From: Sasha Levin Date: Thu, 12 Sep 2024 12:20:57 +0000 (-0400) Subject: Fixes for 6.10 X-Git-Tag: v6.1.111~53 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7ef4d427004097df17627f9a9286ea08b8691500;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.10 Signed-off-by: Sasha Levin --- diff --git a/queue-6.10/btrfs-update-target-inode-s-ctime-on-unlink.patch b/queue-6.10/btrfs-update-target-inode-s-ctime-on-unlink.patch new file mode 100644 index 00000000000..613ef99522b --- /dev/null +++ b/queue-6.10/btrfs-update-target-inode-s-ctime-on-unlink.patch @@ -0,0 +1,43 @@ +From 0a27ebf944c5b6214a9f4401329cd95402493b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 12:30:52 -0400 +Subject: btrfs: update target inode's ctime on unlink + +From: Jeff Layton + +[ Upstream commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 ] + +Unlink changes the link count on the target inode. POSIX mandates that +the ctime must also change when this occurs. + +According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html: + +"Upon successful completion, unlink() shall mark for update the last data + modification and last file status change timestamps of the parent + directory. Also, if the file's link count is not 0, the last file status + change timestamp of the file shall be marked for update." + +Signed-off-by: Jeff Layton +Reviewed-by: David Sterba +[ add link to the opengroup docs ] +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 2951aa0039fc..5d23421b6243 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4213,6 +4213,7 @@ static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans, + + btrfs_i_size_write(dir, dir->vfs_inode.i_size - name->len * 2); + inode_inc_iversion(&inode->vfs_inode); ++ inode_set_ctime_current(&inode->vfs_inode); + inode_inc_iversion(&dir->vfs_inode); + inode_set_mtime_to_ts(&dir->vfs_inode, inode_set_ctime_current(&dir->vfs_inode)); + ret = btrfs_update_inode(trans, dir); +-- +2.43.0 + diff --git a/queue-6.10/cgroup-cpuset-eliminate-unncessary-sched-domains-reb.patch b/queue-6.10/cgroup-cpuset-eliminate-unncessary-sched-domains-reb.patch new file mode 100644 index 00000000000..bf52f851da0 --- /dev/null +++ b/queue-6.10/cgroup-cpuset-eliminate-unncessary-sched-domains-reb.patch @@ -0,0 +1,126 @@ +From b00d3288123d9e493f3a1efec790e0be83e88ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Aug 2024 21:30:17 -0400 +Subject: cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug + +From: Waiman Long + +[ Upstream commit ff0ce721ec213499ec5a532041fb3a1db2dc5ecb ] + +It was found that some hotplug operations may cause multiple +rebuild_sched_domains_locked() calls. Some of those intermediate calls +may use cpuset states not in the final correct form leading to incorrect +sched domain setting. + +Fix this problem by using the existing force_rebuild flag to inhibit +immediate rebuild_sched_domains_locked() calls if set and only doing +one final call at the end. Also renaming the force_rebuild flag to +force_sd_rebuild to make its meaning for clear. + +Signed-off-by: Waiman Long +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cpuset.c | 33 +++++++++++++++++---------------- + 1 file changed, 17 insertions(+), 16 deletions(-) + +diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c +index e8f24483e05f..c03a2bc106d4 100644 +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -223,6 +223,13 @@ static cpumask_var_t isolated_cpus; + /* List of remote partition root children */ + static struct list_head remote_children; + ++/* ++ * A flag to force sched domain rebuild at the end of an operation while ++ * inhibiting it in the intermediate stages when set. Currently it is only ++ * set in hotplug code. ++ */ ++static bool force_sd_rebuild; ++ + /* + * Partition root states: + * +@@ -1442,7 +1449,7 @@ static void update_partition_sd_lb(struct cpuset *cs, int old_prs) + clear_bit(CS_SCHED_LOAD_BALANCE, &cs->flags); + } + +- if (rebuild_domains) ++ if (rebuild_domains && !force_sd_rebuild) + rebuild_sched_domains_locked(); + } + +@@ -1805,7 +1812,7 @@ static void remote_partition_check(struct cpuset *cs, struct cpumask *newmask, + remote_partition_disable(child, tmp); + disable_cnt++; + } +- if (disable_cnt) ++ if (disable_cnt && !force_sd_rebuild) + rebuild_sched_domains_locked(); + } + +@@ -2415,7 +2422,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp, + } + rcu_read_unlock(); + +- if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD)) ++ if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD) && ++ !force_sd_rebuild) + rebuild_sched_domains_locked(); + } + +@@ -3077,7 +3085,8 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs, + cs->flags = trialcs->flags; + spin_unlock_irq(&callback_lock); + +- if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed) ++ if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed && ++ !force_sd_rebuild) + rebuild_sched_domains_locked(); + + if (spread_flag_changed) +@@ -4478,11 +4487,9 @@ hotplug_update_tasks(struct cpuset *cs, + update_tasks_nodemask(cs); + } + +-static bool force_rebuild; +- + void cpuset_force_rebuild(void) + { +- force_rebuild = true; ++ force_sd_rebuild = true; + } + + /** +@@ -4630,15 +4637,9 @@ static void cpuset_handle_hotplug(void) + !cpumask_empty(subpartitions_cpus); + mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems); + +- /* +- * In the rare case that hotplug removes all the cpus in +- * subpartitions_cpus, we assumed that cpus are updated. +- */ +- if (!cpus_updated && !cpumask_empty(subpartitions_cpus)) +- cpus_updated = true; +- + /* For v1, synchronize cpus_allowed to cpu_active_mask */ + if (cpus_updated) { ++ cpuset_force_rebuild(); + spin_lock_irq(&callback_lock); + if (!on_dfl) + cpumask_copy(top_cpuset.cpus_allowed, &new_cpus); +@@ -4694,8 +4695,8 @@ static void cpuset_handle_hotplug(void) + } + + /* rebuild sched domains if cpus_allowed has changed */ +- if (cpus_updated || force_rebuild) { +- force_rebuild = false; ++ if (force_sd_rebuild) { ++ force_sd_rebuild = false; + rebuild_sched_domains_cpuslocked(); + } + +-- +2.43.0 + diff --git a/queue-6.10/drm-amdgpu-update-kmd_fw_shared-for-vcn5.patch b/queue-6.10/drm-amdgpu-update-kmd_fw_shared-for-vcn5.patch new file mode 100644 index 00000000000..29c9ef48e94 --- /dev/null +++ b/queue-6.10/drm-amdgpu-update-kmd_fw_shared-for-vcn5.patch @@ -0,0 +1,41 @@ +From a960d2f90a5f7ed3f4103b4232ffcf5c0944979f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 17:20:26 -0400 +Subject: drm/amdgpu: Update kmd_fw_shared for VCN5 + +From: Yinjie Yao + +[ Upstream commit 507a2286c052919fe416b3daa0f0061d0fc702b9 ] + +kmd_fw_shared changed in VCN5 + +Signed-off-by: Yinjie Yao +Reviewed-by: Ruijing Dong +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit aa02486fb18cecbaca0c4fd393d1a03f1d4c3f9a) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +index 1a5439abd1a0..c87d68d4be53 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h +@@ -461,8 +461,11 @@ struct amdgpu_vcn5_fw_shared { + struct amdgpu_fw_shared_unified_queue_struct sq; + uint8_t pad1[8]; + struct amdgpu_fw_shared_fw_logging fw_log; ++ uint8_t pad2[20]; + struct amdgpu_fw_shared_rb_setup rb_setup; +- uint8_t pad2[4]; ++ struct amdgpu_fw_shared_smu_interface_info smu_dpm_interface; ++ struct amdgpu_fw_shared_drm_key_wa drm_key_wa; ++ uint8_t pad3[9]; + }; + + #define VCN_BLOCK_ENCODE_DISABLE_MASK 0x80 +-- +2.43.0 + diff --git a/queue-6.10/drm-mediatek-set-sensible-cursor-width-height-values.patch b/queue-6.10/drm-mediatek-set-sensible-cursor-width-height-values.patch new file mode 100644 index 00000000000..4d98324b749 --- /dev/null +++ b/queue-6.10/drm-mediatek-set-sensible-cursor-width-height-values.patch @@ -0,0 +1,52 @@ +From 8158bec1be4d09c0b250a54bbe74e875642b02fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jul 2024 10:24:10 +0200 +Subject: drm/mediatek: Set sensible cursor width/height values to fix crash + +From: AngeloGioacchino Del Regno + +[ Upstream commit 042b8711a0beafb2c3b888bebe3c300ab4c817fa ] + +Hardware-speaking, there is no feature-reduced cursor specific +plane, so this driver reserves the last all Overlay plane as a +Cursor plane, but sets the maximum cursor width/height to the +maximum value that the full overlay plane can use. + +While this could be ok, it raises issues with common userspace +using libdrm (especially Mutter, but other compositors too) which +will crash upon performing allocations and/or using said cursor +plane. + +Reduce the maximum width/height for the cursor to 512x512 pixels, +value taken from IGT's maximum cursor size test, which succeeds. + +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Fei Shao +Tested-by: Fei Shao +Reviewed-by: Daniel Stone +Reviewed-by: CK Hu +Link: https://patchwork.kernel.org/project/dri-devel/patch/20240718082410.204459-1-angelogioacchino.delregno@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 56f409ad7f39..ab2bace792e4 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -539,8 +539,8 @@ static int mtk_drm_kms_init(struct drm_device *drm) + } + + /* IGT will check if the cursor size is configured */ +- drm->mode_config.cursor_width = drm->mode_config.max_width; +- drm->mode_config.cursor_height = drm->mode_config.max_height; ++ drm->mode_config.cursor_width = 512; ++ drm->mode_config.cursor_height = 512; + + /* Use OVL device for all DMA memory allocations */ + crtc = drm_crtc_from_index(drm, 0); +-- +2.43.0 + diff --git a/queue-6.10/drm-msm-adreno-fix-error-return-if-missing-firmware-.patch b/queue-6.10/drm-msm-adreno-fix-error-return-if-missing-firmware-.patch new file mode 100644 index 00000000000..75a6231c3a5 --- /dev/null +++ b/queue-6.10/drm-msm-adreno-fix-error-return-if-missing-firmware-.patch @@ -0,0 +1,40 @@ +From 9b6e01ffc838153cb929db9751a09dc42525cde2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 09:06:30 -0700 +Subject: drm/msm/adreno: Fix error return if missing firmware-name + +From: Rob Clark + +[ Upstream commit 624ab9cde26a9f150b4fd268b0f3dae3184dc40c ] + +-ENODEV is used to signify that there is no zap shader for the platform, +and the CPU can directly take the GPU out of secure mode. We want to +use this return code when there is no zap-shader node. But not when +there is, but without a firmware-name property. This case we want to +treat as-if the needed fw is not found. + +Signed-off-by: Rob Clark +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/604564/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 074fb498706f..b93ed15f04a3 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -99,7 +99,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname, + * was a bad idea, and is only provided for backwards + * compatibility for older targets. + */ +- return -ENODEV; ++ return -ENOENT; + } + + if (IS_ERR(fw)) { +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch b/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch new file mode 100644 index 00000000000..a7dfe20ac24 --- /dev/null +++ b/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch @@ -0,0 +1,42 @@ +From 36e38a4bf2a9df16bd60077e0ac513070e5f5ea7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jul 2024 14:47:30 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero + +From: Bouke Sybren Haarsma + +[ Upstream commit b86aa4140f6a8f01f35bfb05af60e01a55b48803 ] + +Add quirk orientation for the Ayn Loki Zero. + +This also has been tested/used by the JELOS team. + +Signed-off-by: Bouke Sybren Haarsma +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-2-boukehaarsma23@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 903f4bfea7e8..40473c705562 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_BOARD_NAME, "KUN"), + }, + .driver_data = (void *)&lcd1600x2560_rightside_up, ++ }, { /* AYN Loki Zero */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Zero"), ++ }, ++ .driver_data = (void *)&lcd1080x1920_leftside_up, + }, { /* Chuwi HiBook (CWI514) */ + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"), +-- +2.43.0 + diff --git a/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch-21215 b/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch-21215 new file mode 100644 index 00000000000..971536b7b20 --- /dev/null +++ b/queue-6.10/drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch-21215 @@ -0,0 +1,44 @@ +From 2862ce5a86750d8fcda7d29ad5871ca9e26d4f72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jul 2024 14:47:31 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for Ayn Loki Max + +From: Bouke Sybren Haarsma + +[ Upstream commit 2c71c8459c8ca66bd8f597effaac892ee8448a9f ] + +Add quirk orientation for Ayn Loki Max model. + +This has been tested by JELOS team that uses their +own patched kernel for a while now and confirmed by +users in the ChimeraOS discord servers. + +Signed-off-by: Bouke Sybren Haarsma +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-3-boukehaarsma23@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 40473c705562..70c9bd25f78d 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_MATCH(DMI_BOARD_NAME, "KUN"), + }, + .driver_data = (void *)&lcd1600x2560_rightside_up, ++ }, { /* AYN Loki Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Max"), ++ }, ++ .driver_data = (void *)&lcd1080x1920_leftside_up, + }, { /* AYN Loki Zero */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"), +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-fix-wa-14018094691.patch b/queue-6.10/drm-xe-fix-wa-14018094691.patch new file mode 100644 index 00000000000..8a0384421e6 --- /dev/null +++ b/queue-6.10/drm-xe-fix-wa-14018094691.patch @@ -0,0 +1,59 @@ +From e165196186b49d1565f95b1d7a1fa7a935388c1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2024 16:53:32 -0700 +Subject: drm/xe: fix WA 14018094691 + +From: Daniele Ceraolo Spurio + +[ Upstream commit f5cb1275c8ce56c7583cb323cfa08a820a7ef6b4 ] + +This WA is applied while initializing the media GT, but it a primary +GT WA (because it modifies a register on the primary GT), so the XE_WA +macro is returning false even when the WA should be applied. +Fix this by using the primary GT in the macro. + +Note that this WA only applies to PXP and we don't yet support that in +Xe, so there are no negative effects to this bug, which is why we didn't +see any errors in testing. + +v2: use the primary GT in the macro instead of marking the WA as +platform-wide (Lucas, Matt). + +Signed-off-by: Daniele Ceraolo Spurio +Cc: Matt Roper +Cc: Lucas De Marchi +Reviewed-by: Matt Roper +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240807235333.1370915-1-daniele.ceraolospurio@intel.com +(cherry picked from commit e422c0bfd9e47e399e86bcc483f49d8b54064fc2) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_gsc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_gsc.c b/drivers/gpu/drm/xe/xe_gsc.c +index 95c17b72fa57..c9a4ffcfdcca 100644 +--- a/drivers/gpu/drm/xe/xe_gsc.c ++++ b/drivers/gpu/drm/xe/xe_gsc.c +@@ -256,7 +256,7 @@ static int gsc_upload_and_init(struct xe_gsc *gsc) + struct xe_tile *tile = gt_to_tile(gt); + int ret; + +- if (XE_WA(gt, 14018094691)) { ++ if (XE_WA(tile->primary_gt, 14018094691)) { + ret = xe_force_wake_get(gt_to_fw(tile->primary_gt), XE_FORCEWAKE_ALL); + + /* +@@ -274,7 +274,7 @@ static int gsc_upload_and_init(struct xe_gsc *gsc) + + ret = gsc_upload(gsc); + +- if (XE_WA(gt, 14018094691)) ++ if (XE_WA(tile->primary_gt, 14018094691)) + xe_force_wake_put(gt_to_fw(tile->primary_gt), XE_FORCEWAKE_ALL); + + if (ret) +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-use-devm-instead-of-drmm-for-managed-bo.patch b/queue-6.10/drm-xe-use-devm-instead-of-drmm-for-managed-bo.patch new file mode 100644 index 00000000000..eea7a6b49fd --- /dev/null +++ b/queue-6.10/drm-xe-use-devm-instead-of-drmm-for-managed-bo.patch @@ -0,0 +1,61 @@ +From d06b6eb394680700c6b3b8ce33f50afbcf90e446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 16:12:35 -0700 +Subject: drm/xe: use devm instead of drmm for managed bo + +From: Daniele Ceraolo Spurio + +[ Upstream commit 8636a5c29be1f05b5162a5c82c874338b6717759 ] + +The BO cleanup touches the GGTT and therefore requires the HW to be +available, so we need to use devm instead of drmm. + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1160 +Signed-off-by: Daniele Ceraolo Spurio +Cc: Lucas De Marchi +Cc: Matthew Auld +Reviewed-by: Matthew Auld +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240809231237.1503796-2-daniele.ceraolospurio@intel.com +Signed-off-by: Lucas De Marchi +(cherry picked from commit 8d3a2d3d766a823c7510cdc17e6ff7c042c63b61) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_bo.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c +index b6f3a43d637f..f5e3012eff20 100644 +--- a/drivers/gpu/drm/xe/xe_bo.c ++++ b/drivers/gpu/drm/xe/xe_bo.c +@@ -1539,7 +1539,7 @@ struct xe_bo *xe_bo_create_from_data(struct xe_device *xe, struct xe_tile *tile, + return bo; + } + +-static void __xe_bo_unpin_map_no_vm(struct drm_device *drm, void *arg) ++static void __xe_bo_unpin_map_no_vm(void *arg) + { + xe_bo_unpin_map_no_vm(arg); + } +@@ -1554,7 +1554,7 @@ struct xe_bo *xe_managed_bo_create_pin_map(struct xe_device *xe, struct xe_tile + if (IS_ERR(bo)) + return bo; + +- ret = drmm_add_action_or_reset(&xe->drm, __xe_bo_unpin_map_no_vm, bo); ++ ret = devm_add_action_or_reset(xe->drm.dev, __xe_bo_unpin_map_no_vm, bo); + if (ret) + return ERR_PTR(ret); + +@@ -1602,7 +1602,7 @@ int xe_managed_bo_reinit_in_vram(struct xe_device *xe, struct xe_tile *tile, str + if (IS_ERR(bo)) + return PTR_ERR(bo); + +- drmm_release_action(&xe->drm, __xe_bo_unpin_map_no_vm, *src); ++ devm_release_action(xe->drm.dev, __xe_bo_unpin_map_no_vm, *src); + *src = bo; + + return 0; +-- +2.43.0 + diff --git a/queue-6.10/drm-xe-xe2lpm-extend-wa_16021639441.patch b/queue-6.10/drm-xe-xe2lpm-extend-wa_16021639441.patch new file mode 100644 index 00000000000..ca2862a5626 --- /dev/null +++ b/queue-6.10/drm-xe-xe2lpm-extend-wa_16021639441.patch @@ -0,0 +1,46 @@ +From d4d657c4af73dd590b2cc1e4ddca8e74a6387960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 11:46:37 -0700 +Subject: drm/xe/xe2lpm: Extend Wa_16021639441 + +From: Ngai-Mint Kwan + +[ Upstream commit 03a2dc84f5c4ef31ac0112b29d51ff103f7c8dd4 ] + +Wa_16021639441 applies to Xe2_LPM. + +Signed-off-by: Ngai-Mint Kwan +Reviewed-by: Matt Roper +Signed-off-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20240701184637.531794-1-ngai-mint.kwan@linux.intel.com +(cherry picked from commit 74e3076800067c6dc0dcff5b75344cec064c20eb) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/xe/xe_wa.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c +index 66dafe980b9c..1f7699d7fffb 100644 +--- a/drivers/gpu/drm/xe/xe_wa.c ++++ b/drivers/gpu/drm/xe/xe_wa.c +@@ -542,6 +542,16 @@ static const struct xe_rtp_entry_sr engine_was[] = { + XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE)) + }, + ++ /* Xe2_LPM */ ++ ++ { XE_RTP_NAME("16021639441"), ++ XE_RTP_RULES(MEDIA_VERSION(2000)), ++ XE_RTP_ACTIONS(SET(CSFE_CHICKEN1(0), ++ GHWSP_CSB_REPORT_DIS | ++ PPHWSP_CSB_AND_TIMESTAMP_REPORT_DIS, ++ XE_RTP_ACTION_FLAG(ENGINE_BASE))) ++ }, ++ + /* Xe2_HPM */ + + { XE_RTP_NAME("16021639441"), +-- +2.43.0 + diff --git a/queue-6.10/hid-asus-add-rog-ally-x-prod-id-to-quirk-list.patch b/queue-6.10/hid-asus-add-rog-ally-x-prod-id-to-quirk-list.patch new file mode 100644 index 00000000000..1875d9c3510 --- /dev/null +++ b/queue-6.10/hid-asus-add-rog-ally-x-prod-id-to-quirk-list.patch @@ -0,0 +1,49 @@ +From c5d9a595580fb4ce0d81687c16372f8c965f8900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 10:31:25 +1200 +Subject: hid-asus: add ROG Ally X prod ID to quirk list + +From: Luke D. Jones + +[ Upstream commit d1aa95e86f178dc597e80228cd9bd81fc3510f34 ] + +The new ASUS ROG Ally X functions almost exactly the same as the previous +model, so we can use the same quirks. + +Signed-off-by: Luke D. Jones +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 3 +++ + drivers/hid/hid-ids.h | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 37e6d25593c2..a282388b7aa5 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -1248,6 +1248,9 @@ static const struct hid_device_id asus_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY), + QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, ++ USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X), ++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, + USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD), + QUIRK_ROG_CLAYMORE_II_KEYBOARD }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 72d56ee7ce1b..6e3223389080 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -210,6 +210,7 @@ + #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 0x1a30 + #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR 0x18c6 + #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY 0x1abe ++#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c + #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b + #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869 + +-- +2.43.0 + diff --git a/queue-6.10/hid-multitouch-add-support-for-gt7868q.patch b/queue-6.10/hid-multitouch-add-support-for-gt7868q.patch new file mode 100644 index 00000000000..e1ef84ea1a7 --- /dev/null +++ b/queue-6.10/hid-multitouch-add-support-for-gt7868q.patch @@ -0,0 +1,95 @@ +From afe768b698a72e768fe4cfeaf75fe82a9cbf9367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2024 23:27:57 +0100 +Subject: HID: multitouch: Add support for GT7868Q + +From: Dmitry Savin + +[ Upstream commit c8000deb68365b461b324d68c7ea89d730f0bb85 ] + +GT7868Q has incorrect data in the report and needs a fixup. +The change enables haptic touchpad on Lenovo ThinkBook 13x Gen 4 +and has been tested on the device. + +Signed-off-by: Dmitry Savin +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 2 ++ + drivers/hid/hid-multitouch.c | 33 +++++++++++++++++++++++++++++++++ + 2 files changed, 35 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 6e3223389080..781c5aa29859 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -521,6 +521,8 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + + #define I2C_VENDOR_ID_GOODIX 0x27c6 ++#define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 ++#define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 + + #define USB_VENDOR_ID_GOODTOUCH 0x1aad +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 56fc78841f24..99812c0f830b 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1441,6 +1441,30 @@ static int mt_event(struct hid_device *hid, struct hid_field *field, + return 0; + } + ++static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *size) ++{ ++ if (hdev->vendor == I2C_VENDOR_ID_GOODIX && ++ (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { ++ if (rdesc[607] == 0x15) { ++ rdesc[607] = 0x25; ++ dev_info( ++ &hdev->dev, ++ "GT7868Q report descriptor fixup is applied.