +- rtw89_write32_clr(rtwdev, R_AX_PCIE_MIX_CFG_V1, B_AX_ASPM_CTRL_MASK); +- + g1_oobs = rtw89_read16_mask(rtwdev, R_RAC_DIRECT_OFFSET_G1 + + RAC_ANA09 * RAC_MULT, BAC_OOBS_SEL); + g2_oobs = rtw89_read16_mask(rtwdev, R_RAC_DIRECT_OFFSET_G2 + + RAC_ANA09 * RAC_MULT, BAC_OOBS_SEL); + if (g1_oobs && g2_oobs) +- goto out; ++ return; ++ ++ backup_aspm = rtw89_read32(rtwdev, R_AX_PCIE_MIX_CFG_V1); ++ rtw89_write32_clr(rtwdev, R_AX_PCIE_MIX_CFG_V1, B_AX_ASPM_CTRL_MASK); + + ret = rtw89_pci_get_phy_offset_by_link_speed(rtwdev, &phy_offset); + if (ret) +@@ -2354,15 +2353,16 @@ static void rtw89_pci_disable_eq(struct rtw89_dev *rtwdev) + rtw89_write16(rtwdev, phy_offset + RAC_ANA10 * RAC_MULT, ADDR_SEL_PINOUT_DIS_VAL); + rtw89_write16_set(rtwdev, phy_offset + RAC_ANA19 * RAC_MULT, B_PCIE_BIT_RD_SEL); + +- val16 = rtw89_read16_mask(rtwdev, phy_offset + RAC_ANA1F * RAC_MULT, +- OOBS_LEVEL_MASK); +- oobs_val = u16_encode_bits(val16, OOBS_SEN_MASK); ++ oobs_val = rtw89_read16_mask(rtwdev, phy_offset + RAC_ANA1F * RAC_MULT, ++ OOBS_LEVEL_MASK); + +- rtw89_write16(rtwdev, R_RAC_DIRECT_OFFSET_G1 + RAC_ANA03 * RAC_MULT, oobs_val); ++ rtw89_write16_mask(rtwdev, R_RAC_DIRECT_OFFSET_G1 + RAC_ANA03 * RAC_MULT, ++ OOBS_SEN_MASK, oobs_val); + rtw89_write16_set(rtwdev, R_RAC_DIRECT_OFFSET_G1 + RAC_ANA09 * RAC_MULT, + BAC_OOBS_SEL); + +- rtw89_write16(rtwdev, R_RAC_DIRECT_OFFSET_G2 + RAC_ANA03 * RAC_MULT, oobs_val); ++ rtw89_write16_mask(rtwdev, R_RAC_DIRECT_OFFSET_G2 + RAC_ANA03 * RAC_MULT, ++ OOBS_SEN_MASK, oobs_val); + rtw89_write16_set(rtwdev, R_RAC_DIRECT_OFFSET_G2 + RAC_ANA09 * RAC_MULT, + BAC_OOBS_SEL); + +@@ -2783,7 +2783,6 @@ static int rtw89_pci_ops_mac_pre_init_ax(struct rtw89_dev *rtwdev) + const struct rtw89_pci_info *info = rtwdev->pci_info; + int ret; + +- rtw89_pci_disable_eq(rtwdev); + rtw89_pci_ber(rtwdev); + rtw89_pci_rxdma_prefth(rtwdev); + rtw89_pci_l1off_pwroff(rtwdev); +@@ -4155,6 +4154,7 @@ static int __maybe_unused rtw89_pci_resume(struct device *dev) + B_AX_SEL_REQ_ENTR_L1); + } + rtw89_pci_l2_hci_ldo(rtwdev); ++ rtw89_pci_disable_eq(rtwdev); + rtw89_pci_filter_out(rtwdev); + rtw89_pci_link_cfg(rtwdev); + rtw89_pci_l1ss_cfg(rtwdev); +@@ -4289,6 +4289,7 @@ int rtw89_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err_clear_resource; + } + ++ rtw89_pci_disable_eq(rtwdev); + rtw89_pci_filter_out(rtwdev); + rtw89_pci_link_cfg(rtwdev); + rtw89_pci_l1ss_cfg(rtwdev); +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch b/queue-6.10/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch new file mode 100644 index 00000000000..25e37a1857f --- /dev/null +++ b/queue-6.10/wifi-rtw89-fix-array-index-mistake-in-rtw89_sta_info.patch @@ -0,0 +1,44 @@ +From d8b8703d397aabef03b47d5fef29d53585f00c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2024 00:05:10 +0300 +Subject: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() + +From: Aleksandr Mishin + +[ Upstream commit 85099c7ce4f9e64c66aa397cd9a37473637ab891 ] + +In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size. +But then 'rate->he_gi' is used as array index instead of 'status->he_gi'. +This can lead to go beyond array boundaries in case of 'rate->he_gi' is +not equal to 'status->he_gi' and is bigger than array size. Looks like +"copy-paste" mistake. + +Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") +Signed-off-by: Aleksandr Mishin +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240703210510.11089-1-amishin@t-argos.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c +index affffc4092ba3..5b4077c9fd286 100644 +--- a/drivers/net/wireless/realtek/rtw89/debug.c ++++ b/drivers/net/wireless/realtek/rtw89/debug.c +@@ -3531,7 +3531,7 @@ static void rtw89_sta_info_get_iter(void *data, struct ieee80211_sta *sta) + case RX_ENC_HE: + seq_printf(m, "HE %dSS MCS-%d GI:%s", status->nss, status->rate_idx, + status->he_gi <= NL80211_RATE_INFO_HE_GI_3_2 ? +- he_gi_str[rate->he_gi] : "N/A"); ++ he_gi_str[status->he_gi] : "N/A"); + break; + case RX_ENC_EHT: + seq_printf(m, "EHT %dSS MCS-%d GI:%s", status->nss, status->rate_idx, +-- +2.43.0 + diff --git a/queue-6.10/wifi-rtw89-wow-fix-gtk-offload-h2c-skbuff-issue.patch b/queue-6.10/wifi-rtw89-wow-fix-gtk-offload-h2c-skbuff-issue.patch new file mode 100644 index 00000000000..12f00f6d192 --- /dev/null +++ b/queue-6.10/wifi-rtw89-wow-fix-gtk-offload-h2c-skbuff-issue.patch @@ -0,0 +1,101 @@ +From 5b9ea56387037b1f17b66fe76228d1d3dade7d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 13:58:22 +0800 +Subject: wifi: rtw89: wow: fix GTK offload H2C skbuff issue + +From: Chih-Kang Chang + +[ Upstream commit dda364c345913fe03ddbe4d5ae14a2754c100296 ] + +We mistakenly put skb too large and that may exceed skb->end. +Therefore, we fix it. + +skbuff: skb_over_panic: text:ffffffffc09e9a9d len:416 put:204 head:ffff8fba04eca780 data:ffff8fba04eca7e0 tail:0x200 end:0x140 dev: +------------[ cut here ]------------ +kernel BUG at net/core/skbuff.c:192! +invalid opcode: 0000 [#1] PREEMPT SMP PTI +CPU: 1 PID: 4747 Comm: kworker/u4:44 Tainted: G O 6.6.30-02659-gc18865c4dfbd #1 86547039b47e46935493f615ee31d0b2d711d35e +Hardware name: HP Meep/Meep, BIOS Google_Meep.11297.262.0 03/18/2021 +Workqueue: events_unbound async_run_entry_fn +RIP: 0010:skb_panic+0x5d/0x60 +Code: c6 63 8b 8f bb 4c 0f 45 f6 48 c7 c7 4d 89 8b bb 48 89 ce 44 89 d1 41 56 53 41 53 ff b0 c8 00 00 00 e8 27 5f 23 00 48 83 c4 20 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 +RSP: 0018:ffffaa700144bad0 EFLAGS: 00010282 +RAX: 0000000000000089 RBX: 0000000000000140 RCX: 14432c5aad26c900 +RDX: 0000000000000000 RSI: 00000000ffffdfff RDI: 0000000000000001 +RBP: ffffaa700144bae0 R08: 0000000000000000 R09: ffffaa700144b920 +R10: 00000000ffffdfff R11: ffffffffbc28fbc0 R12: ffff8fba4e57a010 +R13: 0000000000000000 R14: ffffffffbb8f8b63 R15: 0000000000000000 +FS: 0000000000000000(0000) GS:ffff8fba7bd00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007999c4ad1000 CR3: 000000015503a000 CR4: 0000000000350ee0 +Call Trace: + + ? __die_body+0x1f/0x70 + ? die+0x3d/0x60 + ? do_trap+0xa4/0x110 + ? skb_panic+0x5d/0x60 + ? do_error_trap+0x6d/0x90 + ? skb_panic+0x5d/0x60 + ? handle_invalid_op+0x30/0x40 + ? skb_panic+0x5d/0x60 + ? exc_invalid_op+0x3c/0x50 + ? asm_exc_invalid_op+0x16/0x20 + ? skb_panic+0x5d/0x60 + skb_put+0x49/0x50 + rtw89_fw_h2c_wow_gtk_ofld+0xbd/0x220 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] + rtw89_wow_resume+0x31f/0x540 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] + rtw89_ops_resume+0x2b/0xa0 [rtw89_core 778b32de31cd1f14df2d6721ae99ba8a83636fa5] + ieee80211_reconfig+0x84/0x13e0 [mac80211 818a894e3b77da6298269c59ed7cdff065a4ed52] + ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] + ? dev_printk_emit+0x51/0x70 + ? _dev_info+0x6e/0x90 + ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] + wiphy_resume+0x89/0x180 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] + ? __pfx_wiphy_resume+0x10/0x10 [cfg80211 1a793119e2aeb157c4ca4091ff8e1d9ae233b59d] + dpm_run_callback+0x3c/0x140 + device_resume+0x1f9/0x3c0 + ? __pfx_dpm_watchdog_handler+0x10/0x10 + async_resume+0x1d/0x30 + async_run_entry_fn+0x29/0xd0 + process_scheduled_works+0x1d8/0x3d0 + worker_thread+0x1fc/0x2f0 + kthread+0xed/0x110 + ? __pfx_worker_thread+0x10/0x10 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x38/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + +Modules linked in: ccm 8021q r8153_ecm cdc_ether usbnet r8152 mii dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc uinput rfcomm cmac algif_hash rtw89_8922ae(O) algif_skcipher rtw89_8922a(O) af_alg rtw89_pci(O) rtw89_core(O) btusb(O) snd_soc_sst_bxt_da7219_max98357a btbcm(O) snd_soc_hdac_hdmi btintel(O) snd_soc_intel_hda_dsp_common snd_sof_probes btrtl(O) btmtk(O) snd_hda_codec_hdmi snd_soc_dmic uvcvideo videobuf2_vmalloc uvc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_sof_pci_intel_apl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda soundwire_intel soundwire_generic_allocation snd_sof_intel_hda_mlink soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp mac80211 snd_soc_acpi_intel_match snd_soc_acpi snd_sof snd_sof_utils soundwire_bus snd_soc_max98357a snd_soc_avs snd_soc_hda_codec snd_hda_ext_core snd_intel_dspcfg snd_intel_sdw_acpi snd_soc_da7219 snd_hda_codec snd_hwdep snd_hda_core veth ip6table_nat xt_MASQUERADE xt_cgroup fuse bluetooth ecdh_generic + cfg80211 ecc +gsmi: Log Shutdown Reason 0x03 +---[ end trace 0000000000000000 ]--- + +Fixes: ed9a3c0d4dd9 ("wifi: rtw89: wow: construct EAPoL packet for GTK rekey offload") +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20240620055825.17592-5-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw89/fw.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c +index 044a5b90c7f4e..0e32880e81166 100644 +--- a/drivers/net/wireless/realtek/rtw89/fw.c ++++ b/drivers/net/wireless/realtek/rtw89/fw.c +@@ -6715,10 +6715,8 @@ int rtw89_fw_h2c_wow_gtk_ofld(struct rtw89_dev *rtwdev, + skb_put(skb, len); + h2c = (struct rtw89_h2c_wow_gtk_ofld *)skb->data; + +- if (!enable) { +- skb_put_zero(skb, sizeof(*gtk_info)); ++ if (!enable) + goto hdr; +- } + + ret = rtw89_fw_h2c_add_general_pkt(rtwdev, rtwvif, + RTW89_PKT_OFLD_TYPE_EAPOL_KEY, +-- +2.43.0 + diff --git a/queue-6.10/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch b/queue-6.10/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch new file mode 100644 index 00000000000..75cc72ccaf8 --- /dev/null +++ b/queue-6.10/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch @@ -0,0 +1,98 @@ +From 628dc395b736c93d5c5ced8916c18ebb6c5e12ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jul 2024 10:37:56 +0800 +Subject: wifi: virt_wifi: avoid reporting connection success with wrong SSID + +From: En-Wei Wu + +[ Upstream commit b5d14b0c6716fad7f0c94ac6e1d6f60a49f985c7 ] + +When user issues a connection with a different SSID than the one +virt_wifi has advertised, the __cfg80211_connect_result() will +trigger the warning: WARN_ON(bss_not_found). + +The issue is because the connection code in virt_wifi does not +check the SSID from user space (it only checks the BSSID), and +virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS +even if the SSID is different from the one virt_wifi has advertised. +Eventually cfg80211 won't be able to find the cfg80211_bss and generate +the warning. + +Fixed it by checking the SSID (from user space) in the connection code. + +Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") +Reported-by: syzbot+d6eb9cee2885ec06f5e3@syzkaller.appspotmail.com +Signed-off-by: En-Wei Wu +Link: https://patch.msgid.link/20240705023756.10954-1-en-wei.wu@canonical.