From: Greg Kroah-Hartman Date: Mon, 19 May 2025 12:33:09 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.15.184~51 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=986dc3c507ef8c3e2d3a780eca16e3186c7b6303;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: acpi-pptt-fix-processor-subtable-walk.patch btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch drm-amd-display-avoid-flooding-unnecessary-info-messages.patch drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch loongarch-fix-max_reg_offset-calculation.patch --- diff --git a/queue-6.1/acpi-pptt-fix-processor-subtable-walk.patch b/queue-6.1/acpi-pptt-fix-processor-subtable-walk.patch new file mode 100644 index 0000000000..8c0716581e --- /dev/null +++ b/queue-6.1/acpi-pptt-fix-processor-subtable-walk.patch @@ -0,0 +1,101 @@ +From adfab6b39202481bb43286fff94def4953793fdb Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Wed, 7 May 2025 21:30:25 -0500 +Subject: ACPI: PPTT: Fix processor subtable walk + +From: Jeremy Linton + +commit adfab6b39202481bb43286fff94def4953793fdb upstream. + +The original PPTT code had a bug where the processor subtable length +was not correctly validated when encountering a truncated +acpi_pptt_processor node. + +Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of +sizeof() calls") attempted to fix this by validating the size is as +large as the acpi_pptt_processor node structure. This introduced a +regression where the last processor node in the PPTT table is ignored +if it doesn't contain any private resources. That results errors like: + + ACPI PPTT: PPTT table found, but unable to locate core XX (XX) + ACPI: SPE must be homogeneous + +Furthermore, it fails in a common case where the node length isn't +equal to the acpi_pptt_processor structure size, leaving the original +bug in a modified form. + +Correct the regression by adjusting the loop termination conditions as +suggested by the bug reporters. An additional check performed after +the subtable node type is detected, validates the acpi_pptt_processor +node is fully contained in the PPTT table. Repeating the check in +acpi_pptt_leaf_node() is largely redundant as the node is already +known to be fully contained in the table. + +The case where a final truncated node's parent property is accepted, +but the node itself is rejected should not be considered a bug. + +Fixes: 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls") +Reported-by: Maximilian Heyne +Closes: https://lore.kernel.org/linux-acpi/20250506-draco-taped-15f475cd@mheyne-amazon/ +Reported-by: Yicong Yang +Closes: https://lore.kernel.org/linux-acpi/20250507035124.28071-1-yangyicong@huawei.com/ +Signed-off-by: Jeremy Linton +Tested-by: Yicong Yang +Reviewed-by: Sudeep Holla +Tested-by: Maximilian Heyne +Cc: All applicable # 7ab4f0e37a0f4: ACPI PPTT: Fix coding mistakes ... +Link: https://patch.msgid.link/20250508023025.1301030-1-jeremy.linton@arm.com +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/pptt.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c +index f73ce6e13065..54676e3d82dd 100644 +--- a/drivers/acpi/pptt.c ++++ b/drivers/acpi/pptt.c +@@ -231,16 +231,18 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr, + sizeof(struct acpi_table_pptt)); + proc_sz = sizeof(struct acpi_pptt_processor); + +- while ((unsigned long)entry + proc_sz < table_end) { ++ /* ignore subtable types that are smaller than a processor node */ ++ while ((unsigned long)entry + proc_sz <= table_end) { + cpu_node = (struct acpi_pptt_processor *)entry; ++ + if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && + cpu_node->parent == node_entry) + return 0; + if (entry->length == 0) + return 0; ++ + entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry, + entry->length); +- + } + return 1; + } +@@ -273,15 +275,18 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he + proc_sz = sizeof(struct acpi_pptt_processor); + + /* find the processor structure associated with this cpuid */ +- while ((unsigned long)entry + proc_sz < table_end) { ++ while ((unsigned long)entry + proc_sz <= table_end) { + cpu_node = (struct acpi_pptt_processor *)entry; + + if (entry->length == 0) { + pr_warn("Invalid zero length subtable\n"); + break; + } ++ /* entry->length may not equal proc_sz, revalidate the processor structure length */ + if (entry->type == ACPI_PPTT_TYPE_PROCESSOR && + acpi_cpu_id == cpu_node->acpi_processor_id && ++ (unsigned long)entry + entry->length <= table_end && ++ entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) && + acpi_pptt_leaf_node(table_hdr, cpu_node)) { + return (struct acpi_pptt_processor *)entry; + } +-- +2.49.0 + diff --git a/queue-6.1/btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch b/queue-6.1/btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch new file mode 100644 index 0000000000..94a2079dd2 --- /dev/null +++ b/queue-6.1/btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch @@ -0,0 +1,175 @@ +From 54db6d1bdd71fa90172a2a6aca3308bbf7fa7eb5 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Mon, 5 May 2025 16:03:16 +0100 +Subject: btrfs: fix discard worker infinite loop after disabling discard + +From: Filipe Manana + +commit 54db6d1bdd71fa90172a2a6aca3308bbf7fa7eb5 upstream. + +If the discard worker is running and there's currently only one block +group, that block group is a data block group, it's in the unused block +groups discard list and is being used (it got an extent allocated from it +after becoming unused), the worker can end up in an infinite loop if a +transaction abort happens or the async discard is disabled (during remount +or unmount for example). + +This happens like this: + +1) Task A, the discard worker, is at peek_discard_list() and + find_next_block_group() returns block group X; + +2) Block group X is in the unused block groups discard list (its discard + index is BTRFS_DISCARD_INDEX_UNUSED) since at some point in the past + it become an unused block group and was added to that list, but then + later it got an extent allocated from it, so its ->used counter is not + zero anymore; + +3) The current transaction is aborted by task B and we end up at + __btrfs_handle_fs_error() in the transaction abort path, where we call + btrfs_discard_stop(), which clears BTRFS_FS_DISCARD_RUNNING from + fs_info, and then at __btrfs_handle_fs_error() we set the fs to RO mode + (setting SB_RDONLY in the super block's s_flags field); + +4) Task A calls __add_to_discard_list() with the goal of moving the block + group from the unused block groups discard list into another discard + list, but at __add_to_discard_list() we end up doing nothing because + btrfs_run_discard_work() returns false, since the super block has + SB_RDONLY set in its flags and BTRFS_FS_DISCARD_RUNNING is not set + anymore in fs_info->flags. So block group X remains in the unused block + groups discard list; + +5) Task A then does a goto into the 'again' label, calls + find_next_block_group() again we gets block group X again. Then it + repeats the previous steps over and over since there are not other + block groups in the discard lists and block group X is never moved + out of the unused block groups discard list since + btrfs_run_discard_work() keeps returning false and therefore + __add_to_discard_list() doesn't move block group X out of that discard + list. + +When this happens we can get a soft lockup report like this: + + [71.957] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:3:97] + [71.957] Modules linked in: xfs af_packet rfkill (...) + [71.957] CPU: 0 UID: 0 PID: 97 Comm: kworker/u4:3 Tainted: G W 6.14.2-1-default #1 openSUSE Tumbleweed 968795ef2b1407352128b466fe887416c33af6fa + [71.957] Tainted: [W]=WARN + [71.957] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 + [71.957] Workqueue: btrfs_discard btrfs_discard_workfn [btrfs] + [71.957] RIP: 0010:btrfs_discard_workfn+0xc4/0x400 [btrfs] + [71.957] Code: c1 01 48 83 (...) + [71.957] RSP: 0018:ffffafaec03efe08 EFLAGS: 00000246 + [71.957] RAX: ffff897045500000 RBX: ffff8970413ed8d0 RCX: 0000000000000000 + [71.957] RDX: 0000000000000001 RSI: ffff8970413ed8d0 RDI: 0000000a8f1272ad + [71.957] RBP: 0000000a9d61c60e R08: ffff897045500140 R09: 8080808080808080 + [71.957] R10: ffff897040276800 R11: fefefefefefefeff R12: ffff8970413ed860 + [71.957] R13: ffff897045500000 R14: ffff8970413ed868 R15: 0000000000000000 + [71.957] FS: 0000000000000000(0000) GS:ffff89707bc00000(0000) knlGS:0000000000000000 + [71.957] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [71.957] CR2: 00005605bcc8d2f0 CR3: 000000010376a001 CR4: 0000000000770ef0 + [71.957] PKRU: 55555554 + [71.957] Call Trace: + [71.957] + [71.957] process_one_work+0x17e/0x330 + [71.957] worker_thread+0x2ce/0x3f0 + [71.957] ? __pfx_worker_thread+0x10/0x10 + [71.957] kthread+0xef/0x220 + [71.957] ? __pfx_kthread+0x10/0x10 + [71.957] ret_from_fork+0x34/0x50 + [71.957] ? __pfx_kthread+0x10/0x10 + [71.957] ret_from_fork_asm+0x1a/0x30 + [71.957] + [71.957] Kernel panic - not syncing: softlockup: hung tasks + [71.987] CPU: 0 UID: 0 PID: 97 Comm: kworker/u4:3 Tainted: G W L 6.14.2-1-default #1 openSUSE Tumbleweed 968795ef2b1407352128b466fe887416c33af6fa + [71.989] Tainted: [W]=WARN, [L]=SOFTLOCKUP + [71.989] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 + [71.991] Workqueue: btrfs_discard btrfs_discard_workfn [btrfs] + [71.992] Call Trace: + [71.993] + [71.994] dump_stack_lvl+0x5a/0x80 + [71.994] panic+0x10b/0x2da + [71.995] watchdog_timer_fn.cold+0x9a/0xa1 + [71.996] ? __pfx_watchdog_timer_fn+0x10/0x10 + [71.997] __hrtimer_run_queues+0x132/0x2a0 + [71.997] hrtimer_interrupt+0xff/0x230 + [71.998] __sysvec_apic_timer_interrupt+0x55/0x100 + [71.999] sysvec_apic_timer_interrupt+0x6c/0x90 + [72.000] + [72.000] + [72.001] asm_sysvec_apic_timer_interrupt+0x1a/0x20 + [72.002] RIP: 0010:btrfs_discard_workfn+0xc4/0x400 [btrfs] + [72.002] Code: c1 01 48 83 (...) + [72.005] RSP: 0018:ffffafaec03efe08 EFLAGS: 00000246 + [72.006] RAX: ffff897045500000 RBX: ffff8970413ed8d0 RCX: 0000000000000000 + [72.006] RDX: 0000000000000001 RSI: ffff8970413ed8d0 RDI: 0000000a8f1272ad + [72.007] RBP: 0000000a9d61c60e R08: ffff897045500140 R09: 8080808080808080 + [72.008] R10: ffff897040276800 R11: fefefefefefefeff R12: ffff8970413ed860 + [72.009] R13: ffff897045500000 R14: ffff8970413ed868 R15: 0000000000000000 + [72.010] ? btrfs_discard_workfn+0x51/0x400 [btrfs 23b01089228eb964071fb7ca156eee8cd3bf996f] + [72.011] process_one_work+0x17e/0x330 + [72.012] worker_thread+0x2ce/0x3f0 + [72.013] ? __pfx_worker_thread+0x10/0x10 + [72.014] kthread+0xef/0x220 + [72.014] ? __pfx_kthread+0x10/0x10 + [72.015] ret_from_fork+0x34/0x50 + [72.015] ? __pfx_kthread+0x10/0x10 + [72.016] ret_from_fork_asm+0x1a/0x30 + [72.017] + [72.017] Kernel Offset: 0x15000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + [72.019] Rebooting in 90 seconds.. + +So fix this by making sure we move a block group out of the unused block +groups discard list when calling __add_to_discard_list(). + +Fixes: 2bee7eb8bb81 ("btrfs: discard one region at a time in async discard") +Link: https://bugzilla.suse.com/show_bug.cgi?id=1242012 +CC: stable@vger.kernel.org # 5.10+ +Reviewed-by: Boris Burkov +Reviewed-by: Daniel Vacek +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/discard.