\n"); ++ } else { ++ dev_info( ++ &hdev->dev, ++ "The byte is not expected for fixing the report descriptor. \ ++It's possible that the touchpad firmware is not suitable for applying the fix. \ ++got: %x\n", ++ rdesc[607]); ++ } ++ } ++ ++ return rdesc; ++} ++ + static void mt_report(struct hid_device *hid, struct hid_report *report) + { + struct mt_device *td = hid_get_drvdata(hid); +@@ -2035,6 +2059,14 @@ static const struct hid_device_id mt_devices[] = { + MT_BT_DEVICE(USB_VENDOR_ID_FRUCTEL, + USB_DEVICE_ID_GAMETEL_MT_MODE) }, + ++ /* Goodix GT7868Q devices */ ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, ++ I2C_DEVICE_ID_GOODIX_01E8) }, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, ++ I2C_DEVICE_ID_GOODIX_01E8) }, ++ + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, + MT_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH, +@@ -2270,6 +2302,7 @@ static struct hid_driver mt_driver = { + .feature_mapping = mt_feature_mapping, + .usage_table = mt_grabbed_usages, + .event = mt_event, ++ .report_fixup = mt_report_fixup, + .report = mt_report, + .suspend = pm_ptr(mt_suspend), + .reset_resume = pm_ptr(mt_reset_resume), +-- +2.43.0 + diff --git a/queue-6.10/input-ads7846-ratelimit-the-spi_sync-error-message.patch b/queue-6.10/input-ads7846-ratelimit-the-spi_sync-error-message.patch new file mode 100644 index 00000000000..fa673f3967d --- /dev/null +++ b/queue-6.10/input-ads7846-ratelimit-the-spi_sync-error-message.patch @@ -0,0 +1,40 @@ +From 13e8f770c671c051ac218b9cbfbd06e55b54a7bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jul 2024 23:18:57 +0200 +Subject: Input: ads7846 - ratelimit the spi_sync error message + +From: Marek Vasut + +[ Upstream commit ccbfea78adf75d3d9e87aa739dab83254f5333fa ] + +In case the touch controller is not connected, this message keeps scrolling +on the console indefinitelly. Ratelimit it to avoid filling kernel logs. + +" +ads7846 spi2.1: spi_sync --> -22 +" + +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20240708211913.171243-1-marex@denx.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 4d13db13b9e5..b42096c797bf 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -805,7 +805,7 @@ static void ads7846_read_state(struct ads7846 *ts) + m = &ts->msg[msg_idx]; + error = spi_sync(ts->spi, m); + if (error) { +- dev_err(&ts->spi->dev, "spi_sync --> %d\n", error); ++ dev_err_ratelimited(&ts->spi->dev, "spi_sync --> %d\n", error); + packet->ignore = true; + return; + } +-- +2.43.0 + diff --git a/queue-6.10/input-edt-ft5x06-add-support-for-focaltech-ft8201.patch b/queue-6.10/input-edt-ft5x06-add-support-for-focaltech-ft8201.patch new file mode 100644 index 00000000000..1a30da9d148 --- /dev/null +++ b/queue-6.10/input-edt-ft5x06-add-support-for-focaltech-ft8201.patch @@ -0,0 +1,56 @@ +From ea544f8843a50ab0c7ce23ba2cc900a3bfd318f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Aug 2024 23:13:10 -0400 +Subject: Input: edt-ft5x06 - add support for FocalTech FT8201 + +From: Felix Kaechele + +[ Upstream commit fc289d3e8698f9b11edad6d73f371ebf35944c57 ] + +The driver supports the FT8201 chip as well. It registers up to 10 touch +points. + +Tested on: Lenovo ThinkSmart View (CD-18781Y), LCM: BOE TV080WXM-LL4 + +Signed-off-by: Felix Kaechele +Link: https://lore.kernel.org/r/20240804031310.331871-3-felix@kaechele.ca +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/edt-ft5x06.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c +index 06ec0f2e18ae..b0b5b6241b44 100644 +--- a/drivers/input/touchscreen/edt-ft5x06.c ++++ b/drivers/input/touchscreen/edt-ft5x06.c +@@ -1474,6 +1474,10 @@ static const struct edt_i2c_chip_data edt_ft6236_data = { + .max_support_points = 2, + }; + ++static const struct edt_i2c_chip_data edt_ft8201_data = { ++ .max_support_points = 10, ++}; ++ + static const struct edt_i2c_chip_data edt_ft8719_data = { + .max_support_points = 10, + }; +@@ -1485,6 +1489,7 @@ static const struct i2c_device_id edt_ft5x06_ts_id[] = { + { .name = "ft5452", .driver_data = (long)&edt_ft5452_data }, + /* Note no edt- prefix for compatibility with the ft6236.c driver */ + { .name = "ft6236", .driver_data = (long)&edt_ft6236_data }, ++ { .name = "ft8201", .driver_data = (long)&edt_ft8201_data }, + { .name = "ft8719", .driver_data = (long)&edt_ft8719_data }, + { /* sentinel */ } + }; +@@ -1499,6 +1504,7 @@ static const struct of_device_id edt_ft5x06_of_match[] = { + { .compatible = "focaltech,ft5452", .data = &edt_ft5452_data }, + /* Note focaltech vendor prefix for compatibility with ft6236.c */ + { .compatible = "focaltech,ft6236", .data = &edt_ft6236_data }, ++ { .compatible = "focaltech,ft8201", .data = &edt_ft8201_data }, + { .compatible = "focaltech,ft8719", .data = &edt_ft8719_data }, + { /* sentinel */ } + }; +-- +2.43.0 + diff --git a/queue-6.10/input-i8042-add-fujitsu-lifebook-e756-to-i8042-quirk.patch b/queue-6.10/input-i8042-add-fujitsu-lifebook-e756-to-i8042-quirk.patch new file mode 100644 index 00000000000..2c5b4af2aba --- /dev/null +++ b/queue-6.10/input-i8042-add-fujitsu-lifebook-e756-to-i8042-quirk.patch @@ -0,0 +1,44 @@ +From e6ecb3589f50a5106b5dad3af12e48ee35f1dc64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Aug 2024 12:06:19 +0200 +Subject: Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table + +From: Takashi Iwai + +[ Upstream commit 7ce7c2283fa6843ab3c2adfeb83dcc504a107858 ] + +Yet another quirk entry for Fujitsu laptop. Lifebook E756 requires +i8041.nomux for keeping the touchpad working after suspend/resume. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1229056 +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20240814100630.2048-1-tiwai@suse.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index e9eb9554dd7b..bad238f69a7a 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -627,6 +627,15 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX) + }, ++ { ++ /* Fujitsu Lifebook E756 */ ++ /* https://bugzilla.suse.com/show_bug.cgi?id=1229056 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E756"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOMUX) ++ }, + { + /* Fujitsu Lifebook E5411 */ + .matches = { +-- +2.43.0 + diff --git a/queue-6.10/input-synaptics-enable-smbus-for-hp-elitebook-840-g2.patch b/queue-6.10/input-synaptics-enable-smbus-for-hp-elitebook-840-g2.patch new file mode 100644 index 00000000000..26c2df649eb --- /dev/null +++ b/queue-6.10/input-synaptics-enable-smbus-for-hp-elitebook-840-g2.patch @@ -0,0 +1,38 @@ +From 520fb3826918d3fa64472f6423597a56fa91c8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2024 21:33:30 -0700 +Subject: Input: synaptics - enable SMBus for HP Elitebook 840 G2 + +From: Jonathan Denose + +[ Upstream commit da897484557b34a54fabb81f6c223c19a69e546d ] + +The kernel reports that the touchpad for this device can support a +different bus. + +With SMBus enabled the touchpad movement is smoother and three-finger +gestures are recognized. + +Signed-off-by: Jonathan Denose +Link: https://lore.kernel.org/r/20240719180612.1.Ib652dd808c274076f32cd7fc6c1160d2cf71753b@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 7a303a9d6bf7..cff3393f0dd0 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -189,6 +189,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN2054", /* E480 */ + "LEN2055", /* E580 */ + "LEN2068", /* T14 Gen 1 */ ++ "SYN3015", /* HP EliteBook 840 G2 */ + "SYN3052", /* HP EliteBook 840 G4 */ + "SYN3221", /* HP 15-ay000 */ + "SYN323d", /* HP Spectre X360 13-w013dx */ +-- +2.43.0 + diff --git a/queue-6.10/ksmbd-override-fsids-for-share-path-check.patch b/queue-6.10/ksmbd-override-fsids-for-share-path-check.patch new file mode 100644 index 00000000000..a4d51811ba8 --- /dev/null +++ b/queue-6.10/ksmbd-override-fsids-for-share-path-check.patch @@ -0,0 +1,224 @@ +From e07e35ea13f2ebaada5a1ff2083bb2ce600ac298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2024 08:56:18 +0900 +Subject: ksmbd: override fsids for share path check + +From: Namjae Jeon + +[ Upstream commit a018c1b636e79b60149b41151ded7c2606d8606e ] + +Sangsoo reported that a DAC denial error occurred when accessing +files through the ksmbd thread. This patch override fsids for share +path check. + +Reported-by: Sangsoo Lee +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/mgmt/share_config.c | 15 ++++++++++++--- + fs/smb/server/mgmt/share_config.h | 4 +++- + fs/smb/server/mgmt/tree_connect.c | 9 +++++---- + fs/smb/server/mgmt/tree_connect.h | 4 ++-- + fs/smb/server/smb2pdu.c | 2 +- + fs/smb/server/smb_common.c | 9 +++++++-- + fs/smb/server/smb_common.h | 2 ++ + 7 files changed, 32 insertions(+), 13 deletions(-) + +diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c +index e0a6b758094f..d8d03070ae44 100644 +--- a/fs/smb/server/mgmt/share_config.c ++++ b/fs/smb/server/mgmt/share_config.c +@@ -15,6 +15,7 @@ + #include "share_config.h" + #include "user_config.h" + #include "user_session.h" ++#include "../connection.h" + #include "../transport_ipc.h" + #include "../misc.h" + +@@ -120,12 +121,13 @@ static int parse_veto_list(struct ksmbd_share_config *share, + return 0; + } + +-static struct ksmbd_share_config *share_config_request(struct unicode_map *um, ++static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work, + const char *name) + { + struct ksmbd_share_config_response *resp; + struct ksmbd_share_config *share = NULL; + struct ksmbd_share_config *lookup; ++ struct unicode_map *um = work->conn->um; + int ret; + + resp = ksmbd_ipc_share_config_request(name); +@@ -181,7 +183,14 @@ static struct ksmbd_share_config *share_config_request(struct unicode_map *um, + KSMBD_SHARE_CONFIG_VETO_LIST(resp), + resp->veto_list_sz); + if (!ret && share->path) { ++ if (__ksmbd_override_fsids(work, share)) { ++ kill_share(share); ++ share = NULL; ++ goto out; ++ } ++ + ret = kern_path(share->path, 0, &share->vfs_path); ++ ksmbd_revert_fsids(work); + if (ret) { + ksmbd_debug(SMB, "failed to access '%s'\n", + share->path); +@@ -214,7 +223,7 @@ static struct ksmbd_share_config *share_config_request(struct unicode_map *um, + return share; + } + +-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um, ++struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work, + const char *name) + { + struct ksmbd_share_config *share; +@@ -227,7 +236,7 @@ struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um, + + if (share) + return share; +- return share_config_request(um, name); ++ return share_config_request(work, name); + } + + bool ksmbd_share_veto_filename(struct ksmbd_share_config *share, +diff --git a/fs/smb/server/mgmt/share_config.h b/fs/smb/server/mgmt/share_config.h +index 5f591751b923..d4ac2dd4de20 100644 +--- a/fs/smb/server/mgmt/share_config.h ++++ b/fs/smb/server/mgmt/share_config.h +@@ -11,6 +11,8 @@ + #include + #include + ++struct ksmbd_work; ++ + struct ksmbd_share_config { + char *name; + char *path; +@@ -68,7 +70,7 @@ static inline void ksmbd_share_config_put(struct ksmbd_share_config *share) + __ksmbd_share_config_put(share); + } + +-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um, ++struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work, + const char *name); + bool ksmbd_share_veto_filename(struct ksmbd_share_config *share, + const char *filename); +diff --git a/fs/smb/server/mgmt/tree_connect.c b/fs/smb/server/mgmt/tree_connect.c +index d2c81a8a11dd..94a52a75014a 100644 +--- a/fs/smb/server/mgmt/tree_connect.c ++++ b/fs/smb/server/mgmt/tree_connect.c +@@ -16,17 +16,18 @@ + #include "user_session.h" + + struct ksmbd_tree_conn_status +-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess, +- const char *share_name) ++ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name) + { + struct ksmbd_tree_conn_status status = {-ENOENT, NULL}; + struct ksmbd_tree_connect_response *resp = NULL; + struct ksmbd_share_config *sc; + struct ksmbd_tree_connect *tree_conn = NULL; + struct sockaddr *peer_addr; ++ struct ksmbd_conn *conn = work->conn; ++ struct ksmbd_session *sess = work->sess; + int ret; + +- sc = ksmbd_share_config_get(conn->um, share_name); ++ sc = ksmbd_share_config_get(work, share_name); + if (!sc) + return status; + +@@ -61,7 +62,7 @@ ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess, + struct ksmbd_share_config *new_sc; + + ksmbd_share_config_del(sc); +- new_sc = ksmbd_share_config_get(conn->um, share_name); ++ new_sc = ksmbd_share_config_get(work, share_name); + if (!new_sc) { + pr_err("Failed to update stale share config\n"); + status.ret = -ESTALE; +diff --git a/fs/smb/server/mgmt/tree_connect.h