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virtual/virt_wifi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c +index 6a84ec58d618b..d2271a7644a01 100644 +--- a/drivers/net/wireless/virtual/virt_wifi.c ++++ b/drivers/net/wireless/virtual/virt_wifi.c +@@ -136,6 +136,8 @@ static struct ieee80211_supported_band band_5ghz = { + /* Assigned at module init. Guaranteed locally-administered and unicast. */ + static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; + ++#define VIRT_WIFI_SSID "VirtWifi" ++ + static void virt_wifi_inform_bss(struct wiphy *wiphy) + { + u64 tsf = div_u64(ktime_get_boottime_ns(), 1000); +@@ -146,8 +148,8 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) + u8 ssid[8]; + } __packed ssid = { + .tag = WLAN_EID_SSID, +- .len = 8, +- .ssid = "VirtWifi", ++ .len = strlen(VIRT_WIFI_SSID), ++ .ssid = VIRT_WIFI_SSID, + }; + + informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz, +@@ -213,6 +215,8 @@ struct virt_wifi_netdev_priv { + struct net_device *upperdev; + u32 tx_packets; + u32 tx_failed; ++ u32 connect_requested_ssid_len; ++ u8 connect_requested_ssid[IEEE80211_MAX_SSID_LEN]; + u8 connect_requested_bss[ETH_ALEN]; + bool is_up; + bool is_connected; +@@ -229,6 +233,12 @@ static int virt_wifi_connect(struct wiphy *wiphy, struct net_device *netdev, + if (priv->being_deleted || !priv->is_up) + return -EBUSY; + ++ if (!sme->ssid) ++ return -EINVAL; ++ ++ priv->connect_requested_ssid_len = sme->ssid_len; ++ memcpy(priv->connect_requested_ssid, sme->ssid, sme->ssid_len); ++ + could_schedule = schedule_delayed_work(&priv->connect, HZ * 2); + if (!could_schedule) + return -EBUSY; +@@ -252,12 +262,15 @@ static void virt_wifi_connect_complete(struct work_struct *work) + container_of(work, struct virt_wifi_netdev_priv, connect.work); + u8 *requested_bss = priv->connect_requested_bss; + bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); ++ bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) && ++ !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID, ++ priv->connect_requested_ssid_len); + u16 status = WLAN_STATUS_SUCCESS; + + if (is_zero_ether_addr(requested_bss)) + requested_bss = NULL; + +- if (!priv->is_up || (requested_bss && !right_addr)) ++ if (!priv->is_up || (requested_bss && !right_addr) || !right_ssid) + status = WLAN_STATUS_UNSPECIFIED_FAILURE; + else + priv->is_connected = true; +-- +2.43.0 + diff --git a/queue-6.10/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch b/queue-6.10/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch new file mode 100644 index 00000000000..9af52fd3630 --- /dev/null +++ b/queue-6.10/wifi-virt_wifi-don-t-use-strlen-in-const-context.patch @@ -0,0 +1,56 @@ +From f271dda9407ba9cf8c95e47a85ca358edda6ff93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jul 2024 08:34:09 +0200 +Subject: wifi: virt_wifi: don't use strlen() in const context + +From: Johannes Berg + +[ Upstream commit 6e909f489191b365364e9d636dec33b5dfd4e5eb ] + +Looks like not all compilers allow strlen(constant) as +a constant, so don't do that. Instead, revert back to +defining the length as the first submission had it. + +Fixes: b5d14b0c6716 ("wifi: virt_wifi: avoid reporting connection success with wrong SSID") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202407090934.NnR1TUbW-lkp@intel.com/ +Closes: https://lore.kernel.org/oe-kbuild-all/202407090944.mpwLHGt9-lkp@intel.com/ +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/virtual/virt_wifi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c +index d2271a7644a01..4ee3740804667 100644 +--- a/drivers/net/wireless/virtual/virt_wifi.c ++++ b/drivers/net/wireless/virtual/virt_wifi.c +@@ -137,6 +137,7 @@ static struct ieee80211_supported_band band_5ghz = { + static u8 fake_router_bssid[ETH_ALEN] __ro_after_init = {}; + + #define VIRT_WIFI_SSID "VirtWifi" ++#define VIRT_WIFI_SSID_LEN 8 + + static void virt_wifi_inform_bss(struct wiphy *wiphy) + { +@@ -148,7 +149,7 @@ static void virt_wifi_inform_bss(struct wiphy *wiphy) + u8 ssid[8]; + } __packed ssid = { + .tag = WLAN_EID_SSID, +- .len = strlen(VIRT_WIFI_SSID), ++ .len = VIRT_WIFI_SSID_LEN, + .ssid = VIRT_WIFI_SSID, + }; + +@@ -262,7 +263,7 @@ static void virt_wifi_connect_complete(struct work_struct *work) + container_of(work, struct virt_wifi_netdev_priv, connect.work); + u8 *requested_bss = priv->connect_requested_bss; + bool right_addr = ether_addr_equal(requested_bss, fake_router_bssid); +- bool right_ssid = priv->connect_requested_ssid_len == strlen(VIRT_WIFI_SSID) && ++ bool right_ssid = priv->connect_requested_ssid_len == VIRT_WIFI_SSID_LEN && + !memcmp(priv->connect_requested_ssid, VIRT_WIFI_SSID, + priv->connect_requested_ssid_len); + u16 status = WLAN_STATUS_SUCCESS; +-- +2.43.0 + diff --git a/queue-6.10/x86-kconfig-add-as-instr64-macro-to-properly-evaluat.patch b/queue-6.10/x86-kconfig-add-as-instr64-macro-to-properly-evaluat.patch new file mode 100644 index 00000000000..e683cf29f05 --- /dev/null +++ b/queue-6.10/x86-kconfig-add-as-instr64-macro-to-properly-evaluat.patch @@ -0,0 +1,56 @@ +From b33a794da75e2c486f0f574ff7ba3ec91ad7fdf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 14:02:55 +0900 +Subject: x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS + +From: Masahiro Yamada + +[ Upstream commit 469169803d52a5d8f0dc781090638e851a7d22b1 ] + +Some instructions are only available on the 64-bit architecture. + +Bi-arch compilers that default to -m32 need the explicit -m64 option +to evaluate them properly. + +Fixes: 18e66b695e78 ("x86/shstk: Add Kconfig option for shadow stack") +Closes: https://lore.kernel.org/all/20240612-as-instr-opt-wrussq-v2-1-bd950f7eead7@gmail.com/ +Reported-by: Dmitry Safonov <0x7f454c46@gmail.com> +Signed-off-by: Masahiro Yamada +Signed-off-by: Borislav Petkov (AMD) +Tested-by: Dmitry Safonov <0x7f454c46@gmail.com> +Link: https://lore.kernel.org/r/20240612050257.3670768-1-masahiroy@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig.assembler | 2 +- + scripts/Kconfig.include | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/Kconfig.assembler b/arch/x86/Kconfig.assembler +index 59aedf32c4eaa..6d20a6ce0507d 100644 +--- a/arch/x86/Kconfig.assembler ++++ b/arch/x86/Kconfig.assembler +@@ -36,6 +36,6 @@ config AS_VPCLMULQDQ + Supported by binutils >= 2.30 and LLVM integrated assembler + + config AS_WRUSS +- def_bool $(as-instr,wrussq %rax$(comma)(%rbx)) ++ def_bool $(as-instr64,wrussq %rax$(comma)(%rbx)) + help + Supported by binutils >= 2.31 and LLVM integrated assembler +diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include +index 3ee8ecfb8c044..3500a3d62f0df 100644 +--- a/scripts/Kconfig.include ++++ b/scripts/Kconfig.include +@@ -33,7 +33,8 @@ ld-option = $(success,$(LD) -v $(1)) + + # $(as-instr,) + # Return y if the assembler supports , n otherwise +-as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -) ++as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) $(2) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -) ++as-instr64 = $(as-instr,$(1),$(m64-flag)) + + # check if $(CC) and $(LD) exist + $(error-if,$(failure,command -v $(CC)),C compiler '$(CC)' not found) +-- +2.43.0 + diff --git a/queue-6.10/x86-of-return-consistent-error-type-from-x86_of_pci_.patch b/queue-6.10/x86-of-return-consistent-error-type-from-x86_of_pci_.patch new file mode 100644 index 00000000000..7daaebfbd42 --- /dev/null +++ b/queue-6.10/x86-of-return-consistent-error-type-from-x86_of_pci_.patch @@ -0,0 +1,45 @@ +From bb5226a925a72f09d55bde92a4a69cdc42333bb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:35 +0300 +Subject: x86/of: Return consistent error type from x86_of_pci_irq_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit ec0b4c4d45cf7cf9a6c9626a494a89cb1ae7c645 ] + +x86_of_pci_irq_enable() returns PCIBIOS_* code received from +pci_read_config_byte() directly and also -EINVAL which are not +compatible error types. x86_of_pci_irq_enable() is used as +(*pcibios_enable_irq) function which should not return PCIBIOS_* codes. + +Convert the PCIBIOS_* return code from pci_read_config_byte() into +normal errno using pcibios_err_to_errno(). + +Fixes: 96e0a0797eba ("x86: dtb: Add support for PCI devices backed by dtb nodes") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/devicetree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c +index 8e3c53b4d070e..64280879c68c0 100644 +--- a/arch/x86/kernel/devicetree.c ++++ b/arch/x86/kernel/devicetree.c +@@ -83,7 +83,7 @@ static int x86_of_pci_irq_enable(struct pci_dev *dev) + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin); + if (ret) +- return ret; ++ return pcibios_err_to_errno(ret); + if (!pin) + return 0; + +-- +2.43.0 + diff --git a/queue-6.10/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch b/queue-6.10/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch new file mode 100644 index 00000000000..ce3aa22d61d --- /dev/null +++ b/queue-6.10/x86-pci-intel_mid_pci-fix-pcibios_-return-code-handl.patch @@ -0,0 +1,53 @@ +From d23940a03fd1bb441c6cc768a1eb5a8b382aac03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:36 +0300 +Subject: x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 724852059e97c48557151b3aa4af424614819752 ] + +intel_mid_pci_irq_enable() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +intel_mid_pci_irq_enable() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 5b395e2be6c4 ("x86/platform/intel-mid: Make IRQ allocation a bit more flexible") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240527125538.13620-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/intel_mid_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c +index 8edd622066044..722a33be08a18 100644 +--- a/arch/x86/pci/intel_mid_pci.c ++++ b/arch/x86/pci/intel_mid_pci.c +@@ -233,9 +233,9 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev) + return 0; + + ret = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (ret < 0) { ++ if (ret) { + dev_warn(&dev->dev, "Failed to read interrupt line: %d\n", ret); +- return ret; ++ return pcibios_err_to_errno(ret); + } + + id = x86_match_cpu(intel_mid_cpu_ids); +-- +2.43.0 + diff --git a/queue-6.10/x86-pci-xen-fix-pcibios_-return-code-handling.patch b/queue-6.10/x86-pci-xen-fix-pcibios_-return-code-handling.patch new file mode 100644 index 00000000000..9f030af9dc4 --- /dev/null +++ b/queue-6.10/x86-pci-xen-fix-pcibios_-return-code-handling.patch @@ -0,0 +1,54 @@ +From 1ac8389e58db80c1b9442d4a3fe7bf7893f4e3fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:37 +0300 +Subject: x86/pci/xen: Fix PCIBIOS_* return code handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit e9d7b435dfaec58432f4106aaa632bf39f52ce9f ] + +xen_pcifront_enable_irq() uses pci_read_config_byte() that returns +PCIBIOS_* codes. The error handling, however, assumes the codes are +normal errnos because it checks for < 0. + +xen_pcifront_enable_irq() also returns the PCIBIOS_* code back to the +caller but the function is used as the (*pcibios_enable_irq) function +which should return normal errnos. + +Convert the error check to plain non-zero check which works for +PCIBIOS_* return codes and convert the PCIBIOS_* return code using +pcibios_err_to_errno() into normal errno before returning it. + +Fixes: 3f2a230caf21 ("xen: handled remapped IRQs when enabling a pcifront PCI device.") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240527125538.13620-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/pci/xen.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c +index 652cd53e77f64..0f2fe524f60dc 100644 +--- a/arch/x86/pci/xen.c ++++ b/arch/x86/pci/xen.c +@@ -38,10 +38,10 @@ static int xen_pcifront_enable_irq(struct pci_dev *dev) + u8 gsi; + + rc = pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &gsi); +- if (rc < 0) { ++ if (rc) { + dev_warn(&dev->dev, "Xen PCI: failed to read interrupt line: %d\n", + rc); +- return rc; ++ return pcibios_err_to_errno(rc); + } + /* In PV DomU the Xen PCI backend puts the PIRQ in the interrupt line.*/ + pirq = gsi; +-- +2.43.0 + diff --git a/queue-6.10/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch b/queue-6.10/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch new file mode 100644 index 00000000000..8d3ec77d523 --- /dev/null +++ b/queue-6.10/x86-platform-iosf_mbi-convert-pcibios_-return-codes-.patch @@ -0,0 +1,54 @@ +From c5711bb8565cb24a1d739b24989ad0862d23db17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2024 15:55:38 +0300 +Subject: x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 7821fa101eab529521aa4b724bf708149d70820c ] + +iosf_mbi_pci_{read,write}_mdr() use pci_{read,write}_config_dword() +that return PCIBIOS_* codes but functions also return -ENODEV which are +not compatible error codes. As neither of the functions are related to +PCI read/write functions, they should return normal errnos. + +Convert PCIBIOS_* returns code using pcibios_err_to_errno() into normal +errno before returning it. + +Fixes: 46184415368a ("arch: x86: New MailBox support driver for Intel SOC's") +Signed-off-by: Ilpo Järvinen +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20240527125538.13620-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/platform/intel/iosf_mbi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/platform/intel/iosf_mbi.c b/arch/x86/platform/intel/iosf_mbi.c +index fdd49d70b4373..c81cea208c2c4 100644 +--- a/arch/x86/platform/intel/iosf_mbi.c ++++ b/arch/x86/platform/intel/iosf_mbi.c +@@ -62,7 +62,7 @@ static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr) + + fail_read: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) +@@ -91,7 +91,7 @@ static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr) + + fail_write: + dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result); +- return result; ++ return pcibios_err_to_errno(result); + } + + int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr) +-- +2.43.0 + diff --git a/queue-6.10/x86-sev-do-rmp-memory-coverage-check-after-max_pfn-h.patch b/queue-6.10/x86-sev-do-rmp-memory-coverage-check-after-max_pfn-h.patch new file mode 100644 index 00000000000..2dc5b9023d5 --- /dev/null +++ b/queue-6.10/x86-sev-do-rmp-memory-coverage-check-after-max_pfn-h.patch @@ -0,0 +1,114 @@ +From ca5dadf313e749943fea62da8622c776ba3e9357 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2024 10:42:05 -0500 +Subject: x86/sev: Do RMP memory coverage check after max_pfn has been set + +From: Tom Lendacky + +[ Upstream commit 0440feb090790c6243bca85d6a794824e71ff26c ] + +The RMP table is probed early in the boot process before max_pfn has been +set, so the logic to check if the RMP covers all of system memory is not +valid. + +Move the RMP memory coverage check from snp_probe_rmptable_info() into +snp_rmptable_init(), which is well after max_pfn has been set. Also, fix +the calculation to use PFN_UP instead of PHYS_PFN, in order to compute +the required RMP size properly. + +Fixes: 216d106c7ff7 ("x86/sev: Add SEV-SNP host initialization support") +Signed-off-by: Tom Lendacky +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/bec4364c7e34358cc576f01bb197a7796a109169.1718984524.git.thomas.lendacky@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/virt/svm/sev.c | 44 ++++++++++++++++++++--------------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/arch/x86/virt/svm/sev.c b/arch/x86/virt/svm/sev.c +index 0ae10535c6999..0ce17766c0e52 100644 +--- a/arch/x86/virt/svm/sev.c ++++ b/arch/x86/virt/svm/sev.c +@@ -120,7 +120,7 @@ static __init void snp_enable(void *arg) + + bool snp_probe_rmptable_info(void) + { +- u64 max_rmp_pfn, calc_rmp_sz, rmp_sz, rmp_base, rmp_end; ++ u64 rmp_sz, rmp_base, rmp_end; + + rdmsrl(MSR_AMD64_RMP_BASE, rmp_base); + rdmsrl(MSR_AMD64_RMP_END, rmp_end); +@@ -137,28 +137,11 @@ bool snp_probe_rmptable_info(void) + + rmp_sz = rmp_end - rmp_base + 1; + +- /* +- * Calculate the amount the memory that must be reserved by the BIOS to +- * address the whole RAM, including the bookkeeping area. The RMP itself +- * must also be covered. +- */ +- max_rmp_pfn = max_pfn; +- if (PHYS_PFN(rmp_end) > max_pfn) +- max_rmp_pfn = PHYS_PFN(rmp_end); +- +- calc_rmp_sz = (max_rmp_pfn << 4) + RMPTABLE_CPU_BOOKKEEPING_SZ; +- +- if (calc_rmp_sz > rmp_sz) { +- pr_err("Memory reserved for the RMP table does not cover full system RAM (expected 0x%llx got 0x%llx)\n", +- calc_rmp_sz, rmp_sz); +- return false; +- } +- + probed_rmp_base = rmp_base; + probed_rmp_size = rmp_sz; + + pr_info("RMP table physical range [0x%016llx - 0x%016llx]\n", +- probed_rmp_base, probed_rmp_base + probed_rmp_size - 1); ++ rmp_base, rmp_end); + + return true; + } +@@ -206,9 +189,8 @@ void __init snp_fixup_e820_tables(void) + */ + static int __init snp_rmptable_init(void) + { ++ u64 max_rmp_pfn, calc_rmp_sz, rmptable_size, rmp_end, val; + void *rmptable_start; +- u64 rmptable_size; +- u64 val; + + if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP)) + return 0; +@@ -219,10 +201,28 @@ static int __init snp_rmptable_init(void) + if (!probed_rmp_size) + goto nosnp; + ++ rmp_end = probed_rmp_base + probed_rmp_size - 1; ++ ++ /* ++ * Calculate the amount the memory that must be reserved by the BIOS to ++ * address the whole RAM, including the bookkeeping area. The RMP itself ++ * must also be covered. ++ */ ++ max_rmp_pfn = max_pfn; ++ if (PFN_UP(rmp_end) > max_pfn) ++ max_rmp_pfn = PFN_UP(rmp_end); ++ ++ calc_rmp_sz = (max_rmp_pfn << 4) + RMPTABLE_CPU_BOOKKEEPING_SZ; ++ if (calc_rmp_sz > probed_rmp_size) { ++ pr_err("Memory reserved for the RMP table does not cover full system RAM (expected 0x%llx got 0x%llx)\n", ++ calc_rmp_sz, probed_rmp_size); ++ goto nosnp; ++ } ++ + rmptable_start = memremap(probed_rmp_base, probed_rmp_size, MEMREMAP_WB); + if (!rmptable_start) { + pr_err("Failed to map RMP table\n"); +- return 1; ++ goto nosnp; + } + + /* +-- +2.43.0 + diff --git a/queue-6.10/x86-shstk-make-return-uprobe-work-with-shadow-stack.patch b/queue-6.10/x86-shstk-make-return-uprobe-work-with-shadow-stack.patch new file mode 100644 index 00000000000..aab64c6eef1 --- /dev/null +++ b/queue-6.10/x86-shstk-make-return-uprobe-work-with-shadow-stack.patch @@ -0,0 +1,94 @@ +From 915cf22eec6472aa00a8eb592187172dea7d7b55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 08:44:27 +0900 +Subject: x86/shstk: Make return uprobe work with shadow stack + +From: Jiri Olsa + +[ Upstream commit 1713b63a07a28a475de94664f783b4cfd2e4fa90 ] + +Currently the application with enabled shadow stack will crash +if it sets up return uprobe. The reason is the uretprobe kernel +code changes the user space task's stack, but does not update +shadow stack accordingly. + +Adding new functions to update values on shadow stack and using +them in uprobe code to keep shadow stack in sync with uretprobe +changes to user stack. + +Link: https://lore.kernel.org/all/20240611112158.40795-2-jolsa@kernel.org/ + +Acked-by: Andrii Nakryiko +Acked-by: Rick Edgecombe +Reviewed-by: Oleg Nesterov +Fixes: 488af8ea7131 ("x86/shstk: Wire in shadow stack interface") +Signed-off-by: Jiri Olsa +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/shstk.h | 2 ++ + arch/x86/kernel/shstk.c | 11 +++++++++++ + arch/x86/kernel/uprobes.c | 7 ++++++- + 3 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/shstk.h b/arch/x86/include/asm/shstk.h +index 42fee8959df7b..896909f306e30 100644 +--- a/arch/x86/include/asm/shstk.h ++++ b/arch/x86/include/asm/shstk.h +@@ -21,6 +21,7 @@ unsigned long shstk_alloc_thread_stack(struct task_struct *p, unsigned long clon + void shstk_free(struct task_struct *p); + int setup_signal_shadow_stack(struct ksignal *ksig); + int restore_signal_shadow_stack(void); ++int shstk_update_last_frame(unsigned long val); + #else + static inline long shstk_prctl(struct task_struct *task, int option, + unsigned long arg2) { return -EINVAL; } +@@ -31,6 +32,7 @@ static inline unsigned long shstk_alloc_thread_stack(struct task_struct *p, + static inline void shstk_free(struct task_struct *p) {} + static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; } + static inline int restore_signal_shadow_stack(void) { return 0; } ++static inline int shstk_update_last_frame(unsigned long val) { return 0; } + #endif /* CONFIG_X86_USER_SHADOW_STACK */ + + #endif /* __ASSEMBLY__ */ +diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c +index 6f1e9883f0742..9797d4cdb78a2 100644 +--- a/arch/x86/kernel/shstk.c ++++ b/arch/x86/kernel/shstk.c +@@ -577,3 +577,14 @@ long shstk_prctl(struct task_struct *task, int option, unsigned long arg2) + return wrss_control(true); + return -EINVAL; + } ++ ++int shstk_update_last_frame(unsigned long val) ++{ ++ unsigned long ssp; ++ ++ if (!features_enabled(ARCH_SHSTK_SHSTK)) ++ return 0; ++ ++ ssp = get_user_shstk_addr(); ++ return write_user_shstk_64((u64 __user *)ssp, (u64)val); ++} +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index 6c07f6daaa227..6402fb3089d26 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -1076,8 +1076,13 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs + return orig_ret_vaddr; + + nleft = copy_to_user((void __user *)regs->sp, &trampoline_vaddr, rasize); +- if (likely(!nleft)) ++ if (likely(!nleft)) { ++ if (shstk_update_last_frame(trampoline_vaddr)) { ++ force_sig(SIGSEGV); ++ return -1; ++ } + return orig_ret_vaddr; ++ } + + if (nleft != rasize) { + pr_err("return address clobbered: pid=%d, %%sp=%#lx, %%ip=%#lx\n", +-- +2.43.0 + diff --git a/queue-6.10/x86-syscall-mark-exit-_group-syscall-handlers-__nore.patch b/queue-6.10/x86-syscall-mark-exit-_group-syscall-handlers-__nore.patch new file mode 100644 index 00000000000..d41830c14b6 --- /dev/null +++ b/queue-6.10/x86-syscall-mark-exit-_group-syscall-handlers-__nore.patch @@ -0,0 +1,311 @@ +From 6cf99da1e64ed8d1c0bf1ff48f430594957100d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 23:02:00 -0700 +Subject: x86/syscall: Mark exit[_group] syscall handlers __noreturn + +From: Josh Poimboeuf + +[ Upstream commit 9142be9e6443fd641ca37f820efe00d9cd890eb1 ] + +The direct-call syscall dispatch function doesn't know that the exit() +and exit_group() syscall handlers don't return, so the call sites aren't +optimized accordingly. + +Fix that by marking the exit syscall declarations __noreturn. + +Fixes the following warnings: + + vmlinux.o: warning: objtool: x64_sys_call+0x2804: __x64_sys_exit() is missing a __noreturn annotation + vmlinux.o: warning: objtool: ia32_sys_call+0x29b6: __ia32_sys_exit_group() is missing a __noreturn annotation + +Fixes: 1e3ad78334a6 ("x86/syscall: Don't force use of indirect calls for system calls") +Closes: https://lkml.kernel.org/lkml/6dba9b32-db2c-4e6d-9500-7a08852f17a3@paulmck-laptop +Reported-by: Paul E. McKenney +Signed-off-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov (AMD) +Tested-by: Paul E. McKenney +Link: https://lore.kernel.org/r/5d8882bc077d8eadcc7fd1740b56dfb781f12288.1719381528.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/entry/syscall_32.c | 10 ++++++---- + arch/x86/entry/syscall_64.c | 9 ++++++--- + arch/x86/entry/syscall_x32.c | 7 +++++-- + arch/x86/entry/syscalls/syscall_32.tbl | 6 +++--- + arch/x86/entry/syscalls/syscall_64.tbl | 6 +++--- + arch/x86/um/sys_call_table_32.c | 10 ++++++---- + arch/x86/um/sys_call_table_64.c | 11 +++++++---- + scripts/syscalltbl.sh | 18 ++++++++++++++++-- + tools/objtool/noreturns.h | 4 ++++ + 9 files changed, 56 insertions(+), 25 deletions(-) + +diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c +index c2235bae17ef6..8cc9950d7104a 100644 +--- a/arch/x86/entry/syscall_32.c ++++ b/arch/x86/entry/syscall_32.c +@@ -14,9 +14,12 @@ + #endif + + #define __SYSCALL(nr, sym) extern long __ia32_##sym(const struct pt_regs *); +- ++#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __ia32_##sym(const struct pt_regs *); + #include +-#undef __SYSCALL ++#undef __SYSCALL ++ ++#undef __SYSCALL_NORETURN ++#define __SYSCALL_NORETURN __SYSCALL + + /* + * The sys_call_table[] is no longer used for system calls, but +@@ -28,11 +31,10 @@ + const sys_call_ptr_t sys_call_table[] = { + #include + }; +-#undef __SYSCALL ++#undef __SYSCALL + #endif + + #define __SYSCALL(nr, sym) case nr: return __ia32_##sym(regs); +- + long ia32_sys_call(const struct pt_regs *regs, unsigned int nr) + { + switch (nr) { +diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c +index 33b3f09e6f151..ba8354424860c 100644 +--- a/arch/x86/entry/syscall_64.c ++++ b/arch/x86/entry/syscall_64.c +@@ -8,8 +8,12 @@ + #include + + #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); ++#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(const struct pt_regs *); + #include +-#undef __SYSCALL ++#undef __SYSCALL ++ ++#undef __SYSCALL_NORETURN ++#define __SYSCALL_NORETURN __SYSCALL + + /* + * The sys_call_table[] is no longer used for system calls, but +@@ -20,10 +24,9 @@ + const sys_call_ptr_t sys_call_table[] = { + #include + }; +-#undef __SYSCALL ++#undef __SYSCALL + + #define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); +- + long x64_sys_call(const struct pt_regs *regs, unsigned int nr) + { + switch (nr) { +diff --git a/arch/x86/entry/syscall_x32.c b/arch/x86/entry/syscall_x32.c +index 03de4a9321318..fb77908f44f37 100644 +--- a/arch/x86/entry/syscall_x32.c ++++ b/arch/x86/entry/syscall_x32.c +@@ -8,11 +8,14 @@ + #include + + #define __SYSCALL(nr, sym) extern long __x64_##sym(const struct pt_regs *); ++#define __SYSCALL_NORETURN(nr, sym) extern long __noreturn __x64_##sym(const struct pt_regs *); + #include +-#undef __SYSCALL ++#undef __SYSCALL + +-#define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); ++#undef __SYSCALL_NORETURN ++#define __SYSCALL_NORETURN __SYSCALL + ++#define __SYSCALL(nr, sym) case nr: return __x64_##sym(regs); + long x32_sys_call(const struct pt_regs *regs, unsigned int nr) + { + switch (nr) { +diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl +index d6ebcab1d8b28..4b71a2607bf58 100644 +--- a/arch/x86/entry/syscalls/syscall_32.tbl ++++ b/arch/x86/entry/syscalls/syscall_32.tbl +@@ -2,7 +2,7 @@ + # 32-bit system call numbers and entry vectors + # + # The format is: +-# ++# [ [noreturn]] + # + # The __ia32_sys and __ia32_compat_sys stubs are created on-the-fly for + # sys_*() system calls and compat_sys_*() compat system calls if +@@ -12,7 +12,7 @@ + # The abi is always "i386" for this file. + # + 0 i386 restart_syscall sys_restart_syscall +-1 i386 exit sys_exit ++1 i386 exit sys_exit - noreturn + 2 i386 fork sys_fork + 3 i386 read sys_read + 4 i386 write sys_write +@@ -263,7 +263,7 @@ + 249 i386 io_cancel sys_io_cancel + 250 i386 fadvise64 sys_ia32_fadvise64 + # 251 is available for reuse (was briefly sys_set_zone_reclaim) +-252 i386 exit_group sys_exit_group ++252 i386 exit_group sys_exit_group - noreturn + 253 i386 lookup_dcookie + 254 i386 epoll_create sys_epoll_create + 255 i386 epoll_ctl sys_epoll_ctl +diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl +index a396f6e6ab5bf..a8068f937290a 100644 +--- a/arch/x86/entry/syscalls/syscall_64.tbl ++++ b/arch/x86/entry/syscalls/syscall_64.tbl +@@ -2,7 +2,7 @@ + # 64-bit system call numbers and entry vectors + # + # The format is: +-# ++# [ [noreturn]] + # + # The __x64_sys_*() stubs are created on-the-fly for sys_*() system calls + # +@@ -68,7 +68,7 @@ + 57 common fork sys_fork + 58 common vfork sys_vfork + 59 64 execve sys_execve +-60 common exit sys_exit ++60 common exit sys_exit - noreturn + 61 common wait4 sys_wait4 + 62 common kill sys_kill + 63 common uname sys_newuname +@@ -239,7 +239,7 @@ + 228 common clock_gettime sys_clock_gettime + 229 common clock_getres sys_clock_getres + 230 common clock_nanosleep sys_clock_nanosleep +-231 common exit_group sys_exit_group ++231 common exit_group sys_exit_group - noreturn + 232 common epoll_wait sys_epoll_wait + 233 common epoll_ctl sys_epoll_ctl + 234 common tgkill sys_tgkill +diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c +index 89df5d89d6640..51655133eee36 100644 +--- a/arch/x86/um/sys_call_table_32.c ++++ b/arch/x86/um/sys_call_table_32.c +@@ -9,6 +9,10 @@ + #include + #include + ++extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, ++ unsigned long, unsigned long, ++ unsigned long, unsigned long); ++ + /* + * Below you can see, in terms of #define's, the differences between the x86-64 + * and the UML syscall table. +@@ -22,15 +26,13 @@ + #define sys_vm86 sys_ni_syscall + + #define __SYSCALL_WITH_COMPAT(nr, native, compat) __SYSCALL(nr, native) ++#define __SYSCALL_NORETURN __SYSCALL + + #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long); + #include ++#undef __SYSCALL + +-#undef __SYSCALL + #define __SYSCALL(nr, sym) sym, +- +-extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long); +- + const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + #include + }; +diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c +index b0b4cfd2308c8..943d414f21093 100644 +--- a/arch/x86/um/sys_call_table_64.c ++++ b/arch/x86/um/sys_call_table_64.c +@@ -9,6 +9,10 @@ + #include + #include + ++extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, ++ unsigned long, unsigned long, ++ unsigned long, unsigned long); ++ + /* + * Below you can see, in terms of #define's, the differences between the x86-64 + * and the UML syscall table. +@@ -18,14 +22,13 @@ + #define sys_iopl sys_ni_syscall + #define sys_ioperm sys_ni_syscall + ++#define __SYSCALL_NORETURN __SYSCALL ++ + #define __SYSCALL(nr, sym) extern asmlinkage long sym(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long); + #include ++#undef __SYSCALL + +-#undef __SYSCALL + #define __SYSCALL(nr, sym) sym, +- +-extern asmlinkage long sys_ni_syscall(unsigned long, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long); +- + const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = { + #include + }; +diff --git a/scripts/syscalltbl.sh b/scripts/syscalltbl.sh +index 6abe143889ef6..6a903b87a7c21 100755 +--- a/scripts/syscalltbl.sh ++++ b/scripts/syscalltbl.sh +@@ -54,7 +54,7 @@ nxt=0 + + grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { + +- while read nr abi name native compat ; do ++ while read nr abi name native compat noreturn; do + + if [ $nxt -gt $nr ]; then + echo "error: $infile: syscall table is not sorted or duplicates the same syscall number" >&2 +@@ -66,7 +66,21 @@ grep -E "^[0-9]+[[:space:]]+$abis" "$infile" | { + nxt=$((nxt + 1)) + done + +- if [ -n "$compat" ]; then ++ if [ "$compat" = "-" ]; then ++ unset compat ++ fi ++ ++ if [ -n "$noreturn" ]; then ++ if [ "$noreturn" != "noreturn" ]; then ++ echo "error: $infile: invalid string \"$noreturn\" in 'noreturn' column" ++ exit 1 ++ fi ++ if [ -n "$compat" ]; then ++ echo "__SYSCALL_COMPAT_NORETURN($nr, $native, $compat)" ++ else ++ echo "__SYSCALL_NORETURN($nr, $native)" ++ fi ++ elif [ -n "$compat" ]; then + echo "__SYSCALL_WITH_COMPAT($nr, $native, $compat)" + elif [ -n "$native" ]; then + echo "__SYSCALL($nr, $native)" +diff --git a/tools/objtool/noreturns.h b/tools/objtool/noreturns.h +index 7ebf29c911849..1e8141ef1b15d 100644 +--- a/tools/objtool/noreturns.h ++++ b/tools/objtool/noreturns.h +@@ -7,12 +7,16 @@ + * Yes, this is unfortunate. A better solution is in the works. + */ + NORETURN(__fortify_panic) ++NORETURN(__ia32_sys_exit) ++NORETURN(__ia32_sys_exit_group) + NORETURN(__kunit_abort) + NORETURN(__module_put_and_kthread_exit) + NORETURN(__reiserfs_panic) + NORETURN(__stack_chk_fail) + NORETURN(__tdx_hypercall_failed) + NORETURN(__ubsan_handle_builtin_unreachable) ++NORETURN(__x64_sys_exit) ++NORETURN(__x64_sys_exit_group) + NORETURN(arch_cpu_idle_dead) + NORETURN(bch2_trans_in_restart_error) + NORETURN(bch2_trans_restart_error) +-- +2.43.0 + diff --git a/queue-6.10/x86-xen-convert-comma-to-semicolon.patch b/queue-6.10/x86-xen-convert-comma-to-semicolon.patch new file mode 100644 index 00000000000..abe667ee633 --- /dev/null +++ b/queue-6.10/x86-xen-convert-comma-to-semicolon.patch @@ -0,0 +1,46 @@ +From fa7ce2f981e56ebbb1b7958b7da971650d6473b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2024 11:10:10 +0800 +Subject: x86/xen: Convert comma to semicolon + +From: Chen Ni + +[ Upstream commit 349d271416c61f82b853336509b1d0dc04c1fcbb ] + +Replace a comma between expression statements by a semicolon. + +Fixes: 8310b77b48c5 ("Xen/gnttab: handle p2m update errors on a per-slot basis") +Signed-off-by: Chen Ni +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20240702031010.1411875-1-nichen@iscas.ac.cn +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/p2m.