From: Sasha Levin Date: Tue, 25 Jun 2024 03:25:04 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.1.96~27 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eabd5416534680ec64dfb3293d99668c87ee2516;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arch-mm-restore-dependency-of-__kernel_map_pages-on-.patch b/queue-5.10/arch-mm-restore-dependency-of-__kernel_map_pages-on-.patch new file mode 100644 index 00000000000..027d9723781 --- /dev/null +++ b/queue-5.10/arch-mm-restore-dependency-of-__kernel_map_pages-on-.patch @@ -0,0 +1,351 @@ +From fc3d2d8da62d1731dd1ec10acc392318ca6c371f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:10:30 -0800 +Subject: arch, mm: restore dependency of __kernel_map_pages() on + DEBUG_PAGEALLOC + +From: Mike Rapoport + +[ Upstream commit 5d6ad668f31625c6aa9ed8dc3bdb29561d2b1144 ] + +The design of DEBUG_PAGEALLOC presumes that __kernel_map_pages() must +never fail. With this assumption is wouldn't be safe to allow general +usage of this function. + +Moreover, some architectures that implement __kernel_map_pages() have this +function guarded by #ifdef DEBUG_PAGEALLOC and some refuse to map/unmap +pages when page allocation debugging is disabled at runtime. + +As all the users of __kernel_map_pages() were converted to use +debug_pagealloc_map_pages() it is safe to make it available only when +DEBUG_PAGEALLOC is set. + +Link: https://lkml.kernel.org/r/20201109192128.960-4-rppt@kernel.org +Signed-off-by: Mike Rapoport +Acked-by: David Hildenbrand +Acked-by: Kirill A. Shutemov +Cc: Albert Ou +Cc: Andy Lutomirski +Cc: Benjamin Herrenschmidt +Cc: Borislav Petkov +Cc: Catalin Marinas +Cc: Christian Borntraeger +Cc: Christoph Lameter +Cc: Dave Hansen +Cc: David Rientjes +Cc: "David S. Miller" +Cc: "Edgecombe, Rick P" +Cc: Heiko Carstens +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Joonsoo Kim +Cc: Len Brown +Cc: Michael Ellerman +Cc: Palmer Dabbelt +Cc: Paul Mackerras +Cc: Paul Walmsley +Cc: Pavel Machek +Cc: Pekka Enberg +Cc: Peter Zijlstra +Cc: Rafael J. Wysocki +Cc: "Rafael J. Wysocki" +Cc: Thomas Gleixner +Cc: Vasily Gorbik +Cc: Vlastimil Babka +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: fb1cf0878328 ("riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context") +Signed-off-by: Sasha Levin +--- + arch/Kconfig | 3 +++ + arch/arm64/Kconfig | 4 +--- + arch/arm64/mm/pageattr.c | 8 ++++++-- + arch/powerpc/Kconfig | 5 +---- + arch/riscv/Kconfig | 4 +--- + arch/riscv/include/asm/pgtable.h | 2 -- + arch/riscv/mm/pageattr.c | 2 ++ + arch/s390/Kconfig | 4 +--- + arch/sparc/Kconfig | 4 +--- + arch/x86/Kconfig | 4 +--- + arch/x86/mm/pat/set_memory.c | 2 ++ + include/linux/mm.h | 10 +++++++--- + 12 files changed, 26 insertions(+), 26 deletions(-) + +diff --git a/arch/Kconfig b/arch/Kconfig +index 72e4cef062aca..3f025e47fb5d6 100644 +--- a/arch/Kconfig ++++ b/arch/Kconfig +@@ -1073,6 +1073,9 @@ config ARCH_SPLIT_ARG64 + If a 32-bit architecture requires 64-bit arguments to be split into + pairs of 32-bit arguments, select this option. + ++config ARCH_SUPPORTS_DEBUG_PAGEALLOC ++ bool ++ + source "kernel/gcov/Kconfig" + + source "scripts/gcc-plugins/Kconfig" +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 13cf137da999a..c47b2887f300e 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -71,6 +71,7 @@ config ARM64 + select ARCH_USE_QUEUED_RWLOCKS + select ARCH_USE_QUEUED_SPINLOCKS + select ARCH_USE_SYM_ANNOTATIONS ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC + select ARCH_SUPPORTS_MEMORY_FAILURE + select ARCH_SUPPORTS_SHADOW_CALL_STACK if CC_HAVE_SHADOW_CALL_STACK + select ARCH_SUPPORTS_ATOMIC_RMW +@@ -1063,9 +1064,6 @@ config HOLES_IN_ZONE + + source "kernel/Kconfig.hz" + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- def_bool y +- + config ARCH_SPARSEMEM_ENABLE + def_bool y + select SPARSEMEM_VMEMMAP_ENABLE +diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c +index 1b94f5b826545..439325532be1e 100644 +--- a/arch/arm64/mm/pageattr.c ++++ b/arch/arm64/mm/pageattr.c +@@ -155,7 +155,7 @@ int set_direct_map_invalid_noflush(struct page *page) + .clear_mask = __pgprot(PTE_VALID), + }; + +- if (!rodata_full) ++ if (!debug_pagealloc_enabled() && !rodata_full) + return 0; + + return apply_to_page_range(&init_mm, +@@ -170,7 +170,7 @@ int set_direct_map_default_noflush(struct page *page) + .clear_mask = __pgprot(PTE_RDONLY), + }; + +- if (!rodata_full) ++ if (!debug_pagealloc_enabled() && !rodata_full) + return 0; + + return apply_to_page_range(&init_mm, +@@ -178,6 +178,7 @@ int set_direct_map_default_noflush(struct page *page) + PAGE_SIZE, change_page_range, &data); + } + ++#ifdef CONFIG_DEBUG_PAGEALLOC + void __kernel_map_pages(struct page *page, int numpages, int enable) + { + if (!debug_pagealloc_enabled() && !rodata_full) +@@ -186,6 +187,7 @@ void __kernel_map_pages(struct page *page, int numpages, int enable) + set_memory_valid((unsigned long)page_address(page), numpages, enable); + } + ++#ifdef CONFIG_HIBERNATION + /* + * This function is used to determine if a linear map page has been marked as + * not-valid. Walk the page table and check the PTE_VALID bit. This is based +@@ -232,3 +234,5 @@ bool kernel_page_present(struct page *page) + ptep = pte_offset_kernel(pmdp, addr); + return pte_valid(READ_ONCE(*ptep)); + } ++#endif /* CONFIG_HIBERNATION */ ++#endif /* CONFIG_DEBUG_PAGEALLOC */ +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index 78dd6be8b31dd..c8e5b0929ef25 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -146,6 +146,7 @@ config PPC + select ARCH_MIGHT_HAVE_PC_SERIO + select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX + select ARCH_SUPPORTS_ATOMIC_RMW ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC if PPC32 || PPC_BOOK3S_64 + select ARCH_USE_BUILTIN_BSWAP + select ARCH_USE_CMPXCHG_LOCKREF if PPC64 + select ARCH_USE_QUEUED_RWLOCKS if PPC_QUEUED_SPINLOCKS +@@ -356,10 +357,6 @@ config PPC_OF_PLATFORM_PCI + depends on PCI + depends on PPC64 # not supported on 32 bits yet + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- depends on PPC32 || PPC_BOOK3S_64 +- def_bool y +- + config ARCH_SUPPORTS_UPROBES + def_bool y + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 70271db833831..dc141bd752a2a 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -14,6 +14,7 @@ config RISCV + def_bool y + select ARCH_CLOCKSOURCE_INIT + select ARCH_SUPPORTS_ATOMIC_RMW ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC if MMU + select ARCH_HAS_BINFMT_FLAT + select ARCH_HAS_DEBUG_VM_PGTABLE + select ARCH_HAS_DEBUG_VIRTUAL if MMU +@@ -160,9 +161,6 @@ config ARCH_SELECT_MEMORY_MODEL + config ARCH_WANT_GENERAL_HUGETLB + def_bool y + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- def_bool y +- + config SYS_SUPPORTS_HUGETLBFS + depends on MMU + def_bool y +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index 982745572945e..99110223eb0e1 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -460,8 +460,6 @@ static inline int ptep_clear_flush_young(struct vm_area_struct *vma, + #define VMALLOC_START _AC(0, UL) + #define VMALLOC_END TASK_SIZE + +-static inline void __kernel_map_pages(struct page *page, int numpages, int enable) {} +- + #endif /* !CONFIG_MMU */ + + #define kern_addr_valid(addr) (1) /* FIXME */ +diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c +index 09f6be19ba7b3..ae63a0227e2fb 100644 +--- a/arch/riscv/mm/pageattr.c ++++ b/arch/riscv/mm/pageattr.c +@@ -184,6 +184,7 @@ int set_direct_map_default_noflush(struct page *page) + return ret; + } + ++#ifdef CONFIG_DEBUG_PAGEALLOC + void __kernel_map_pages(struct page *page, int numpages, int enable) + { + if (!debug_pagealloc_enabled()) +@@ -196,3 +197,4 @@ void __kernel_map_pages(struct page *page, int numpages, int enable) + __set_memory((unsigned long)page_address(page), numpages, + __pgprot(0), __pgprot(_PAGE_PRESENT)); + } ++#endif +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index 878993982e39d..cf5b7bb3726f7 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -35,9 +35,6 @@ config GENERIC_LOCKBREAK + config PGSTE + def_bool y if KVM + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- def_bool y +- + config AUDIT_ARCH + def_bool y + +@@ -106,6 +103,7 @@ config S390 + select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE + select ARCH_STACKWALK + select ARCH_SUPPORTS_ATOMIC_RMW ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC + select ARCH_SUPPORTS_NUMA_BALANCING + select ARCH_USE_BUILTIN_BSWAP + select ARCH_USE_CMPXCHG_LOCKREF +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index 7e2ce4c8d6571..1206bb46dd016 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -89,6 +89,7 @@ config SPARC64 + select HAVE_C_RECORDMCOUNT + select HAVE_ARCH_AUDITSYSCALL + select ARCH_SUPPORTS_ATOMIC_RMW ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC + select HAVE_NMI + select HAVE_REGS_AND_STACK_ACCESS_API + select ARCH_USE_QUEUED_RWLOCKS +@@ -149,9 +150,6 @@ config GENERIC_ISA_DMA + bool + default y if SPARC32 + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- def_bool y if SPARC64 +- + config PGTABLE_LEVELS + default 4 if 64BIT + default 3 +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 0c802ade80406..a948d614fbe52 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -94,6 +94,7 @@ config X86 + select ARCH_STACKWALK + select ARCH_SUPPORTS_ACPI + select ARCH_SUPPORTS_ATOMIC_RMW ++ select ARCH_SUPPORTS_DEBUG_PAGEALLOC + select ARCH_SUPPORTS_NUMA_BALANCING if X86_64 + select ARCH_USE_BUILTIN_BSWAP + select ARCH_USE_QUEUED_RWLOCKS +@@ -333,9 +334,6 @@ config ZONE_DMA32 + config AUDIT_ARCH + def_bool y if X86_64 + +-config ARCH_SUPPORTS_DEBUG_PAGEALLOC +- def_bool y +- + config KASAN_SHADOW_OFFSET + hex + depends on KASAN +diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c +index 217dda690ed82..57ba2603d481e 100644 +--- a/arch/x86/mm/pat/set_memory.c ++++ b/arch/x86/mm/pat/set_memory.c +@@ -2194,6 +2194,7 @@ int set_direct_map_default_noflush(struct page *page) + return __set_pages_p(page, 1); + } + ++#ifdef CONFIG_DEBUG_PAGEALLOC + void __kernel_map_pages(struct page *page, int numpages, int enable) + { + if (PageHighMem(page)) +@@ -2239,6 +2240,7 @@ bool kernel_page_present(struct page *page) + return (pte_val(*pte) & _PAGE_PRESENT); + } + #endif /* CONFIG_HIBERNATION */ ++#endif /* CONFIG_DEBUG_PAGEALLOC */ + + int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address, + unsigned numpages, unsigned long page_flags) +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 61ed8b20ea704..5c957fbef655b 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2955,7 +2955,11 @@ static inline bool debug_pagealloc_enabled_static(void) + return static_branch_unlikely(&_debug_pagealloc_enabled); + } + +-#if defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_ARCH_HAS_SET_DIRECT_MAP) ++#ifdef CONFIG_DEBUG_PAGEALLOC ++/* ++ * To support DEBUG_PAGEALLOC architecture must ensure that ++ * __kernel_map_pages() never fails ++ */ + extern void __kernel_map_pages(struct page *page, int numpages, int enable); + + static inline void debug_pagealloc_map_pages(struct page *page, int numpages) +@@ -2973,13 +2977,13 @@ static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) + #ifdef CONFIG_HIBERNATION + extern bool kernel_page_present(struct page *page); + #endif /* CONFIG_HIBERNATION */ +-#else /* CONFIG_DEBUG_PAGEALLOC || CONFIG_ARCH_HAS_SET_DIRECT_MAP */ ++#else /* CONFIG_DEBUG_PAGEALLOC */ + static inline void debug_pagealloc_map_pages(struct page *page, int numpages) {} + static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) {} + #ifdef CONFIG_HIBERNATION + static inline bool kernel_page_present(struct page *page) { return true; } + #endif /* CONFIG_HIBERNATION */ +-#endif /* CONFIG_DEBUG_PAGEALLOC || CONFIG_ARCH_HAS_SET_DIRECT_MAP */ ++#endif /* CONFIG_DEBUG_PAGEALLOC */ + + #ifdef __HAVE_ARCH_GATE_AREA + extern struct vm_area_struct *get_gate_vma(struct mm_struct *mm); +-- +2.43.0 + diff --git a/queue-5.10/arm-dts-samsung-exynos4412-origen-fix-keypad-no-auto.patch b/queue-5.10/arm-dts-samsung-exynos4412-origen-fix-keypad-no-auto.patch new file mode 100644 index 00000000000..29e610f83f1 --- /dev/null +++ b/queue-5.10/arm-dts-samsung-exynos4412-origen-fix-keypad-no-auto.patch @@ -0,0 +1,43 @@ +From 80f534bf878947967c23c3707e2f49786c613a87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 19:31:03 +0100 +Subject: ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat + +From: Krzysztof Kozlowski + +[ Upstream commit 88208d3cd79821117fd3fb80d9bcab618467d37b ] + +Although the Samsung SoC keypad binding defined +linux,keypad-no-autorepeat property, Linux driver never implemented it +and always used linux,input-no-autorepeat. Correct the DTS to use +property actually implemented. + +This also fixes dtbs_check errors like: + + exynos4412-origen.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+' + +Cc: +Fixes: bd08f6277e44 ("ARM: dts: Add keypad entries to Exynos4412 based Origen") +Link: https://lore.kernel.org/r/20240312183105.715735-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-origen.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-origen.dts b/arch/arm/boot/dts/exynos4412-origen.dts +index e2d76ea4404e8..7138bf291437e 100644 +--- a/arch/arm/boot/dts/exynos4412-origen.dts ++++ b/arch/arm/boot/dts/exynos4412-origen.dts +@@ -447,7 +447,7 @@ buck9_reg: BUCK9 { + &keypad { + samsung,keypad-num-rows = <3>; + samsung,keypad-num-columns = <2>; +- linux,keypad-no-autorepeat; ++ linux,input-no-autorepeat; + wakeup-source; + pinctrl-0 = <&keypad_rows &keypad_cols>; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-5.10/arm-dts-samsung-smdk4412-fix-keypad-no-autorepeat.patch b/queue-5.10/arm-dts-samsung-smdk4412-fix-keypad-no-autorepeat.patch new file mode 100644 index 00000000000..bdee06657ce --- /dev/null +++ b/queue-5.10/arm-dts-samsung-smdk4412-fix-keypad-no-autorepeat.patch @@ -0,0 +1,43 @@ +From 3000528e599655fb07c8721e38dce1113e1506b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 19:31:04 +0100 +Subject: ARM: dts: samsung: smdk4412: fix keypad no-autorepeat + +From: Krzysztof Kozlowski + +[ Upstream commit 4ac4c1d794e7ff454d191bbdab7585ed8dbf3758 ] + +Although the Samsung SoC keypad binding defined +linux,keypad-no-autorepeat property, Linux driver never implemented it +and always used linux,input-no-autorepeat. Correct the DTS to use +property actually implemented. + +This also fixes dtbs_check errors like: + + exynos4412-smdk4412.dtb: keypad@100a0000: 'key-A', 'key-B', 'key-C', 'key-D', 'key-E', 'linux,keypad-no-autorepeat' do not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+' + +Cc: +Fixes: c9b92dd70107 ("ARM: dts: Add keypad entries to SMDK4412") +Link: https://lore.kernel.org/r/20240312183105.715735-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4412-smdk4412.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4412-smdk4412.dts b/arch/arm/boot/dts/exynos4412-smdk4412.dts +index 49971203a8aa0..6e6bef907a72e 100644 +--- a/arch/arm/boot/dts/exynos4412-smdk4412.dts ++++ b/arch/arm/boot/dts/exynos4412-smdk4412.dts +@@ -65,7 +65,7 @@ cooling_map1: map1 { + &keypad { + samsung,keypad-num-rows = <3>; + samsung,keypad-num-columns = <8>; +- linux,keypad-no-autorepeat; ++ linux,input-no-autorepeat; + wakeup-source; + pinctrl-0 = <&keypad_rows &keypad_cols>; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-5.10/arm-dts-samsung-smdkv310-fix-keypad-no-autorepeat.patch b/queue-5.10/arm-dts-samsung-smdkv310-fix-keypad-no-autorepeat.patch new file mode 100644 index 00000000000..b2270923d06 --- /dev/null +++ b/queue-5.10/arm-dts-samsung-smdkv310-fix-keypad-no-autorepeat.patch @@ -0,0 +1,43 @@ +From c89ced90e68e2ca3e71114eea17731380f8f1853 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 19:31:02 +0100 +Subject: ARM: dts: samsung: smdkv310: fix keypad no-autorepeat + +From: Krzysztof Kozlowski + +[ Upstream commit 87d8e522d6f5a004f0aa06c0def302df65aff296 ] + +Although the Samsung SoC keypad binding defined +linux,keypad-no-autorepeat property, Linux driver never implemented it +and always used linux,input-no-autorepeat. Correct the DTS to use +property actually implemented. + +This also fixes dtbs_check errors like: + + exynos4210-smdkv310.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+' + +Cc: +Fixes: 0561ceabd0f1 ("ARM: dts: Add intial dts file for EXYNOS4210 SoC, SMDKV310 and ORIGEN") +Link: https://lore.kernel.org/r/20240312183105.715735-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos4210-smdkv310.