From 8712d2aba7c233f6202485f60fbe7e7d747f390d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 6 Sep 2023 20:08:03 -0400 Subject: [PATCH] Fixes for 6.4 Signed-off-by: Sasha Levin --- ...likely-null-pointer-deref-in-handle_.patch | 46 +++ ...ure-offs-is-initialized-in-zc_reques.patch | 43 +++ ...09-support-new-dell-dolphin-variants.patch | 37 ++ ...dd-quirk-for-microsoft-modern-wirele.patch | 85 ++++ ...update-for-native-dsd-support-quirks.patch | 136 +++++++ ...-integrator-fix-pci-bus-dtc-warnings.patch | 41 ++ ...ip-correct-wifi-interrupt-flag-in-bo.patch | 41 ++ ...ip-correct-wifi-interrupt-flag-in-ea.patch | 41 ++ ...ip-correct-wifi-interrupt-flag-in-ro.patch | 42 ++ ...he-8k-sample-parameter-in-i2sc-maste.patch | 46 +++ .../asoc-codecs-es8316-fix-dmic-config.patch | 36 ++ ...asoc-cs35l56-add-an-acpi-match-table.patch | 73 ++++ ...k-for-failure-reading-aad-irq-events.patch | 51 +++ ...lush-pending-aad-irq-when-suspending.patch | 77 ++++ ...-dmi-quirk-mechanism-for-active-high.patch | 99 +++++ ...c-rt1308-sdw-fix-random-louder-sound.patch | 69 ++++ ...fix-for-jd-event-handling-in-clockst.patch | 46 +++ ...or-jd-event-handling-in-clockstop-mo.patch | 46 +++ ...fix-for-jd-event-handling-in-clockst.patch | 48 +++ ...fix-for-jd-event-handling-in-clockst.patch | 48 +++ ...cf-use-dev_err_probe-instead-dev_err.patch | 40 ++ ...om-b44-use-b44_writephy-return-value.patch | 44 +++ ...fs-fix-charset-issue-in-reconnection.patch | 120 ++++++ ...ake-common_clk_fixed_mmio-depend-on-.patch | 52 +++ ...exit-idle-optimizations-before-attem.patch | 45 +++ ...guard-dcn31-phyd32clk-logic-against-.patch | 43 +++ ...-fix-temperature-unit-of-smu-v13.0.6.patch | 49 +++ ...averagegfxclkfrequency-to-replace-pr.patch | 37 ++ ...atch-against-exact-bootloader-status.patch | 53 +++ ...-fix-return-value-check-in-atl1c_tso.patch | 42 ++ ...-do-not-check-0-for-platform_get_irq.patch | 42 ++ ...make-load_nls-take-a-const-parameter.patch | 66 ++++ ...rence-leaks-when-removing-gpio-chips.patch | 58 +++ ...turn-einval-when-i2c-peripheral-clk-.patch | 43 +++ ...fsl_edma-and-intel_idma64-depends-on.patch | 58 +++ ...hibit-probing-on-cfi-preamble-symbol.patch | 56 +++ ...x-out-of-bounds-in-init_smb2_rsp_hdr.patch | 107 ++++++ ...ix-out-of-bounds-in-smb3_decrypt_req.patch | 37 ++ ...signed-expression-compared-with-zero.patch | 52 +++ ...ksmbd-no-response-from-compound-read.patch | 41 ++ ...ession-id-and-tree-id-in-compound-re.patch | 72 ++++ ...dline_extend-and-cmdline_bootloader-.patch | 54 +++ ...iddle-with-checkflags-if-need-compil.patch | 51 +++ .../m68k-fix-invalid-.section-syntax.patch | 100 +++++ .../media-amphion-use-dev_err_probe.patch | 44 +++ ...upport-to-assign-slot-for-encoder-de.patch | 363 ++++++++++++++++++ ...5-fix-error-handling-for-cx23885-ats.patch | 63 +++ ...ulse8-cec-handle-possible-ping-error.patch | 42 ++ ...ta-races-around-sk-sk_-rcv-snd-timeo.patch | 116 ++++++ ...p-ksz9477-register-regmap-alignment-.patch | 117 ++++++ ...et-hns3-add-tm-flush-when-setting-tm.patch | 234 +++++++++++ ...