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c +index 99918beccd80c..6bcbdf3b7999f 100644 +--- a/arch/x86/xen/p2m.c ++++ b/arch/x86/xen/p2m.c +@@ -730,7 +730,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + * immediate unmapping. + */ + map_ops[i].status = GNTST_general_error; +- unmap[0].host_addr = map_ops[i].host_addr, ++ unmap[0].host_addr = map_ops[i].host_addr; + unmap[0].handle = map_ops[i].handle; + map_ops[i].handle = INVALID_GRANT_HANDLE; + if (map_ops[i].flags & GNTMAP_device_map) +@@ -740,7 +740,7 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, + + if (kmap_ops) { + kmap_ops[i].status = GNTST_general_error; +- unmap[1].host_addr = kmap_ops[i].host_addr, ++ unmap[1].host_addr = kmap_ops[i].host_addr; + unmap[1].handle = kmap_ops[i].handle; + kmap_ops[i].handle = INVALID_GRANT_HANDLE; + if (kmap_ops[i].flags & GNTMAP_device_map) +-- +2.43.0 + diff --git a/queue-6.10/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch b/queue-6.10/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch new file mode 100644 index 00000000000..c4550c768f1 --- /dev/null +++ b/queue-6.10/xdp-fix-invalid-wait-context-of-page_pool_destroy.patch @@ -0,0 +1,142 @@ +From 1c637ee339f4f59f54703ef97684274795729988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2024 09:51:16 +0000 +Subject: xdp: fix invalid wait context of page_pool_destroy() + +From: Taehee Yoo + +[ Upstream commit 59a931c5b732ca5fc2ca727f5a72aeabaafa85ec ] + +If the driver uses a page pool, it creates a page pool with +page_pool_create(). +The reference count of page pool is 1 as default. +A page pool will be destroyed only when a reference count reaches 0. +page_pool_destroy() is used to destroy page pool, it decreases a +reference count. +When a page pool is destroyed, ->disconnect() is called, which is +mem_allocator_disconnect(). +This function internally acquires mutex_lock(). + +If the driver uses XDP, it registers a memory model with +xdp_rxq_info_reg_mem_model(). +The xdp_rxq_info_reg_mem_model() internally increases a page pool +reference count if a memory model is a page pool. +Now the reference count is 2. + +To destroy a page pool, the driver should call both page_pool_destroy() +and xdp_unreg_mem_model(). +The xdp_unreg_mem_model() internally calls page_pool_destroy(). +Only page_pool_destroy() decreases a reference count. + +If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we +will face an invalid wait context warning. +Because xdp_unreg_mem_model() calls page_pool_destroy() with +rcu_read_lock(). +The page_pool_destroy() internally acquires mutex_lock(). + +Splat looks like: +============================= +[ BUG: Invalid wait context ] +6.10.0-rc6+ #4 Tainted: G W +----------------------------- +ethtool/1806 is trying to lock: +ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 +other info that might help us debug this: +context-{5:5} +3 locks held by ethtool/1806: +stack backtrace: +CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed +Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 +Call Trace: + +dump_stack_lvl+0x7e/0xc0 +__lock_acquire+0x1681/0x4de0 +? _printk+0x64/0xe0 +? __pfx_mark_lock.part.0+0x10/0x10 +? __pfx___lock_acquire+0x10/0x10 +lock_acquire+0x1b3/0x580 +? mem_allocator_disconnect+0x73/0x150 +? __wake_up_klogd.part.0+0x16/0xc0 +? __pfx_lock_acquire+0x10/0x10 +? dump_stack_lvl+0x91/0xc0 +__mutex_lock+0x15c/0x1690 +? mem_allocator_disconnect+0x73/0x150 +? __pfx_prb_read_valid+0x10/0x10 +? mem_allocator_disconnect+0x73/0x150 +? __pfx_llist_add_batch+0x10/0x10 +? console_unlock+0x193/0x1b0 +? lockdep_hardirqs_on+0xbe/0x140 +? __pfx___mutex_lock+0x10/0x10 +? tick_nohz_tick_stopped+0x16/0x90 +? __irq_work_queue_local+0x1e5/0x330 +? irq_work_queue+0x39/0x50 +? __wake_up_klogd.part.0+0x79/0xc0 +? mem_allocator_disconnect+0x73/0x150 +mem_allocator_disconnect+0x73/0x150 +? __pfx_mem_allocator_disconnect+0x10/0x10 +? mark_held_locks+0xa5/0xf0 +? rcu_is_watching+0x11/0xb0 +page_pool_release+0x36e/0x6d0 +page_pool_destroy+0xd7/0x440 +xdp_unreg_mem_model+0x1a7/0x2a0 +? __pfx_xdp_unreg_mem_model+0x10/0x10 +? kfree+0x125/0x370 +? bnxt_free_ring.isra.0+0x2eb/0x500 +? bnxt_free_mem+0x5ac/0x2500 +xdp_rxq_info_unreg+0x4a/0xd0 +bnxt_free_mem+0x1356/0x2500 +bnxt_close_nic+0xf0/0x3b0 +? __pfx_bnxt_close_nic+0x10/0x10 +? ethnl_parse_bit+0x2c6/0x6d0 +? __pfx___nla_validate_parse+0x10/0x10 +? __pfx_ethnl_parse_bit+0x10/0x10 +bnxt_set_features+0x2a8/0x3e0 +__netdev_update_features+0x4dc/0x1370 +? ethnl_parse_bitset+0x4ff/0x750 +? __pfx_ethnl_parse_bitset+0x10/0x10 +? __pfx___netdev_update_features+0x10/0x10 +? mark_held_locks+0xa5/0xf0 +? _raw_spin_unlock_irqrestore+0x42/0x70 +? __pm_runtime_resume+0x7d/0x110 +ethnl_set_features+0x32d/0xa20 + +To fix this problem, it uses rhashtable_lookup_fast() instead of +rhashtable_lookup() with rcu_read_lock(). +Using xa without rcu_read_lock() here is safe. +xa is freed by __xdp_mem_allocator_rcu_free() and this is called by +call_rcu() of mem_xa_remove(). +The mem_xa_remove() is called by page_pool_destroy() if a reference +count reaches 0. +The xa is already protected by the reference count mechanism well in the +control plane. +So removing rcu_read_lock() for page_pool_destroy() is safe. + +Fixes: c3f812cea0d7 ("page_pool: do not release pool until inflight == 0.") +Signed-off-by: Taehee Yoo +Reviewed-by: Jakub Kicinski +Link: https://patch.msgid.link/20240712095116.3801586-1-ap420073@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/xdp.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/core/xdp.c b/net/core/xdp.c +index 022c12059cf2f..bcc5551c6424b 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -127,10 +127,8 @@ void xdp_unreg_mem_model(struct xdp_mem_info *mem) + return; + + if (type == MEM_TYPE_PAGE_POOL) { +- rcu_read_lock(); +- xa = rhashtable_lookup(mem_id_ht, &id, mem_id_rht_params); ++ xa = rhashtable_lookup_fast(mem_id_ht, &id, mem_id_rht_params); + page_pool_destroy(xa->page_pool); +- rcu_read_unlock(); + } + } + EXPORT_SYMBOL_GPL(xdp_unreg_mem_model); +-- +2.43.0 + diff --git a/queue-6.10/xen-blkfront-fix-sector_size-propagation-to-the-bloc.patch b/queue-6.10/xen-blkfront-fix-sector_size-propagation-to-the-bloc.patch new file mode 100644 index 00000000000..6e182cd34c1 --- /dev/null +++ b/queue-6.10/xen-blkfront-fix-sector_size-propagation-to-the-bloc.patch @@ -0,0 +1,96 @@ +From 158fd50824a76e0e3c4452aa35bc232c21a96152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jun 2024 07:52:38 +0200 +Subject: xen-blkfront: fix sector_size propagation to the block layer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit 98d34c087249d39838874b83e17671e7d5eb1ca7 ] + +Ensure that info->sector_size and info->physical_sector_size are set +before the call to blkif_set_queue_limits by doing away with the +local variables and arguments that propagate them. + +Thanks to Marek Marczykowski-Górecki and Jürgen Groß for root causing +the issue. + +Fixes: ba3f67c11638 ("xen-blkfront: atomically update queue limits") +Reported-by: Rusty Bird +Signed-off-by: Christoph Hellwig +Reviewed-by: Roger Pau Monné +Link: https://lore.kernel.org/r/20240625055238.7934-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/xen-blkfront.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index fd7c0ff2139ce..67aa63dabcff1 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -1063,8 +1063,7 @@ static char *encode_disk_name(char *ptr, unsigned int n) + } + + static int xlvbd_alloc_gendisk(blkif_sector_t capacity, +- struct blkfront_info *info, u16 sector_size, +- unsigned int physical_sector_size) ++ struct blkfront_info *info) + { + struct queue_limits lim = {}; + struct gendisk *gd; +@@ -1159,8 +1158,6 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity, + + info->rq = gd->queue; + info->gd = gd; +- info->sector_size = sector_size; +- info->physical_sector_size = physical_sector_size; + + xlvbd_flush(info); + +@@ -2315,8 +2312,6 @@ static void blkfront_gather_backend_features(struct blkfront_info *info) + static void blkfront_connect(struct blkfront_info *info) + { + unsigned long long sectors; +- unsigned long sector_size; +- unsigned int physical_sector_size; + int err, i; + struct blkfront_ring_info *rinfo; + +@@ -2355,7 +2350,7 @@ static void blkfront_connect(struct blkfront_info *info) + err = xenbus_gather(XBT_NIL, info->xbdev->otherend, + "sectors", "%llu", §ors, + "info", "%u", &info->vdisk_info, +- "sector-size", "%lu", §or_size, ++ "sector-size", "%lu", &info->sector_size, + NULL); + if (err) { + xenbus_dev_fatal(info->xbdev, err, +@@ -2369,9 +2364,9 @@ static void blkfront_connect(struct blkfront_info *info) + * provide this. Assume physical sector size to be the same as + * sector_size in that case. + */ +- physical_sector_size = xenbus_read_unsigned(info->xbdev->otherend, ++ info->physical_sector_size = xenbus_read_unsigned(info->xbdev->otherend, + "physical-sector-size", +- sector_size); ++ info->sector_size); + blkfront_gather_backend_features(info); + for_each_rinfo(info, rinfo, i) { + err = blkfront_setup_indirect(rinfo); +@@ -2383,8 +2378,7 @@ static void blkfront_connect(struct blkfront_info *info) + } + } + +- err = xlvbd_alloc_gendisk(sectors, info, sector_size, +- physical_sector_size); ++ err = xlvbd_alloc_gendisk(sectors, info); + if (err) { + xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s", + info->xbdev->otherend); +-- +2.43.0 + diff --git a/queue-6.10/xfrm-call-xfrm_dev_policy_delete-when-kill-policy.patch b/queue-6.10/xfrm-call-xfrm_dev_policy_delete-when-kill-policy.patch new file mode 100644 index 00000000000..899b85daa5f --- /dev/null +++ b/queue-6.10/xfrm-call-xfrm_dev_policy_delete-when-kill-policy.patch @@ -0,0 +1,90 @@ +From 84e5d59b180edd11abe14b22cc7d14de8fd04a5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 09:58:12 +0300 +Subject: xfrm: call xfrm_dev_policy_delete when kill policy + +From: Jianbo Liu + +[ Upstream commit 89a2aefe4b084686c2ffc1ee939585111ea4fc0f ] + +xfrm_policy_kill() is called at different places to delete xfrm +policy. It will call xfrm_pol_put(). But xfrm_dev_policy_delete() is +not called to free the policy offloaded to hardware. + +The three commits cited here are to handle this issue by calling +xfrm_dev_policy_delete() outside xfrm_get_policy(). But they didn't +cover all the cases. An example, which is not handled for now, is +xfrm_policy_insert(). It is called when XFRM_MSG_UPDPOLICY request is +received. Old policy is replaced by new one, but the offloaded policy +is not deleted, so driver doesn't have the chance to release hardware +resources. + +To resolve this issue for all cases, move xfrm_dev_policy_delete() +into xfrm_policy_kill(), so the offloaded policy can be deleted from +hardware when it is called, which avoids hardware resources leakage. + +Fixes: 919e43fad516 ("xfrm: add an interface to offload policy") +Fixes: bf06fcf4be0f ("xfrm: add missed call to delete offloaded policies") +Fixes: 982c3aca8bac ("xfrm: delete offloaded policy") +Signed-off-by: Jianbo Liu +Reviewed-by: Cosmin Ratiu +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_policy.c | 5 ++--- + net/xfrm/xfrm_user.c | 1 - + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 66e07de2de35c..56b88ad88db6f 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -452,6 +452,8 @@ EXPORT_SYMBOL(xfrm_policy_destroy); + + static void xfrm_policy_kill(struct xfrm_policy *policy) + { ++ xfrm_dev_policy_delete(policy); ++ + write_lock_bh(&policy->lock); + policy->walk.dead = 1; + write_unlock_bh(&policy->lock); +@@ -1850,7 +1852,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid) + + __xfrm_policy_unlink(pol, dir); + spin_unlock_bh(&net->xfrm.xfrm_policy_lock); +- xfrm_dev_policy_delete(pol); + cnt++; + xfrm_audit_policy_delete(pol, 1, task_valid); + xfrm_policy_kill(pol); +@@ -1891,7 +1892,6 @@ int xfrm_dev_policy_flush(struct net *net, struct net_device *dev, + + __xfrm_policy_unlink(pol, dir); + spin_unlock_bh(&net->xfrm.xfrm_policy_lock); +- xfrm_dev_policy_delete(pol); + cnt++; + xfrm_audit_policy_delete(pol, 1, task_valid); + xfrm_policy_kill(pol); +@@ -2342,7 +2342,6 @@ int xfrm_policy_delete(struct xfrm_policy *pol, int dir) + pol = __xfrm_policy_unlink(pol, dir); + spin_unlock_bh(&net->xfrm.xfrm_policy_lock); + if (pol) { +- xfrm_dev_policy_delete(pol); + xfrm_policy_kill(pol); + return 0; + } +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index e83c687bd64ee..77355422ce82a 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2455,7 +2455,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, + NETLINK_CB(skb).portid); + } + } else { +- xfrm_dev_policy_delete(xp); + xfrm_audit_policy_delete(xp, err ? 0 : 1, true); + + if (err != 0) +-- +2.43.0 + diff --git a/queue-6.10/xfrm-export-symbol-xfrm_dev_state_delete.patch b/queue-6.10/xfrm-export-symbol-xfrm_dev_state_delete.patch new file mode 100644 index 00000000000..23275332a92 --- /dev/null +++ b/queue-6.10/xfrm-export-symbol-xfrm_dev_state_delete.patch @@ -0,0 +1,35 @@ +From b6f55a3f143197772e5ca4f0c201822b44068dbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2024 10:46:25 +0200 +Subject: xfrm: Export symbol xfrm_dev_state_delete. + +From: Steffen Klassert + +[ Upstream commit 2d5317753e5f02a66e6d0afb9b25105d0beab1be ] + +This fixes a build failure if xfrm_user is build as a module. + +Fixes: 07b87f9eea0c ("xfrm: Fix unregister netdevice hang on hardware offload.") +Reported-by: Mark Brown +Tested-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_state.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index d531d2a1fae28..936f9348e5f63 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -698,6 +698,7 @@ void xfrm_dev_state_delete(struct xfrm_state *x) + spin_unlock_bh(&xfrm_state_dev_gc_lock); + } + } ++EXPORT_SYMBOL_GPL(xfrm_dev_state_delete); + + void xfrm_dev_state_free(struct xfrm_state *x) + { +-- +2.43.0 + diff --git a/queue-6.10/xfrm-fix-input-error-path-memory-access.patch b/queue-6.10/xfrm-fix-input-error-path-memory-access.patch new file mode 100644 index 00000000000..9f05bde6f72 --- /dev/null +++ b/queue-6.10/xfrm-fix-input-error-path-memory-access.patch @@ -0,0 +1,263 @@ +From a1f002de8901bd3fc614c4a79d1b95f4ab5917f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 08:31:29 +0200 +Subject: xfrm: Fix input error path memory access + +From: Antony Antony + +[ Upstream commit 54fcc6189dfb822eea984fa2b3e477a02447279d ] + +When there is a misconfiguration of input state slow path +KASAN report error. Fix this error. +west login: +[ 52.987278] eth1: renamed from veth11 +[ 53.078814] eth1: renamed from veth21 +[ 53.181355] eth1: renamed from veth31 +[ 54.921702] ================================================================== +[ 54.922602] BUG: KASAN: wild-memory-access in xfrmi_rcv_cb+0x2d/0x295 +[ 54.923393] Read of size 8 at addr 6b6b6b6b00000000 by task ping/512 +[ 54.924169] +[ 54.924386] CPU: 0 PID: 512 Comm: ping Not tainted 6.9.0-08574-gcd29a4313a1b #25 +[ 54.925290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +[ 54.926401] Call Trace: +[ 54.926731] +[ 54.927009] dump_stack_lvl+0x2a/0x3b +[ 54.927478] kasan_report+0x84/0xa6 +[ 54.927930] ? xfrmi_rcv_cb+0x2d/0x295 +[ 54.928410] xfrmi_rcv_cb+0x2d/0x295 +[ 54.928872] ? xfrm4_rcv_cb+0x3d/0x5e +[ 54.929354] xfrm4_rcv_cb+0x46/0x5e +[ 54.929804] xfrm_rcv_cb+0x7e/0xa1 +[ 54.930240] xfrm_input+0x1b3a/0x1b96 +[ 54.930715] ? xfrm_offload+0x41/0x41 +[ 54.931182] ? raw_rcv+0x292/0x292 +[ 54.931617] ? nf_conntrack_confirm+0xa2/0xa2 +[ 54.932158] ? skb_sec_path+0xd/0x3f +[ 54.932610] ? xfrmi_input+0x90/0xce +[ 54.933066] xfrm4_esp_rcv+0x33/0x54 +[ 54.933521] ip_protocol_deliver_rcu+0xd7/0x1b2 +[ 54.934089] ip_local_deliver_finish+0x110/0x120 +[ 54.934659] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 +[ 54.935248] NF_HOOK.constprop.0+0xf8/0x138 +[ 54.935767] ? ip_sublist_rcv_finish+0x68/0x68 +[ 54.936317] ? secure_tcpv6_ts_off+0x23/0x168 +[ 54.936859] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 +[ 54.937454] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d +[ 54.938135] NF_HOOK.constprop.0+0xf8/0x138 +[ 54.938663] ? ip_sublist_rcv_finish+0x68/0x68 +[ 54.939220] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d +[ 54.939904] ? ip_local_deliver_finish+0x120/0x120 +[ 54.940497] __netif_receive_skb_one_core+0xc9/0x107 +[ 54.941121] ? __netif_receive_skb_list_core+0x1c2/0x1c2 +[ 54.941771] ? blk_mq_start_stopped_hw_queues+0xc7/0xf9 +[ 54.942413] ? blk_mq_start_stopped_hw_queue+0x38/0x38 +[ 54.943044] ? virtqueue_get_buf_ctx+0x295/0x46b +[ 54.943618] process_backlog+0xb3/0x187 +[ 54.944102] __napi_poll.constprop.0+0x57/0x1a7 +[ 54.944669] net_rx_action+0x1cb/0x380 +[ 54.945150] ? __napi_poll.constprop.0+0x1a7/0x1a7 +[ 54.945744] ? vring_new_virtqueue+0x17a/0x17a +[ 54.946300] ? note_interrupt+0x2cd/0x367 +[ 54.946805] handle_softirqs+0x13c/0x2c9 +[ 54.947300] do_softirq+0x5f/0x7d +[ 54.947727] +[ 54.948014] +[ 54.948300] __local_bh_enable_ip+0x48/0x62 +[ 54.948832] __neigh_event_send+0x3fd/0x4ca +[ 54.949361] neigh_resolve_output+0x1e/0x210 +[ 54.949896] ip_finish_output2+0x4bf/0x4f0 +[ 54.950410] ? __ip_finish_output+0x171/0x1b8 +[ 54.950956] ip_send_skb+0x25/0x57 +[ 54.951390] raw_sendmsg+0xf95/0x10c0 +[ 54.951850] ? check_new_pages+0x45/0x71 +[ 54.952343] ? raw_hash_sk+0x21b/0x21b +[ 54.952815] ? kernel_init_pages+0x42/0x51 +[ 54.953337] ? prep_new_page+0x44/0x51 +[ 54.953811] ? get_page_from_freelist+0x72b/0x915 +[ 54.954390] ? signal_pending_state+0x77/0x77 +[ 54.954936] ? preempt_count_sub+0x14/0xb3 +[ 54.955450] ? __might_resched+0x8a/0x240 +[ 54.955951] ? __might_sleep+0x25/0xa0 +[ 54.956424] ? first_zones_zonelist+0x2c/0x43 +[ 54.956977] ? __rcu_read_lock+0x2d/0x3a +[ 54.957476] ? __pte_offset_map+0x32/0xa4 +[ 54.957980] ? __might_resched+0x8a/0x240 +[ 54.958483] ? __might_sleep+0x25/0xa0 +[ 54.958963] ? inet_send_prepare+0x54/0x54 +[ 54.959478] ? sock_sendmsg_nosec+0x42/0x6c +[ 54.960000] sock_sendmsg_nosec+0x42/0x6c +[ 54.960502] __sys_sendto+0x15d/0x1cc +[ 54.960966] ? __x64_sys_getpeername+0x44/0x44 +[ 54.961522] ? __handle_mm_fault+0x679/0xae4 +[ 54.962068] ? find_vma+0x6b/0x8b +[ 54.962497] ? find_vma_intersection+0x8a/0x8a +[ 54.963052] ? handle_mm_fault+0x38/0x154 +[ 54.963556] ? handle_mm_fault+0xeb/0x154 +[ 54.964059] ? preempt_latency_start+0x29/0x34 +[ 54.964613] ? preempt_count_sub+0x14/0xb3 +[ 54.965141] ? up_read+0x4b/0x5c +[ 54.965557] __x64_sys_sendto+0x76/0x82 +[ 54.966041] do_syscall_64+0x69/0xd5 +[ 54.966497] entry_SYSCALL_64_after_hwframe+0x4b/0x53 +[ 54.967119] RIP: 0033:0x7f2d2fec9a73 +[ 54.967572] Code: 8b 15 a9 83 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 80 3d 71 0b 0d 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24 +[ 54.969747] RSP: 002b:00007ffe85756418 EFLAGS: 00000202 ORIG_RAX: 000000000000002c +[ 54.970655] RAX: ffffffffffffffda RBX: 0000558bebad1340 RCX: 00007f2d2fec9a73 +[ 54.971511] RDX: 0000000000000040 RSI: 0000558bebad73c0 RDI: 0000000000000003 +[ 54.972366] RBP: 0000558bebad73c0 R08: 0000558bebad35c0 R09: 0000000000000010 +[ 54.973234] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040 +[ 54.974091] R13: 00007ffe85757b00 R14: 0000001d00000001 R15: 0000558bebad4680 +[ 54.974951] +[ 54.975244] ================================================================== +[ 54.976133] Disabling lock debugging due to kernel taint +[ 54.976784] Oops: stack segment: 0000 [#1] PREEMPT DEBUG_PAGEALLOC KASAN +[ 54.977603] CPU: 0 PID: 512 Comm: ping Tainted: G B 6.9.0-08574-gcd29a4313a1b #25 +[ 54.978654] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +[ 54.979750] RIP: 0010:xfrmi_rcv_cb+0x2d/0x295 +[ 54.980293] Code: 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb 51 85 f6 75 31 48 89 df e8 d7 e8 ff ff 48 89 c5 48 89 c7 e8 8b a4 4f ff <48> 8b 7d 00 48 89 ee e8 eb f3 ff ff 49 89 c5 b8 01 00 00 00 4d 85 +[ 54.982462] RSP: 0018:ffffc90000007990 EFLAGS: 00010282 +[ 54.983099] RAX: 0000000000000001 RBX: ffff8881126e9900 RCX: fffffbfff07b77cd +[ 54.983948] RDX: fffffbfff07b77cd RSI: fffffbfff07b77cd RDI: ffffffff83dbbe60 +[ 54.984794] RBP: 6b6b6b6b00000000 R08: 0000000000000008 R09: 0000000000000001 +[ 54.985647] R10: ffffffff83dbbe67 R11: fffffbfff07b77cc