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos4210-smdkv310.dts b/arch/arm/boot/dts/exynos4210-smdkv310.dts +index c5609afa6101c..a6622a0d9b58b 100644 +--- a/arch/arm/boot/dts/exynos4210-smdkv310.dts ++++ b/arch/arm/boot/dts/exynos4210-smdkv310.dts +@@ -84,7 +84,7 @@ eeprom@52 { + &keypad { + samsung,keypad-num-rows = <2>; + samsung,keypad-num-columns = <8>; +- linux,keypad-no-autorepeat; ++ linux,input-no-autorepeat; + wakeup-source; + pinctrl-names = "default"; + pinctrl-0 = <&keypad_rows &keypad_cols>; +-- +2.43.0 + diff --git a/queue-5.10/bcache-fix-variable-length-array-abuse-in-btree_iter.patch b/queue-5.10/bcache-fix-variable-length-array-abuse-in-btree_iter.patch new file mode 100644 index 00000000000..f912347d499 --- /dev/null +++ b/queue-5.10/bcache-fix-variable-length-array-abuse-in-btree_iter.patch @@ -0,0 +1,423 @@ +From 4d7775fa87d4a813fa37f8a35d60272557395c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 09:11:17 +0800 +Subject: bcache: fix variable length array abuse in btree_iter + +From: Matthew Mirvish + +[ Upstream commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 ] + +btree_iter is used in two ways: either allocated on the stack with a +fixed size MAX_BSETS, or from a mempool with a dynamic size based on the +specific cache set. Previously, the struct had a fixed-length array of +size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized +iterators, which causes UBSAN to complain. + +This patch uses the same approach as in bcachefs's sort_iter and splits +the iterator into a btree_iter with a flexible array member and a +btree_iter_stack which embeds a btree_iter as well as a fixed-length +data array. + +Cc: stable@vger.kernel.org +Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 +Signed-off-by: Matthew Mirvish +Signed-off-by: Coly Li +Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ + drivers/md/bcache/bset.h | 28 ++++++++++++++-------- + drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- + drivers/md/bcache/super.c | 5 ++-- + drivers/md/bcache/sysfs.c | 2 +- + drivers/md/bcache/writeback.c | 10 ++++---- + 6 files changed, 70 insertions(+), 59 deletions(-) + +diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c +index 67a2c47f4201a..f006c780dd4bf 100644 +--- a/drivers/md/bcache/bset.c ++++ b/drivers/md/bcache/bset.c +@@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) + int __bch_count_data(struct btree_keys *b) + { + unsigned int ret = 0; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct bkey *k; + + if (b->ops->is_extents) +@@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) + { + va_list args; + struct bkey *k, *p = NULL; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + const char *err; + + for_each_key(b, k, &iter) { +@@ -877,7 +877,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, + unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; + struct bset *i = bset_tree_last(b)->data; + struct bkey *m, *prev = NULL; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct bkey preceding_key_on_stack = ZERO_KEY; + struct bkey *preceding_key_p = &preceding_key_on_stack; + +@@ -893,9 +893,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, + else + preceding_key(k, &preceding_key_p); + +- m = bch_btree_iter_init(b, &iter, preceding_key_p); ++ m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); + +- if (b->ops->insert_fixup(b, k, &iter, replace_key)) ++ if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) + return status; + + status = BTREE_INSERT_STATUS_INSERT; +@@ -1096,33 +1096,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, + btree_iter_cmp)); + } + +-static struct bkey *__bch_btree_iter_init(struct btree_keys *b, +- struct btree_iter *iter, +- struct bkey *search, +- struct bset_tree *start) ++static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, ++ struct btree_iter_stack *iter, ++ struct bkey *search, ++ struct bset_tree *start) + { + struct bkey *ret = NULL; + +- iter->size = ARRAY_SIZE(iter->data); +- iter->used = 0; ++ iter->iter.size = ARRAY_SIZE(iter->stack_data); ++ iter->iter.used = 0; + + #ifdef CONFIG_BCACHE_DEBUG +- iter->b = b; ++ iter->iter.b = b; + #endif + + for (; start <= bset_tree_last(b); start++) { + ret = bch_bset_search(b, start, search); +- bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); ++ bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); + } + + return ret; + } + +-struct bkey *bch_btree_iter_init(struct btree_keys *b, +- struct btree_iter *iter, ++struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, ++ struct btree_iter_stack *iter, + struct bkey *search) + { +- return __bch_btree_iter_init(b, iter, search, b->set); ++ return __bch_btree_iter_stack_init(b, iter, search, b->set); + } + + static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, +@@ -1289,10 +1289,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, + struct bset_sort_state *state) + { + size_t order = b->page_order, keys = 0; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + int oldsize = bch_count_data(b); + +- __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); ++ __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); + + if (start) { + unsigned int i; +@@ -1303,7 +1303,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, + order = get_order(__set_bytes(b->set->data, keys)); + } + +- __btree_sort(b, &iter, start, order, false, state); ++ __btree_sort(b, &iter.iter, start, order, false, state); + + EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); + } +@@ -1319,11 +1319,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, + struct bset_sort_state *state) + { + uint64_t start_time = local_clock(); +- struct btree_iter iter; ++ struct btree_iter_stack iter; + +- bch_btree_iter_init(b, &iter, NULL); ++ bch_btree_iter_stack_init(b, &iter, NULL); + +- btree_mergesort(b, new->set->data, &iter, false, true); ++ btree_mergesort(b, new->set->data, &iter.iter, false, true); + + bch_time_stats_update(&state->time, start_time); + +diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h +index a50dcfda656f5..2ed6dbd35d6e5 100644 +--- a/drivers/md/bcache/bset.h ++++ b/drivers/md/bcache/bset.h +@@ -321,7 +321,14 @@ struct btree_iter { + #endif + struct btree_iter_set { + struct bkey *k, *end; +- } data[MAX_BSETS]; ++ } data[]; ++}; ++ ++/* Fixed-size btree_iter that can be allocated on the stack */ ++ ++struct btree_iter_stack { ++ struct btree_iter iter; ++ struct btree_iter_set stack_data[MAX_BSETS]; + }; + + typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); +@@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, + + void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, + struct bkey *end); +-struct bkey *bch_btree_iter_init(struct btree_keys *b, +- struct btree_iter *iter, +- struct bkey *search); ++struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, ++ struct btree_iter_stack *iter, ++ struct bkey *search); + + struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, + const struct bkey *search); +@@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, + return search ? __bch_bset_search(b, t, search) : t->data->start; + } + +-#define for_each_key_filter(b, k, iter, filter) \ +- for (bch_btree_iter_init((b), (iter), NULL); \ +- ((k) = bch_btree_iter_next_filter((iter), (b), filter));) ++#define for_each_key_filter(b, k, stack_iter, filter) \ ++ for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ ++ ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ ++ filter));) + +-#define for_each_key(b, k, iter) \ +- for (bch_btree_iter_init((b), (iter), NULL); \ +- ((k) = bch_btree_iter_next(iter));) ++#define for_each_key(b, k, stack_iter) \ ++ for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ ++ ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) + + /* Sorting */ + +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 1a1a9554474ae..2768b4b4302d6 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1283,7 +1283,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) + uint8_t stale = 0; + unsigned int keys = 0, good_keys = 0; + struct bkey *k; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct bset_tree *t; + + gc->nodes++; +@@ -1544,7 +1544,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, + static unsigned int btree_gc_count_keys(struct btree *b) + { + struct bkey *k; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + unsigned int ret = 0; + + for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) +@@ -1585,17 +1585,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, + int ret = 0; + bool should_rewrite; + struct bkey *k; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct gc_merge_info r[GC_MERGE_NODES]; + struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; + +- bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); ++ bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); + + for (i = r; i < r + ARRAY_SIZE(r); i++) + i->b = ERR_PTR(-EINTR); + + while (1) { +- k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); ++ k = bch_btree_iter_next_filter(&iter.iter, &b->keys, ++ bch_ptr_bad); + if (k) { + r->b = bch_btree_node_get(b->c, op, k, b->level - 1, + true, b); +@@ -1885,7 +1886,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) + { + int ret = 0; + struct bkey *k, *p = NULL; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + + for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) + bch_initial_mark_key(b->c, b->level, k); +@@ -1893,10 +1894,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) + bch_initial_mark_key(b->c, b->level + 1, &b->key); + + if (b->level) { +- bch_btree_iter_init(&b->keys, &iter, NULL); ++ bch_btree_iter_stack_init(&b->keys, &iter, NULL); + + do { +- k = bch_btree_iter_next_filter(&iter, &b->keys, ++ k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); + if (k) { + btree_node_prefetch(b, k); +@@ -1924,7 +1925,7 @@ static int bch_btree_check_thread(void *arg) + struct btree_check_info *info = arg; + struct btree_check_state *check_state = info->state; + struct cache_set *c = check_state->c; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct bkey *k, *p; + int cur_idx, prev_idx, skip_nr; + +@@ -1933,8 +1934,8 @@ static int bch_btree_check_thread(void *arg) + ret = 0; + + /* root node keys are checked before thread created */ +- bch_btree_iter_init(&c->root->keys, &iter, NULL); +- k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); ++ bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); ++ k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); + BUG_ON(!k); + + p = k; +@@ -1952,7 +1953,7 @@ static int bch_btree_check_thread(void *arg) + skip_nr = cur_idx - prev_idx; + + while (skip_nr) { +- k = bch_btree_iter_next_filter(&iter, ++ k = bch_btree_iter_next_filter(&iter.iter, + &c->root->keys, + bch_ptr_bad); + if (k) +@@ -2025,7 +2026,7 @@ int bch_btree_check(struct cache_set *c) + int ret = 0; + int i; + struct bkey *k = NULL; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct btree_check_state check_state; + + /* check and mark root node keys */ +@@ -2521,11 +2522,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, + + if (b->level) { + struct bkey *k; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + +- bch_btree_iter_init(&b->keys, &iter, from); ++ bch_btree_iter_stack_init(&b->keys, &iter, from); + +- while ((k = bch_btree_iter_next_filter(&iter, &b->keys, ++ while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { + ret = bcache_btree(map_nodes_recurse, k, b, + op, from, fn, flags); +@@ -2554,11 +2555,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, + { + int ret = MAP_CONTINUE; + struct bkey *k; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + +- bch_btree_iter_init(&b->keys, &iter, from); ++ bch_btree_iter_stack_init(&b->keys, &iter, from); + +- while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { ++ while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, ++ bch_ptr_bad))) { + ret = !b->level + ? fn(op, b, k) + : bcache_btree(map_keys_recurse, k, +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 04ddaa4bbd77f..14336fd541020 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1939,8 +1939,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) + INIT_LIST_HEAD(&c->btree_cache_freed); + INIT_LIST_HEAD(&c->data_buckets); + +- iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * +- sizeof(struct btree_iter_set); ++ iter_size = sizeof(struct btree_iter) + ++ ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * ++ sizeof(struct btree_iter_set); + + c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); + if (!c->devices) +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index ca3e2f000cd4d..a31108625f463 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -639,7 +639,7 @@ static unsigned int bch_root_usage(struct cache_set *c) + unsigned int bytes = 0; + struct bkey *k; + struct btree *b; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + + goto lock_root; + +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index 8e3f5f004c397..9a2aac59f6bcb 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -852,15 +852,15 @@ static int bch_dirty_init_thread(void *arg) + struct dirty_init_thrd_info *info = arg; + struct bch_dirty_init_state *state = info->state; + struct cache_set *c = state->c; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct bkey *k, *p; + int cur_idx, prev_idx, skip_nr; + + k = p = NULL; + prev_idx = 0; + +- bch_btree_iter_init(&c->root->keys, &iter, NULL); +- k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); ++ bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); ++ k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); + BUG_ON(!k); + + p = k; +@@ -874,7 +874,7 @@ static int bch_dirty_init_thread(void *arg) + skip_nr = cur_idx - prev_idx; + + while (skip_nr) { +- k = bch_btree_iter_next_filter(&iter, ++ k = bch_btree_iter_next_filter(&iter.iter, + &c->root->keys, + bch_ptr_bad); + if (k) +@@ -923,7 +923,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) + int i; + struct btree *b = NULL; + struct bkey *k = NULL; +- struct btree_iter iter; ++ struct btree_iter_stack iter; + struct sectors_dirty_init op; + struct cache_set *c = d->c; + struct bch_dirty_init_state state; +-- +2.43.0 + diff --git a/queue-5.10/cifs-missed-ref-counting-smb-session-in-find.patch b/queue-5.10/cifs-missed-ref-counting-smb-session-in-find.patch new file mode 100644 index 00000000000..8ea31515b18 --- /dev/null +++ b/queue-5.10/cifs-missed-ref-counting-smb-session-in-find.patch @@ -0,0 +1,71 @@ +From 5676509437fd421471aec602841d76f29ad0e48f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 May 2021 16:54:42 +0000 +Subject: cifs: missed ref-counting smb session in find + +From: Shyam Prasad N + +[ Upstream commit e695a9ad0305af6e8b0cbc24a54976ac2120cbb3 ] + +When we lookup an smb session based on session id, +we did not up the ref-count for the session. This can +potentially cause issues if the session is freed from under us. + +Signed-off-by: Shyam Prasad N +Reviewed-by: Aurelien Aptel +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Stable-dep-of: 02c418774f76 ("smb: client: fix deadlock in smb2_find_smb_tcon()") +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2transport.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index d659eb70df76d..f40b8de2aeeb3 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -154,6 +154,7 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + if (ses->Suid != ses_id) + continue; ++ ++ses->ses_count; + return ses; + } + +@@ -205,7 +206,14 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) + return NULL; + } + tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); ++ if (!tcon) { ++ cifs_put_smb_ses(ses); ++ spin_unlock(&cifs_tcp_ses_lock); ++ return NULL; ++ } + spin_unlock(&cifs_tcp_ses_lock); ++ /* tcon already has a ref to ses, so we don't need ses anymore */ ++ cifs_put_smb_ses(ses); + + return tcon; + } +@@ -239,7 +247,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, + if (rc) { + cifs_server_dbg(VFS, + "%s: sha256 alloc failed\n", __func__); +- return rc; ++ goto out; + } + shash = &sdesc->shash; + } else { +@@ -290,6 +298,8 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server, + out: + if (allocate_crypto) + cifs_free_hash(&hash, &sdesc); ++ if (ses) ++ cifs_put_smb_ses(ses); + return rc; + } + +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-atomfirmware-add-edp-and-integrated-info-.patch b/queue-5.10/drm-amdgpu-atomfirmware-add-edp-and-integrated-info-.patch new file mode 100644 index 00000000000..b76d1cfec1d --- /dev/null +++ b/queue-5.10/drm-amdgpu-atomfirmware-add-edp-and-integrated-info-.patch @@ -0,0 +1,101 @@ +From 78cbc9a916e025099cbd2575c23e96ab651b20cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 16:21:53 -0400 +Subject: drm/amdgpu/atomfirmware: Add edp and integrated info v2.1 tables + +From: Roman Li + +[ Upstream commit b9d90cb031c488d77a47084a009655d235e3d765 ] + +Required for vangogh. + +Signed-off-by: Roman Li +Reviewed-by: Alex Deucher +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Stable-dep-of: e64e8f7c178e ("drm/amdgpu/atomfirmware: add intergrated info v2.3 table") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/atomfirmware.h | 62 +++++++++++++++++++++- + 1 file changed, 61 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h +index 0799a9ca04401..4eb578b1baef1 100644 +--- a/drivers/gpu/drm/amd/include/atomfirmware.h ++++ b/drivers/gpu/drm/amd/include/atomfirmware.h +@@ -1304,11 +1304,71 @@ struct atom_integrated_system_info_v1_12 + struct atom_hdmi_retimer_redriver_set dp3_retimer_set; //for DP3 + struct atom_DCN_dpphy_dp_tuningset hbr_tuningset; //hbr 2.7G dp tuning set + struct atom_DCN_dpphy_dp_tuningset hbr2_tuningset; //hbr2 5.4G dp turnig set +- struct atom_DCN_dpphy_dp_tuningset edp_tunings; //edp tuning set ++ struct atom_DCN_dpphy_dp_tuningset edp_tunings; //edp tuning set + struct atom_DCN_dpphy_dvihdmi_tuningset hdmiCLK6_tuningset; + uint32_t reserved[63]; + }; + ++ ++#if defined(CONFIG_DRM_AMD_DC_DCN3_01) ++ ++struct edp_info_table ++{ ++ uint16_t edp_backlight_pwm_hz; ++ uint16_t edp_ss_percentage; ++ uint16_t edp_ss_rate_10hz; ++ uint16_t reserved1; ++ uint32_t reserved2; ++ uint8_t edp_pwr_on_off_delay; ++ uint8_t edp_pwr_on_vary_bl_to_blon; ++ uint8_t edp_pwr_down_bloff_to_vary_bloff; ++ uint8_t edp_panel_bpc; ++ uint8_t edp_bootup_bl_level; ++ uint8_t reserved3[3]; ++ uint32_t reserved4[3]; ++}; ++ ++struct atom_integrated_system_info_v2_1 ++{ ++ struct atom_common_table_header table_header; ++ uint32_t vbios_misc; //enum of atom_system_vbiosmisc_def ++ uint32_t gpucapinfo; //enum of atom_system_gpucapinf_def ++ uint32_t system_config; ++ uint32_t cpucapinfo; ++ uint16_t gpuclk_ss_percentage; //unit of 0.001%, 1000 mean 1% ++ uint16_t gpuclk_ss_type; ++ uint16_t dpphy_override; // bit vector, enum of atom_sysinfo_dpphy_override_def ++ uint8_t memorytype; // enum of atom_dmi_t17_mem_type_def, APU memory type indication. ++ uint8_t umachannelnumber; // number of memory channels ++ uint8_t htc_hyst_limit; ++ uint8_t htc_tmp_limit; ++ uint8_t reserved1; ++ uint8_t reserved2; ++ struct edp_info_table edp1_info; ++ struct edp_info_table edp2_info; ++ uint32_t reserved3[8]; ++ struct atom_external_display_connection_info extdispconninfo; ++ struct atom_DCN_dpphy_dvihdmi_tuningset TMDS_tuningset; ++ struct atom_DCN_dpphy_dvihdmi_tuningset hdmiCLK5_tuningset; //add clk6 ++ struct atom_DCN_dpphy_dvihdmi_tuningset