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/discard.c ++++ b/fs/btrfs/discard.c +@@ -78,8 +78,6 @@ static void __add_to_discard_list(struct + struct btrfs_block_group *block_group) + { + lockdep_assert_held(&discard_ctl->lock); +- if (!btrfs_run_discard_work(discard_ctl)) +- return; + + if (list_empty(&block_group->discard_list) || + block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED) { +@@ -102,6 +100,9 @@ static void add_to_discard_list(struct b + if (!btrfs_is_block_group_data_only(block_group)) + return; + ++ if (!btrfs_run_discard_work(discard_ctl)) ++ return; ++ + spin_lock(&discard_ctl->lock); + __add_to_discard_list(discard_ctl, block_group); + spin_unlock(&discard_ctl->lock); +@@ -233,6 +234,18 @@ again: + block_group->used != 0) { + if (btrfs_is_block_group_data_only(block_group)) { + __add_to_discard_list(discard_ctl, block_group); ++ /* ++ * The block group must have been moved to other ++ * discard list even if discard was disabled in ++ * the meantime or a transaction abort happened, ++ * otherwise we can end up in an infinite loop, ++ * always jumping into the 'again' label and ++ * keep getting this block group over and over ++ * in case there are no other block groups in ++ * the discard lists. ++ */ ++ ASSERT(block_group->discard_index != ++ BTRFS_DISCARD_INDEX_UNUSED); + } else { + list_del_init(&block_group->discard_list); + btrfs_put_block_group(block_group); diff --git a/queue-6.1/dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch b/queue-6.1/dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch new file mode 100644 index 0000000000..31661536f5 --- /dev/null +++ b/queue-6.1/dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch @@ -0,0 +1,51 @@ +From df180e65305f8c1e020d54bfc2132349fd693de1 Mon Sep 17 00:00:00 2001 +From: Nathan Lynch +Date: Thu, 3 Apr 2025 11:24:19 -0500 +Subject: dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted" + +From: Nathan Lynch + +commit df180e65305f8c1e020d54bfc2132349fd693de1 upstream. + +Several issues with this change: + +* The analysis is flawed and it's unclear what problem is being + fixed. There is no difference between wait_event_freezable_timeout() + and wait_event_timeout() with respect to device interrupts. And of + course "the interrupt notifying the finish of an operation happens + during wait_event_freezable_timeout()" -- that's how it's supposed + to work. + +* The link at the "Closes:" tag appears to be an unrelated + use-after-free in idxd. + +* It introduces a regression: dmatest threads are meant to be + freezable and this change breaks that. + +See discussion here: +https://lore.kernel.org/dmaengine/878qpa13fe.fsf@AUSNATLYNCH.amd.com/ + +Fixes: e87ca16e9911 ("dmaengine: dmatest: Fix dmatest waiting less when interrupted") +Signed-off-by: Nathan Lynch +Link: https://lore.kernel.org/r/20250403-dmaengine-dmatest-revert-waiting-less-v1-1-8227c5a3d7c8@amd.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dmatest.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -827,9 +827,9 @@ static int dmatest_func(void *data) + } else { + dma_async_issue_pending(chan); + +- wait_event_timeout(thread->done_wait, +- done->done, +- msecs_to_jiffies(params->timeout)); ++ wait_event_freezable_timeout(thread->done_wait, ++ done->done, ++ msecs_to_jiffies(params->timeout)); + + status = dma_async_is_tx_complete(chan, cookie, NULL, + NULL); diff --git a/queue-6.1/drm-amd-display-avoid-flooding-unnecessary-info-messages.patch b/queue-6.1/drm-amd-display-avoid-flooding-unnecessary-info-messages.patch new file mode 100644 index 0000000000..075c3a1a6b --- /dev/null +++ b/queue-6.1/drm-amd-display-avoid-flooding-unnecessary-info-messages.patch @@ -0,0 +1,53 @@ +From d33724ffb743d3d2698bd969e29253ae0cff9739 Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Tue, 13 May 2025 11:20:24 +0800 +Subject: drm/amd/display: Avoid flooding unnecessary info messages + +From: Wayne Lin + +commit d33724ffb743d3d2698bd969e29253ae0cff9739 upstream. + +It's expected that we'll encounter temporary exceptions +during aux transactions. Adjust logging from drm_info to +drm_dbg_dp to prevent flooding with unnecessary log messages. + +Fixes: 3637e457eb00 ("drm/amd/display: Fix wrong handling for AUX_DEFER case") +Cc: Mario Limonciello +Cc: Alex Deucher +Signed-off-by: Wayne Lin +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20250513032026.838036-1-Wayne.Lin@amd.com +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 9a9c3e1fe5256da14a0a307dff0478f90c55fc8c) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -111,7 +111,7 @@ static ssize_t dm_dp_aux_transfer(struct + if (payload.write && result >= 0) { + if (result) { + /*one byte indicating partially written bytes*/ +- drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n"); ++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX partially written\n"); + result = payload.data[0]; + } else if (!payload.reply[0]) + /*I2C_ACK|AUX_ACK*/ +@@ -137,11 +137,11 @@ static ssize_t dm_dp_aux_transfer(struct + break; + } + +- drm_info(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result); ++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result); + } + + if (payload.reply[0]) +- drm_info(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.", ++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.", + payload.reply[0]); + + return result; diff --git a/queue-6.1/drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch b/queue-6.1/drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch new file mode 100644 index 0000000000..259c105d9c --- /dev/null +++ b/queue-6.1/drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch @@ -0,0 +1,82 @@ +From d433981385c62c72080e26f1c00a961d18b233be Mon Sep 17 00:00:00 2001 +From: Wayne Lin +Date: Fri, 25 Apr 2025 14:44:02 +0800 +Subject: drm/amd/display: Correct the reply value when AUX write incomplete + +From: Wayne Lin + +commit d433981385c62c72080e26f1c00a961d18b233be upstream. + +[Why] +Now forcing aux->transfer to return 0 when incomplete AUX write is +inappropriate. It should return bytes have been transferred. + +[How] +aux->transfer is asked not to change original msg except reply field of +drm_dp_aux_msg structure. Copy the msg->buffer when it's write request, +and overwrite the first byte when sink reply 1 byte indicating partially +written byte number. Then we can return the correct value without +changing the original msg. + +Fixes: 3637e457eb00 ("drm/amd/display: Fix wrong handling for AUX_DEFER case") +Cc: Mario Limonciello +Cc: Alex Deucher +Reviewed-by: Ray Wu +Signed-off-by: Wayne Lin +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 7ac37f0dcd2e0b729fa7b5513908dc8ab802b540) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 10 ++++++++-- + 2 files changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10707,7 +10707,8 @@ int amdgpu_dm_process_dmub_aux_transfer_ + /* The reply is stored in the top nibble of the command. */ + payload->reply[0] = (adev->dm.dmub_notify->aux_reply.command >> 4) & 0xF; + +- if (!payload->write && p_notify->aux_reply.length) ++ /*write req may receive a byte indicating partially written number as well*/ ++ if (p_notify->aux_reply.length) + memcpy(payload->data, p_notify->aux_reply.data, + p_notify->aux_reply.length); + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -66,6 +66,7 @@ static ssize_t dm_dp_aux_transfer(struct + enum aux_return_code_type operation_result; + struct amdgpu_device *adev; + struct ddc_service *ddc; ++ uint8_t copy[16]; + + if (WARN_ON(msg->size > 16)) + return -E2BIG; +@@ -81,6 +82,11 @@ static ssize_t dm_dp_aux_transfer(struct + (msg->request & DP_AUX_I2C_WRITE_STATUS_UPDATE) != 0; + payload.defer_delay = 0; + ++ if (payload.write) { ++ memcpy(copy, msg->buffer, msg->size); ++ payload.data = copy; ++ } ++ + result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload, + &operation_result); + +@@ -104,9 +110,9 @@ static ssize_t dm_dp_aux_transfer(struct + */ + if (payload.write && result >= 0) { + if (result) { +- /*one byte indicating partially written bytes. Force 0 to retry*/ ++ /*one byte indicating partially written bytes*/ + drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n"); +- result = 0; ++ result = payload.data[0]; + } else if (!payload.reply[0]) + /*I2C_ACK|AUX_ACK*/ + result = msg->size; diff --git a/queue-6.1/loongarch-fix-max_reg_offset-calculation.patch b/queue-6.1/loongarch-fix-max_reg_offset-calculation.patch new file mode 100644 index 0000000000..268daabacb --- /dev/null +++ b/queue-6.1/loongarch-fix-max_reg_offset-calculation.patch @@ -0,0 +1,32 @@ +From 90436d234230e9a950ccd87831108b688b27a234 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Wed, 14 May 2025 22:17:43 +0800 +Subject: LoongArch: Fix MAX_REG_OFFSET calculation + +From: Huacai Chen + +commit 90436d234230e9a950ccd87831108b688b27a234 upstream. + +Fix MAX_REG_OFFSET calculation, make it point to the last register +in 'struct pt_regs' and not to the marker itself, which could allow +regs_get_register() to return an invalid offset. + +Cc: stable@vger.kernel.org +Fixes: 803b0fc5c3f2baa6e5 ("LoongArch: Add process management") +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/ptrace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/loongarch/include/asm/ptrace.h ++++ b/arch/loongarch/include/asm/ptrace.h +@@ -54,7 +54,7 @@ static inline void instruction_pointer_s + + /* Query offset/name of register from its name/offset */ + extern int regs_query_register_offset(const char *name); +-#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last)) ++#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last) - sizeof(unsigned long)) + + /** + * regs_get_register() - get register value from its offset diff --git a/queue-6.1/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch b/queue-6.1/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch index 173b5d8671..e73f90b880 100644 --- a/queue-6.1/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch +++ b/queue-6.1/nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch @@ -15,14 +15,12 @@ Fixes: 68f744797edd ("pNFS: Do not free layout segments that are marked for retu Signed-off-by: Trond Myklebust Signed-off-by: Sasha Levin --- - fs/nfs/pnfs.c | 9 +++++++++ + fs/nfs/pnfs.c | 9 +++++++++ 1 file changed, 9 insertions(+) -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index f682869320198..fe0ddbce3bcb2 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c -@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo, +@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(struct return remaining; } @@ -37,7 +35,7 @@ index f682869320198..fe0ddbce3bcb2 100644 static void pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo, struct list_head *free_me, -@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo, +@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq); pnfs_free_returned_lsegs(lo, &freeme, range, seq); pnfs_set_layout_stateid(lo, stateid, NULL, true); @@ -45,6 +43,3 @@ index f682869320198..fe0ddbce3bcb2 100644 } else pnfs_mark_layout_stateid_invalid(lo, &freeme); out_unlock: --- -2.39.5 - diff --git a/queue-6.1/series b/queue-6.1/series index d2020ca13e..b406832587 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -37,3 +37,9 @@ regulator-max20086-fix-invalid-memory-access.patch octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch net-tls-fix-kernel-panic-when-alloc_page-failed.patch nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch +dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch +loongarch-fix-max_reg_offset-calculation.patch +btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch +drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch +drm-amd-display-avoid-flooding-unnecessary-info-messages.patch +acpi-pptt-fix-processor-subtable-walk.patch