b/fs/smb/server/mgmt/tree_connect.h +index 6377a70b811c..a42cdd051041 100644 +--- a/fs/smb/server/mgmt/tree_connect.h ++++ b/fs/smb/server/mgmt/tree_connect.h +@@ -13,6 +13,7 @@ + struct ksmbd_share_config; + struct ksmbd_user; + struct ksmbd_conn; ++struct ksmbd_work; + + enum { + TREE_NEW = 0, +@@ -50,8 +51,7 @@ static inline int test_tree_conn_flag(struct ksmbd_tree_connect *tree_conn, + struct ksmbd_session; + + struct ksmbd_tree_conn_status +-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess, +- const char *share_name); ++ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name); + void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon); + + int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess, +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 39dfecf082ba..65cb35ed36c6 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -1959,7 +1959,7 @@ int smb2_tree_connect(struct ksmbd_work *work) + ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n", + name, treename); + +- status = ksmbd_tree_conn_connect(conn, sess, name); ++ status = ksmbd_tree_conn_connect(work, name); + if (status.ret == KSMBD_TREE_CONN_STATUS_OK) + rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id); + else +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 474dadf6b7b8..13818ecb6e1b 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -732,10 +732,10 @@ bool is_asterisk(char *p) + return p && p[0] == '*'; + } + +-int ksmbd_override_fsids(struct ksmbd_work *work) ++int __ksmbd_override_fsids(struct ksmbd_work *work, ++ struct ksmbd_share_config *share) + { + struct ksmbd_session *sess = work->sess; +- struct ksmbd_share_config *share = work->tcon->share_conf; + struct cred *cred; + struct group_info *gi; + unsigned int uid; +@@ -775,6 +775,11 @@ int ksmbd_override_fsids(struct ksmbd_work *work) + return 0; + } + ++int ksmbd_override_fsids(struct ksmbd_work *work) ++{ ++ return __ksmbd_override_fsids(work, work->tcon->share_conf); ++} ++ + void ksmbd_revert_fsids(struct ksmbd_work *work) + { + const struct cred *cred; +diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h +index f1092519c0c2..4a3148b0167f 100644 +--- a/fs/smb/server/smb_common.h ++++ b/fs/smb/server/smb_common.h +@@ -447,6 +447,8 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn, + int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command); + + int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp); ++int __ksmbd_override_fsids(struct ksmbd_work *work, ++ struct ksmbd_share_config *share); + int ksmbd_override_fsids(struct ksmbd_work *work); + void ksmbd_revert_fsids(struct ksmbd_work *work); + +-- +2.43.0 + diff --git a/queue-6.10/ksmbd-override-fsids-for-smb2_query_info.patch b/queue-6.10/ksmbd-override-fsids-for-smb2_query_info.patch new file mode 100644 index 00000000000..9c9b1b1e085 --- /dev/null +++ b/queue-6.10/ksmbd-override-fsids-for-smb2_query_info.patch @@ -0,0 +1,56 @@ +From 49c12d18588f089109aafa79b8f16936bd95d539 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2024 08:57:03 +0900 +Subject: ksmbd: override fsids for smb2_query_info() + +From: Namjae Jeon + +[ Upstream commit f6bd41280a44dcc2e0a25ed72617d25f586974a7 ] + +Sangsoo reported that a DAC denial error occurred when accessing +files through the ksmbd thread. This patch override fsids for +smb2_query_info(). + +Reported-by: Sangsoo Lee +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 65cb35ed36c6..0687083bcc3f 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5601,6 +5601,11 @@ int smb2_query_info(struct ksmbd_work *work) + + ksmbd_debug(SMB, "GOT query info request\n"); + ++ if (ksmbd_override_fsids(work)) { ++ rc = -ENOMEM; ++ goto err_out; ++ } ++ + switch (req->InfoType) { + case SMB2_O_INFO_FILE: + ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n"); +@@ -5619,6 +5624,7 @@ int smb2_query_info(struct ksmbd_work *work) + req->InfoType); + rc = -EOPNOTSUPP; + } ++ ksmbd_revert_fsids(work); + + if (!rc) { + rsp->StructureSize = cpu_to_le16(9); +@@ -5628,6 +5634,7 @@ int smb2_query_info(struct ksmbd_work *work) + le32_to_cpu(rsp->OutputBufferLength)); + } + ++err_out: + if (rc < 0) { + if (rc == -EACCES) + rsp->hdr.Status = STATUS_ACCESS_DENIED; +-- +2.43.0 + diff --git a/queue-6.10/net-ethernet-use-ip_hdrlen-instead-of-bit-shift.patch b/queue-6.10/net-ethernet-use-ip_hdrlen-instead-of-bit-shift.patch new file mode 100644 index 00000000000..2029d73a975 --- /dev/null +++ b/queue-6.10/net-ethernet-use-ip_hdrlen-instead-of-bit-shift.patch @@ -0,0 +1,50 @@ +From e9a542ddf849f6ff151c086a744563aa15ece735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2024 19:07:21 +0900 +Subject: net: ethernet: use ip_hdrlen() instead of bit shift + +From: Moon Yeounsu + +[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ] + +`ip_hdr(skb)->ihl << 2` is the same as `ip_hdrlen(skb)` +Therefore, we should use a well-defined function not a bit shift +to find the header length. + +It also compresses two lines to a single line. + +Signed-off-by: Moon Yeounsu +Reviewed-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/jme.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index b06e24562973..d8be0e4dcb07 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -946,15 +946,13 @@ jme_udpsum(struct sk_buff *skb) + if (skb->protocol != htons(ETH_P_IP)) + return csum; + skb_set_network_header(skb, ETH_HLEN); +- if ((ip_hdr(skb)->protocol != IPPROTO_UDP) || +- (skb->len < (ETH_HLEN + +- (ip_hdr(skb)->ihl << 2) + +- sizeof(struct udphdr)))) { ++ ++ if (ip_hdr(skb)->protocol != IPPROTO_UDP || ++ skb->len < (ETH_HLEN + ip_hdrlen(skb) + sizeof(struct udphdr))) { + skb_reset_network_header(skb); + return csum; + } +- skb_set_transport_header(skb, +- ETH_HLEN + (ip_hdr(skb)->ihl << 2)); ++ skb_set_transport_header(skb, ETH_HLEN + ip_hdrlen(skb)); + csum = udp_hdr(skb)->check; + skb_reset_transport_header(skb); + skb_reset_network_header(skb); +-- +2.43.0 + diff --git a/queue-6.10/net-hns3-use-correct-release-function-during-uniniti.patch b/queue-6.10/net-hns3-use-correct-release-function-during-uniniti.patch new file mode 100644 index 00000000000..d0acaca0bec --- /dev/null +++ b/queue-6.10/net-hns3-use-correct-release-function-during-uniniti.patch @@ -0,0 +1,39 @@ +From 62e4c158ed0808a65c5a4ad550bfa080525f12b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Aug 2024 22:10:24 +0800 +Subject: net: hns3: use correct release function during uninitialization + +From: Peiyang Wang + +[ Upstream commit 7660833d217528c8f2385528951ab820a031e4e3 ] + +pci_request_regions is called to apply for PCI I/O and memory resources +when the driver is initialized, Therefore, when the driver is uninstalled, +pci_release_regions should be used to release PCI I/O and memory resources +instead of pci_release_mem_regions is used to release memory reasouces +only. + +Signed-off-by: Peiyang Wang +Signed-off-by: Jijie Shao +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 465f0d582283..6c33195a1168 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -11456,7 +11456,7 @@ static void hclge_pci_uninit(struct hclge_dev *hdev) + + pcim_iounmap(pdev, hdev->hw.hw.io_base); + pci_free_irq_vectors(pdev); +- pci_release_mem_regions(pdev); ++ pci_release_regions(pdev); + pci_disable_device(pdev); + } + +-- +2.43.0 + diff --git a/queue-6.10/net-phy-vitesse-repair-vsc73xx-autonegotiation.patch b/queue-6.10/net-phy-vitesse-repair-vsc73xx-autonegotiation.patch new file mode 100644 index 00000000000..b336058d46e --- /dev/null +++ b/queue-6.10/net-phy-vitesse-repair-vsc73xx-autonegotiation.patch @@ -0,0 +1,76 @@ +From d3d19b5320a317864142b308ac7669d591399fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 21:38:06 +0200 +Subject: net: phy: vitesse: repair vsc73xx autonegotiation + +From: Pawel Dembicki + +[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ] + +When the vsc73xx mdio bus work properly, the generic autonegotiation +configuration works well. + +Reviewed-by: Linus Walleij +Signed-off-by: Pawel Dembicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/vitesse.c | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c +index 897b979ec03c..3b5fcaf0dd36 100644 +--- a/drivers/net/phy/vitesse.c ++++ b/drivers/net/phy/vitesse.c +@@ -237,16 +237,6 @@ static int vsc739x_config_init(struct phy_device *phydev) + return 0; + } + +-static int vsc73xx_config_aneg(struct phy_device *phydev) +-{ +- /* The VSC73xx switches does not like to be instructed to +- * do autonegotiation in any way, it prefers that you just go +- * with the power-on/reset defaults. Writing some registers will +- * just make autonegotiation permanently fail. +- */ +- return 0; +-} +- + /* This adds a skew for both TX and RX clocks, so the skew should only be + * applied to "rgmii-id" interfaces. It may not work as expected + * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces. +@@ -444,7 +434,6 @@ static struct phy_driver vsc82xx_driver[] = { + .phy_id_mask = 0x000ffff0, + /* PHY_GBIT_FEATURES */ + .config_init = vsc738x_config_init, +- .config_aneg = vsc73xx_config_aneg, + .read_page = vsc73xx_read_page, + .write_page = vsc73xx_write_page, + }, { +@@ -453,7 +442,6 @@ static struct phy_driver vsc82xx_driver[] = { + .phy_id_mask = 0x000ffff0, + /* PHY_GBIT_FEATURES */ + .config_init = vsc738x_config_init, +- .config_aneg = vsc73xx_config_aneg, + .read_page = vsc73xx_read_page, + .write_page = vsc73xx_write_page, + }, { +@@ -462,7 +450,6 @@ static struct phy_driver vsc82xx_driver[] = { + .phy_id_mask = 0x000ffff0, + /* PHY_GBIT_FEATURES */ + .config_init = vsc739x_config_init, +- .config_aneg = vsc73xx_config_aneg, + .read_page = vsc73xx_read_page, + .write_page = vsc73xx_write_page, + }, { +@@ -471,7 +458,6 @@ static struct phy_driver vsc82xx_driver[] = { + .phy_id_mask = 0x000ffff0, + /* PHY_GBIT_FEATURES */ + .config_init = vsc739x_config_init, +- .config_aneg = vsc73xx_config_aneg, + .read_page = vsc73xx_read_page, + .write_page = vsc73xx_write_page, + }, { +-- +2.43.0 + diff --git a/queue-6.10/nfs-avoid-unnecessary-rescanning-of-the-per-server-d.patch b/queue-6.10/nfs-avoid-unnecessary-rescanning-of-the-per-server-d.patch new file mode 100644 index 00000000000..5de4a892c99 --- /dev/null +++ b/queue-6.10/nfs-avoid-unnecessary-rescanning-of-the-per-server-d.patch @@ -0,0 +1,84 @@ +From fbaaf7a02fb7c791f83c0d72c571206cbf65138e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 14:05:02 -0400 +Subject: NFS: Avoid unnecessary rescanning of the per-server delegation list + +From: Trond Myklebust + +[ Upstream commit f92214e4c312f6ea9d78650cc6291d200f17abb6 ] + +If the call to nfs_delegation_grab_inode() fails, we will not have +dropped any locks that require us to rescan the list. + +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/delegation.