hdmiCLK6_tuningset; ++ struct atom_DCN_dpphy_dvihdmi_tuningset hdmiCLK8_tuningset; ++ uint32_t reserved4[6];//reserve 2*sizeof(atom_DCN_dpphy_dvihdmi_tuningset) ++ struct atom_DCN_dpphy_dp_tuningset rbr_tuningset; // rbr 1.62G dp tuning set ++ struct atom_DCN_dpphy_dp_tuningset hbr_tuningset; //hbr 2.7G dp tuning set ++ struct atom_DCN_dpphy_dp_tuningset hbr2_tuningset; //hbr2 5.4G dp turnig set ++ struct atom_DCN_dpphy_dp_tuningset hbr3_tuningset; // HBR3 dp tuning set ++ struct atom_DCN_dpphy_dp_tuningset edp_tunings; //edp tuning set ++ uint32_t reserved5[28];//reserve 2*sizeof(atom_DCN_dpphy_dp_tuningset) ++ struct atom_hdmi_retimer_redriver_set dp0_retimer_set; //for DP0 ++ struct atom_hdmi_retimer_redriver_set dp1_retimer_set; //for DP1 ++ struct atom_hdmi_retimer_redriver_set dp2_retimer_set; //for DP2 ++ struct atom_hdmi_retimer_redriver_set dp3_retimer_set; //for DP3 ++ uint32_t reserved6[30];// reserve size of(atom_camera_data) for camera_info ++ uint32_t reserved7[32]; ++ ++}; ++#endif ++ + // system_config + enum atom_system_vbiosmisc_def{ + INTEGRATED_SYSTEM_INFO__GET_EDID_CALLBACK_FUNC_SUPPORT = 0x01, +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-atomfirmware-add-intergrated-info-v2.3-ta.patch b/queue-5.10/drm-amdgpu-atomfirmware-add-intergrated-info-v2.3-ta.patch new file mode 100644 index 00000000000..2966e01b345 --- /dev/null +++ b/queue-5.10/drm-amdgpu-atomfirmware-add-intergrated-info-v2.3-ta.patch @@ -0,0 +1,118 @@ +From 932a1db41ed0a5e087fc7d9ca22b94e03948c132 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 18:43:55 +0800 +Subject: drm/amdgpu/atomfirmware: add intergrated info v2.3 table + +From: Li Ma + +[ Upstream commit e64e8f7c178e5228e0b2dbb504b9dc75953a319f ] + +[Why] +The vram width value is 0. +Because the integratedsysteminfo table in VBIOS has updated to 2.3. + +[How] +Driver needs a new intergrated info v2.3 table too. +Then the vram width value will be correct. + +Signed-off-by: Li Ma +Reviewed-by: Yifan Zhang +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 15 +++++++ + drivers/gpu/drm/amd/include/atomfirmware.h | 43 +++++++++++++++++++ + 2 files changed, 58 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +index c5ebf8ee66bc4..f71fbdc02e111 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +@@ -113,6 +113,7 @@ union igp_info { + struct atom_integrated_system_info_v1_11 v11; + struct atom_integrated_system_info_v1_12 v12; + struct atom_integrated_system_info_v2_1 v21; ++ struct atom_integrated_system_info_v2_3 v23; + }; + + union umc_info { +@@ -239,6 +240,20 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev, + if (vram_type) + *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); + break; ++ case 3: ++ mem_channel_number = igp_info->v23.umachannelnumber; ++ if (!mem_channel_number) ++ mem_channel_number = 1; ++ mem_type = igp_info->v23.memorytype; ++ if (mem_type == LpDdr5MemType) ++ mem_channel_width = 32; ++ else ++ mem_channel_width = 64; ++ if (vram_width) ++ *vram_width = mem_channel_number * mem_channel_width; ++ if (vram_type) ++ *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); ++ break; + default: + return -EINVAL; + } +diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h +index c7cfe9d9096dc..7465f84ba5664 100644 +--- a/drivers/gpu/drm/amd/include/atomfirmware.h ++++ b/drivers/gpu/drm/amd/include/atomfirmware.h +@@ -1419,6 +1419,49 @@ struct atom_integrated_system_info_v2_2 + uint32_t reserved4[189]; + }; + ++struct uma_carveout_option { ++ char optionName[29]; //max length of string is 28chars + '\0'. Current design is for "minimum", "Medium", "High". This makes entire struct size 64bits ++ uint8_t memoryCarvedGb; //memory carved out with setting ++ uint8_t memoryRemainingGb; //memory remaining on system ++ union { ++ struct _flags { ++ uint8_t Auto : 1; ++ uint8_t Custom : 1; ++ uint8_t Reserved : 6; ++ } flags; ++ uint8_t all8; ++ } uma_carveout_option_flags; ++}; ++ ++struct atom_integrated_system_info_v2_3 { ++ struct atom_common_table_header table_header; ++ uint32_t vbios_misc; // enum of atom_system_vbiosmisc_def ++ uint32_t gpucapinfo; // enum of atom_system_gpucapinf_def ++ uint32_t system_config; ++ uint32_t cpucapinfo; ++ uint16_t gpuclk_ss_percentage; // unit of 0.001%, 1000 mean 1% ++ uint16_t gpuclk_ss_type; ++ uint16_t dpphy_override; // bit vector, enum of atom_sysinfo_dpphy_override_def ++ uint8_t memorytype; // enum of atom_dmi_t17_mem_type_def, APU memory type indication. ++ uint8_t umachannelnumber; // number of memory channels ++ uint8_t htc_hyst_limit; ++ uint8_t htc_tmp_limit; ++ uint8_t reserved1; // dp_ss_control ++ uint8_t gpu_package_id; ++ struct edp_info_table edp1_info; ++ struct edp_info_table edp2_info; ++ uint32_t reserved2[8]; ++ struct atom_external_display_connection_info extdispconninfo; ++ uint8_t UMACarveoutVersion; ++ uint8_t UMACarveoutIndexMax; ++ uint8_t UMACarveoutTypeDefault; ++ uint8_t UMACarveoutIndexDefault; ++ uint8_t UMACarveoutType; //Auto or Custom ++ uint8_t UMACarveoutIndex; ++ struct uma_carveout_option UMASizeControlOption[20]; ++ uint8_t reserved3[110]; ++}; ++ + // system_config + enum atom_system_vbiosmisc_def{ + INTEGRATED_SYSTEM_INFO__GET_EDID_CALLBACK_FUNC_SUPPORT = 0x01, +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-drop-config_drm_amd_dc_dcn3_01-from-atomf.patch b/queue-5.10/drm-amdgpu-drop-config_drm_amd_dc_dcn3_01-from-atomf.patch new file mode 100644 index 00000000000..0469a3c8a65 --- /dev/null +++ b/queue-5.10/drm-amdgpu-drop-config_drm_amd_dc_dcn3_01-from-atomf.patch @@ -0,0 +1,44 @@ +From 0e0594d117ca71ec4d4017b17d20160c871c64c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 11:42:00 -0400 +Subject: drm/amdgpu: drop CONFIG_DRM_AMD_DC_DCN3_01 from atomfirmware.h + +From: Alex Deucher + +[ Upstream commit 15047bd436a763dd2ddf8e1024b4e25af9cc11ee ] + +Not needed. + +Reviewed-by: Luben Tuikov +Signed-off-by: Alex Deucher +Stable-dep-of: e64e8f7c178e ("drm/amdgpu/atomfirmware: add intergrated info v2.3 table") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/atomfirmware.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h +index 4eb578b1baef1..6139d10f4289d 100644 +--- a/drivers/gpu/drm/amd/include/atomfirmware.h ++++ b/drivers/gpu/drm/amd/include/atomfirmware.h +@@ -1309,9 +1309,6 @@ struct atom_integrated_system_info_v1_12 + uint32_t reserved[63]; + }; + +- +-#if defined(CONFIG_DRM_AMD_DC_DCN3_01) +- + struct edp_info_table + { + uint16_t edp_backlight_pwm_hz; +@@ -1367,7 +1364,6 @@ struct atom_integrated_system_info_v2_1 + uint32_t reserved7[32]; + + }; +-#endif + + // system_config + enum atom_system_vbiosmisc_def{ +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-fix-vram-type-and-bandwidth-error-for-ddr.patch b/queue-5.10/drm-amdgpu-fix-vram-type-and-bandwidth-error-for-ddr.patch new file mode 100644 index 00000000000..a674cfed901 --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-vram-type-and-bandwidth-error-for-ddr.patch @@ -0,0 +1,96 @@ +From 5bbed97f73987016b4f084c882125bc76c7fca74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 20:13:17 +0800 +Subject: drm/amdgpu: fix vram type and bandwidth error for DDR5 and DDR4 + +From: Huang Rui + +[ Upstream commit 78683229ddeef56ba62e4b680c6394ea97f88d6c ] + +This patch is to update atomfirmware parser for the memory type and +bandwidth of DDR5 and DDR4. + +Signed-off-by: Huang Rui +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Stable-dep-of: e64e8f7c178e ("drm/amdgpu/atomfirmware: add intergrated info v2.3 table") +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 53 +++++++++++++------ + 1 file changed, 36 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +index b4df6460e45a9..c5ebf8ee66bc4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +@@ -112,6 +112,7 @@ int amdgpu_atomfirmware_allocate_fb_scratch(struct amdgpu_device *adev) + union igp_info { + struct atom_integrated_system_info_v1_11 v11; + struct atom_integrated_system_info_v1_12 v12; ++ struct atom_integrated_system_info_v2_1 v21; + }; + + union umc_info { +@@ -205,24 +206,42 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev, + if (adev->flags & AMD_IS_APU) { + igp_info = (union igp_info *) + (mode_info->atom_context->bios + data_offset); +- switch (crev) { +- case 11: +- mem_channel_number = igp_info->v11.umachannelnumber; +- /* channel width is 64 */ +- if (vram_width) +- *vram_width = mem_channel_number * 64; +- mem_type = igp_info->v11.memorytype; +- if (vram_type) +- *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); ++ switch (frev) { ++ case 1: ++ switch (crev) { ++ case 11: ++ case 12: ++ mem_channel_number = igp_info->v11.umachannelnumber; ++ if (!mem_channel_number) ++ mem_channel_number = 1; ++ /* channel width is 64 */ ++ if (vram_width) ++ *vram_width = mem_channel_number * 64; ++ mem_type = igp_info->v11.memorytype; ++ if (vram_type) ++ *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); ++ break; ++ default: ++ return -EINVAL; ++ } + break; +- case 12: +- mem_channel_number = igp_info->v12.umachannelnumber; +- /* channel width is 64 */ +- if (vram_width) +- *vram_width = mem_channel_number * 64; +- mem_type = igp_info->v12.memorytype; +- if (vram_type) +- *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); ++ case 2: ++ switch (crev) { ++ case 1: ++ case 2: ++ mem_channel_number = igp_info->v21.umachannelnumber; ++ if (!mem_channel_number) ++ mem_channel_number = 1; ++ /* channel width is 64 */ ++ if (vram_width) ++ *vram_width = mem_channel_number * 64; ++ mem_type = igp_info->v21.memorytype; ++ if (vram_type) ++ *vram_type = convert_atom_mem_type_to_vram_type(adev, mem_type); ++ break; ++ default: ++ return -EINVAL; ++ } + break; + default: + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-update-atomfirmware-for-dcn3.1-phy-tuning.patch b/queue-5.10/drm-amdgpu-update-atomfirmware-for-dcn3.1-phy-tuning.patch new file mode 100644 index 00000000000..c7e6b811c92 --- /dev/null +++ b/queue-5.10/drm-amdgpu-update-atomfirmware-for-dcn3.1-phy-tuning.patch @@ -0,0 +1,101 @@ +From 75053bfdbb4d78694076e47c1e13fef25084a7bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 10:38:47 -0400 +Subject: drm/amdgpu: Update atomfirmware for DCN3.1 phy tuning and eDP caps + +From: Nicholas Kazlauskas + +[ Upstream commit 753625643e218eb72a6e7b7df87db595a446931a ] + +[Why & How] +We'll need these in driver for phy tuning in DCN3.1. + +Multiple eDP support also requires understanding which LCD the backlight +curve in atombios is for. + +Acked-by: Huang Rui +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Stable-dep-of: e64e8f7c178e ("drm/amdgpu/atomfirmware: add intergrated info v2.3 table") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/atomfirmware.h | 56 +++++++++++++++++++++- + 1 file changed, 55 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h +index 6139d10f4289d..c7cfe9d9096dc 100644 +--- a/drivers/gpu/drm/amd/include/atomfirmware.h ++++ b/drivers/gpu/drm/amd/include/atomfirmware.h +@@ -871,7 +871,8 @@ struct atom_bracket_layout_record + }; + + enum atom_display_device_tag_def{ +- ATOM_DISPLAY_LCD1_SUPPORT = 0x0002, //an embedded display is either an LVDS or eDP signal type of display ++ ATOM_DISPLAY_LCD1_SUPPORT = 0x0002, //an embedded display is either an LVDS or eDP signal type of display ++ ATOM_DISPLAY_LCD2_SUPPORT = 0x0020, //second edp device tag 0x0020 for backward compability + ATOM_DISPLAY_DFP1_SUPPORT = 0x0008, + ATOM_DISPLAY_DFP2_SUPPORT = 0x0080, + ATOM_DISPLAY_DFP3_SUPPORT = 0x0200, +@@ -1365,6 +1366,59 @@ struct atom_integrated_system_info_v2_1 + + }; + ++struct atom_n6_display_phy_tuning_set { ++ uint8_t display_signal_type; ++ uint8_t phy_sel; ++ uint8_t preset_level; ++ uint8_t reserved1; ++ uint32_t reserved2; ++ uint32_t speed_upto; ++ uint8_t tx_vboost_level; ++ uint8_t tx_vreg_v2i; ++ uint8_t tx_vregdrv_byp; ++ uint8_t tx_term_cntl; ++ uint8_t tx_peak_level; ++ uint8_t tx_slew_en; ++ uint8_t tx_eq_pre; ++ uint8_t tx_eq_main; ++ uint8_t tx_eq_post; ++ uint8_t tx_en_inv_pre; ++ uint8_t tx_en_inv_post; ++ uint8_t reserved3; ++ uint32_t reserved4; ++ uint32_t reserved5; ++ uint32_t reserved6; ++}; ++ ++struct atom_display_phy_tuning_info { ++ struct atom_common_table_header table_header; ++ struct atom_n6_display_phy_tuning_set disp_phy_tuning[1]; ++}; ++ ++struct atom_integrated_system_info_v2_2 ++{ ++ struct atom_common_table_header table_header; ++ uint32_t vbios_misc; //enum of atom_system_vbiosmisc_def ++ uint32_t gpucapinfo; //enum of atom_system_gpucapinf_def ++ uint32_t system_config; ++ uint32_t cpucapinfo; ++ uint16_t gpuclk_ss_percentage; //unit of 0.001%, 1000 mean 1% ++ uint16_t gpuclk_ss_type; ++ uint16_t dpphy_override; // bit vector, enum of atom_sysinfo_dpphy_override_def ++ uint8_t memorytype; // enum of atom_dmi_t17_mem_type_def, APU memory type indication. ++ uint8_t umachannelnumber; // number of memory channels ++ uint8_t htc_hyst_limit; ++ uint8_t htc_tmp_limit; ++ uint8_t reserved1; ++ uint8_t reserved2; ++ struct edp_info_table edp1_info; ++ struct edp_info_table edp2_info; ++ uint32_t reserved3[8]; ++ struct atom_external_display_connection_info extdispconninfo; ++ ++ uint32_t reserved4[189]; ++}; ++ + // system_config + enum atom_system_vbiosmisc_def{ + INTEGRATED_SYSTEM_INFO__GET_EDID_CALLBACK_FUNC_SUPPORT = 0x01, +-- +2.43.0 + diff --git a/queue-5.10/drm-amdgpu-update-new-memory-types-in-atomfirmware-h.patch b/queue-5.10/drm-amdgpu-update-new-memory-types-in-atomfirmware-h.patch new file mode 100644 index 00000000000..92fd8031c79 --- /dev/null +++ b/queue-5.10/drm-amdgpu-update-new-memory-types-in-atomfirmware-h.patch @@ -0,0 +1,38 @@ +From db94fa5f8f6d8f6f19747a278de06dabfebd8a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 17:50:33 +0800 +Subject: drm/amdgpu: update new memory types in atomfirmware header + +From: Huang Rui + +[ Upstream commit af118ed9ef9fc6c6cc37f2db3d4aa2b66b2c4335 ] + +Add new nemory types in atomfirmware header. + +Signed-off-by: Huang Rui +Signed-off-by: Alex Deucher +Stable-dep-of: e64e8f7c178e ("drm/amdgpu/atomfirmware: add intergrated info v2.3 table") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/atomfirmware.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h +index 3e526c394f6cb..0799a9ca04401 100644 +--- a/drivers/gpu/drm/amd/include/atomfirmware.h ++++ b/drivers/gpu/drm/amd/include/atomfirmware.h +@@ -1367,6 +1367,11 @@ enum atom_dmi_t17_mem_type_def{ + LpDdr2MemType, ///< Assign 28 to LPDDR2 + LpDdr3MemType, ///< Assign 29 to LPDDR3 + LpDdr4MemType, ///< Assign 30 to LPDDR4 ++ GDdr6MemType, ///< Assign 31 to GDDR6 ++ HbmMemType, ///< Assign 32 to HBM ++ Hbm2MemType, ///< Assign 33 to HBM2 ++ Ddr5MemType, ///< Assign 34 to DDR5 ++ LpDdr5MemType, ///< Assign 35 to LPDDR5 + }; + + +-- +2.43.0 + diff --git a/queue-5.10/kheaders-explicitly-define-file-modes-for-archived-h.patch b/queue-5.10/kheaders-explicitly-define-file-modes-for-archived-h.patch new file mode 100644 index 00000000000..539409cadca --- /dev/null +++ b/queue-5.10/kheaders-explicitly-define-file-modes-for-archived-h.patch @@ -0,0 +1,42 @@ +From d1db0e66c6334a4167e4e6cf10db5b7c237296ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 11:32:43 +0000 +Subject: kheaders: explicitly define file modes for archived headers + +From: Matthias Maennich + +[ Upstream commit 3bd27a847a3a4827a948387cc8f0dbc9fa5931d5 ] + +Build environments might be running with different umask settings +resulting in indeterministic file modes for the files contained in +kheaders.tar.xz. The file itself is served with 444, i.e. world +readable. Archive the files explicitly with 744,a+X to improve +reproducibility across build environments. + +--mode=0444 is not suitable as directories need to be executable. Also, +444 makes it hard to delete all the readonly files after extraction. + +Cc: stable@vger.kernel.org +Signed-off-by: Matthias Maennich +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + kernel/gen_kheaders.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh +index d7e827c6cd2d2..206ab3d41ee76 100755 +--- a/kernel/gen_kheaders.sh ++++ b/kernel/gen_kheaders.sh +@@ -84,7 +84,7 @@ find $cpio_dir -type f -print0 | + + # Create archive and try to normalize metadata for reproducibility. + tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ +- --owner=0 --group=0 --sort=name --numeric-owner \ ++ --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \ + -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null + + echo $headers_md5 > kernel/kheaders.md5 +-- +2.43.0 + diff --git a/queue-5.10/knfsd-lookup-can-return-an-illegal-error-value.patch b/queue-5.10/knfsd-lookup-can-return-an-illegal-error-value.patch new file mode 100644 index 00000000000..aa4e783cac1 --- /dev/null +++ b/queue-5.10/knfsd-lookup-can-return-an-illegal-error-value.patch @@ -0,0 +1,52 @@ +From 07ed118b48ba24f17ad7c4d80adc8cb6f4e0619a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2024 12:30:04 -0400 +Subject: knfsd: LOOKUP can return an illegal error value + +From: Trond Myklebust + +[ Upstream commit e221c45da3770962418fb30c27d941bbc70d595a ] + +The 'NFS error' NFSERR_OPNOTSUPP is not described by any of the official +NFS related RFCs, but appears to have snuck into some older .x files for +NFSv2. +Either way, it is not in RFC1094, RFC1813 or any of the NFSv4 RFCs, so +should not be returned by the knfsd server, and particularly not by the +"LOOKUP" operation. + +Instead, let's return NFSERR_STALE, which is more appropriate if the +filesystem encodes the filehandle as FILEID_INVALID. + +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfsfh.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c +index db8d62632a5be..ae3323e0708dd 100644 +--- a/fs/nfsd/nfsfh.c ++++ b/fs/nfsd/nfsfh.c +@@ -573,7 +573,7 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, + _fh_update(fhp, exp, dentry); + if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID) { + fh_put(fhp); +- return nfserr_opnotsupp; ++ return nfserr_stale; + } + + return 0; +@@ -599,7 +599,7 @@ fh_update(struct svc_fh *fhp) + + _fh_update(fhp, fhp->fh_export, dentry); + if (fhp->fh_handle.fh_fileid_type == FILEID_INVALID) +- return nfserr_opnotsupp; ++ return nfserr_stale; + return 0; + out_bad: + printk(KERN_ERR "fh_update: fh not verified!