R12: 00000000ffffffff +[ 54.986512] R13: 00000000ffffffff R14: 00000000ffffffff R15: 0000000000000002 +[ 54.987365] FS: 00007f2d2fc0dc40(0000) GS:ffffffff82eb2000(0000) knlGS:0000000000000000 +[ 54.988329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 54.989026] CR2: 00007ffe85755ff8 CR3: 0000000109941000 CR4: 0000000000350ef0 +[ 54.989897] Call Trace: +[ 54.990223] +[ 54.990500] ? __die_body+0x1a/0x56 +[ 54.990950] ? die+0x30/0x49 +[ 54.991326] ? do_trap+0x9b/0x132 +[ 54.991751] ? do_error_trap+0x7d/0xaf +[ 54.992223] ? exc_stack_segment+0x35/0x45 +[ 54.992734] ? asm_exc_stack_segment+0x22/0x30 +[ 54.993294] ? xfrmi_rcv_cb+0x2d/0x295 +[ 54.993764] ? xfrm4_rcv_cb+0x3d/0x5e +[ 54.994228] xfrm4_rcv_cb+0x46/0x5e +[ 54.994670] xfrm_rcv_cb+0x7e/0xa1 +[ 54.995106] xfrm_input+0x1b3a/0x1b96 +[ 54.995572] ? xfrm_offload+0x41/0x41 +[ 54.996038] ? raw_rcv+0x292/0x292 +[ 54.996472] ? nf_conntrack_confirm+0xa2/0xa2 +[ 54.997011] ? skb_sec_path+0xd/0x3f +[ 54.997466] ? xfrmi_input+0x90/0xce +[ 54.997925] xfrm4_esp_rcv+0x33/0x54 +[ 54.998378] ip_protocol_deliver_rcu+0xd7/0x1b2 +[ 54.998944] ip_local_deliver_finish+0x110/0x120 +[ 54.999520] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 +[ 55.000111] NF_HOOK.constprop.0+0xf8/0x138 +[ 55.000630] ? ip_sublist_rcv_finish+0x68/0x68 +[ 55.001195] ? secure_tcpv6_ts_off+0x23/0x168 +[ 55.001743] ? ip_protocol_deliver_rcu+0x1b2/0x1b2 +[ 55.002331] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d +[ 55.003008] NF_HOOK.constprop.0+0xf8/0x138 +[ 55.003527] ? ip_sublist_rcv_finish+0x68/0x68 +[ 55.004078] ? __xfrm_policy_check2.constprop.0+0x18d/0x18d +[ 55.004755] ? ip_local_deliver_finish+0x120/0x120 +[ 55.005351] __netif_receive_skb_one_core+0xc9/0x107 +[ 55.005972] ? __netif_receive_skb_list_core+0x1c2/0x1c2 +[ 55.006626] ? blk_mq_start_stopped_hw_queues+0xc7/0xf9 +[ 55.007266] ? blk_mq_start_stopped_hw_queue+0x38/0x38 +[ 55.007899] ? virtqueue_get_buf_ctx+0x295/0x46b +[ 55.008476] process_backlog+0xb3/0x187 +[ 55.008961] __napi_poll.constprop.0+0x57/0x1a7 +[ 55.009540] net_rx_action+0x1cb/0x380 +[ 55.010020] ? __napi_poll.constprop.0+0x1a7/0x1a7 +[ 55.010610] ? vring_new_virtqueue+0x17a/0x17a +[ 55.011173] ? note_interrupt+0x2cd/0x367 +[ 55.011675] handle_softirqs+0x13c/0x2c9 +[ 55.012169] do_softirq+0x5f/0x7d +[ 55.012597] +[ 55.012882] +[ 55.013179] __local_bh_enable_ip+0x48/0x62 +[ 55.013704] __neigh_event_send+0x3fd/0x4ca +[ 55.014227] neigh_resolve_output+0x1e/0x210 +[ 55.014761] ip_finish_output2+0x4bf/0x4f0 +[ 55.015278] ? __ip_finish_output+0x171/0x1b8 +[ 55.015823] ip_send_skb+0x25/0x57 +[ 55.016261] raw_sendmsg+0xf95/0x10c0 +[ 55.016729] ? check_new_pages+0x45/0x71 +[ 55.017229] ? raw_hash_sk+0x21b/0x21b +[ 55.017708] ? kernel_init_pages+0x42/0x51 +[ 55.018225] ? prep_new_page+0x44/0x51 +[ 55.018704] ? get_page_from_freelist+0x72b/0x915 +[ 55.019292] ? signal_pending_state+0x77/0x77 +[ 55.019840] ? preempt_count_sub+0x14/0xb3 +[ 55.020357] ? __might_resched+0x8a/0x240 +[ 55.020860] ? __might_sleep+0x25/0xa0 +[ 55.021345] ? first_zones_zonelist+0x2c/0x43 +[ 55.021896] ? __rcu_read_lock+0x2d/0x3a +[ 55.022396] ? __pte_offset_map+0x32/0xa4 +[ 55.022901] ? __might_resched+0x8a/0x240 +[ 55.023404] ? __might_sleep+0x25/0xa0 +[ 55.023879] ? inet_send_prepare+0x54/0x54 +[ 55.024391] ? sock_sendmsg_nosec+0x42/0x6c +[ 55.024918] sock_sendmsg_nosec+0x42/0x6c +[ 55.025428] __sys_sendto+0x15d/0x1cc +[ 55.025892] ? __x64_sys_getpeername+0x44/0x44 +[ 55.026441] ? __handle_mm_fault+0x679/0xae4 +[ 55.026988] ? find_vma+0x6b/0x8b +[ 55.027414] ? find_vma_intersection+0x8a/0x8a +[ 55.027966] ? handle_mm_fault+0x38/0x154 +[ 55.028470] ? handle_mm_fault+0xeb/0x154 +[ 55.028972] ? preempt_latency_start+0x29/0x34 +[ 55.029532] ? preempt_count_sub+0x14/0xb3 +[ 55.030047] ? up_read+0x4b/0x5c +[ 55.030463] __x64_sys_sendto+0x76/0x82 +[ 55.030949] do_syscall_64+0x69/0xd5 +[ 55.031406] entry_SYSCALL_64_after_hwframe+0x4b/0x53 +[ 55.032028] RIP: 0033:0x7f2d2fec9a73 +[ 55.032481] Code: 8b 15 a9 83 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 80 3d 71 0b 0d 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24 +[ 55.034660] RSP: 002b:00007ffe85756418 EFLAGS: 00000202 ORIG_RAX: 000000000000002c +[ 55.035567] RAX: ffffffffffffffda RBX: 0000558bebad1340 RCX: 00007f2d2fec9a73 +[ 55.036424] RDX: 0000000000000040 RSI: 0000558bebad73c0 RDI: 0000000000000003 +[ 55.037293] RBP: 0000558bebad73c0 R08: 0000558bebad35c0 R09: 0000000000000010 +[ 55.038153] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040 +[ 55.039012] R13: 00007ffe85757b00 R14: 0000001d00000001 R15: 0000558bebad4680 +[ 55.039871] +[ 55.040167] Modules linked in: +[ 55.040585] ---[ end trace 0000000000000000 ]--- +[ 55.041164] RIP: 0010:xfrmi_rcv_cb+0x2d/0x295 +[ 55.041714] Code: 00 00 41 57 41 56 41 89 f6 41 55 41 54 55 53 48 89 fb 51 85 f6 75 31 48 89 df e8 d7 e8 ff ff 48 89 c5 48 89 c7 e8 8b a4 4f ff <48> 8b 7d 00 48 89 ee e8 eb f3 ff ff 49 89 c5 b8 01 00 00 00 4d 85 +[ 55.043889] RSP: 0018:ffffc90000007990 EFLAGS: 00010282 +[ 55.044528] RAX: 0000000000000001 RBX: ffff8881126e9900 RCX: fffffbfff07b77cd +[ 55.045386] RDX: fffffbfff07b77cd RSI: fffffbfff07b77cd RDI: ffffffff83dbbe60 +[ 55.046250] RBP: 6b6b6b6b00000000 R08: 0000000000000008 R09: 0000000000000001 +[ 55.047104] R10: ffffffff83dbbe67 R11: fffffbfff07b77cc R12: 00000000ffffffff +[ 55.047960] R13: 00000000ffffffff R14: 00000000ffffffff R15: 0000000000000002 +[ 55.048820] FS: 00007f2d2fc0dc40(0000) GS:ffffffff82eb2000(0000) knlGS:0000000000000000 +[ 55.049805] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 55.050507] CR2: 00007ffe85755ff8 CR3: 0000000109941000 CR4: 0000000000350ef0 +[ 55.051366] Kernel panic - not syncing: Fatal exception in interrupt +[ 55.052136] Kernel Offset: disabled +[ 55.052577] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- + +Fixes: 304b44f0d5a4 ("xfrm: Add dir validation to "in" data path lookup") +Signed-off-by: Antony Antony +Reviewed-by: Simon Horman +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_input.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index d2ea18dcb0cb5..63c0041039120 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -585,8 +585,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + } + + if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) { ++ secpath_reset(skb); + XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR); ++ xfrm_audit_state_notfound(skb, family, spi, seq); + xfrm_state_put(x); ++ x = NULL; + goto drop; + } + +-- +2.43.0 + diff --git a/queue-6.10/xfrm-fix-netdev-reference-count-imbalance.patch b/queue-6.10/xfrm-fix-netdev-reference-count-imbalance.patch new file mode 100644 index 00000000000..c2f1f5ac965 --- /dev/null +++ b/queue-6.10/xfrm-fix-netdev-reference-count-imbalance.patch @@ -0,0 +1,42 @@ +From 5ca92f6d7f6d7d1c0b81cad84aaff3cb2ab2fd24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 09:58:11 +0300 +Subject: xfrm: fix netdev reference count imbalance + +From: Jianbo Liu + +[ Upstream commit 9199b915e9fad7f5eff6160d24ff6b38e970107d ] + +In cited commit, netdev_tracker_alloc() is called for the newly +allocated xfrm state, but dev_hold() is missed, which causes netdev +reference count imbalance, because netdev_put() is called when the +state is freed in xfrm_dev_state_free(). Fix the issue by replacing +netdev_tracker_alloc() with netdev_hold(). + +Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode") +Signed-off-by: Jianbo Liu +Reviewed-by: Cosmin Ratiu +Signed-off-by: Leon Romanovsky +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_state.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 936f9348e5f63..67b2a399a48a7 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1331,8 +1331,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + xso->dev = xdo->dev; + xso->real_dev = xdo->real_dev; + xso->flags = XFRM_DEV_OFFLOAD_FLAG_ACQ; +- netdev_tracker_alloc(xso->dev, &xso->dev_tracker, +- GFP_ATOMIC); ++ netdev_hold(xso->dev, &xso->dev_tracker, GFP_ATOMIC); + error = xso->dev->xfrmdev_ops->xdo_dev_state_add(x, NULL); + if (error) { + xso->dir = 0; +-- +2.43.0 + diff --git a/queue-6.10/xfrm-fix-unregister-netdevice-hang-on-hardware-offlo.patch b/queue-6.10/xfrm-fix-unregister-netdevice-hang-on-hardware-offlo.patch new file mode 100644 index 00000000000..f949211b924 --- /dev/null +++ b/queue-6.10/xfrm-fix-unregister-netdevice-hang-on-hardware-offlo.patch @@ -0,0 +1,218 @@ +From 7fb66bdd8d34cd58cb89442887100c54fae83081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2024 08:47:24 +0200 +Subject: xfrm: Fix unregister netdevice hang on hardware offload. + +From: Steffen Klassert + +[ Upstream commit 07b87f9eea0c30675084d50c82532d20168da009 ] + +When offloading xfrm states to hardware, the offloading +device is attached to the skbs secpath. If a skb is free +is deferred, an unregister netdevice hangs because the +netdevice is still refcounted. + +Fix this by removing the netdevice from the xfrm states +when the netdevice is unregistered. To find all xfrm states +that need to be cleared we add another list where skbs +linked to that are unlinked from the lists (deleted) +but not yet freed. + +Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 36 +++++++------------------ + net/xfrm/xfrm_state.c | 61 +++++++++++++++++++++++++++++++++++++++++-- + 2 files changed, 69 insertions(+), 28 deletions(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 77ebf5bcf0b90..7d4c2235252c7 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -178,7 +178,10 @@ struct xfrm_state { + struct hlist_node gclist; + struct hlist_node bydst; + }; +- struct hlist_node bysrc; ++ union { ++ struct hlist_node dev_gclist; ++ struct hlist_node bysrc; ++ }; + struct hlist_node byspi; + struct hlist_node byseq; + +@@ -1588,7 +1591,7 @@ void xfrm_state_update_stats(struct net *net); + static inline void xfrm_dev_state_update_stats(struct xfrm_state *x) + { + struct xfrm_dev_offload *xdo = &x->xso; +- struct net_device *dev = xdo->dev; ++ struct net_device *dev = READ_ONCE(xdo->dev); + + if (dev && dev->xfrmdev_ops && + dev->xfrmdev_ops->xdo_dev_state_update_stats) +@@ -1946,13 +1949,16 @@ int xfrm_dev_policy_add(struct net *net, struct xfrm_policy *xp, + struct xfrm_user_offload *xuo, u8 dir, + struct netlink_ext_ack *extack); + bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); ++void xfrm_dev_state_delete(struct xfrm_state *x); ++void xfrm_dev_state_free(struct xfrm_state *x); + + static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x) + { + struct xfrm_dev_offload *xso = &x->xso; ++ struct net_device *dev = READ_ONCE(xso->dev); + +- if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn) +- xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); ++ if (dev && dev->xfrmdev_ops->xdo_dev_state_advance_esn) ++ dev->xfrmdev_ops->xdo_dev_state_advance_esn(x); + } + + static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) +@@ -1973,28 +1979,6 @@ static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) + return false; + } + +-static inline void xfrm_dev_state_delete(struct xfrm_state *x) +-{ +- struct xfrm_dev_offload *xso = &x->xso; +- +- if (xso->dev) +- xso->dev->xfrmdev_ops->xdo_dev_state_delete(x); +-} +- +-static inline void xfrm_dev_state_free(struct xfrm_state *x) +-{ +- struct xfrm_dev_offload *xso = &x->xso; +- struct net_device *dev = xso->dev; +- +- if (dev && dev->xfrmdev_ops) { +- if (dev->xfrmdev_ops->xdo_dev_state_free) +- dev->xfrmdev_ops->xdo_dev_state_free(x); +- xso->dev = NULL; +- xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; +- netdev_put(dev, &xso->dev_tracker); +- } +-} +- + static inline void xfrm_dev_policy_delete(struct xfrm_policy *x) + { + struct xfrm_dev_offload *xdo = &x->xdo; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 649bb739df0dd..d531d2a1fae28 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -49,6 +49,7 @@ static struct kmem_cache *xfrm_state_cache __ro_after_init; + + static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task); + static HLIST_HEAD(xfrm_state_gc_list); ++static HLIST_HEAD(xfrm_state_dev_gc_list); + + static inline bool xfrm_state_hold_rcu(struct xfrm_state __rcu *x) + { +@@ -214,6 +215,7 @@ static DEFINE_SPINLOCK(xfrm_state_afinfo_lock); + static struct xfrm_state_afinfo __rcu *xfrm_state_afinfo[NPROTO]; + + static DEFINE_SPINLOCK(xfrm_state_gc_lock); ++static DEFINE_SPINLOCK(xfrm_state_dev_gc_lock); + + int __xfrm_state_delete(struct xfrm_state *x); + +@@ -683,6 +685,40 @@ struct xfrm_state *xfrm_state_alloc(struct net *net) + } + EXPORT_SYMBOL(xfrm_state_alloc); + ++#ifdef CONFIG_XFRM_OFFLOAD ++void xfrm_dev_state_delete(struct xfrm_state *x) ++{ ++ struct xfrm_dev_offload *xso = &x->xso; ++ struct net_device *dev = READ_ONCE(xso->dev); ++ ++ if (dev) { ++ dev->xfrmdev_ops->xdo_dev_state_delete(x); ++ spin_lock_bh(&xfrm_state_dev_gc_lock); ++ hlist_add_head(&x->dev_gclist, &xfrm_state_dev_gc_list); ++ spin_unlock_bh(&xfrm_state_dev_gc_lock); ++ } ++} ++ ++void xfrm_dev_state_free(struct xfrm_state *x) ++{ ++ struct xfrm_dev_offload *xso = &x->xso; ++ struct net_device *dev = READ_ONCE(xso->dev); ++ ++ if (dev && dev->xfrmdev_ops) { ++ spin_lock_bh(&xfrm_state_dev_gc_lock); ++ if (!hlist_unhashed(&x->dev_gclist)) ++ hlist_del(&x->dev_gclist); ++ spin_unlock_bh(&xfrm_state_dev_gc_lock); ++ ++ if (dev->xfrmdev_ops->xdo_dev_state_free) ++ dev->xfrmdev_ops->xdo_dev_state_free(x); ++ WRITE_ONCE(xso->dev, NULL); ++ xso->type = XFRM_DEV_OFFLOAD_UNSPECIFIED; ++ netdev_put(dev, &xso->dev_tracker); ++ } ++} ++#endif ++ + void __xfrm_state_destroy(struct xfrm_state *x, bool sync) + { + WARN_ON(x->km.state != XFRM_STATE_DEAD); +@@ -848,6 +884,9 @@ EXPORT_SYMBOL(xfrm_state_flush); + + int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid) + { ++ struct xfrm_state *x; ++ struct hlist_node *tmp; ++ struct xfrm_dev_offload *xso; + int i, err = 0, cnt = 0; + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +@@ -857,8 +896,6 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali + + err = -ESRCH; + for (i = 0; i <= net->xfrm.state_hmask; i++) { +- struct xfrm_state *x; +- struct xfrm_dev_offload *xso; + restart: + hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { + xso = &x->xso; +@@ -868,6 +905,8 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + + err = xfrm_state_delete(x); ++ xfrm_dev_state_free(x); ++ + xfrm_audit_state_delete(x, err ? 0 : 1, + task_valid); + xfrm_state_put(x); +@@ -884,6 +923,24 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali + + out: + spin_unlock_bh(&net->xfrm.xfrm_state_lock); ++ ++ spin_lock_bh(&xfrm_state_dev_gc_lock); ++restart_gc: ++ hlist_for_each_entry_safe(x, tmp, &xfrm_state_dev_gc_list, dev_gclist) { ++ xso = &x->xso; ++ ++ if (xso->dev == dev) { ++ spin_unlock_bh(&xfrm_state_dev_gc_lock); ++ xfrm_dev_state_free(x); ++ spin_lock_bh(&xfrm_state_dev_gc_lock); ++ goto restart_gc; ++ } ++ ++ } ++ spin_unlock_bh(&xfrm_state_dev_gc_lock); ++ ++ xfrm_flush_gc(); ++ + return err; + } + EXPORT_SYMBOL(xfrm_dev_state_flush); +-- +2.43.0 + diff --git a/queue-6.10/xfrm-log-input-direction-mismatch-error-in-one-place.patch b/queue-6.10/xfrm-log-input-direction-mismatch-error-in-one-place.patch new file mode 100644 index 00000000000..89d71808028 --- /dev/null +++ b/queue-6.10/xfrm-log-input-direction-mismatch-error-in-one-place.patch @@ -0,0 +1,87 @@ +From 77487a52b88015dff3adf7618e591864f5cd9ab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2024 08:32:15 +0200 +Subject: xfrm: Log input direction mismatch error in one place + +From: Antony Antony + +[ Upstream commit 15f5fe9e84839dcc9eaa69b08ced9d24cb464369 ] + +Previously, the offload data path decrypted the packet before checking +the direction, leading to error logging and packet dropping. However, +dropped packets wouldn't be visible in tcpdump or audit log. + +With this fix, the offload path, upon noticing SA direction mismatch, +will pass the packet to the stack without decrypting it. The L3 layer +will then log the error, audit, and drop ESP without decrypting or +decapsulating it. + +This also ensures that the slow path records the error and audit log, +making dropped packets visible in tcpdump. + +Fixes: 304b44f0d5a4 ("xfrm: Add dir validation to "in" data path lookup") +Signed-off-by: Antony Antony +Reviewed-by: Simon Horman +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4_offload.c | 7 +++++++ + net/ipv6/esp6_offload.c | 7 +++++++ + net/xfrm/xfrm_input.c | 5 ----- + 3 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index b3271957ad9a0..3f28ecbdcaef1 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -56,6 +56,13 @@ static struct sk_buff *esp4_gro_receive(struct list_head *head, + x = xfrm_state_lookup(dev_net(skb->dev), skb->mark, + (xfrm_address_t *)&ip_hdr(skb)->daddr, + spi, IPPROTO_ESP, AF_INET); ++ ++ if (unlikely(x && x->dir && x->dir != XFRM_SA_DIR_IN)) { ++ /* non-offload path will record the error and audit log */ ++ xfrm_state_put(x); ++ x = NULL; ++ } ++ + if (!x) + goto out_reset; + +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index 527b7caddbc68..919ebfabbe4ee 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -83,6 +83,13 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head, + x = xfrm_state_lookup(dev_net(skb->dev), skb->mark, + (xfrm_address_t *)&ipv6_hdr(skb)->daddr, + spi, IPPROTO_ESP, AF_INET6); ++ ++ if (unlikely(x && x->dir && x->dir != XFRM_SA_DIR_IN)) { ++ /* non-offload path will record the error and audit log */ ++ xfrm_state_put(x); ++ x = NULL; ++ } ++ + if (!x) + goto out_reset; + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 63c0041039120..e95462b982b0f 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -474,11 +474,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + if (encap_type < 0 || (xo && xo->flags & XFRM_GRO)) { + x = xfrm_input_state(skb); + +- if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) { +- XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR); +- goto drop; +- } +- + if (unlikely(x->km.state != XFRM_STATE_VALID)) { + if (x->km.state == XFRM_STATE_ACQ) + XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR); +-- +2.43.0 + diff --git a/queue-6.10/xprtrdma-fix-rpcrdma_reqs_reset.patch b/queue-6.10/xprtrdma-fix-rpcrdma_reqs_reset.patch new file mode 100644 index 00000000000..908123d5640 --- /dev/null +++ b/queue-6.10/xprtrdma-fix-rpcrdma_reqs_reset.patch @@ -0,0 +1,85 @@ +From 7f14f8bd623b2a402f3e2a370d081234e164325e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2024 15:45:23 -0400 +Subject: xprtrdma: Fix rpcrdma_reqs_reset() + +From: Chuck Lever + +[ Upstream commit acd9f2dd23c632568156217aac7a05f5a0313152 ] + +Avoid FastReg operations getting MW_BIND_ERR after a reconnect. + +rpcrdma_reqs_reset() is called on transport tear-down to get each +rpcrdma_req back into a clean state. + +MRs on req->rl_registered are waiting for a FastReg, are already +registered, or are waiting for invalidation. If the transport is +being torn down when reqs_reset() is called, the matching LocalInv +might never be posted. That leaves these MR registered /and/ on +req->rl_free_mrs, where they can be re-used for the next +connection. + +Since xprtrdma does not keep specific track of the MR state, it's +not possible to know what state these MRs are in, so the only safe +thing to do is release them immediately. + +Fixes: 5de55ce951a1 ("xprtrdma: Release in-flight MRs on disconnect") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/frwr_ops.c | 3 ++- + net/sunrpc/xprtrdma/verbs.c | 16 +++++++++++++++- + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c +index ffbf99894970e..47f33bb7bff81 100644 +--- a/net/sunrpc/xprtrdma/frwr_ops.c ++++ b/net/sunrpc/xprtrdma/frwr_ops.c +@@ -92,7 +92,8 @@ static void frwr_mr_put(struct rpcrdma_mr *mr) + rpcrdma_mr_push(mr, &mr->mr_req->rl_free_mrs); + } + +-/* frwr_reset - Place MRs back on the free list ++/** ++ * frwr_reset - Place MRs back on @req's free list + * @req: request to reset + * + * Used after a failed marshal. For FRWR, this means the MRs +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 432557a553e7e..a0b071089e159 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -897,6 +897,8 @@ static int rpcrdma_reqs_setup(struct rpcrdma_xprt *r_xprt) + + static void rpcrdma_req_reset(struct rpcrdma_req *req) + { ++ struct rpcrdma_mr *mr; ++ + /* Credits are valid for only one connection */ + req->rl_slot.rq_cong = 0; + +@@ -906,7 +908,19 @@ static void rpcrdma_req_reset(struct rpcrdma_req *req) + rpcrdma_regbuf_dma_unmap(req->rl_sendbuf); + rpcrdma_regbuf_dma_unmap(req->rl_recvbuf); + +- frwr_reset(req); ++ /* The verbs consumer can't know the state of an MR on the ++ * req->rl_registered list unless a successful completion ++ * has occurred, so they cannot be re-used. ++ */ ++ while ((mr = rpcrdma_mr_pop(&req->rl_registered))) { ++ struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf; ++ ++ spin_lock(&buf->rb_lock); ++ list_del(&mr->mr_all); ++ spin_unlock(&buf->rb_lock); ++ ++ frwr_mr_release(mr); ++ } + } + + /* ASSUMPTION: the rb_allreqs list is stable for the duration, +-- +2.43.0 +