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 6bace5fece04..ed362d291b90 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -624,6 +624,9 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, + prev = delegation; + continue; + } ++ inode = nfs_delegation_grab_inode(delegation); ++ if (inode == NULL) ++ continue; + + if (prev) { + struct inode *tmp = nfs_delegation_grab_inode(prev); +@@ -634,12 +637,6 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server, + } + } + +- inode = nfs_delegation_grab_inode(delegation); +- if (inode == NULL) { +- rcu_read_unlock(); +- iput(to_put); +- goto restart; +- } + delegation = nfs_start_delegation_return_locked(NFS_I(inode)); + rcu_read_unlock(); + +@@ -1161,7 +1158,6 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server, + struct inode *inode; + restart: + rcu_read_lock(); +-restart_locked: + list_for_each_entry_rcu(delegation, &server->delegations, super_list) { + if (test_bit(NFS_DELEGATION_INODE_FREEING, + &delegation->flags) || +@@ -1172,7 +1168,7 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server, + continue; + inode = nfs_delegation_grab_inode(delegation); + if (inode == NULL) +- goto restart_locked; ++ continue; + delegation = nfs_start_delegation_return_locked(NFS_I(inode)); + rcu_read_unlock(); + if (delegation != NULL) { +@@ -1295,7 +1291,6 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server, + + restart: + rcu_read_lock(); +-restart_locked: + list_for_each_entry_rcu(delegation, &server->delegations, super_list) { + if (test_bit(NFS_DELEGATION_INODE_FREEING, + &delegation->flags) || +@@ -1307,7 +1302,7 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server, + continue; + inode = nfs_delegation_grab_inode(delegation); + if (inode == NULL) +- goto restart_locked; ++ continue; + spin_lock(&delegation->lock); + cred = get_cred_rcu(delegation->cred); + nfs4_stateid_copy(&stateid, &delegation->stateid); +-- +2.43.0 + diff --git a/queue-6.10/nfsv4-fix-clearing-of-layout-segments-in-layoutretur.patch b/queue-6.10/nfsv4-fix-clearing-of-layout-segments-in-layoutretur.patch new file mode 100644 index 00000000000..58f13d796d8 --- /dev/null +++ b/queue-6.10/nfsv4-fix-clearing-of-layout-segments-in-layoutretur.patch @@ -0,0 +1,65 @@ +From e6b7e8c7cfc5644117a9b67a7e4d515bca0b7f0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Aug 2024 14:05:01 -0400 +Subject: NFSv4: Fix clearing of layout segments in layoutreturn + +From: Trond Myklebust + +[ Upstream commit d72b7963115bea971a28eaa2cb76722c023f9fdf ] + +Make sure that we clear the layout segments in cases where we see a +fatal error, and also in the case where the layout is invalid. + +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 9 ++++++--- + fs/nfs/pnfs.c | 5 ++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index bff9d6600741..3b76e89b6d02 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -9873,13 +9873,16 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata) + fallthrough; + default: + task->tk_status = 0; ++ lrp->res.lrs_present = 0; + fallthrough; + case 0: + break; + case -NFS4ERR_DELAY: +- if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN) +- break; +- goto out_restart; ++ if (nfs4_async_handle_error(task, server, NULL, NULL) == ++ -EAGAIN) ++ goto out_restart; ++ lrp->res.lrs_present = 0; ++ break; + } + return; + out_restart: +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index b5834728f31b..d1e3c17dcceb 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1172,10 +1172,9 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo, + LIST_HEAD(freeme); + + spin_lock(&inode->i_lock); +- if (!pnfs_layout_is_valid(lo) || +- !nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid)) ++ if (!nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid)) + goto out_unlock; +- if (stateid) { ++ if (stateid && pnfs_layout_is_valid(lo)) { + u32 seq = be32_to_cpu(arg_stateid->seqid); + + pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq); +-- +2.43.0 + diff --git a/queue-6.10/platform-surface-aggregator_registry-add-fan-and-the.patch b/queue-6.10/platform-surface-aggregator_registry-add-fan-and-the.patch new file mode 100644 index 00000000000..4d5afc0fe1e --- /dev/null +++ b/queue-6.10/platform-surface-aggregator_registry-add-fan-and-the.patch @@ -0,0 +1,44 @@ +From cd6c26c7bd6f5bb7f1d5b81ddccbaf61fc11bc06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 15:19:47 +0200 +Subject: platform/surface: aggregator_registry: Add fan and thermal sensor + support for Surface Laptop 5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maximilian Luz + +[ Upstream commit 002adda09bc1c983c75c82a7e12285c7423aec31 ] + +The EC on the Surface Laptop 5 exposes the fan interface. With the +recently introduced driver for it, we can now also enable it here. In +addition, also enable the thermal sensor interface. + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20240811131948.261806-5-luzmaximilian@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/surface/surface_aggregator_registry.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c +index 892ba9549f6a..4d3f5b3111ba 100644 +--- a/drivers/platform/surface/surface_aggregator_registry.c ++++ b/drivers/platform/surface/surface_aggregator_registry.c +@@ -265,7 +265,9 @@ static const struct software_node *ssam_node_group_sl5[] = { + &ssam_node_root, + &ssam_node_bat_ac, + &ssam_node_bat_main, +- &ssam_node_tmp_perf_profile, ++ &ssam_node_tmp_perf_profile_with_fan, ++ &ssam_node_tmp_sensors, ++ &ssam_node_fan_speed, + &ssam_node_hid_main_keyboard, + &ssam_node_hid_main_touchpad, + &ssam_node_hid_main_iid5, +-- +2.43.0 + diff --git a/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch new file mode 100644 index 00000000000..b1bf6b07146 --- /dev/null +++ b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch @@ -0,0 +1,50 @@ +From 2e4b177225ec89b48437f5daa258c8e306511a96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 15:19:44 +0200 +Subject: platform/surface: aggregator_registry: Add Support for Surface Pro 10 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maximilian Luz + +[ Upstream commit 9c8e022567bbec53bee8ae75c44b3d6cd2080d42 ] + +Add SAM client device nodes for the Surface Pro 10. It seems to use the +same SAM client devices as the Surface Pro 9, so re-use its node group. + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20240811131948.261806-2-luzmaximilian@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/surface/surface_aggregator_registry.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c +index 1c4d74db08c9..fa5b896e5f4e 100644 +--- a/drivers/platform/surface/surface_aggregator_registry.c ++++ b/drivers/platform/surface/surface_aggregator_registry.c +@@ -324,7 +324,7 @@ static const struct software_node *ssam_node_group_sp8[] = { + NULL, + }; + +-/* Devices for Surface Pro 9 */ ++/* Devices for Surface Pro 9 and 10 */ + static const struct software_node *ssam_node_group_sp9[] = { + &ssam_node_root, + &ssam_node_hub_kip, +@@ -365,6 +365,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = { + /* Surface Pro 9 */ + { "MSHW0343", (unsigned long)ssam_node_group_sp9 }, + ++ /* Surface Pro 10 */ ++ { "MSHW0510", (unsigned long)ssam_node_group_sp9 }, ++ + /* Surface Book 2 */ + { "MSHW0107", (unsigned long)ssam_node_group_gen5 }, + +-- +2.43.0 + diff --git a/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-26748 b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-26748 new file mode 100644 index 00000000000..183392c87ec --- /dev/null +++ b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-26748 @@ -0,0 +1,67 @@ +From f987090f6bf68ace626398bceec99855d2acc9d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 15:19:48 +0200 +Subject: platform/surface: aggregator_registry: Add support for Surface Laptop + 6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maximilian Luz + +[ Upstream commit 99ae7b9ba047ad029a0a23b2bd51608ce79c8e97 ] + +Add SAM client device nodes for the Surface Laptop Studio 6 (SL6). The +SL6 is similar to the SL5, with the typical battery/AC, platform +profile, and HID nodes. It also has support for the newly supported fan +interface. + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20240811131948.261806-6-luzmaximilian@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + .../surface/surface_aggregator_registry.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c +index 4d3f5b3111ba..a23dff35f8ca 100644 +--- a/drivers/platform/surface/surface_aggregator_registry.c ++++ b/drivers/platform/surface/surface_aggregator_registry.c +@@ -275,6 +275,22 @@ static const struct software_node *ssam_node_group_sl5[] = { + NULL, + }; + ++/* Devices for Surface Laptop 6. */ ++static const struct software_node *ssam_node_group_sl6[] = { ++ &ssam_node_root, ++ &ssam_node_bat_ac, ++ &ssam_node_bat_main, ++ &ssam_node_tmp_perf_profile_with_fan, ++ &ssam_node_tmp_sensors, ++ &ssam_node_fan_speed, ++ &ssam_node_hid_main_keyboard, ++ &ssam_node_hid_main_touchpad, ++ &ssam_node_hid_main_iid5, ++ &ssam_node_hid_sam_sensors, ++ &ssam_node_hid_sam_ucm_ucsi, ++ NULL, ++}; ++ + /* Devices for Surface Laptop Studio 1. */ + static const struct software_node *ssam_node_group_sls1[] = { + &ssam_node_root, +@@ -410,6 +426,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = { + /* Surface Laptop 5 */ + { "MSHW0350", (unsigned long)ssam_node_group_sl5 }, + ++ /* Surface Laptop 6 */ ++ { "MSHW0530", (unsigned long)ssam_node_group_sl6 }, ++ + /* Surface Laptop Go 1 */ + { "MSHW0118", (unsigned long)ssam_node_group_slg1 }, + +-- +2.43.0 + diff --git a/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-29141 b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-29141 new file mode 100644 index 00000000000..a84c5bf928f --- /dev/null +++ b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-29141 @@ -0,0 +1,83 @@ +From 6bc7ae4a3025cbd572dd7cbc7d29a64942bea315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 15:19:46 +0200 +Subject: platform/surface: aggregator_registry: Add support for Surface Laptop + Studio 2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maximilian Luz + +[ Upstream commit 28d04b4a2cc20981c95787f9c449e6fc51d904f9 ] + +Add SAM client device nodes for the Surface Laptop Studio 2 (SLS2). The +SLS2 is quite similar to the SLS1, but it does not provide the touchpad +as a SAM-HID device. Therefore, add a new node group for the SLS2 and +update the comments accordingly. In addition, it uses the new fan +control interface. + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20240811131948.261806-4-luzmaximilian@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + .../surface/surface_aggregator_registry.c | 27 ++++++++++++++++--- + 1 file changed, 23 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c +index 4d36810c2308..892ba9549f6a 100644 +--- a/drivers/platform/surface/surface_aggregator_registry.c ++++ b/drivers/platform/surface/surface_aggregator_registry.c +@@ -273,8 +273,8 @@ static const struct software_node *ssam_node_group_sl5[] = { + NULL, + }; + +-/* Devices for Surface Laptop Studio. */ +-static const struct software_node *ssam_node_group_sls[] = { ++/* Devices for Surface Laptop Studio 1. */ ++static const struct software_node *ssam_node_group_sls1[] = { + &ssam_node_root, + &ssam_node_bat_ac, + &ssam_node_bat_main, +@@ -289,6 +289,22 @@ static const struct software_node *ssam_node_group_sls[] = { + NULL, + }; + ++/* Devices for Surface Laptop Studio 2. */ ++static const struct software_node *ssam_node_group_sls2[] = { ++ &ssam_node_root, ++ &ssam_node_bat_ac, ++ &ssam_node_bat_main, ++ &ssam_node_tmp_perf_profile_with_fan, ++ &ssam_node_tmp_sensors, ++ &ssam_node_fan_speed, ++ &ssam_node_pos_tablet_switch, ++ &ssam_node_hid_sam_keyboard, ++ &ssam_node_hid_sam_penstash, ++ &ssam_node_hid_sam_sensors, ++ &ssam_node_hid_sam_ucm_ucsi, ++ NULL, ++}; ++ + /* Devices for Surface Laptop Go. */ + static const struct software_node *ssam_node_group_slg1[] = { + &ssam_node_root, +@@ -401,8 +417,11 @@ static const struct acpi_device_id ssam_platform_hub_match[] = { + /* Surface Laptop Go 3 */ + { "MSHW0440", (unsigned long)ssam_node_group_slg1 }, + +- /* Surface Laptop Studio */ +- { "MSHW0123", (unsigned long)ssam_node_group_sls }, ++ /* Surface Laptop Studio 1 */ ++ { "MSHW0123", (unsigned long)ssam_node_group_sls1 }, ++ ++ /* Surface Laptop Studio 2 */ ++ { "MSHW0360", (unsigned long)ssam_node_group_sls2 }, + + { }, + }; +-- +2.43.0 + diff --git a/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-9026 b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-9026 new file mode 100644 index 00000000000..f272e755347 --- /dev/null +++ b/queue-6.10/platform-surface-aggregator_registry-add-support-for.patch-9026 @@ -0,0 +1,43 @@ +From 9d114e35033f021a04c72f674cfab861060edc1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Aug 2024 15:19:45 +0200 +Subject: platform/surface: aggregator_registry: Add support for Surface Laptop + Go 3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maximilian Luz + +[ Upstream commit ed235163c3f02329d5e37ed4485bbc39ed2568d4 ] + +Add SAM client device nodes for the Surface Laptop Go 3. It seems to use +the same SAM client devices as the Surface Laptop Go 1 and 2, so re-use +their node group. + +Signed-off-by: Maximilian Luz +Link: https://lore.kernel.org/r/20240811131948.261806-3-luzmaximilian@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/surface/surface_aggregator_registry.