\n"); +-- +2.43.0 + diff --git a/queue-5.10/mm-introduce-debug_pagealloc_-map-unmap-_pages-helpe.patch b/queue-5.10/mm-introduce-debug_pagealloc_-map-unmap-_pages-helpe.patch new file mode 100644 index 00000000000..234b4f16686 --- /dev/null +++ b/queue-5.10/mm-introduce-debug_pagealloc_-map-unmap-_pages-helpe.patch @@ -0,0 +1,192 @@ +From a25514ea7731b0f9a21c67b2a8de9787b31dcd83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:10:20 -0800 +Subject: mm: introduce debug_pagealloc_{map,unmap}_pages() helpers + +From: Mike Rapoport + +[ Upstream commit 77bc7fd607dee2ffb28daff6d0dd8ae42af61ea8 ] + +Patch series "arch, mm: improve robustness of direct map manipulation", v7. + +During recent discussion about KVM protected memory, David raised a +concern about usage of __kernel_map_pages() outside of DEBUG_PAGEALLOC +scope [1]. + +Indeed, for architectures that define CONFIG_ARCH_HAS_SET_DIRECT_MAP it is +possible that __kernel_map_pages() would fail, but since this function is +void, the failure will go unnoticed. + +Moreover, there's lack of consistency of __kernel_map_pages() semantics +across architectures as some guard this function with #ifdef +DEBUG_PAGEALLOC, some refuse to update the direct map if page allocation +debugging is disabled at run time and some allow modifying the direct map +regardless of DEBUG_PAGEALLOC settings. + +This set straightens this out by restoring dependency of +__kernel_map_pages() on DEBUG_PAGEALLOC and updating the call sites +accordingly. + +Since currently the only user of __kernel_map_pages() outside +DEBUG_PAGEALLOC is hibernation, it is updated to make direct map accesses +there more explicit. + +[1] https://lore.kernel.org/lkml/2759b4bf-e1e3-d006-7d86-78a40348269d@redhat.com + +This patch (of 4): + +When CONFIG_DEBUG_PAGEALLOC is enabled, it unmaps pages from the kernel +direct mapping after free_pages(). The pages than need to be mapped back +before they could be used. Theese mapping operations use +__kernel_map_pages() guarded with with debug_pagealloc_enabled(). + +The only place that calls __kernel_map_pages() without checking whether +DEBUG_PAGEALLOC is enabled is the hibernation code that presumes +availability of this function when ARCH_HAS_SET_DIRECT_MAP is set. Still, +on arm64, __kernel_map_pages() will bail out when DEBUG_PAGEALLOC is not +enabled but set_direct_map_invalid_noflush() may render some pages not +present in the direct map and hibernation code won't be able to save such +pages. + +To make page allocation debugging and hibernation interaction more robust, +the dependency on DEBUG_PAGEALLOC or ARCH_HAS_SET_DIRECT_MAP has to be +made more explicit. + +Start with combining the guard condition and the call to +__kernel_map_pages() into debug_pagealloc_map_pages() and +debug_pagealloc_unmap_pages() functions to emphasize that +__kernel_map_pages() should not be called without DEBUG_PAGEALLOC and use +these new functions to map/unmap pages when page allocation debugging is +enabled. + +Link: https://lkml.kernel.org/r/20201109192128.960-1-rppt@kernel.org +Link: https://lkml.kernel.org/r/20201109192128.960-2-rppt@kernel.org +Signed-off-by: Mike Rapoport +Reviewed-by: David Hildenbrand +Acked-by: Kirill A. Shutemov +Acked-by: Vlastimil Babka +Cc: Albert Ou +Cc: Andy Lutomirski +Cc: Benjamin Herrenschmidt +Cc: Borislav Petkov +Cc: Catalin Marinas +Cc: Christian Borntraeger +Cc: Christoph Lameter +Cc: "David S. Miller" +Cc: Dave Hansen +Cc: David Rientjes +Cc: "Edgecombe, Rick P" +Cc: "H. Peter Anvin" +Cc: Heiko Carstens +Cc: Ingo Molnar +Cc: Joonsoo Kim +Cc: Len Brown +Cc: Michael Ellerman +Cc: Palmer Dabbelt +Cc: Paul Mackerras +Cc: Paul Walmsley +Cc: Pavel Machek +Cc: Pekka Enberg +Cc: Peter Zijlstra +Cc: "Rafael J. Wysocki" +Cc: Thomas Gleixner +Cc: Vasily Gorbik +Cc: Will Deacon +Cc: Rafael J. Wysocki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: fb1cf0878328 ("riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context") +Signed-off-by: Sasha Levin +--- + include/linux/mm.h | 15 +++++++++++++++ + mm/memory_hotplug.c | 3 +-- + mm/page_alloc.c | 6 ++---- + mm/slab.c | 2 +- + 4 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index b8b677f47a8da..4b9c1b3656a49 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2967,12 +2967,27 @@ kernel_map_pages(struct page *page, int numpages, int enable) + { + __kernel_map_pages(page, numpages, enable); + } ++ ++static inline void debug_pagealloc_map_pages(struct page *page, int numpages) ++{ ++ if (debug_pagealloc_enabled_static()) ++ __kernel_map_pages(page, numpages, 1); ++} ++ ++static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) ++{ ++ if (debug_pagealloc_enabled_static()) ++ __kernel_map_pages(page, numpages, 0); ++} ++ + #ifdef CONFIG_HIBERNATION + extern bool kernel_page_present(struct page *page); + #endif /* CONFIG_HIBERNATION */ + #else /* CONFIG_DEBUG_PAGEALLOC || CONFIG_ARCH_HAS_SET_DIRECT_MAP */ + static inline void + kernel_map_pages(struct page *page, int numpages, int enable) {} ++static inline void debug_pagealloc_map_pages(struct page *page, int numpages) {} ++static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) {} + #ifdef CONFIG_HIBERNATION + static inline bool kernel_page_present(struct page *page) { return true; } + #endif /* CONFIG_HIBERNATION */ +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 553b0705dce8e..a29b134790596 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -596,8 +596,7 @@ void generic_online_page(struct page *page, unsigned int order) + * so we should map it first. This is better than introducing a special + * case in page freeing fast path. + */ +- if (debug_pagealloc_enabled_static()) +- kernel_map_pages(page, 1 << order, 1); ++ debug_pagealloc_map_pages(page, 1 << order); + __free_pages_core(page, order); + totalram_pages_add(1UL << order); + #ifdef CONFIG_HIGHMEM +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index ed66601044be5..5e02b4bc94a08 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -1274,8 +1274,7 @@ static __always_inline bool free_pages_prepare(struct page *page, + */ + arch_free_page(page, order); + +- if (debug_pagealloc_enabled_static()) +- kernel_map_pages(page, 1 << order, 0); ++ debug_pagealloc_unmap_pages(page, 1 << order); + + kasan_free_nondeferred_pages(page, order); + +@@ -2272,8 +2271,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, + set_page_refcounted(page); + + arch_alloc_page(page, order); +- if (debug_pagealloc_enabled_static()) +- kernel_map_pages(page, 1 << order, 1); ++ debug_pagealloc_map_pages(page, 1 << order); + kasan_alloc_pages(page, order); + kernel_poison_pages(page, 1 << order, 1); + set_page_owner(page, order, gfp_flags); +diff --git a/mm/slab.c b/mm/slab.c +index b2cc2cf7d8a33..067ffc2939904 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -1434,7 +1434,7 @@ static void slab_kernel_map(struct kmem_cache *cachep, void *objp, int map) + if (!is_debug_pagealloc_cache(cachep)) + return; + +- kernel_map_pages(virt_to_page(objp), cachep->size / PAGE_SIZE, map); ++ __kernel_map_pages(virt_to_page(objp), cachep->size / PAGE_SIZE, map); + } + + #else +-- +2.43.0 + diff --git a/queue-5.10/mmc-core-capture-emmc-and-sd-card-errors.patch b/queue-5.10/mmc-core-capture-emmc-and-sd-card-errors.patch new file mode 100644 index 00000000000..14fdec3aa30 --- /dev/null +++ b/queue-5.10/mmc-core-capture-emmc-and-sd-card-errors.patch @@ -0,0 +1,111 @@ +From 850a915594ef259a944e57a010012abd4138e684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 23:23:52 +0530 +Subject: mmc: core: Capture eMMC and SD card errors + +From: Shaik Sajida Bhanu + +[ Upstream commit 91f059c95c6a5dbc0907a5f871e7915a5e93c1f9 ] + +Add changes to capture eMMC and SD card errors. +This is useful for debug and testing. + +Signed-off-by: Liangliang Lu +Signed-off-by: Sayali Lokhande +Signed-off-by: Bao D. Nguyen +Signed-off-by: Ram Prakash Gupta +Signed-off-by: Shaik Sajida Bhanu +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/1653674036-21829-2-git-send-email-quic_c_sbhanu@quicinc.com +Signed-off-by: Ulf Hansson +Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/core.c | 10 +++++++++- + include/linux/mmc/host.h | 26 ++++++++++++++++++++++++++ + 2 files changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 2a8c7d5631d14..914ded6025235 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -947,9 +947,11 @@ int mmc_execute_tuning(struct mmc_card *card) + } + + /* Only print error when we don't check for card removal */ +- if (!host->detect_change) ++ if (!host->detect_change) { + pr_err("%s: tuning execution failed: %d\n", + mmc_hostname(host), err); ++ mmc_debugfs_err_stats_inc(host, MMC_ERR_TUNING); ++ } + + return err; + } +@@ -2322,6 +2324,12 @@ void mmc_rescan(struct work_struct *work) + if (freqs[i] <= host->f_min) + break; + } ++ ++ /* ++ * Ignore the command timeout errors observed during ++ * the card init as those are excepted. ++ */ ++ host->err_stats[MMC_ERR_CMD_TIMEOUT] = 0; + mmc_release_host(host); + + out: +diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h +index fb08b86acdbf3..50df925bcefe0 100644 +--- a/include/linux/mmc/host.h ++++ b/include/linux/mmc/host.h +@@ -79,6 +79,25 @@ struct mmc_ios { + + struct mmc_host; + ++enum mmc_err_stat { ++ MMC_ERR_CMD_TIMEOUT, ++ MMC_ERR_CMD_CRC, ++ MMC_ERR_DAT_TIMEOUT, ++ MMC_ERR_DAT_CRC, ++ MMC_ERR_AUTO_CMD, ++ MMC_ERR_ADMA, ++ MMC_ERR_TUNING, ++ MMC_ERR_CMDQ_RED, ++ MMC_ERR_CMDQ_GCE, ++ MMC_ERR_CMDQ_ICCE, ++ MMC_ERR_REQ_TIMEOUT, ++ MMC_ERR_CMDQ_REQ_TIMEOUT, ++ MMC_ERR_ICE_CFG, ++ MMC_ERR_CTRL_TIMEOUT, ++ MMC_ERR_UNEXPECTED_IRQ, ++ MMC_ERR_MAX, ++}; ++ + struct mmc_host_ops { + /* + * It is optional for the host to implement pre_req and post_req in +@@ -472,6 +491,7 @@ struct mmc_host { + /* Host Software Queue support */ + bool hsq_enabled; + ++ u32 err_stats[MMC_ERR_MAX]; + unsigned long private[] ____cacheline_aligned; + }; + +@@ -607,6 +627,12 @@ static inline enum dma_data_direction mmc_get_dma_dir(struct mmc_data *data) + return data->flags & MMC_DATA_WRITE ? DMA_TO_DEVICE : DMA_FROM_DEVICE; + } + ++static inline void mmc_debugfs_err_stats_inc(struct mmc_host *host, ++ enum mmc_err_stat stat) ++{ ++ host->err_stats[stat] += 1; ++} ++ + int mmc_send_tuning(struct mmc_host *host, u32 opcode, int *cmd_error); + int mmc_abort_tuning(struct mmc_host *host, u32 opcode); + +-- +2.43.0 + diff --git a/queue-5.10/mmc-core-only-print-retune-error-when-we-don-t-check.patch b/queue-5.10/mmc-core-only-print-retune-error-when-we-don-t-check.patch new file mode 100644 index 00000000000..4b99e010638 --- /dev/null +++ b/queue-5.10/mmc-core-only-print-retune-error-when-we-don-t-check.patch @@ -0,0 +1,54 @@ +From 9b0485c53fffdb27d85c1790abadd790b498040d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 06:16:58 +0200 +Subject: mmc: core: Only print retune error when we don't check for card + removal + +From: Wolfram Sang + +[ Upstream commit 8335928849729f8e5f10c1497c67260742f7a8cb ] + +Skip printing a retune error when we scan for a removed card because we +then expect a failed command. + +Signed-off-by: Wolfram Sang +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20210630041658.7574-1-wsa+renesas@sang-engineering.com +[Ulf: Rebased patch] +Signed-off-by: Ulf Hansson +Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/core.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index d8b38203f0fe9..2a8c7d5631d14 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -940,15 +940,17 @@ int mmc_execute_tuning(struct mmc_card *card) + opcode = MMC_SEND_TUNING_BLOCK; + + err = host->ops->execute_tuning(host, opcode); +- +- if (err) { +- pr_err("%s: tuning execution failed: %d\n", +- mmc_hostname(host), err); +- } else { ++ if (!err) { + mmc_retune_clear(host); + mmc_retune_enable(host); ++ return 0; + } + ++ /* Only print error when we don't check for card removal */ ++ if (!host->detect_change) ++ pr_err("%s: tuning execution failed: %d\n", ++ mmc_hostname(host), err); ++ + return err; + } + +-- +2.43.0 + diff --git a/queue-5.10/mmc-host-factor-out-clearing-the-retune-state.patch b/queue-5.10/mmc-host-factor-out-clearing-the-retune-state.patch new file mode 100644 index 00000000000..c7d485572cc --- /dev/null +++ b/queue-5.10/mmc-host-factor-out-clearing-the-retune-state.patch @@ -0,0 +1,74 @@ +From e81a9beece2662eeee7fe2153da71b51a2d31e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 17:16:16 +0200 +Subject: mmc: host: factor out clearing the retune state + +From: Wolfram Sang + +[ Upstream commit 8ffb2611a752e1067c18fba39968080469394206 ] + +We have this in two places, so let's have a dedicated function. It is +also more readable. + +Signed-off-by: Wolfram Sang +Acked-by: Adrian Hunter +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20210624151616.38770-4-wsa+renesas@sang-engineering.com +Signed-off-by: Ulf Hansson +Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/core.c | 3 +-- + drivers/mmc/core/host.c | 3 +-- + drivers/mmc/core/host.h | 6 ++++++ + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index d5ca59bd1c995..d8b38203f0fe9 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -945,8 +945,7 @@ int mmc_execute_tuning(struct mmc_card *card) + pr_err("%s: tuning execution failed: %d\n", + mmc_hostname(host), err); + } else { +- host->retune_now = 0; +- host->need_retune = 0; ++ mmc_retune_clear(host); + mmc_retune_enable(host); + } + +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index 7ba1343ca5c1e..28834d1d07679 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -139,8 +139,7 @@ void mmc_retune_disable(struct mmc_host *host) + mmc_retune_unpause(host); + host->can_retune = 0; + del_timer_sync(&host->retune_timer); +- host->retune_now = 0; +- host->need_retune = 0; ++ mmc_retune_clear(host); + } + + void mmc_retune_timer_stop(struct mmc_host *host) +diff --git a/drivers/mmc/core/host.h b/drivers/mmc/core/host.h +index 5e3b9534ffb23..855ecf428380f 100644 +--- a/drivers/mmc/core/host.h ++++ b/drivers/mmc/core/host.h +@@ -21,6 +21,12 @@ int mmc_retune(struct mmc_host *host); + void mmc_retune_pause(struct mmc_host *host); + void mmc_retune_unpause(struct mmc_host *host); + ++static inline void mmc_retune_clear(struct mmc_host *host) ++{ ++ host->retune_now = 0; ++ host->need_retune = 0; ++} ++ + static inline void mmc_retune_hold_now(struct mmc_host *host) + { + host->retune_now = 0; +-- +2.43.0 + diff --git a/queue-5.10/mmc-sdhci-add-support-for-tuning-error-interrupts.patch b/queue-5.10/mmc-sdhci-add-support-for-tuning-error-interrupts.patch new file mode 100644 index 00000000000..e62c457163e --- /dev/null +++ b/queue-5.10/mmc-sdhci-add-support-for-tuning-error-interrupts.patch @@ -0,0 +1,110 @@ +From 6fbef751cf99c15345f0004ee7ad562dac2a917e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Apr 2024 21:16:35 +0200 +Subject: mmc: sdhci: Add support for "Tuning Error" interrupts + +From: Adrian Hunter + +[ Upstream commit b3855668d98cf9c6aec2db999dd27d872f8ba878 ] + +Most Bay Trail devices do not enable UHS modes for the external sdcard slot +the Lenovo Yoga Tablet 2 830 / 1050 and Lenovo Yoga Tablet 2 Pro 1380 (8", +10" and 13") models however do enable this. + +Using a UHS cards in these tablets results in errors like this one: + +[ 225.272001] mmc2: Unexpected interrupt 0x04000000. +[ 225.272024] mmc2: sdhci: ============ SDHCI REGISTER DUMP =========== +[ 225.272034] mmc2: sdhci: Sys addr: 0x0712c400 | Version: 0x0000b502 +[ 225.272044] mmc2: sdhci: Blk size: 0x00007200 | Blk cnt: 0x00000007 +[ 225.272054] mmc2: sdhci: Argument: 0x00000000 | Trn mode: 0x00000023 +[ 225.272064] mmc2: sdhci: Present: 0x01e20002 | Host ctl: 0x00000016 +[ 225.272073] mmc2: sdhci: Power: 0x0000000f | Blk gap: 0x00000000 +[ 225.272082] mmc2: sdhci: Wake-up: 0x00000000 | Clock: 0x00000107 +[ 225.272092] mmc2: sdhci: Timeout: 0x0000000e | Int stat: 0x00000001 +[ 225.272101] mmc2: sdhci: Int enab: 0x03ff000b | Sig enab: 0x03ff000b +[ 225.272110] mmc2: sdhci: ACmd stat: 0x00000000 | Slot int: 0x00000001 +[ 225.272119] mmc2: sdhci: Caps: 0x076864b2 | Caps_1: 0x00000004 +[ 225.272129] mmc2: sdhci: Cmd: 0x00000c1b | Max curr: 0x00000000 +[ 225.272138] mmc2: sdhci: Resp[0]: 0x00000c00 | Resp[1]: 0x00000000 +[ 225.272147] mmc2: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000900 +[ 225.272155] mmc2: sdhci: Host ctl2: 0x0000000c +[ 225.272164] mmc2: sdhci: ADMA Err: 0x00000003 | ADMA Ptr: 0x0712c200 +[ 225.272172] mmc2: sdhci: ============================================ + +which results in IO errors leading to issues accessing the sdcard. + +0x04000000 is a so-called "Tuning Error" which sofar the SDHCI driver +does not support / enable. Modify the IRQ handler to process these. + +This fixes UHS microsd cards not working with these tablets. + +Link: https://lore.kernel.org/r/199bb4aa-c6b5-453e-be37-58bbf468800c@intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240410191639.526324-3-hdegoede@redhat.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 10 ++++++++-- + drivers/mmc/host/sdhci.h | 3 ++- + 2 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 7df35c35778c1..feb1e3a3ddb0a 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3421,12 +3421,18 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask) + host->data->error = -EILSEQ; + if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)))) + sdhci_err_stats_inc(host, DAT_CRC); +- } else if ((intmask & SDHCI_INT_DATA_CRC) && ++ } else if ((intmask & (SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) && + SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)) + != MMC_BUS_TEST_R) { + host->data->error = -EILSEQ; + if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)))) + sdhci_err_stats_inc(host, DAT_CRC); ++ if (intmask & SDHCI_INT_TUNING_ERROR) { ++ u16 ctrl2 = sdhci_readw(host, SDHCI_HOST_CONTROL2); ++ ++ ctrl2 &= ~SDHCI_CTRL_TUNED_CLK; ++ sdhci_writew(host, ctrl2, SDHCI_HOST_CONTROL2); ++ } + } else if (intmask & SDHCI_INT_ADMA_ERROR) { + pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc), + intmask); +@@ -3963,7 +3969,7 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error, + } else + *cmd_error = 0; + +- if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) { ++ if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) { + *data_error = -EILSEQ; + if (!mmc_op_tuning(host->cmd->opcode)) + sdhci_err_stats_inc(host, DAT_CRC); +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index ca5ae0f038804..2d9c518682f01 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -151,6 +151,7 @@ + #define SDHCI_INT_BUS_POWER 0x00800000 + #define SDHCI_INT_AUTO_CMD_ERR 0x01000000 + #define SDHCI_INT_ADMA_ERROR 0x02000000 ++#define SDHCI_INT_TUNING_ERROR 0x04000000 + + #define SDHCI_INT_NORMAL_MASK 0x00007FFF + #define SDHCI_INT_ERROR_MASK 0xFFFF8000 +@@ -162,7 +163,7 @@ + SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \ + SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \ + SDHCI_INT_DATA_END_BIT | SDHCI_INT_ADMA_ERROR | \ +- SDHCI_INT_BLK_GAP) ++ SDHCI_INT_BLK_GAP | SDHCI_INT_TUNING_ERROR) + #define SDHCI_INT_ALL_MASK ((unsigned int)-1) + + #define SDHCI_CQE_INT_ERR_MASK ( \ +-- +2.43.0 + diff --git a/queue-5.10/mmc-sdhci-capture-emmc-and-sd-card-errors.patch b/queue-5.10/mmc-sdhci-capture-emmc-and-sd-card-errors.patch new file mode 100644 index 00000000000..b82c7c6c129 --- /dev/null +++ b/queue-5.10/mmc-sdhci-capture-emmc-and-sd-card-errors.patch @@ -0,0 +1,242 @@ +From d284b4cefa170ec6852e3c3830ca5ee8654fea9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 23:23:53 +0530 +Subject: mmc: sdhci: Capture eMMC and SD card errors + +From: Shaik Sajida Bhanu + +[ Upstream commit efe8f5c9b5e118070f424205078ababc46fd130a ] + +Add changes to capture eMMC and SD card errors. +This is useful for debug and testing. + +Signed-off-by: Liangliang Lu +Signed-off-by: Sayali Lokhande +Signed-off-by: Bao D. Nguyen +Signed-off-by: Shaik Sajida Bhanu +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/1653674036-21829-3-git-send-email-quic_c_sbhanu@quicinc.com +Signed-off-by: Ulf Hansson +Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 59 ++++++++++++++++++++++++++++++---------- + drivers/mmc/host/sdhci.h | 3 ++ + include/linux/mmc/mmc.h | 6 ++++ + 3 files changed, 53 insertions(+), 15 deletions(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 688248287e8d5..7df35c35778c1 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -225,6 +225,7 @@ void sdhci_reset(struct sdhci_host *host, u8 mask) + if (timedout) { + pr_err("%s: Reset 0x%x never completed.\n", + mmc_hostname(host->mmc), (int)mask); ++ sdhci_err_stats_inc(host, CTRL_TIMEOUT); + sdhci_dumpregs(host); + return; + } +@@ -1721,6 +1722,7 @@ static bool sdhci_send_command_retry(struct sdhci_host *host, + if (!timeout--) { + pr_err("%s: Controller never released inhibit bit(s).\n", + mmc_hostname(host->mmc)); ++ sdhci_err_stats_inc(host, CTRL_TIMEOUT); + sdhci_dumpregs(host); + cmd->error = -EIO; + return false; +@@ -1970,6 +1972,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk) + if (timedout) { + pr_err("%s: Internal clock never stabilised.\n", + mmc_hostname(host->mmc)); ++ sdhci_err_stats_inc(host, CTRL_TIMEOUT); + sdhci_dumpregs(host); + return; + } +@@ -1992,6 +1995,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk) + if (timedout) { + pr_err("%s: PLL clock never stabilised.\n", + mmc_hostname(host->mmc)); ++ sdhci_err_stats_inc(host, CTRL_TIMEOUT); + sdhci_dumpregs(host); + return; + } +@@ -3192,6 +3196,7 @@ static void sdhci_timeout_timer(struct timer_list *t) + if (host->cmd && !sdhci_data_line_cmd(host->cmd)) { + pr_err("%s: Timeout waiting for hardware cmd interrupt.\n", + mmc_hostname(host->mmc)); ++ sdhci_err_stats_inc(host, REQ_TIMEOUT); + sdhci_dumpregs(host); + + host->cmd->error = -ETIMEDOUT; +@@ -3214,6 +3219,7 @@ static void sdhci_timeout_data_timer(struct timer_list *t) + (host->cmd && sdhci_data_line_cmd(host->cmd))) { + pr_err("%s: Timeout waiting for hardware interrupt.\n", + mmc_hostname(host->mmc)); ++ sdhci_err_stats_inc(host, REQ_TIMEOUT); + sdhci_dumpregs(host); + + if (host->data) { +@@ -3265,17 +3271,21 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p) + return; + pr_err("%s: Got command interrupt 0x%08x even though no command operation was in progress.\n", + mmc_hostname(host->mmc), (unsigned)intmask); ++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ); + sdhci_dumpregs(host); + return; + } + + if (intmask & (SDHCI_INT_TIMEOUT | SDHCI_INT_CRC | + SDHCI_INT_END_BIT | SDHCI_INT_INDEX)) { +- if (intmask & SDHCI_INT_TIMEOUT) ++ if (intmask & SDHCI_INT_TIMEOUT) { + host->cmd->error = -ETIMEDOUT; +- else ++ sdhci_err_stats_inc(host, CMD_TIMEOUT); ++ } else { + host->cmd->error = -EILSEQ; +- ++ if (!mmc_op_tuning(host->cmd->opcode)) ++ sdhci_err_stats_inc(host, CMD_CRC); ++ } + /* Treat data command CRC error the same as data CRC error */ + if (host->cmd->data && + (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) == +@@ -3297,6 +3307,8 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p) + -ETIMEDOUT : + -EILSEQ; + ++ sdhci_err_stats_inc(host, AUTO_CMD); ++ + if (sdhci_auto_cmd23(host, mrq)) { + mrq->sbc->error = err; + __sdhci_finish_mrq(host, mrq); +@@ -3367,6 +3379,7 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask) + if (intmask & SDHCI_INT_DATA_TIMEOUT) { + host->data_cmd = NULL; + data_cmd->error = -ETIMEDOUT; ++ sdhci_err_stats_inc(host, CMD_TIMEOUT); + __sdhci_finish_mrq(host, data_cmd->mrq); + return; + } +@@ -3395,23 +3408,30 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask) + + pr_err("%s: Got data interrupt 0x%08x even though no data operation was in progress.\n", + mmc_hostname(host->mmc), (unsigned)intmask); ++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ); + sdhci_dumpregs(host); + + return; + } + +- if (intmask & SDHCI_INT_DATA_TIMEOUT) ++ if (intmask & SDHCI_INT_DATA_TIMEOUT) { + host->data->error = -ETIMEDOUT; +- else if (intmask & SDHCI_INT_DATA_END_BIT) ++ sdhci_err_stats_inc(host, DAT_TIMEOUT); ++ } else if (intmask & SDHCI_INT_DATA_END_BIT) { + host->data->error = -EILSEQ; +- else if ((intmask & SDHCI_INT_DATA_CRC) && ++ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)))) ++ sdhci_err_stats_inc(host, DAT_CRC); ++ } else if ((intmask & SDHCI_INT_DATA_CRC) && + SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)) +- != MMC_BUS_TEST_R) ++ != MMC_BUS_TEST_R) { + host->data->error = -EILSEQ; +- else if (intmask & SDHCI_INT_ADMA_ERROR) { ++ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND)))) ++ sdhci_err_stats_inc(host, DAT_CRC); ++ } else if (intmask & SDHCI_INT_ADMA_ERROR) { + pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc), + intmask); + sdhci_adma_show_error(host); ++ sdhci_err_stats_inc(host, ADMA); + host->data->error = -EIO; + if (host->ops->adma_workaround) + host->ops->adma_workaround(host, intmask); +@@ -3609,6 +3629,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id) + if (unexpected) { + pr_err("%s: Unexpected interrupt 0x%08x.\n", + mmc_hostname(host->mmc), unexpected); ++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ); + sdhci_dumpregs(host); + } + +@@ -3932,20 +3953,27 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error, + if (!host->cqe_on) + return false; + +- if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC)) ++ if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC)) { + *cmd_error = -EILSEQ; +- else if (intmask & SDHCI_INT_TIMEOUT) ++ if (!mmc_op_tuning(host->cmd->opcode)) ++ sdhci_err_stats_inc(host, CMD_CRC); ++ } else if (intmask & SDHCI_INT_TIMEOUT) { + *cmd_error = -ETIMEDOUT; +- else ++ sdhci_err_stats_inc(host, CMD_TIMEOUT); ++ } else + *cmd_error = 0; + +- if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) ++ if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) { + *data_error = -EILSEQ; +- else if (intmask & SDHCI_INT_DATA_TIMEOUT) ++ if (!mmc_op_tuning(host->cmd->opcode)) ++ sdhci_err_stats_inc(host, DAT_CRC); ++ } else if (intmask & SDHCI_INT_DATA_TIMEOUT) { + *data_error = -ETIMEDOUT; +- else if (intmask & SDHCI_INT_ADMA_ERROR) ++ sdhci_err_stats_inc(host, DAT_TIMEOUT); ++ } else if (intmask & SDHCI_INT_ADMA_ERROR) { + *data_error = -EIO; +- else ++ sdhci_err_stats_inc(host, ADMA); ++ } else + *data_error = 0; + + /* Clear selected interrupts. */ +@@ -3961,6 +3989,7 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error, + sdhci_writel(host, intmask, SDHCI_INT_STATUS); + pr_err("%s: CQE: Unexpected interrupt 0x%08x.\n", + mmc_hostname(host->mmc), intmask); ++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ); + sdhci_dumpregs(host); + } + +diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h +index 4db57c3a8cd4b..ca5ae0f038804 100644 +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -354,6 +354,9 @@ struct sdhci_adma2_64_desc { + */ + #define MMC_CMD_TRANSFER_TIME (10 * NSEC_PER_MSEC) /* max 10 ms */ + ++#define sdhci_err_stats_inc(host, err_name) \ ++ mmc_debugfs_err_stats_inc((host)->mmc, MMC_ERR_##err_name) ++ + enum sdhci_cookie { + COOKIE_UNMAPPED, + COOKIE_PRE_MAPPED, /* mapped by sdhci_pre_req() */ +diff --git a/include/linux/mmc/mmc.h b/include/linux/mmc/mmc.h +index 545578fb814b0..6f7993803ee78 100644 +--- a/include/linux/mmc/mmc.h ++++ b/include/linux/mmc/mmc.h +@@ -99,6 +99,12 @@ static inline bool mmc_op_multi(u32 opcode) + opcode == MMC_READ_MULTIPLE_BLOCK; + } + ++static inline bool mmc_op_tuning(u32 opcode) ++{ ++ return opcode == MMC_SEND_TUNING_BLOCK || ++ opcode == MMC_SEND_TUNING_BLOCK_HS200; ++} ++ + /* + * MMC_SWITCH argument format: + * +-- +2.43.0 + diff --git a/queue-5.10/mmc-sdhci-change-the-code-to-check-auto_cmd23.patch b/queue-5.10/mmc-sdhci-change-the-code-to-check-auto_cmd23.patch new file mode 100644 index 00000000000..ea04d3a87c1 --- /dev/null +++ b/queue-5.10/mmc-sdhci-change-the-code-to-check-auto_cmd23.patch @@ -0,0 +1,39 @@ +From eca9f5fdf549298e1d1f912b9fe02f41f955d81e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 18:33:45 +0900 +Subject: mmc: sdhci: Change the code to check auto_cmd23 + +From: ChanWoo Lee + +[ Upstream commit 38929d4f0d811df399c99398ce0599f546369bd4 ] + +It is replaced with a function that is already declared. +//[1/5] mmc: sdhci: Add helpers for the auto-CMD23 flag +//20200412090349.1607-2-adrian.hunter@intel.com + +Signed-off-by: ChanWoo Lee +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20210825093345.14706-1-cw9316.lee@samsung.com +Signed-off-by: Ulf Hansson +Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index bad01cc6823f6..688248287e8d5 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3297,7 +3297,7 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p) + -ETIMEDOUT : + -EILSEQ; + +- if (mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) { ++ if (sdhci_auto_cmd23(host, mrq)) { + mrq->sbc->error = err; + __sdhci_finish_mrq(host, mrq); + return; +-- +2.43.0 + diff --git a/queue-5.10/pci-add-pci_error_response-and-related-definitions.patch b/queue-5.10/pci-add-pci_error_response-and-related-definitions.patch new file mode 100644 index 00000000000..5c20139524b --- /dev/null +++ b/queue-5.10/pci-add-pci_error_response-and-related-definitions.patch @@ -0,0 +1,56 @@ +From fdc83976105c0bab3139980b1d2bcbe91081f4b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 19:33:11 +0530 +Subject: PCI: Add PCI_ERROR_RESPONSE and related definitions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Naveen Naidu + +[ Upstream commit 57bdeef4716689d9b0e3571034d65cf420f6efcd ] + +A config or MMIO read from a PCI device that doesn't exist or doesn't +respond causes a PCI error. There's no real data to return to satisfy the +CPU read, so most hardware fabricates ~0 data. + +Add a PCI_ERROR_RESPONSE definition for that and use it where appropriate +to make these checks consistent and easier to find. + +Also add helper definitions PCI_SET_ERROR_RESPONSE() and +PCI_POSSIBLE_ERROR() to make the code more readable. + +Suggested-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/55563bf4dfc5d3fdc96695373c659d099bf175b1.1637243717.git.naveennaidu479@gmail.com +Signed-off-by: Naveen Naidu +Signed-off-by: Bjorn Helgaas +Reviewed-by: Pali Rohár +Stable-dep-of: c625dabbf1c4 ("x86/amd_nb: Check for invalid SMN reads") +Signed-off-by: Sasha Levin +--- + include/linux/pci.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 5b24a6fbfa0be..30bc462fb1964 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -148,6 +148,15 @@ enum pci_interrupt_pin { + /* The number of legacy PCI INTx interrupts */ + #define PCI_NUM_INTX 4 + ++/* ++ * Reading from a device that doesn't respond typically returns ~0. A ++ * successful read from a device may also return ~0, so you need additional ++ * information to reliably identify errors. ++ */ ++#define PCI_ERROR_RESPONSE (~0ULL) ++#define PCI_SET_ERROR_RESPONSE(val) (*(val) = ((typeof(*(val))) PCI_ERROR_RESPONSE)) ++#define PCI_POSSIBLE_ERROR(val) ((val) == ((typeof(val)) PCI_ERROR_RESPONSE)) ++ + /* + * pci_power_t values must match the bits in the Capabilities PME_Support + * and Control/Status PowerState fields in the Power Management capability. +-- +2.43.0 + diff --git a/queue-5.10/perf-core-fix-missing-wakeup-when-waiting-for-contex.patch b/queue-5.10/perf-core-fix-missing-wakeup-when-waiting-for-contex.patch new file mode 100644 index 00000000000..c441a930c5b --- /dev/null +++ b/queue-5.10/perf-core-fix-missing-wakeup-when-waiting-for-contex.patch @@ -0,0 +1,111 @@ +From c4dea5d7d9b6bedde730fddc6aca8eace744b240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 May 2024 10:39:48 +0000 +Subject: perf/core: Fix missing wakeup when waiting for context reference + +From: Haifeng Xu + +[ Upstream commit 74751ef5c1912ebd3e65c3b65f45587e05ce5d36 ] + +In our production environment, we found many hung tasks which are +blocked for more than 18 hours. Their call traces are like this: + +[346278.191038] __schedule+0x2d8/0x890 +[346278.191046] schedule+0x4e/0xb0 +[346278.191049] perf_event_free_task+0x220/0x270 +[346278.191056] ? init_wait_var_entry+0x50/0x50 +[346278.191060] copy_process+0x663/0x18d0 +[346278.191068] kernel_clone+0x9d/0x3d0 +[346278.191072] __do_sys_clone+0x5d/0x80 +[346278.191076] __x64_sys_clone+0x25/0x30 +[346278.191079] do_syscall_64+0x5c/0xc0 +[346278.191083] ? syscall_exit_to_user_mode+0x27/0x50 +[346278.191086] ? do_syscall_64+0x69/0xc0 +[346278.191088] ? irqentry_exit_to_user_mode+0x9/0x20 +[346278.191092] ? irqentry_exit+0x19/0x30 +[346278.191095] ? exc_page_fault+0x89/0x160 +[346278.191097] ? asm_exc_page_fault+0x8/0x30 +[346278.191102] entry_SYSCALL_64_after_hwframe+0x44/0xae + +The task was waiting for the refcount become to 1, but from the vmcore, +we found the refcount has already been 1. It seems that the task didn't +get woken up by perf_event_release_kernel() and got stuck forever. The +below scenario may cause the problem. + +Thread A Thread B +... ... +perf_event_free_task perf_event_release_kernel + ... + acquire event->child_mutex + ... + get_ctx + ... release event->child_mutex + acquire ctx->mutex + ... + perf_free_event (acquire/release event->child_mutex) + ... + release ctx->mutex + wait_var_event + acquire ctx->mutex + acquire event->child_mutex + # move existing events to free_list + release event->child_mutex + release ctx->mutex + put_ctx +... ... + +In this case, all events of the ctx have been freed, so we couldn't +find the ctx in free_list and Thread A will miss the wakeup. It's thus +necessary to add a wakeup after dropping the reference. + +Fixes: 1cf8dfe8a661 ("perf/core: Fix race between close() and fork()") +Signed-off-by: Haifeng Xu +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Frederic Weisbecker +Acked-by: Mark Rutland +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20240513103948.33570-1-haifeng.xu@shopee.