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c +index fa5b896e5f4e..4d36810c2308 100644 +--- a/drivers/platform/surface/surface_aggregator_registry.c ++++ b/drivers/platform/surface/surface_aggregator_registry.c +@@ -398,6 +398,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = { + /* Surface Laptop Go 2 */ + { "MSHW0290", (unsigned long)ssam_node_group_slg1 }, + ++ /* Surface Laptop Go 3 */ ++ { "MSHW0440", (unsigned long)ssam_node_group_slg1 }, ++ + /* Surface Laptop Studio */ + { "MSHW0123", (unsigned long)ssam_node_group_sls }, + +-- +2.43.0 + diff --git a/queue-6.10/platform-x86-asus-wmi-add-quirk-for-rog-ally-x.patch b/queue-6.10/platform-x86-asus-wmi-add-quirk-for-rog-ally-x.patch new file mode 100644 index 00000000000..37a9e5f4730 --- /dev/null +++ b/queue-6.10/platform-x86-asus-wmi-add-quirk-for-rog-ally-x.patch @@ -0,0 +1,65 @@ +From d70a2107bc917154642118aa3b48249466912076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 11:46:03 +1200 +Subject: platform/x86: asus-wmi: Add quirk for ROG Ally X +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luke D. Jones + +[ Upstream commit d2dfed310aae0739dc87b68c660357e6a4f29819 ] + +The new ROG Ally X functions the same as the previus model so we can use +the same method to ensure the MCU USB devices wake and reconnect +correctly. + +Given that two devices marks the start of a trend, this patch also adds +a quirk table to make future additions easier if the MCU is the same. + +Signed-off-by: Luke D. Jones +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20240805234603.38736-1-luke@ljones.dev +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index bc9c5db38324..5fe5149549cc 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -146,6 +146,20 @@ static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL }; + + static int throttle_thermal_policy_write(struct asus_wmi *); + ++static const struct dmi_system_id asus_ally_mcu_quirk[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "RC71L"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "RC72L"), ++ }, ++ }, ++ { }, ++}; ++ + static bool ashs_present(void) + { + int i = 0; +@@ -4650,7 +4664,7 @@ static int asus_wmi_add(struct platform_device *pdev) + asus->dgpu_disable_available = asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_DGPU); + asus->kbd_rgb_state_available = asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_TUF_RGB_STATE); + asus->ally_mcu_usb_switch = acpi_has_method(NULL, ASUS_USB0_PWR_EC0_CSEE) +- && dmi_match(DMI_BOARD_NAME, "RC71L"); ++ && dmi_check_system(asus_ally_mcu_quirk); + + if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_MINI_LED_MODE)) + asus->mini_led_dev_id = ASUS_WMI_DEVID_MINI_LED_MODE; +-- +2.43.0 + diff --git a/queue-6.10/powerpc-mm-fix-boot-warning-with-hugepages-and-confi.patch b/queue-6.10/powerpc-mm-fix-boot-warning-with-hugepages-and-confi.patch new file mode 100644 index 00000000000..365357d0a9e --- /dev/null +++ b/queue-6.10/powerpc-mm-fix-boot-warning-with-hugepages-and-confi.patch @@ -0,0 +1,85 @@ +From a0f4b496351555824c02ac0812794371ece8d22d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 09:05:08 +0200 +Subject: powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL + +From: Christophe Leroy + +[ Upstream commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 ] + +Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when +passing hugepage reservation on command line: + + Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot + HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages. + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936 + Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS + NIP: c1020240 LR: c10201d0 CTR: 00000000 + REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty) + MSR: 00021000 CR: 44084288 XER: 20000000 + + GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000 + GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149 + GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000 + GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000 + NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284 + LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 + Call Trace: + [c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable) + [c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8 + [c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc + [c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280 + [c13fdf30] [c0078904] parse_args+0x200/0x4c4 + [c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0 + [c13fdff0] [c0000434] set_ivor+0x12c/0x168 + Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb + ---[ end trace 0000000000000000 ]--- + +This is due to virt_addr_valid() using high_memory before it is set. + +high_memory is set in mem_init() using max_low_pfn, but max_low_pfn +is available long before, it is set in mem_topology_setup(). So just +like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM") +moved the setting of max_mapnr immediately after the call to +mem_topology_setup(), the same can be done for high_memory. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/62b69c4baad067093f39e7e60df0fe27a86b8d2a.1723100702.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/setup-common.c | 1 + + arch/powerpc/mm/mem.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 4bd2f87616ba..943430077375 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -959,6 +959,7 @@ void __init setup_arch(char **cmdline_p) + mem_topology_setup(); + /* Set max_mapnr before paging_init() */ + set_max_mapnr(max_pfn); ++ high_memory = (void *)__va(max_low_pfn * PAGE_SIZE); + + /* + * Release secondary cpus out of their spinloops at 0x60 now that +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index d325217ab201..da21cb018984 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -290,8 +290,6 @@ void __init mem_init(void) + swiotlb_init(ppc_swiotlb_enable, ppc_swiotlb_flags); + #endif + +- high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); +- + kasan_late_init(); + + memblock_free_all(); +-- +2.43.0 + diff --git a/queue-6.10/s390-mm-pin-identity-mapping-base-to-zero.patch b/queue-6.10/s390-mm-pin-identity-mapping-base-to-zero.patch new file mode 100644 index 00000000000..d7b5881e24c --- /dev/null +++ b/queue-6.10/s390-mm-pin-identity-mapping-base-to-zero.patch @@ -0,0 +1,66 @@ +From 546570a22284c8099bbb0fc23fee32d11e87094b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 08:47:16 +0200 +Subject: s390/mm: Pin identity mapping base to zero + +From: Alexander Gordeev + +[ Upstream commit 32db401965f165f7c44447d0508097f070c8f576 ] + +SIE instruction performs faster when the virtual address of +SIE block matches the physical one. Pin the identity mapping +base to zero for the benefit of SIE and other instructions +that have similar performance impact. Still, randomize the +base when DEBUG_VM kernel configuration option is enabled. + +Suggested-by: Vasily Gorbik +Reviewed-by: Christian Borntraeger +Signed-off-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 13 +++++++++++++ + arch/s390/boot/startup.c | 3 ++- + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index c59d2b54df49..4f7ed0cd12cc 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -602,6 +602,19 @@ config RANDOMIZE_BASE + as a security feature that deters exploit attempts relying on + knowledge of the location of kernel internals. + ++config RANDOMIZE_IDENTITY_BASE ++ bool "Randomize the address of the identity mapping base" ++ depends on RANDOMIZE_BASE ++ default DEBUG_VM ++ help ++ The identity mapping base address is pinned to zero by default. ++ Allow randomization of that base to expose otherwise missed ++ notion of physical and virtual addresses of data structures. ++ That does not have any impact on the base address at which the ++ kernel image is loaded. ++ ++ If unsure, say N ++ + config KERNEL_IMAGE_BASE + hex "Kernel image base address" + range 0x100000 0x1FFFFFE0000000 if !KASAN +diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c +index 66ee97ac803d..90c51368f933 100644 +--- a/arch/s390/boot/startup.c ++++ b/arch/s390/boot/startup.c +@@ -333,7 +333,8 @@ static unsigned long setup_kernel_memory_layout(unsigned long kernel_size) + BUILD_BUG_ON(MAX_DCSS_ADDR > (1UL << MAX_PHYSMEM_BITS)); + max_mappable = max(ident_map_size, MAX_DCSS_ADDR); + max_mappable = min(max_mappable, vmemmap_start); +- __identity_base = round_down(vmemmap_start - max_mappable, rte_size); ++ if (IS_ENABLED(CONFIG_RANDOMIZE_IDENTITY_BASE)) ++ __identity_base = round_down(vmemmap_start - max_mappable, rte_size); + + return asce_limit; + } +-- +2.43.0 + diff --git a/queue-6.10/s390-mm-prevent-lowcore-vs-identity-mapping-overlap.patch b/queue-6.10/s390-mm-prevent-lowcore-vs-identity-mapping-overlap.patch new file mode 100644 index 00000000000..49e968d0608 --- /dev/null +++ b/queue-6.10/s390-mm-prevent-lowcore-vs-identity-mapping-overlap.patch @@ -0,0 +1,69 @@ +From f099121f10218f5869c62e7c3d6b122a35c64b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 08:47:15 +0200 +Subject: s390/mm: Prevent lowcore vs identity mapping overlap + +From: Alexander Gordeev + +[ Upstream commit a3ca27c405faad584af6e8e38cdafe5be73230a1 ] + +The identity mapping position in virtual memory is randomized +together with the kernel mapping. That position can never +overlap with the lowcore even when the lowcore is relocated. + +Prevent overlapping with the lowcore to allow independent +positioning of the identity mapping. With the current value +of the alternative lowcore address of 0x70000 the overlap +could happen in case the identity mapping is placed at zero. + +This is a prerequisite for uncoupling of randomization base +of kernel image and identity mapping in virtual memory. + +Acked-by: Vasily Gorbik +Signed-off-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/setup.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 610e6f794511..4b1afd8ac3ee 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -734,7 +734,23 @@ static void __init memblock_add_physmem_info(void) + } + + /* +- * Reserve memory used for lowcore/command line/kernel image. ++ * Reserve memory used for lowcore. ++ */ ++static void __init reserve_lowcore(void) ++{ ++ void *lowcore_start = get_lowcore(); ++ void *lowcore_end = lowcore_start + sizeof(struct lowcore); ++ void *start, *end; ++ ++ if ((void *)__identity_base < lowcore_end) { ++ start = max(lowcore_start, (void *)__identity_base); ++ end = min(lowcore_end, (void *)(__identity_base + ident_map_size)); ++ memblock_reserve(__pa(start), __pa(end)); ++ } ++} ++ ++/* ++ * Reserve memory used for absolute lowcore/command line/kernel image. + */ + static void __init reserve_kernel(void) + { +@@ -915,6 +931,7 @@ void __init setup_arch(char **cmdline_p) + + /* Do some memory reservations *before* memory is added to memblock */ + reserve_pgtables(); ++ reserve_lowcore(); + reserve_kernel(); + reserve_initrd(); + reserve_certificate_list(); +-- +2.43.0 + diff --git a/queue-6.10/scripts-kconfig-merge_config-config-files-add-a-trai.patch b/queue-6.10/scripts-kconfig-merge_config-config-files-add-a-trai.patch new file mode 100644 index 00000000000..1c0576f9c4a --- /dev/null +++ b/queue-6.10/scripts-kconfig-merge_config-config-files-add-a-trai.patch @@ -0,0 +1,48 @@ +From d9150278e1ebc008b2a4b36509b52ed2142526ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Aug 2024 11:22:34 +0200 +Subject: scripts: kconfig: merge_config: config files: add a trailing newline + +From: Anders Roxell + +[ Upstream commit 33330bcf031818e60a816db0cfd3add9eecc3b28 ] + +When merging files without trailing newlines at the end of the file, two +config fragments end up at the same row if file1.config doens't have a +trailing newline at the end of the file. + +file1.config "CONFIG_1=y" +file2.config "CONFIG_2=y" +./scripts/kconfig/merge_config.sh -m .config file1.config file2.config + +This will generate a .config looking like this. +cat .config +... +CONFIG_1=yCONFIG_2=y" + +Making sure so we add a newline at the end of every config file that is +passed into the script. + +Signed-off-by: Anders Roxell +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/merge_config.