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e0b47bed86750..3a191bec69aca 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5128,6 +5128,7 @@ int perf_event_release_kernel(struct perf_event *event) + again: + mutex_lock(&event->child_mutex); + list_for_each_entry(child, &event->child_list, child_list) { ++ void *var = NULL; + + /* + * Cannot change, child events are not migrated, see the +@@ -5168,11 +5169,23 @@ int perf_event_release_kernel(struct perf_event *event) + * this can't be the last reference. + */ + put_event(event); ++ } else { ++ var = &ctx->refcount; + } + + mutex_unlock(&event->child_mutex); + mutex_unlock(&ctx->mutex); + put_ctx(ctx); ++ ++ if (var) { ++ /* ++ * If perf_event_free_task() has deleted all events from the ++ * ctx while the child_mutex got released above, make sure to ++ * notify about the preceding put_ctx(). ++ */ ++ smp_mb(); /* pairs with wait_var_event() */ ++ wake_up_var(var); ++ } + goto again; + } + mutex_unlock(&event->child_mutex); +-- +2.43.0 + diff --git a/queue-5.10/pm-hibernate-make-direct-map-manipulations-more-expl.patch b/queue-5.10/pm-hibernate-make-direct-map-manipulations-more-expl.patch new file mode 100644 index 00000000000..eada3779b2d --- /dev/null +++ b/queue-5.10/pm-hibernate-make-direct-map-manipulations-more-expl.patch @@ -0,0 +1,157 @@ +From 2b3ed759e93fb5bc86744856a0cbe80f1b980e49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:10:25 -0800 +Subject: PM: hibernate: make direct map manipulations more explicit + +From: Mike Rapoport + +[ Upstream commit 2abf962a8d42b32f5ffeb827826290b799c85f86 ] + +When DEBUG_PAGEALLOC or ARCH_HAS_SET_DIRECT_MAP is enabled a page may be +not present in the direct map and has to be explicitly mapped before it +could be copied. + +Introduce hibernate_map_page() and hibernation_unmap_page() that will +explicitly use set_direct_map_{default,invalid}_noflush() for +ARCH_HAS_SET_DIRECT_MAP case and debug_pagealloc_{map,unmap}_pages() for +DEBUG_PAGEALLOC case. + +The remapping of the pages in safe_copy_page() presumes that it only +changes protection bits in an existing PTE and so it is safe to ignore +return value of set_direct_map_{default,invalid}_noflush(). + +Still, add a pr_warn() so that future changes in set_memory APIs will not +silently break hibernation. + +Link: https://lkml.kernel.org/r/20201109192128.960-3-rppt@kernel.org +Signed-off-by: Mike Rapoport +Acked-by: Rafael J. Wysocki +Reviewed-by: David Hildenbrand +Acked-by: Kirill A. Shutemov +Acked-by: Vlastimil Babka +Cc: Albert Ou +Cc: Andy Lutomirski +Cc: Benjamin Herrenschmidt +Cc: Borislav Petkov +Cc: Catalin Marinas +Cc: Christian Borntraeger +Cc: Christoph Lameter +Cc: Dave Hansen +Cc: David Rientjes +Cc: "David S. Miller" +Cc: "Edgecombe, Rick P" +Cc: Heiko Carstens +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Joonsoo Kim +Cc: Len Brown +Cc: Michael Ellerman +Cc: Palmer Dabbelt +Cc: Paul Mackerras +Cc: Paul Walmsley +Cc: Pavel Machek +Cc: Pekka Enberg +Cc: Peter Zijlstra +Cc: "Rafael J. Wysocki" +Cc: Thomas Gleixner +Cc: Vasily Gorbik +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: fb1cf0878328 ("riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context") +Signed-off-by: Sasha Levin +--- + include/linux/mm.h | 12 ------------ + kernel/power/snapshot.c | 38 ++++++++++++++++++++++++++++++++++++-- + 2 files changed, 36 insertions(+), 14 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 4b9c1b3656a49..61ed8b20ea704 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2958,16 +2958,6 @@ static inline bool debug_pagealloc_enabled_static(void) + #if defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_ARCH_HAS_SET_DIRECT_MAP) + extern void __kernel_map_pages(struct page *page, int numpages, int enable); + +-/* +- * When called in DEBUG_PAGEALLOC context, the call should most likely be +- * guarded by debug_pagealloc_enabled() or debug_pagealloc_enabled_static() +- */ +-static inline void +-kernel_map_pages(struct page *page, int numpages, int enable) +-{ +- __kernel_map_pages(page, numpages, enable); +-} +- + static inline void debug_pagealloc_map_pages(struct page *page, int numpages) + { + if (debug_pagealloc_enabled_static()) +@@ -2984,8 +2974,6 @@ static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) + extern bool kernel_page_present(struct page *page); + #endif /* CONFIG_HIBERNATION */ + #else /* CONFIG_DEBUG_PAGEALLOC || CONFIG_ARCH_HAS_SET_DIRECT_MAP */ +-static inline void +-kernel_map_pages(struct page *page, int numpages, int enable) {} + static inline void debug_pagealloc_map_pages(struct page *page, int numpages) {} + static inline void debug_pagealloc_unmap_pages(struct page *page, int numpages) {} + #ifdef CONFIG_HIBERNATION +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index c1bdaae07f4c7..e84fb16f30b9d 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -76,6 +76,40 @@ static inline void hibernate_restore_protect_page(void *page_address) {} + static inline void hibernate_restore_unprotect_page(void *page_address) {} + #endif /* CONFIG_STRICT_KERNEL_RWX && CONFIG_ARCH_HAS_SET_MEMORY */ + ++ ++/* ++ * The calls to set_direct_map_*() should not fail because remapping a page ++ * here means that we only update protection bits in an existing PTE. ++ * It is still worth to have a warning here if something changes and this ++ * will no longer be the case. ++ */ ++static inline void hibernate_map_page(struct page *page) ++{ ++ if (IS_ENABLED(CONFIG_ARCH_HAS_SET_DIRECT_MAP)) { ++ int ret = set_direct_map_default_noflush(page); ++ ++ if (ret) ++ pr_warn_once("Failed to remap page\n"); ++ } else { ++ debug_pagealloc_map_pages(page, 1); ++ } ++} ++ ++static inline void hibernate_unmap_page(struct page *page) ++{ ++ if (IS_ENABLED(CONFIG_ARCH_HAS_SET_DIRECT_MAP)) { ++ unsigned long addr = (unsigned long)page_address(page); ++ int ret = set_direct_map_invalid_noflush(page); ++ ++ if (ret) ++ pr_warn_once("Failed to remap page\n"); ++ ++ flush_tlb_kernel_range(addr, addr + PAGE_SIZE); ++ } else { ++ debug_pagealloc_unmap_pages(page, 1); ++ } ++} ++ + static int swsusp_page_is_free(struct page *); + static void swsusp_set_page_forbidden(struct page *); + static void swsusp_unset_page_forbidden(struct page *); +@@ -1348,9 +1382,9 @@ static void safe_copy_page(void *dst, struct page *s_page) + if (kernel_page_present(s_page)) { + do_copy_page(dst, page_address(s_page)); + } else { +- kernel_map_pages(s_page, 1, 1); ++ hibernate_map_page(s_page); + do_copy_page(dst, page_address(s_page)); +- kernel_map_pages(s_page, 1, 0); ++ hibernate_unmap_page(s_page); + } + } + +-- +2.43.0 + diff --git a/queue-5.10/pmdomain-ti-sci-fix-duplicate-pd-referrals.patch b/queue-5.10/pmdomain-ti-sci-fix-duplicate-pd-referrals.patch new file mode 100644 index 00000000000..dfde8ead289 --- /dev/null +++ b/queue-5.10/pmdomain-ti-sci-fix-duplicate-pd-referrals.patch @@ -0,0 +1,70 @@ +From bc79e5e15d18874e0201c83360478dd85d5f46b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 19:00:23 +0300 +Subject: pmdomain: ti-sci: Fix duplicate PD referrals + +From: Tomi Valkeinen + +[ Upstream commit 670c900f69645db394efb38934b3344d8804171a ] + +When the dts file has multiple referrers to a single PD (e.g. +simple-framebuffer and dss nodes both point to the DSS power-domain) the +ti-sci driver will create two power domains, both with the same ID, and +that will cause problems as one of the power domains will hide the other +one. + +Fix this checking if a PD with the ID has already been created, and only +create a PD for new IDs. + +Fixes: efa5c01cd7ee ("soc: ti: ti_sci_pm_domains: switch to use multiple genpds instead of one") +Signed-off-by: Tomi Valkeinen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240415-ti-sci-pd-v1-1-a0e56b8ad897@ideasonboard.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/ti_sci_pm_domains.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c +index a33ec7eaf23d1..17984a7bffba5 100644 +--- a/drivers/soc/ti/ti_sci_pm_domains.c ++++ b/drivers/soc/ti/ti_sci_pm_domains.c +@@ -114,6 +114,18 @@ static const struct of_device_id ti_sci_pm_domain_matches[] = { + }; + MODULE_DEVICE_TABLE(of, ti_sci_pm_domain_matches); + ++static bool ti_sci_pm_idx_exists(struct ti_sci_genpd_provider *pd_provider, u32 idx) ++{ ++ struct ti_sci_pm_domain *pd; ++ ++ list_for_each_entry(pd, &pd_provider->pd_list, node) { ++ if (pd->idx == idx) ++ return true; ++ } ++ ++ return false; ++} ++ + static int ti_sci_pm_domain_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -153,8 +165,14 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev) + break; + + if (args.args_count >= 1 && args.np == dev->of_node) { +- if (args.args[0] > max_id) ++ if (args.args[0] > max_id) { + max_id = args.args[0]; ++ } else { ++ if (ti_sci_pm_idx_exists(pd_provider, args.args[0])) { ++ index++; ++ continue; ++ } ++ } + + pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); + if (!pd) +-- +2.43.0 + diff --git a/queue-5.10/r8169-fix-possible-ring-buffer-corruption-on-fragmen.patch b/queue-5.10/r8169-fix-possible-ring-buffer-corruption-on-fragmen.patch new file mode 100644 index 00000000000..905b190f6fd --- /dev/null +++ b/queue-5.10/r8169-fix-possible-ring-buffer-corruption-on-fragmen.patch @@ -0,0 +1,60 @@ +From f80c71927ec39acde8f37af5842c00b846f2893a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 23:45:50 +0100 +Subject: r8169: Fix possible ring buffer corruption on fragmented Tx packets. + +From: Ken Milmore + +[ Upstream commit c71e3a5cffd5309d7f84444df03d5b72600cc417 ] + +An issue was found on the RTL8125b when transmitting small fragmented +packets, whereby invalid entries were inserted into the transmit ring +buffer, subsequently leading to calls to dma_unmap_single() with a null +address. + +This was caused by rtl8169_start_xmit() not noticing changes to nr_frags +which may occur when small packets are padded (to work around hardware +quirks) in rtl8169_tso_csum_v2(). + +To fix this, postpone inspecting nr_frags until after any padding has been +applied. + +Fixes: 9020845fb5d6 ("r8169: improve rtl8169_start_xmit") +Cc: stable@vger.kernel.org +Signed-off-by: Ken Milmore +Reviewed-by: Heiner Kallweit +Link: https://lore.kernel.org/r/27ead18b-c23d-4f49-a020-1fc482c5ac95@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index dd4404efdb8d6..d24eb5ee152a5 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4278,11 +4278,11 @@ static void rtl8169_doorbell(struct rtl8169_private *tp) + static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + struct net_device *dev) + { +- unsigned int frags = skb_shinfo(skb)->nr_frags; + struct rtl8169_private *tp = netdev_priv(dev); + unsigned int entry = tp->cur_tx % NUM_TX_DESC; + struct TxDesc *txd_first, *txd_last; + bool stop_queue, door_bell; ++ unsigned int frags; + u32 opts[2]; + + if (unlikely(!rtl_tx_slots_avail(tp))) { +@@ -4305,6 +4305,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + + txd_first = tp->TxDescArray + entry; + ++ frags = skb_shinfo(skb)->nr_frags; + if (frags) { + if (rtl8169_xmit_frags(tp, skb, opts, entry)) + goto err_dma_1; +-- +2.43.0 + diff --git a/queue-5.10/r8169-improve-rtl8169_start_xmit.patch b/queue-5.10/r8169-improve-rtl8169_start_xmit.patch new file mode 100644 index 00000000000..3cb7ee2cda2 --- /dev/null +++ b/queue-5.10/r8169-improve-rtl8169_start_xmit.patch @@ -0,0 +1,73 @@ +From 9e7264d0481da6e57af83dffd7f6d21d6c37b042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 21:49:53 +0100 +Subject: r8169: improve rtl8169_start_xmit + +From: Heiner Kallweit + +[ Upstream commit 41294e6a434d4f19e957c55b275ea0324f275009 ] + +Improve the following in rtl8169_start_xmit: +- tp->cur_tx can be accessed in parallel by rtl_tx(), therefore + annotate the race by using WRITE_ONCE +- avoid checking stop_queue a second time by moving the doorbell check +- netif_stop_queue() uses atomic operation set_bit() that includes a + full memory barrier on some platforms, therefore use + smp_mb__after_atomic to avoid overhead + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/80085451-3eaf-507a-c7c0-08d607c46fbc@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 0847b64fbb2f4..b678fd1436a4c 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4331,7 +4331,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + /* rtl_tx needs to see descriptor changes before updated tp->cur_tx */ + smp_wmb(); + +- tp->cur_tx += frags + 1; ++ WRITE_ONCE(tp->cur_tx, tp->cur_tx + frags + 1); + + stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS); + if (unlikely(stop_queue)) { +@@ -4340,13 +4340,6 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + */ + smp_wmb(); + netif_stop_queue(dev); +- door_bell = true; +- } +- +- if (door_bell) +- rtl8169_doorbell(tp); +- +- if (unlikely(stop_queue)) { + /* Sync with rtl_tx: + * - publish queue status and cur_tx ring index (write barrier) + * - refresh dirty_tx ring index (read barrier). +@@ -4354,11 +4347,15 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + * status and forget to wake up queue, a racing rtl_tx thread + * can't. + */ +- smp_mb(); ++ smp_mb__after_atomic(); + if (rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) + netif_start_queue(dev); ++ door_bell = true; + } + ++ if (door_bell) ++ rtl8169_doorbell(tp); ++ + return NETDEV_TX_OK; + + err_dma_1: +-- +2.43.0 + diff --git a/queue-5.10/r8169-improve-rtl_tx.patch b/queue-5.10/r8169-improve-rtl_tx.patch new file mode 100644 index 00000000000..69b20254c7b --- /dev/null +++ b/queue-5.10/r8169-improve-rtl_tx.patch @@ -0,0 +1,63 @@ +From 3015c2d0b0241d1ef7ae6c44c2f7661e9abdbf5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 22:56:29 +0100 +Subject: r8169: improve rtl_tx + +From: Heiner Kallweit + +[ Upstream commit ca1ab89cd2d654661f559bd83ad9fc7323cb6c86 ] + +We can simplify the for() condition and eliminate variable tx_left. +The change also considers that tp->cur_tx may be incremented by a +racing rtl8169_start_xmit(). +In addition replace the write to tp->dirty_tx and the following +smp_mb() with an equivalent call to smp_store_mb(). This implicitly +adds a WRITE_ONCE() to the write. + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/c2e19e5e-3d3f-d663-af32-13c3374f5def@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index 84c8362a65cd1..0847b64fbb2f4 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4469,11 +4469,11 @@ static void rtl8169_pcierr_interrupt(struct net_device *dev) + static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + int budget) + { +- unsigned int dirty_tx, tx_left, bytes_compl = 0, pkts_compl = 0; ++ unsigned int dirty_tx, bytes_compl = 0, pkts_compl = 0; + + dirty_tx = tp->dirty_tx; + +- for (tx_left = READ_ONCE(tp->cur_tx) - dirty_tx; tx_left; tx_left--) { ++ while (READ_ONCE(tp->cur_tx) != dirty_tx) { + unsigned int entry = dirty_tx % NUM_TX_DESC; + struct sk_buff *skb = tp->tx_skb[entry].skb; + u32 status; +@@ -4497,7 +4497,6 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + + rtl_inc_priv_stats(&tp->tx_stats, pkts_compl, bytes_compl); + +- tp->dirty_tx = dirty_tx; + /* Sync with rtl8169_start_xmit: + * - publish dirty_tx ring index (write barrier) + * - refresh cur_tx ring index and queue status (read barrier) +@@ -4505,7 +4504,7 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + * a racing xmit thread can only have a right view of the + * ring status. + */ +- smp_mb(); ++ smp_store_mb(tp->dirty_tx, dirty_tx); + if (netif_queue_stopped(dev) && + rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) { + netif_wake_queue(dev); +-- +2.43.0 + diff --git a/queue-5.10/r8169-remove-not-needed-check-in-rtl8169_start_xmit.patch b/queue-5.10/r8169-remove-not-needed-check-in-rtl8169_start_xmit.patch new file mode 100644 index 00000000000..9f22883e436 --- /dev/null +++ b/queue-5.10/r8169-remove-not-needed-check-in-rtl8169_start_xmit.patch @@ -0,0 +1,57 @@ +From e9bff0caaadd4f0e1166c6cd0aab930885693ff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 21:34:09 +0100 +Subject: r8169: remove not needed check in rtl8169_start_xmit + +From: Heiner Kallweit + +[ Upstream commit bd4bdeb4f29027199c68104fbdfa07ad45390cc1 ] + +In rtl_tx() the released descriptors are zero'ed by +rtl8169_unmap_tx_skb(). And in the beginning of rtl8169_start_xmit() +we check that enough descriptors are free, therefore there's no way +the DescOwn bit can be set here. + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/6965d665-6c50-90c5-70e6-0bb335d4ea47@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index dbf885f4dd01d..dd4404efdb8d6 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4285,17 +4285,12 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + bool stop_queue, door_bell; + u32 opts[2]; + +- txd_first = tp->TxDescArray + entry; +- + if (unlikely(!rtl_tx_slots_avail(tp))) { + if (net_ratelimit()) + netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); + goto err_stop_0; + } + +- if (unlikely(le32_to_cpu(txd_first->opts1) & DescOwn)) +- goto err_stop_0; +- + opts[1] = rtl8169_tx_vlan_tag(skb); + opts[0] = 0; + +@@ -4308,6 +4303,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + entry, false))) + goto err_dma_0; + ++ txd_first = tp->TxDescArray + entry; ++ + if (frags) { + if (rtl8169_xmit_frags(tp, skb, opts, entry)) + goto err_dma_1; +-- +2.43.0 + diff --git a/queue-5.10/r8169-remove-nr_frags-argument-from-rtl_tx_slots_ava.patch b/queue-5.10/r8169-remove-nr_frags-argument-from-rtl_tx_slots_ava.patch new file mode 100644 index 00000000000..43941b9f8e9 --- /dev/null +++ b/queue-5.10/r8169-remove-nr_frags-argument-from-rtl_tx_slots_ava.patch @@ -0,0 +1,85 @@ +From 684bcfdfcfc2755fccd490750028e3fea4e96a40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 17:03:14 +0100 +Subject: r8169: remove nr_frags argument from rtl_tx_slots_avail + +From: Heiner Kallweit + +[ Upstream commit 83c317d7b36bb3858cf1cb86d2635ec3f3bd6ea3 ] + +The only time when nr_frags isn't SKB_MAX_FRAGS is when entering +rtl8169_start_xmit(). However we can use SKB_MAX_FRAGS also here +because when queue isn't stopped there should always be room for +MAX_SKB_FRAGS + 1 descriptors. + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/3d1f2ad7-31d5-2cac-4f4a-394f8a3cab63@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index b678fd1436a4c..dbf885f4dd01d 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4247,13 +4247,12 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, + return true; + } + +-static bool rtl_tx_slots_avail(struct rtl8169_private *tp, +- unsigned int nr_frags) ++static bool rtl_tx_slots_avail(struct rtl8169_private *tp) + { + unsigned int slots_avail = tp->dirty_tx + NUM_TX_DESC - tp->cur_tx; + + /* A skbuff with nr_frags needs nr_frags+1 entries in the tx queue */ +- return slots_avail > nr_frags; ++ return slots_avail > MAX_SKB_FRAGS; + } + + /* Versions RTL8102e and from RTL8168c onwards support csum_v2 */ +@@ -4288,7 +4287,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + + txd_first = tp->TxDescArray + entry; + +- if (unlikely(!rtl_tx_slots_avail(tp, frags))) { ++ if (unlikely(!rtl_tx_slots_avail(tp))) { + if (net_ratelimit()) + netdev_err(dev, "BUG! Tx Ring full when queue awake!