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh +index 902eb429b9db..0b7952471c18 100755 +--- a/scripts/kconfig/merge_config.sh ++++ b/scripts/kconfig/merge_config.sh +@@ -167,6 +167,8 @@ for ORIG_MERGE_FILE in $MERGE_LIST ; do + sed -i "/$CFG[ =]/d" $MERGE_FILE + fi + done ++ # In case the previous file lacks a new line at the end ++ echo >> $TMP_FILE + cat $MERGE_FILE >> $TMP_FILE + done + +-- +2.43.0 + diff --git a/queue-6.10/series b/queue-6.10/series new file mode 100644 index 00000000000..8b86571a3c0 --- /dev/null +++ b/queue-6.10/series @@ -0,0 +1,42 @@ +usb-typec-ucsi-always-set-number-of-alternate-modes.patch +usb-typec-ucsi-fix-cable-registration.patch +drm-mediatek-set-sensible-cursor-width-height-values.patch +ksmbd-override-fsids-for-share-path-check.patch +ksmbd-override-fsids-for-smb2_query_info.patch +usbnet-ipheth-remove-extraneous-rx-urb-length-check.patch +usbnet-ipheth-drop-rx-urbs-with-no-payload.patch +usbnet-ipheth-do-not-stop-rx-on-failing-rx-callback.patch +usbnet-ipheth-fix-carrier-detection-in-modes-1-and-4.patch +net-ethernet-use-ip_hdrlen-instead-of-bit-shift.patch +drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch +drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch-21215 +net-phy-vitesse-repair-vsc73xx-autonegotiation.patch +powerpc-mm-fix-boot-warning-with-hugepages-and-confi.patch +wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch +drm-amdgpu-update-kmd_fw_shared-for-vcn5.patch +net-hns3-use-correct-release-function-during-uniniti.patch +btrfs-update-target-inode-s-ctime-on-unlink.patch +input-ads7846-ratelimit-the-spi_sync-error-message.patch +input-synaptics-enable-smbus-for-hp-elitebook-840-g2.patch +hid-asus-add-rog-ally-x-prod-id-to-quirk-list.patch +hid-multitouch-add-support-for-gt7868q.patch +input-edt-ft5x06-add-support-for-focaltech-ft8201.patch +cgroup-cpuset-eliminate-unncessary-sched-domains-reb.patch +scripts-kconfig-merge_config-config-files-add-a-trai.patch +platform-x86-asus-wmi-add-quirk-for-rog-ally-x.patch +platform-surface-aggregator_registry-add-support-for.patch +platform-surface-aggregator_registry-add-support-for.patch-9026 +platform-surface-aggregator_registry-add-support-for.patch-29141 +platform-surface-aggregator_registry-add-fan-and-the.patch +platform-surface-aggregator_registry-add-support-for.patch-26748 +spi-zynqmp-gqspi-scale-timeout-by-data-size.patch +drm-msm-adreno-fix-error-return-if-missing-firmware-.patch +input-i8042-add-fujitsu-lifebook-e756-to-i8042-quirk.patch +drm-xe-xe2lpm-extend-wa_16021639441.patch +drm-xe-fix-wa-14018094691.patch +drm-xe-use-devm-instead-of-drmm-for-managed-bo.patch +s390-mm-prevent-lowcore-vs-identity-mapping-overlap.patch +s390-mm-pin-identity-mapping-base-to-zero.patch +smb-server-fix-return-value-of-smb2_open.patch +nfsv4-fix-clearing-of-layout-segments-in-layoutretur.patch +nfs-avoid-unnecessary-rescanning-of-the-per-server-d.patch diff --git a/queue-6.10/smb-server-fix-return-value-of-smb2_open.patch b/queue-6.10/smb-server-fix-return-value-of-smb2_open.patch new file mode 100644 index 00000000000..875c7778722 --- /dev/null +++ b/queue-6.10/smb-server-fix-return-value-of-smb2_open.patch @@ -0,0 +1,38 @@ +From cad17a4058a75849bb6da18ff271a9ffb5ef68b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2024 08:20:50 +0000 +Subject: smb/server: fix return value of smb2_open() + +From: ChenXiaoSong + +[ Upstream commit 2186a116538a715b20e15f84fdd3545e5fe0a39b ] + +In most error cases, error code is not returned in smb2_open(), +__process_request() will not print error message. + +Fix this by returning the correct value at the end of smb2_open(). + +Signed-off-by: ChenXiaoSong +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 0687083bcc3f..adfd6046275a 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -3714,7 +3714,7 @@ int smb2_open(struct ksmbd_work *work) + kfree(name); + kfree(lc); + +- return 0; ++ return rc; + } + + static int readdir_info_level_struct_sz(int info_level) +-- +2.43.0 + diff --git a/queue-6.10/spi-zynqmp-gqspi-scale-timeout-by-data-size.patch b/queue-6.10/spi-zynqmp-gqspi-scale-timeout-by-data-size.patch new file mode 100644 index 00000000000..67589467487 --- /dev/null +++ b/queue-6.10/spi-zynqmp-gqspi-scale-timeout-by-data-size.patch @@ -0,0 +1,93 @@ +From 83b83811132747b55708e1047fb09fbd3cf8f3bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Aug 2024 16:15:39 -0400 +Subject: spi: zynqmp-gqspi: Scale timeout by data size + +From: Sean Anderson + +[ Upstream commit 5d61841c74db8b5bbbf9403f1bd4879f614617d2 ] + +Large blocks of data time out when reading because we don't wait long +enough for the transfer to complete. Scale our timeouts based on the +amount of data we are tranferring, with a healthy dose of pessimism. + +Signed-off-by: Sean Anderson +Link: https://patch.msgid.link/20240809201540.3363243-1-sean.anderson@linux.dev +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynqmp-gqspi.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c +index 99524a3c9f38..558c466135a5 100644 +--- a/drivers/spi/spi-zynqmp-gqspi.c ++++ b/drivers/spi/spi-zynqmp-gqspi.c +@@ -1033,6 +1033,18 @@ static int __maybe_unused zynqmp_runtime_resume(struct device *dev) + return 0; + } + ++static unsigned long zynqmp_qspi_timeout(struct zynqmp_qspi *xqspi, u8 bits, ++ unsigned long bytes) ++{ ++ unsigned long timeout; ++ ++ /* Assume we are at most 2x slower than the nominal bus speed */ ++ timeout = mult_frac(bytes, 2 * 8 * MSEC_PER_SEC, ++ bits * xqspi->speed_hz); ++ /* And add 100 ms for scheduling delays */ ++ return msecs_to_jiffies(timeout + 100); ++} ++ + /** + * zynqmp_qspi_exec_op() - Initiates the QSPI transfer + * @mem: The SPI memory +@@ -1049,6 +1061,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + { + struct zynqmp_qspi *xqspi = spi_controller_get_devdata + (mem->spi->controller); ++ unsigned long timeout; + int err = 0, i; + u32 genfifoentry = 0; + u16 opcode = op->cmd.opcode; +@@ -1077,8 +1090,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST, + GQSPI_IER_GENFIFOEMPTY_MASK | + GQSPI_IER_TXNOT_FULL_MASK); +- if (!wait_for_completion_timeout +- (&xqspi->data_completion, msecs_to_jiffies(1000))) { ++ timeout = zynqmp_qspi_timeout(xqspi, op->cmd.buswidth, ++ op->cmd.nbytes); ++ if (!wait_for_completion_timeout(&xqspi->data_completion, ++ timeout)) { + err = -ETIMEDOUT; + goto return_err; + } +@@ -1104,8 +1119,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + GQSPI_IER_TXEMPTY_MASK | + GQSPI_IER_GENFIFOEMPTY_MASK | + GQSPI_IER_TXNOT_FULL_MASK); +- if (!wait_for_completion_timeout +- (&xqspi->data_completion, msecs_to_jiffies(1000))) { ++ timeout = zynqmp_qspi_timeout(xqspi, op->addr.buswidth, ++ op->addr.nbytes); ++ if (!wait_for_completion_timeout(&xqspi->data_completion, ++ timeout)) { + err = -ETIMEDOUT; + goto return_err; + } +@@ -1173,8 +1190,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem, + GQSPI_IER_RXEMPTY_MASK); + } + } +- if (!wait_for_completion_timeout +- (&xqspi->data_completion, msecs_to_jiffies(1000))) ++ timeout = zynqmp_qspi_timeout(xqspi, op->data.buswidth, ++ op->data.nbytes); ++ if (!wait_for_completion_timeout(&xqspi->data_completion, timeout)) + err = -ETIMEDOUT; + } + +-- +2.43.0 + diff --git a/queue-6.10/usb-typec-ucsi-always-set-number-of-alternate-modes.patch b/queue-6.10/usb-typec-ucsi-always-set-number-of-alternate-modes.patch new file mode 100644 index 00000000000..42c24eb768d --- /dev/null +++ b/queue-6.10/usb-typec-ucsi-always-set-number-of-alternate-modes.patch @@ -0,0 +1,70 @@ +From d98a1811fba9b7d3807953e7a675874aa0db1bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 May 2024 20:12:44 +0000 +Subject: usb: typec: ucsi: Always set number of alternate modes + +From: Jameson Thies + +[ Upstream commit c313a44ac9cda60431bdc7dcdb4b135eaef31785 ] + +Providing the number of known alternate modes allows user space to +determine when device registration has completed. Always register a +number of known alternate modes for the partner and cable plug, even +when the number of supported alternate modes is 0. + +Reviewed-by: Heikki Krogerus +Reviewed-by: Benson Leung +Signed-off-by: Jameson Thies +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20240510201244.2968152-5-jthies@google.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 87eb3cb4ec61 ("usb: typec: ucsi: Fix cable registration") +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 45e91d065b3b..7a127ea57b5a 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -817,10 +817,11 @@ static int ucsi_check_altmodes(struct ucsi_connector *con) + /* Ignoring the errors in this case. */ + if (con->partner_altmode[0]) { + num_partner_am = ucsi_get_num_altmode(con->partner_altmode); +- if (num_partner_am > 0) +- typec_partner_set_num_altmodes(con->partner, num_partner_am); ++ typec_partner_set_num_altmodes(con->partner, num_partner_am); + ucsi_altmode_update_active(con); + return 0; ++ } else { ++ typec_partner_set_num_altmodes(con->partner, 0); + } + + return ret; +@@ -1143,7 +1144,7 @@ static int ucsi_check_connection(struct ucsi_connector *con) + static int ucsi_check_cable(struct ucsi_connector *con) + { + u64 command; +- int ret; ++ int ret, num_plug_am; + + if (con->cable) + return 0; +@@ -1177,6 +1178,13 @@ static int ucsi_check_cable(struct ucsi_connector *con) + return ret; + } + ++ if (con->plug_altmode[0]) { ++ num_plug_am = ucsi_get_num_altmode(con->plug_altmode); ++ typec_plug_set_num_altmodes(con->plug, num_plug_am); ++ } else { ++ typec_plug_set_num_altmodes(con->plug, 0); ++ } ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.10/usb-typec-ucsi-fix-cable-registration.patch b/queue-6.10/usb-typec-ucsi-fix-cable-registration.patch new file mode 100644 index 00000000000..8a5db118c24 --- /dev/null +++ b/queue-6.10/usb-typec-ucsi-fix-cable-registration.patch @@ -0,0 +1,105 @@ +From cbecb9ffec88253caf4d38185fea0aeb96be67d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Sep 2024 16:09:44 +0300 +Subject: usb: typec: ucsi: Fix cable registration + +From: Heikki Krogerus + +[ Upstream commit 87eb3cb4ec619299cd5572e1d5eb68aef4074ac2 ] + +The Cable PD Revision field in GET_CABLE_PROPERTY was +introduced in UCSI v2.1, so adding check for that. + +The cable properties are also not used anywhere after the +cable is registered, so removing the cable_prop member +from struct ucsi_connector while at it. + +Fixes: 38ca416597b0 ("usb: typec: ucsi: Register cables based on GET_CABLE_PROPERTY") +Cc: stable@vger.kernel.org +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20240903130945.3395291-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 30 +++++++++++++++--------------- + drivers/usb/typec/ucsi/ucsi.h | 1 - + 2 files changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 