\n"); + goto err_stop_0; +@@ -4333,7 +4332,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + + WRITE_ONCE(tp->cur_tx, tp->cur_tx + frags + 1); + +- stop_queue = !rtl_tx_slots_avail(tp, MAX_SKB_FRAGS); ++ stop_queue = !rtl_tx_slots_avail(tp); + if (unlikely(stop_queue)) { + /* Avoid wrongly optimistic queue wake-up: rtl_tx thread must + * not miss a ring update when it notices a stopped queue. +@@ -4348,7 +4347,7 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb, + * can't. + */ + smp_mb__after_atomic(); +- if (rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) ++ if (rtl_tx_slots_avail(tp)) + netif_start_queue(dev); + door_bell = true; + } +@@ -4502,10 +4501,8 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + * ring status. + */ + smp_store_mb(tp->dirty_tx, dirty_tx); +- if (netif_queue_stopped(dev) && +- rtl_tx_slots_avail(tp, MAX_SKB_FRAGS)) { ++ if (netif_queue_stopped(dev) && rtl_tx_slots_avail(tp)) + netif_wake_queue(dev); +- } + /* + * 8168 hack: TxPoll requests are lost when the Tx packets are + * too close. Let's kick an extra TxPoll request when a burst +-- +2.43.0 + diff --git a/queue-5.10/r8169-remove-unneeded-memory-barrier-in-rtl_tx.patch b/queue-5.10/r8169-remove-unneeded-memory-barrier-in-rtl_tx.patch new file mode 100644 index 00000000000..314921b2df4 --- /dev/null +++ b/queue-5.10/r8169-remove-unneeded-memory-barrier-in-rtl_tx.patch @@ -0,0 +1,42 @@ +From fa50bbd7b5166ac8d67069dd278938a046792afa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 18:56:06 +0100 +Subject: r8169: remove unneeded memory barrier in rtl_tx + +From: Heiner Kallweit + +[ Upstream commit 3a689e34973e8717cd57991c6fcf527dc56062b5 ] + +tp->dirty_tx isn't changed outside rtl_tx(). Therefore I see no need +to guarantee a specific order of reading tp->dirty_tx and tp->cur_tx. +Having said that we can remove the memory barrier. +In addition use READ_ONCE() when reading tp->cur_tx because it can +change in parallel to rtl_tx(). + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/2264563a-fa9e-11b0-2c42-31bc6b8e2790@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: c71e3a5cffd5 ("r8169: Fix possible ring buffer corruption on fragmented Tx packets.") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index c29d43c5f4504..84c8362a65cd1 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4472,9 +4472,8 @@ static void rtl_tx(struct net_device *dev, struct rtl8169_private *tp, + unsigned int dirty_tx, tx_left, bytes_compl = 0, pkts_compl = 0; + + dirty_tx = tp->dirty_tx; +- smp_rmb(); + +- for (tx_left = tp->cur_tx - dirty_tx; tx_left > 0; tx_left--) { ++ for (tx_left = READ_ONCE(tp->cur_tx) - dirty_tx; tx_left; tx_left--) { + unsigned int entry = dirty_tx % NUM_TX_DESC; + struct sk_buff *skb = tp->tx_skb[entry].skb; + u32 status; +-- +2.43.0 + diff --git a/queue-5.10/revert-kheaders-substituting-sort-in-archive-creatio.patch b/queue-5.10/revert-kheaders-substituting-sort-in-archive-creatio.patch new file mode 100644 index 00000000000..6dfc40451c5 --- /dev/null +++ b/queue-5.10/revert-kheaders-substituting-sort-in-archive-creatio.patch @@ -0,0 +1,48 @@ +From ddcb8b6b7964f14a0ce198d9332eff01a9aabde9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 May 2023 22:23:35 +0900 +Subject: Revert "kheaders: substituting --sort in archive creation" + +From: Masahiro Yamada + +[ Upstream commit 49c386ebbb43394ff4773ce24f726f6afc4c30c8 ] + +This reverts commit 700dea5a0bea9f64eba89fae7cb2540326fdfdc1. + +The reason for that commit was --sort=ORDER introduced in +tar 1.28 (2014). More than 3 years have passed since then. + +Requiring GNU tar 1.28 should be fine now because we require +GCC 5.1 (2015). + +Signed-off-by: Masahiro Yamada +Reviewed-by: Nicolas Schier +Stable-dep-of: 3bd27a847a3a ("kheaders: explicitly define file modes for archived headers") +Signed-off-by: Sasha Levin +--- + kernel/gen_kheaders.sh | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh +index c1510f0ab3ea5..d7e827c6cd2d2 100755 +--- a/kernel/gen_kheaders.sh ++++ b/kernel/gen_kheaders.sh +@@ -83,12 +83,9 @@ find $cpio_dir -type f -print0 | + xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;' + + # Create archive and try to normalize metadata for reproducibility. +-# For compatibility with older versions of tar, files are fed to tar +-# pre-sorted, as --sort=name might not be available. +-find $cpio_dir -printf "./%P\n" | LC_ALL=C sort | \ +- tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ +- --owner=0 --group=0 --numeric-owner --no-recursion \ +- -I $XZ -cf $tarfile -C $cpio_dir/ -T - > /dev/null ++tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ ++ --owner=0 --group=0 --sort=name --numeric-owner \ ++ -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null + + echo $headers_md5 > kernel/kheaders.md5 + echo "$this_file_md5" >> kernel/kheaders.md5 +-- +2.43.0 + diff --git a/queue-5.10/riscv-rewrite-__kernel_map_pages-to-fix-sleeping-in-.patch b/queue-5.10/riscv-rewrite-__kernel_map_pages-to-fix-sleeping-in-.patch new file mode 100644 index 00000000000..20a6df5bd57 --- /dev/null +++ b/queue-5.10/riscv-rewrite-__kernel_map_pages-to-fix-sleeping-in-.patch @@ -0,0 +1,104 @@ +From f4a9ab6c094bec464d2264ab51a88ce2fe172dd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 07:50:40 +0200 +Subject: riscv: rewrite __kernel_map_pages() to fix sleeping in invalid + context + +From: Nam Cao + +[ Upstream commit fb1cf0878328fe75d47f0aed0a65b30126fcefc4 ] + +__kernel_map_pages() is a debug function which clears the valid bit in page +table entry for deallocated pages to detect illegal memory accesses to +freed pages. + +This function set/clear the valid bit using __set_memory(). __set_memory() +acquires init_mm's semaphore, and this operation may sleep. This is +problematic, because __kernel_map_pages() can be called in atomic context, +and thus is illegal to sleep. An example warning that this causes: + +BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1578 +in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd +preempt_count: 2, expected: 0 +CPU: 0 PID: 2 Comm: kthreadd Not tainted 6.9.0-g1d4c6d784ef6 #37 +Hardware name: riscv-virtio,qemu (DT) +Call Trace: +[] dump_backtrace+0x1c/0x24 +[] show_stack+0x2c/0x38 +[] dump_stack_lvl+0x5a/0x72 +[] dump_stack+0x14/0x1c +[] __might_resched+0x104/0x10e +[] __might_sleep+0x3e/0x62 +[] down_write+0x20/0x72 +[] __set_memory+0x82/0x2fa +[] __kernel_map_pages+0x5a/0xd4 +[] __alloc_pages_bulk+0x3b2/0x43a +[] __vmalloc_node_range+0x196/0x6ba +[] copy_process+0x72c/0x17ec +[] kernel_clone+0x60/0x2fe +[] kernel_thread+0x82/0xa0 +[] kthreadd+0x14a/0x1be +[] ret_from_fork+0xe/0x1c + +Rewrite this function with apply_to_existing_page_range(). It is fine to +not have any locking, because __kernel_map_pages() works with pages being +allocated/deallocated and those pages are not changed by anyone else in the +meantime. + +Fixes: 5fde3db5eb02 ("riscv: add ARCH_SUPPORTS_DEBUG_PAGEALLOC support") +Signed-off-by: Nam Cao +Cc: stable@vger.kernel.org +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/1289ecba9606a19917bc12b6c27da8aa23e1e5ae.1715750938.git.namcao@linutronix.de +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/pageattr.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c +index ae63a0227e2fb..ce4b73b4d0e42 100644 +--- a/arch/riscv/mm/pageattr.c ++++ b/arch/riscv/mm/pageattr.c +@@ -185,16 +185,32 @@ int set_direct_map_default_noflush(struct page *page) + } + + #ifdef CONFIG_DEBUG_PAGEALLOC ++static int debug_pagealloc_set_page(pte_t *pte, unsigned long addr, void *data) ++{ ++ int enable = *(int *)data; ++ ++ unsigned long val = pte_val(ptep_get(pte)); ++ ++ if (enable) ++ val |= _PAGE_PRESENT; ++ else ++ val &= ~_PAGE_PRESENT; ++ ++ set_pte(pte, __pte(val)); ++ ++ return 0; ++} ++ + void __kernel_map_pages(struct page *page, int numpages, int enable) + { + if (!debug_pagealloc_enabled()) + return; + +- if (enable) +- __set_memory((unsigned long)page_address(page), numpages, +- __pgprot(_PAGE_PRESENT), __pgprot(0)); +- else +- __set_memory((unsigned long)page_address(page), numpages, +- __pgprot(0), __pgprot(_PAGE_PRESENT)); ++ unsigned long start = (unsigned long)page_address(page); ++ unsigned long size = PAGE_SIZE * numpages; ++ ++ apply_to_existing_page_range(&init_mm, start, size, debug_pagealloc_set_page, &enable); ++ ++ flush_tlb_kernel_range(start, start + size); + } + #endif +-- +2.43.0 + diff --git a/queue-5.10/rtlwifi-rtl8192de-style-clean-ups.patch b/queue-5.10/rtlwifi-rtl8192de-style-clean-ups.patch new file mode 100644 index 00000000000..2d7298f0b72 --- /dev/null +++ b/queue-5.10/rtlwifi-rtl8192de-style-clean-ups.patch @@ -0,0 +1,103 @@ +From 70f9b084e3d05f362789fad368fd80150b6cf2be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 11:22:33 -0800 +Subject: rtlwifi: rtl8192de: Style clean-ups + +From: Kees Cook + +[ Upstream commit 69831173fcbbfebb7aa2d76523deaf0b87b8eddd ] + +Clean up some style issues: +- Use ARRAY_SIZE() even though it's a u8 array. +- Remove redundant CHANNEL_MAX_NUMBER_2G define. +Additionally fix some dead code WARNs. + +Acked-by: Ping-Ke Shih +Link: https://lore.kernel.org/lkml/57d0d1b6064342309f680f692192556c@realtek.com/ +Signed-off-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211119192233.1021063-1-keescook@chromium.org +Stable-dep-of: de4d4be4fa64 ("wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power") +Signed-off-by: Sasha Levin +--- + .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 17 +++++++---------- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 - + 2 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +index af0c7d74b3f5a..da9acebbe237a 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +@@ -892,7 +892,7 @@ static u8 _rtl92c_phy_get_rightchnlplace(u8 chnl) + u8 place = chnl; + + if (chnl > 14) { +- for (place = 14; place < sizeof(channel5g); place++) { ++ for (place = 14; place < ARRAY_SIZE(channel5g); place++) { + if (channel5g[place] == chnl) { + place++; + break; +@@ -1359,7 +1359,7 @@ u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl) + u8 place = chnl; + + if (chnl > 14) { +- for (place = 14; place < sizeof(channel_all); place++) { ++ for (place = 14; place < ARRAY_SIZE(channel_all); place++) { + if (channel_all[place] == chnl) + return place - 13; + } +@@ -2417,7 +2417,7 @@ static bool _rtl92d_is_legal_5g_channel(struct ieee80211_hw *hw, u8 channel) + + int i; + +- for (i = 0; i < sizeof(channel5g); i++) ++ for (i = 0; i < ARRAY_SIZE(channel5g); i++) + if (channel == channel5g[i]) + return true; + return false; +@@ -2681,9 +2681,8 @@ void rtl92d_phy_reset_iqk_result(struct ieee80211_hw *hw) + u8 i; + + rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "settings regs %d default regs %d\n", +- (int)(sizeof(rtlphy->iqk_matrix) / +- sizeof(struct iqk_matrix_regs)), ++ "settings regs %zu default regs %d\n", ++ ARRAY_SIZE(rtlphy->iqk_matrix), + IQK_MATRIX_REG_NUM); + /* 0xe94, 0xe9c, 0xea4, 0xeac, 0xeb4, 0xebc, 0xec4, 0xecc */ + for (i = 0; i < IQK_MATRIX_SETTINGS_NUM; i++) { +@@ -2850,16 +2849,14 @@ u8 rtl92d_phy_sw_chnl(struct ieee80211_hw *hw) + case BAND_ON_5G: + /* Get first channel error when change between + * 5G and 2.4G band. */ +- if (channel <= 14) ++ if (WARN_ONCE(channel <= 14, "rtl8192de: 5G but channel<=14\n")) + return 0; +- WARN_ONCE((channel <= 14), "rtl8192de: 5G but channel<=14\n"); + break; + case BAND_ON_2_4G: + /* Get first channel error when change between + * 5G and 2.4G band. */ +- if (channel > 14) ++ if (WARN_ONCE(channel > 14, "rtl8192de: 2G but channel>14\n")) + return 0; +- WARN_ONCE((channel > 14), "rtl8192de: 2G but channel>14\n"); + break; + default: + WARN_ONCE(true, "rtl8192de: Invalid WirelessMode(%#x)!!\n", +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index a89e232d6963f..c997d8bfda975 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -108,7 +108,6 @@ + #define CHANNEL_GROUP_IDX_5GM 6 + #define CHANNEL_GROUP_IDX_5GH 9 + #define CHANNEL_GROUP_MAX_5G 9 +-#define CHANNEL_MAX_NUMBER_2G 14 + #define AVG_THERMAL_NUM 8 + #define AVG_THERMAL_NUM_88E 4 + #define AVG_THERMAL_NUM_8723BE 4 +-- +2.43.0 + diff --git a/queue-5.10/s390-cpacf-make-use-of-invalid-opcode-produce-a-link.patch b/queue-5.10/s390-cpacf-make-use-of-invalid-opcode-produce-a-link.patch new file mode 100644 index 00000000000..8da7a146ff6 --- /dev/null +++ b/queue-5.10/s390-cpacf-make-use-of-invalid-opcode-produce-a-link.patch @@ -0,0 +1,65 @@ +From dd53b6a67fdd1af2fbfb0333570ef8689f774427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 10:09:32 +0200 +Subject: s390/cpacf: Make use of invalid opcode produce a link error + +From: Harald Freudenberger + +[ Upstream commit 32e8bd6423fc127d2b37bdcf804fd76af3bbec79 ] + +Instead of calling BUG() at runtime introduce and use a prototype for a +non-existing function to produce a link error during compile when a not +supported opcode is used with the __cpacf_query() or __cpacf_check_opcode() +inline functions. + +Suggested-by: Heiko Carstens +Signed-off-by: Harald Freudenberger +Reviewed-by: Holger Dengler +Reviewed-by: Juergen Christ +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/cpacf.h | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/cpacf.h b/arch/s390/include/asm/cpacf.h +index fa31f71cf5746..0f6ff2008a159 100644 +--- a/arch/s390/include/asm/cpacf.h ++++ b/arch/s390/include/asm/cpacf.h +@@ -161,6 +161,13 @@ + + typedef struct { unsigned char bytes[16]; } cpacf_mask_t; + ++/* ++ * Prototype for a not existing function to produce a link ++ * error if __cpacf_query() or __cpacf_check_opcode() is used ++ * with an invalid compile time const opcode. ++ */ ++void __cpacf_bad_opcode(void); ++ + static __always_inline void __cpacf_query_rre(u32 opc, u8 r1, u8 r2, + cpacf_mask_t *mask) + { +@@ -232,7 +239,7 @@ static __always_inline void __cpacf_query(unsigned int opcode, + __cpacf_query_rre(CPACF_PRNO, 2, 4, mask); + break; + default: +- BUG(); ++ __cpacf_bad_opcode(); + } + } + +@@ -257,7 +264,8 @@ static __always_inline int __cpacf_check_opcode(unsigned int opcode) + case CPACF_KMA: + return test_facility(146); /* check for MSA8 */ + default: +- BUG(); ++ __cpacf_bad_opcode(); ++ return 0; + } + } + +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 86518fa4baa..ba178f0f0e4 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -204,3 +204,45 @@ gcov-add-support-for-gcc-14.patch kcov-don-t-lose-track-of-remote-references-during-softirqs.patch i2c-ocores-set-iack-bit-after-core-is-enabled.patch dt-bindings-i2c-google-cros-ec-i2c-tunnel-correct-path-to-i2c-controller-schema.patch +arm-dts-samsung-smdkv310-fix-keypad-no-autorepeat.patch +arm-dts-samsung-exynos4412-origen-fix-keypad-no-auto.patch +arm-dts-samsung-smdk4412-fix-keypad-no-autorepeat.patch +mmc-host-factor-out-clearing-the-retune-state.patch +mmc-core-only-print-retune-error-when-we-don-t-check.patch +mmc-sdhci-change-the-code-to-check-auto_cmd23.patch +mmc-core-capture-emmc-and-sd-card-errors.patch +mmc-sdhci-capture-emmc-and-sd-card-errors.patch +mmc-sdhci-add-support-for-tuning-error-interrupts.patch +rtlwifi-rtl8192de-style-clean-ups.patch +wifi-rtlwifi-rtl8192de-fix-5-ghz-tx-power.patch +pmdomain-ti-sci-fix-duplicate-pd-referrals.patch +knfsd-lookup-can-return-an-illegal-error-value.patch +spmi-hisi-spmi-controller-do-not-override-device-ide.patch +bcache-fix-variable-length-array-abuse-in-btree_iter.patch +s390-cpacf-make-use-of-invalid-opcode-produce-a-link.patch +tracing-add-module_description-to-preemptirq_delay_t.patch +x86-cpu-vfm-add-new-macros-to-work-with-vendor-famil.patch +x86-cpu-fix-x86_match_cpu-to-match-just-x86_vendor_i.patch +drm-amdgpu-update-new-memory-types-in-atomfirmware-h.patch +drm-amdgpu-atomfirmware-add-edp-and-integrated-info-.patch +drm-amdgpu-drop-config_drm_amd_dc_dcn3_01-from-atomf.patch +drm-amdgpu-fix-vram-type-and-bandwidth-error-for-ddr.patch +drm-amdgpu-update-atomfirmware-for-dcn3.1-phy-tuning.patch +drm-amdgpu-atomfirmware-add-intergrated-info-v2.3-ta.patch +mm-introduce-debug_pagealloc_-map-unmap-_pages-helpe.patch +pm-hibernate-make-direct-map-manipulations-more-expl.patch +arch-mm-restore-dependency-of-__kernel_map_pages-on-.patch +riscv-rewrite-__kernel_map_pages-to-fix-sleeping-in-.patch +r8169-remove-unneeded-memory-barrier-in-rtl_tx.patch +r8169-improve-rtl_tx.patch +r8169-improve-rtl8169_start_xmit.patch +r8169-remove-nr_frags-argument-from-rtl_tx_slots_ava.patch +r8169-remove-not-needed-check-in-rtl8169_start_xmit.patch +r8169-fix-possible-ring-buffer-corruption-on-fragmen.patch +revert-kheaders-substituting-sort-in-archive-creatio.patch +kheaders-explicitly-define-file-modes-for-archived-h.patch +perf-core-fix-missing-wakeup-when-waiting-for-contex.patch +pci-add-pci_error_response-and-related-definitions.patch +x86-amd_nb-check-for-invalid-smn-reads.patch +cifs-missed-ref-counting-smb-session-in-find.patch +smb-client-fix-deadlock-in-smb2_find_smb_tcon.patch diff --git a/queue-5.10/smb-client-fix-deadlock-in-smb2_find_smb_tcon.patch b/queue-5.10/smb-client-fix-deadlock-in-smb2_find_smb_tcon.patch new file mode 100644 index 00000000000..d6cf410e9e6 --- /dev/null +++ b/queue-5.10/smb-client-fix-deadlock-in-smb2_find_smb_tcon.patch @@ -0,0 +1,39 @@ +From 4b813b47f06cf31e2847a760e9b8346d79c82f12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jun 2024 13:13:13 -0300 +Subject: smb: client: fix deadlock in smb2_find_smb_tcon() + +From: Enzo Matsumiya + +[ Upstream commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 ] + +Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such +deadlock. + +Cc: stable@vger.kernel.org +Signed-off-by: Enzo Matsumiya +Reviewed-by: Shyam Prasad N +Reviewed-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index f40b8de2aeeb3..adb324234b444 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -207,8 +207,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) + } + tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); + if (!tcon) { +- cifs_put_smb_ses(ses); + spin_unlock(&cifs_tcp_ses_lock); ++ cifs_put_smb_ses(ses); + return NULL; + } + spin_unlock(&cifs_tcp_ses_lock); +-- +2.43.0 + diff --git a/queue-5.10/spmi-hisi-spmi-controller-do-not-override-device-ide.patch b/queue-5.10/spmi-hisi-spmi-controller-do-not-override-device-ide.patch new file mode 100644 index 00000000000..b7cff2fd26d --- /dev/null +++ b/queue-5.10/spmi-hisi-spmi-controller-do-not-override-device-ide.patch @@ -0,0 +1,41 @@ +From 6467ad91444ce5d8bb9e2825a19de776254c6cc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 14:07:41 -0700 +Subject: spmi: hisi-spmi-controller: Do not override device identifier + +From: Vamshi Gajjela + +[ Upstream commit eda4923d78d634482227c0b189d9b7ca18824146 ] + +'nr' member of struct spmi_controller, which serves as an identifier +for the controller/bus. This value is a dynamic ID assigned in +spmi_controller_alloc, and overriding it from the driver results in an +ida_free error "ida_free called for id=xx which is not allocated". + +Signed-off-by: Vamshi Gajjela +Fixes: 70f59c90c819 ("staging: spmi: add Hikey 970 SPMI controller driver") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240228185116.1269-1-vamshigajjela@google.com +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20240507210809.3479953-5-sboyd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/hikey9xx/hisi-spmi-controller.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/staging/hikey9xx/hisi-spmi-controller.c b/drivers/staging/hikey9xx/hisi-spmi-controller.c +index 29f226503668d..eee3dcf96ee79 100644 +--- a/drivers/staging/hikey9xx/hisi-spmi-controller.c ++++ b/drivers/staging/hikey9xx/hisi-spmi-controller.c +@@ -303,7 +303,6 @@ static int spmi_controller_probe(struct platform_device *pdev) + + spin_lock_init(&spmi_controller->lock); + +- ctrl->nr = spmi_controller->channel; + ctrl->dev.parent = pdev->dev.parent; + ctrl->dev.of_node = of_node_get(pdev->dev.of_node); + +-- +2.43.0 + diff --git a/queue-5.10/tracing-add-module_description-to-preemptirq_delay_t.patch b/queue-5.10/tracing-add-module_description-to-preemptirq_delay_t.patch new file mode 100644 index 00000000000..2e35485245a --- /dev/null +++ b/queue-5.10/tracing-add-module_description-to-preemptirq_delay_t.patch @@ -0,0 +1,39 @@ +From fd90e721156d4ffff7c693841b22747861fcaf39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2024 15:54:49 -0700 +Subject: tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test + +From: Jeff Johnson + +[ Upstream commit 23748e3e0fbfe471eff5ce439921629f6a427828 ] + +Fix the 'make W=1' warning: + +WARNING: modpost: missing MODULE_DESCRIPTION() in kernel/trace/preemptirq_delay_test.o + +Link: https://lore.kernel.org/linux-trace-kernel/20240518-md-preemptirq_delay_test-v1-1-387d11b30d85@quicinc.com + +Cc: stable@vger.kernel.org +Cc: Mathieu Desnoyers +Fixes: f96e8577da10 ("lib: Add module for testing preemptoff/irqsoff latency tracers") +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Jeff Johnson +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/preemptirq_delay_test.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c +index 312d1a0ca3b60..1a4f2f4249961 100644 +--- a/kernel/trace/preemptirq_delay_test.c ++++ b/kernel/trace/preemptirq_delay_test.c +@@ -201,4 +201,5 @@ static void __exit preemptirq_delay_exit(void) + + module_init(preemptirq_delay_init) + module_exit(preemptirq_delay_exit) ++MODULE_DESCRIPTION("Preempt / IRQ disable delay thread to test latency tracers"); + MODULE_LICENSE("GPL v2"); +-- +2.43.0 + diff --git a/queue-5.10/wifi-rtlwifi-rtl8192de-fix-5-ghz-tx-power.patch b/queue-5.10/wifi-rtlwifi-rtl8192de-fix-5-ghz-tx-power.patch new file mode 100644 index 00000000000..2f23c3995b9 --- /dev/null +++ b/queue-5.10/wifi-rtlwifi-rtl8192de-fix-5-ghz-tx-power.patch @@ -0,0 +1,47 @@ +From 25291a6445861783b1ff057c07d16714ae9c0508 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Apr 2024 21:09:21 +0300 +Subject: wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power + +From: Bitterblue Smith + +[ Upstream commit de4d4be4fa64ed7b4aa1c613061015bd8fa98b24 ] + +Different channels have different TX power settings. rtl8192de is using +the TX power setting from the wrong channel in the 5 GHz band because +_rtl92c_phy_get_rightchnlplace expects an array which includes all the +channel numbers, but it's using an array which includes only the 5 GHz +channel numbers. + +Use the array channel_all (defined in rtl8192de/phy.c) instead of +the incorrect channel5g (defined in core.c). + +Tested only with rtl8192du, which will use the same TX power code. + +Cc: stable@vger.kernel.org +Signed-off-by: Bitterblue Smith +Signed-off-by: Ping-Ke Shih +Link: https://msgid.link/c7653517-cf88-4f57-b79a-8edb0a8b32f0@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +index da9acebbe237a..ffe6d243c7649 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +@@ -892,8 +892,8 @@ static u8 _rtl92c_phy_get_rightchnlplace(u8 chnl) + u8 place = chnl; + + if (chnl > 14) { +- for (place = 14; place < ARRAY_SIZE(channel5g); place++) { +- if (channel5g[place] == chnl) { ++ for (place = 14; place < ARRAY_SIZE(channel_all); place++) { ++ if (channel_all[place] == chnl) { + place++; + break; + } +-- +2.43.0 + diff --git a/queue-5.10/x86-amd_nb-check-for-invalid-smn-reads.patch b/queue-5.10/x86-amd_nb-check-for-invalid-smn-reads.patch new file mode 100644 index 00000000000..68b1aa9523c --- /dev/null +++ b/queue-5.10/x86-amd_nb-check-for-invalid-smn-reads.patch @@ -0,0 +1,64 @@ +From e22e28d0d7242b3c137222a03a548beeb4d142bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 16:42:44 +0000 +Subject: x86/amd_nb: Check for invalid SMN reads + +From: Yazen Ghannam + +[ Upstream commit c625dabbf1c4a8e77e4734014f2fde7aa9071a1f ] + +AMD Zen-based systems use a System Management Network (SMN) that +provides access to implementation-specific registers. + +SMN accesses are done indirectly through an index/data pair in PCI +config space. The PCI config access may fail and return an error code. +This would prevent the "read" value from being updated. + +However, the PCI config access may succeed, but the return value may be +invalid. This is in similar fashion to PCI bad reads, i.e. return all +bits set. + +Most systems will return 0 for SMN addresses that are not accessible. +This is in line with AMD convention that unavailable registers are +Read-as-Zero/Writes-Ignored. + +However, some systems will return a "PCI Error Response" instead. This +value, along with an error code of 0 from the PCI config access, will +confuse callers of the amd_smn_read() function. + +Check for this condition, clear the return value, and set a proper error +code. + +Fixes: ddfe43cdc0da ("x86/amd_nb: Add SMN and Indirect Data Fabric access for AMD Fam17h") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230403164244.471141-1-yazen.ghannam@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/amd_nb.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index 18f6b7c4bd79f..16cd56627574d 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -164,7 +164,14 @@ static int __amd_smn_rw(u16 node, u32 address, u32 *value, bool write) + + int amd_smn_read(u16 node, u32 address, u32 *value) + { +- return __amd_smn_rw(node, address, value, false); ++ int err = __amd_smn_rw(node, address, value, false); ++ ++ if (PCI_POSSIBLE_ERROR(*value)) { ++ err = -ENODEV; ++ *value = 0; ++ } ++ ++ return err; + } + EXPORT_SYMBOL_GPL(amd_smn_read); + +-- +2.43.0 + diff --git a/queue-5.10/x86-cpu-fix-x86_match_cpu-to-match-just-x86_vendor_i.patch b/queue-5.10/x86-cpu-fix-x86_match_cpu-to-match-just-x86_vendor_i.patch new file mode 100644 index 00000000000..abe9ae56bb7 --- /dev/null +++ b/queue-5.10/x86-cpu-fix-x86_match_cpu-to-match-just-x86_vendor_i.patch @@ -0,0 +1,175 @@ +From 7e96ff8a1d96627c5bdc77bb4b8f22e4c4ab5ca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2024 15:45:33 -0700 +Subject: x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL + +From: Tony Luck + +[ Upstream commit 93022482b2948a9a7e9b5a2bb685f2e1cb4c3348 ] + +Code in v6.9 arch/x86/kernel/smpboot.c was changed by commit + + 4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") from: + + static const struct x86_cpu_id intel_cod_cpu[] = { + X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0), /* COD */ + X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0), /* COD */ + X86_MATCH_INTEL_FAM6_MODEL(ANY, 1), /* SNC */ <--- 443 + {} + }; + + static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o) + { + const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu); + +to: + + static const struct x86_cpu_id intel_cod_cpu[] = { + X86_MATCH_VFM(INTEL_HASWELL_X, 0), /* COD */ + X86_MATCH_VFM(INTEL_BROADWELL_X, 0), /* COD */ + X86_MATCH_VFM(INTEL_ANY, 1), /* SNC */ + {} + }; + + static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o) + { + const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu); + +On an Intel CPU with SNC enabled this code previously matched the rule on line +443 to avoid printing messages about insane cache configuration. The new code +did not match any rules. + +Expanding the macros for the intel_cod_cpu[] array shows that the old is +equivalent to: + + static const struct x86_cpu_id intel_cod_cpu[] = { + [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 }, + [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 }, + [2] = { .vendor = 0, .family = 6, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 }, + [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } + } + +while the new code expands to: + + static const struct x86_cpu_id intel_cod_cpu[] = { + [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 }, + [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 }, + [2] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 }, + [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 } + } + +Looking at the code for x86_match_cpu(): + + const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match) + { + const struct x86_cpu_id *m; + struct cpuinfo_x86 *c = &boot_cpu_data; + + for (m = match; + m->vendor | m->family | m->model | m->steppings | m->feature; + m++) { + ... + } + return NULL; + +it is clear that there was no match because the ANY entry in the table (array +index 2) is now the loop termination condition (all of vendor, family, model, +steppings, and feature are zero). + +So this code was working before because the "ANY" check was looking for any +Intel CPU in family 6. But fails now because the family is a wild card. So the +root cause is that x86_match_cpu() has never been able to match on a rule with +just X86_VENDOR_INTEL and all other fields set to wildcards. + +Add a new flags field to struct x86_cpu_id that has a bit set to indicate that +this entry in the array is valid. Update X86_MATCH*() macros to set that bit. +Change the end-marker check in x86_match_cpu() to just check the flags field +for this bit. + +Backporter notes: The commit in Fixes is really the one that is broken: +you can't have m->vendor as part of the loop termination conditional in +x86_match_cpu() because it can happen - as it has happened above +- that that whole conditional is 0 albeit vendor == 0 is a valid case +- X86_VENDOR_INTEL is 0. + +However, the only case where the above happens is the SNC check added by +4db64279bc2b1 so you only need this fix if you have backported that +other commit + + 4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") + +Fixes: 644e9cbbe3fc ("Add driver auto probing for x86 features v4") +Suggested-by: Thomas Gleixner +Suggested-by: Borislav Petkov +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov (AMD) +Cc: # see above +Link: https://lore.kernel.org/r/20240517144312.GBZkdtAOuJZCvxhFbJ@fat_crate.local +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/cpu_device_id.h | 5 +++++ + arch/x86/kernel/cpu/match.c | 4 +--- + include/linux/mod_devicetable.h | 2 ++ + 3 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h +index dd7b9463696f5..e8e3dbe7f1730 100644 +--- a/arch/x86/include/asm/cpu_device_id.h ++++ b/arch/x86/include/asm/cpu_device_id.h +@@ -53,6 +53,9 @@ + #define X86_CENTAUR_FAM6_C7_D 0xd + #define X86_CENTAUR_FAM6_NANO 0xf + ++/* x86_cpu_id::flags */ ++#define X86_CPU_ID_FLAG_ENTRY_VALID BIT(0) ++ + #define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins) + /** + * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching +@@ -79,6 +82,7 @@ + .model = _model, \ + .steppings = _steppings, \ + .feature = _feature, \ ++ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ + .driver_data = (unsigned long) _data \ + } + +@@ -89,6 +93,7 @@ + .model = _model, \ + .steppings = _steppings, \ + .feature = _feature, \ ++ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \ + .driver_data = (unsigned long) _data \ + } + +diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c +index ad6776081e60d..ae71b8ef909c9 100644 +--- a/arch/x86/kernel/cpu/match.c ++++ b/arch/x86/kernel/cpu/match.c +@@ -39,9 +39,7 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match) + const struct x86_cpu_id *m; + struct cpuinfo_x86 *c = &boot_cpu_data; + +- for (m = match; +- m->vendor | m->family | m->model | m->steppings | m->feature; +- m++) { ++ for (m = match; m->flags & X86_CPU_ID_FLAG_ENTRY_VALID; m++) { + if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor) + continue; + if (m->family != X86_FAMILY_ANY && c->x86 != m->family) +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 5b08a473cdba4..18be4459aaf72 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -669,6 +669,8 @@ struct x86_cpu_id { + __u16 model; + __u16 steppings; + __u16 feature; /* bit index */ ++ /* Solely for kernel-internal use: DO NOT EXPORT to userspace! */ ++ __u16 flags; + kernel_ulong_t driver_data; + }; + +-- +2.43.0 + diff --git a/queue-5.10/x86-cpu-vfm-add-new-macros-to-work-with-vendor-famil.patch b/queue-5.10/x86-cpu-vfm-add-new-macros-to-work-with-vendor-famil.patch new file mode 100644 index 00000000000..69571966482 --- /dev/null +++ b/queue-5.10/x86-cpu-vfm-add-new-macros-to-work-with-vendor-famil.patch @@ -0,0 +1,146 @@ +From bc4cc86e41e7006ffb799e8a85872f2845e949d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 14:19:04 -0700 +Subject: x86/cpu/vfm: Add new macros to work with (vendor/family/model) values + +From: Tony Luck + +[ Upstream commit e6dfdc2e89a0adedf455814c91b977d6a584cc88 ] + +To avoid adding a slew of new macros for each new Intel CPU family +switch over from providing CPU model number #defines to a new +scheme that encodes vendor, family, and model in a single number. + + [ bp: s/casted/cast/g ] + +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20240416211941.9369-3-tony.luck@intel.com +Stable-dep-of: 93022482b294 ("x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/cpu_device_id.h | 93 ++++++++++++++++++++++++++++ + 1 file changed, 93 insertions(+) + +diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h +index eb8fcede9e3bf..dd7b9463696f5 100644 +--- a/arch/x86/include/asm/cpu_device_id.h ++++ b/arch/x86/include/asm/cpu_device_id.h +@@ -2,6 +2,39 @@ + #ifndef _ASM_X86_CPU_DEVICE_ID + #define _ASM_X86_CPU_DEVICE_ID + ++/* ++ * Can't use because it generates expressions that ++ * cannot be used in structure initializers. Bitfield construction ++ * here must match the union in struct cpuinfo_86: ++ * union { ++ * struct { ++ * __u8 x86_model; ++ * __u8 x86; ++ * __u8 x86_vendor; ++ * __u8 x86_reserved; ++ * }; ++ * __u32 x86_vfm; ++ * }; ++ */ ++#define VFM_MODEL_BIT 0 ++#define VFM_FAMILY_BIT 8 ++#define VFM_VENDOR_BIT 16 ++#define VFM_RSVD_BIT 24 ++ ++#define VFM_MODEL_MASK GENMASK(VFM_FAMILY_BIT - 1, VFM_MODEL_BIT) ++#define VFM_FAMILY_MASK GENMASK(VFM_VENDOR_BIT - 1, VFM_FAMILY_BIT) ++#define VFM_VENDOR_MASK GENMASK(VFM_RSVD_BIT - 1, VFM_VENDOR_BIT) ++ ++#define VFM_MODEL(vfm) (((vfm) & VFM_MODEL_MASK) >> VFM_MODEL_BIT) ++#define VFM_FAMILY(vfm) (((vfm) & VFM_FAMILY_MASK) >> VFM_FAMILY_BIT) ++#define VFM_VENDOR(vfm) (((vfm) & VFM_VENDOR_MASK) >> VFM_VENDOR_BIT) ++ ++#define VFM_MAKE(_vendor, _family, _model) ( \ ++ ((_model) << VFM_MODEL_BIT) | \ ++ ((_family) << VFM_FAMILY_BIT) | \ ++ ((_vendor) << VFM_VENDOR_BIT) \ ++) ++ + /* + * Declare drivers belonging to specific x86 CPUs + * Similar in spirit to pci_device_id and related PCI functions +@@ -49,6 +82,16 @@ + .driver_data = (unsigned long) _data \ + } + ++#define X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \ ++ _steppings, _feature, _data) { \ ++ .vendor = _vendor, \ ++ .family = _family, \ ++ .model = _model, \ ++ .steppings = _steppings, \ ++ .feature = _feature, \ ++ .driver_data = (unsigned long) _data \ ++} ++ + /** + * X86_MATCH_VENDOR_FAM_MODEL_FEATURE - Macro for CPU matching + * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY +@@ -164,6 +207,56 @@ + X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, INTEL_FAM6_##model, \ + steppings, X86_FEATURE_ANY, data) + ++/** ++ * X86_MATCH_VFM - Match encoded vendor/family/model ++ * @vfm: Encoded 8-bits each for vendor, family, model ++ * @data: Driver specific data or NULL. The internal storage ++ * format is unsigned long. The supplied value, pointer ++ * etc. is cast to unsigned long internally. ++ * ++ * Stepping and feature are set to wildcards ++ */ ++#define X86_MATCH_VFM(vfm, data) \ ++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ ++ VFM_VENDOR(vfm), \ ++ VFM_FAMILY(vfm), \ ++ VFM_MODEL(vfm), \ ++ X86_STEPPING_ANY, X86_FEATURE_ANY, data) ++ ++/** ++ * X86_MATCH_VFM_STEPPINGS - Match encoded vendor/family/model/stepping ++ * @vfm: Encoded 8-bits each for vendor, family, model ++ * @steppings: Bitmask of steppings to match ++ * @data: Driver specific data or NULL. The internal storage ++ * format is unsigned long. The supplied value, pointer ++ * etc. is cast to unsigned long internally. ++ * ++ * feature is set to wildcard ++ */ ++#define X86_MATCH_VFM_STEPPINGS(vfm, steppings, data) \ ++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ ++ VFM_VENDOR(vfm), \ ++ VFM_FAMILY(vfm), \ ++ VFM_MODEL(vfm), \ ++ steppings, X86_FEATURE_ANY, data) ++ ++/** ++ * X86_MATCH_VFM_FEATURE - Match encoded vendor/family/model/feature ++ * @vfm: Encoded 8-bits each for vendor, family, model ++ * @feature: A X86_FEATURE bit ++ * @data: Driver specific data or NULL. The internal storage ++ * format is unsigned long. The supplied value, pointer ++ * etc. is cast to unsigned long internally. ++ * ++ * Steppings is set to wildcard ++ */ ++#define X86_MATCH_VFM_FEATURE(vfm, feature, data) \ ++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \ ++ VFM_VENDOR(vfm), \ ++ VFM_FAMILY(vfm), \ ++ VFM_MODEL(vfm), \ ++ X86_STEPPING_ANY, feature, data) ++ + /* + * Match specific microcode revisions. + * +-- +2.43.0 +