7a127ea57b5a..bf349ad95dcd 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -915,10 +915,20 @@ static void ucsi_unregister_plug(struct ucsi_connector *con) + + static int ucsi_register_cable(struct ucsi_connector *con) + { ++ struct ucsi_cable_property cable_prop; + struct typec_cable *cable; + struct typec_cable_desc desc = {}; ++ u64 command; ++ int ret; ++ ++ command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); ++ ret = ucsi_send_command(con->ucsi, command, &cable_prop, sizeof(cable_prop)); ++ if (ret < 0) { ++ dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", ret); ++ return ret; ++ } + +- switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(con->cable_prop.flags)) { ++ switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(cable_prop.flags)) { + case UCSI_CABLE_PROPERTY_PLUG_TYPE_A: + desc.type = USB_PLUG_TYPE_A; + break; +@@ -934,10 +944,10 @@ static int ucsi_register_cable(struct ucsi_connector *con) + } + + desc.identity = &con->cable_identity; +- desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & +- con->cable_prop.flags); +- desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD( +- con->cable_prop.flags); ++ desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & cable_prop.flags); ++ ++ if (con->ucsi->version >= UCSI_VERSION_2_1) ++ desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD(cable_prop.flags); + + cable = typec_register_cable(con->port, &desc); + if (IS_ERR(cable)) { +@@ -1143,21 +1153,11 @@ static int ucsi_check_connection(struct ucsi_connector *con) + + static int ucsi_check_cable(struct ucsi_connector *con) + { +- u64 command; + int ret, num_plug_am; + + if (con->cable) + return 0; + +- command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num); +- ret = ucsi_send_command(con->ucsi, command, &con->cable_prop, +- sizeof(con->cable_prop)); +- if (ret < 0) { +- dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", +- ret); +- return ret; +- } +- + ret = ucsi_register_cable(con); + if (ret < 0) + return ret; +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index f66224a270bc..46c37643b59c 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -444,7 +444,6 @@ struct ucsi_connector { + + struct ucsi_connector_status status; + struct ucsi_connector_capability cap; +- struct ucsi_cable_property cable_prop; + struct power_supply *psy; + struct power_supply_desc psy_desc; + u32 rdo; +-- +2.43.0 + diff --git a/queue-6.10/usbnet-ipheth-do-not-stop-rx-on-failing-rx-callback.patch b/queue-6.10/usbnet-ipheth-do-not-stop-rx-on-failing-rx-callback.patch new file mode 100644 index 00000000000..af0cbe37fdc --- /dev/null +++ b/queue-6.10/usbnet-ipheth-do-not-stop-rx-on-failing-rx-callback.patch @@ -0,0 +1,42 @@ +From b5ffad7651abc3e0e4c1c7ab94e4d3553e5702da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 19:28:08 +0200 +Subject: usbnet: ipheth: do not stop RX on failing RX callback + +From: Foster Snowhill + +[ Upstream commit 74efed51e0a4d62f998f806c307778b47fc73395 ] + +RX callbacks can fail for multiple reasons: + +* Payload too short +* Payload formatted incorrecly (e.g. bad NCM framing) +* Lack of memory + +None of these should cause the driver to seize up. + +Make such failures non-critical and continue processing further +incoming URBs. + +Signed-off-by: Foster Snowhill +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ipheth.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index f04c7bf79665..cdc72559790a 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -308,7 +308,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + if (retval != 0) { + dev_err(&dev->intf->dev, "%s: callback retval: %d\n", + __func__, retval); +- return; + } + + rx_submit: +-- +2.43.0 + diff --git a/queue-6.10/usbnet-ipheth-drop-rx-urbs-with-no-payload.patch b/queue-6.10/usbnet-ipheth-drop-rx-urbs-with-no-payload.patch new file mode 100644 index 00000000000..8b96d35b9b4 --- /dev/null +++ b/queue-6.10/usbnet-ipheth-drop-rx-urbs-with-no-payload.patch @@ -0,0 +1,45 @@ +From ace7ca9379fbd7f757b59952e46c479a73ec98d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 19:28:07 +0200 +Subject: usbnet: ipheth: drop RX URBs with no payload + +From: Foster Snowhill + +[ Upstream commit 94d7eeb6c0ef0310992944f0d0296929816a2cb0 ] + +On iPhone 15 Pro Max one can observe periodic URBs with no payload +on the "bulk in" (RX) endpoint. These don't seem to do anything +meaningful. Reproduced on iOS 17.5.1 and 17.6. + +This behaviour isn't observed on iPhone 11 on the same iOS version. The +nature of these zero-length URBs is so far unknown. + +Drop RX URBs with no payload. + +Signed-off-by: Foster Snowhill +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ipheth.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index 017255615508..f04c7bf79665 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -286,6 +286,12 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + return; + } + ++ /* iPhone may periodically send URBs with no payload ++ * on the "bulk in" endpoint. It is safe to ignore them. ++ */ ++ if (urb->actual_length == 0) ++ goto rx_submit; ++ + /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames, + * but rather are control frames. Their purpose is not documented, and + * they don't affect driver functionality, okay to drop them. +-- +2.43.0 + diff --git a/queue-6.10/usbnet-ipheth-fix-carrier-detection-in-modes-1-and-4.patch b/queue-6.10/usbnet-ipheth-fix-carrier-detection-in-modes-1-and-4.patch new file mode 100644 index 00000000000..3ae5462bb8d --- /dev/null +++ b/queue-6.10/usbnet-ipheth-fix-carrier-detection-in-modes-1-and-4.patch @@ -0,0 +1,80 @@ +From 246f5fa2cbc8b52c3034ff9611a2e6f4c30475ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 19:28:09 +0200 +Subject: usbnet: ipheth: fix carrier detection in modes 1 and 4 + +From: Foster Snowhill + +[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ] + +Apart from the standard "configurations", "interfaces" and "alternate +interface settings" in USB, iOS devices also have a notion of +"modes". In different modes, the device exposes a different set of +available configurations. + +Depending on the iOS version, and depending on the current mode, the +length and contents of the carrier state control message differs: + +* 1 byte (seen on iOS 4.2.1, 8.4): + * 03: carrier off (mode 0) + * 04: carrier on (mode 0) +* 3 bytes (seen on iOS 10.3.4, 15.7.6): + * 03 03 03: carrier off (mode 0) + * 04 04 03: carrier on (mode 0) +* 4 bytes (seen on iOS 16.5, 17.6): + * 03 03 03 00: carrier off (mode 0) + * 04 03 03 00: carrier off (mode 1) + * 06 03 03 00: carrier off (mode 4) + * 04 04 03 04: carrier on (mode 0 and 1) + * 06 04 03 04: carrier on (mode 4) + +Before this change, the driver always used the first byte of the +response to determine carrier state. + +From this larger sample, the first byte seems to indicate the number of +available USB configurations in the current mode (with the exception of +the default mode 0), and in some cases (namely mode 1 and 4) does not +correlate with the carrier state. + +Previous logic erroneously counted `04 03 03 00` as "carrier on" and +`06 04 03 04` as "carrier off" on iOS versions that support mode 1 and +mode 4 respectively. + +Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for +the ipheth driver. + +Check the second byte of the control message where possible, and fall +back to checking the first byte on older iOS versions. + +Signed-off-by: Foster Snowhill +Tested-by: Georgi Valkov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ipheth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index cdc72559790a..46afb95ffabe 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -355,13 +355,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev) + 0x02, /* index */ + dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE, + IPHETH_CTRL_TIMEOUT); +- if (retval < 0) { ++ if (retval <= 0) { + dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n", + __func__, retval); + return retval; + } + +- if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) { ++ if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) || ++ (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) { + netif_carrier_on(dev->net); + if (dev->tx_urb->status != -EINPROGRESS) + netif_wake_queue(dev->net); +-- +2.43.0 + diff --git a/queue-6.10/usbnet-ipheth-remove-extraneous-rx-urb-length-check.patch b/queue-6.10/usbnet-ipheth-remove-extraneous-rx-urb-length-check.patch new file mode 100644 index 00000000000..2b109902a7a --- /dev/null +++ b/queue-6.10/usbnet-ipheth-remove-extraneous-rx-urb-length-check.patch @@ -0,0 +1,57 @@ +From 329f357f07fe0ff5375f511f5d4e341b8fcf990b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Aug 2024 19:28:06 +0200 +Subject: usbnet: ipheth: remove extraneous rx URB length check + +From: Foster Snowhill + +[ Upstream commit 655b46d7a39ac6f049698b27c1568c0f7ff85d1e ] + +Rx URB length was already checked in ipheth_rcvbulk_callback_legacy() +and ipheth_rcvbulk_callback_ncm(), depending on the current mode. +The check in ipheth_rcvbulk_callback() was thus mostly a duplicate. + +The only place in ipheth_rcvbulk_callback() where we care about the URB +length is for the initial control frame. These frames are always 4 bytes +long. This has been checked as far back as iOS 4.2.1 on iPhone 3G. + +Remove the extraneous URB length check. For control frames, check for +the specific 4-byte length instead. + +Signed-off-by: Foster Snowhill +Tested-by: Georgi Valkov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ipheth.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index 6eeef10edada..017255615508 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -286,11 +286,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + return; + } + +- if (urb->actual_length <= IPHETH_IP_ALIGN) { +- dev->net->stats.rx_length_errors++; +- return; +- } +- + /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames, + * but rather are control frames. Their purpose is not documented, and + * they don't affect driver functionality, okay to drop them. +@@ -298,7 +293,8 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + * URB received from the bulk IN endpoint. + */ + if (unlikely +- (((char *)urb->transfer_buffer)[0] == 0 && ++ (urb->actual_length == 4 && ++ ((char *)urb->transfer_buffer)[0] == 0 && + ((char *)urb->transfer_buffer)[1] == 1)) + goto rx_submit; + +-- +2.43.0 + diff --git a/queue-6.10/wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch b/queue-6.10/wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch new file mode 100644 index 00000000000..bda2545b4dc --- /dev/null +++ b/queue-6.10/wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch @@ -0,0 +1,38 @@ +From de9b2892088f1e2a8d11c3c1f27d5c9b22d43a4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2024 12:45:41 +0200 +Subject: wifi: mt76: mt7921: fix NULL pointer access in + mt7921_ipv6_addr_change + +From: Bert Karwatzki + +[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ] + +When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. +At this point mvif->phy is already NULL so we cannot use it here. + +Signed-off-by: Bert Karwatzki +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20240812104542.80760-1-spasswolf@web.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 3e3ad3518d85..cca7132ed6ab 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -1182,7 +1182,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw, + struct inet6_dev *idev) + { + struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv; +- struct mt792x_dev *dev = mvif->phy->dev; ++ struct mt792x_dev *dev = mt792x_hw_dev(hw); + struct inet6_ifaddr *ifa; + struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN]; + struct sk_buff *skb; +-- +2.43.0 +