-user-pause-configure-when-disable-a.patch | 70 ++++ ...00g-25g-active-optical-cables-in-sfp.patch | 65 ++++ ...net-usb-qmi_wwan-add-quectel-em05gv2.patch | 64 +++ ...eevaluate-the-file-signature-for-ima.patch | 44 +++ ...-drm-amd-display-fix-possible-underf.patch | 46 +++ ...mto-v2-use-qcom_snps_hsphy_suspend-r.patch | 48 +++ ...x-fix-mlxbf-tmfifo-not-handling-all-.patch | 40 ++ ...-pmf-fix-unsigned-comparison-with-le.patch | 44 +++ ...s-wmi-fix-setting-rgb-mode-on-some-t.patch | 56 +++ ...wei-wmi-silence-ambient-light-sensor.patch | 55 +++ ...el-hid-add-hp-dragonfly-g2-to-vgbs-d.patch | 51 +++ ...tel-hid-always-call-btnl-acpi-method.patch | 73 ++++ ...nk-lmi-use-kfree_sensitive-instead-o.patch | 43 +++ ...-use-early_-io-variants-in-via_calib.patch | 69 ++++ ...d-extack-warning-when-enabling-stp-i.patch | 67 ++++ ...k-silence-false-positive-wno-danglin.patch | 42 ++ ...hanging-device-after-request-requeue.patch | 222 +++++++++++ ...rrect-number-of-retries-for-erp-requ.patch | 45 +++ ...pfc-remove-reftag-check-in-dif-paths.patch | 108 ++++++ ...tential-deadlock-on-qedi_percpu-p_wo.patch | 67 ++++ ...rform-capable-check-only-on-privileg.patch | 66 ++++ queue-6.4/series | 85 ++++ ...i9341-use-macro-fbtft_register_spi_d.patch | 36 ++ ...stify-params-in-thermal_zone_device_.patch | 82 ++++ ...e-pipe_cpumask-to-avoid-race-on-trac.patch | 211 ++++++++++ ...t-default-number-of-queues-when-mq-i.patch | 50 +++ ...-fix-alignment-handling-with-windows.patch | 343 +++++++++++++++++ ...-if-the-config-changed-before-fake-o.patch | 79 ++++ ...rt-most-offline_and_remove_memory-er.patch | 49 +++ ...retrying-on-offline_and_remove_memor.patch | 183 +++++++++ ...e-unsafe-unplug-in-big-block-mode-bb.patch | 124 ++++++ ...x-wrong-python-syntax-for-integer-va.patch | 52 +++ ...buffer-overflow-when-scanning-with-e.patch | 56 +++ ...x-field-spanning-write-in-brcmf_scan.patch | 66 ++++ ...oop-functions-to-x86_init-mpparse-fu.patch | 51 +++ 86 files changed, 6344 insertions(+) create mode 100644 queue-6.4/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch create mode 100644 queue-6.4/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch create mode 100644 queue-6.4/alsa-hda-cs8409-support-new-dell-dolphin-variants.patch create mode 100644 queue-6.4/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch create mode 100644 queue-6.4/alsa-usb-audio-update-for-native-dsd-support-quirks.patch create mode 100644 queue-6.4/arm-dts-integrator-fix-pci-bus-dtc-warnings.patch create mode 100644 queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-bo.patch create mode 100644 queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ea.patch create mode 100644 queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ro.patch create mode 100644 queue-6.4/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch create mode 100644 queue-6.4/asoc-codecs-es8316-fix-dmic-config.patch create mode 100644 queue-6.4/asoc-cs35l56-add-an-acpi-match-table.patch create mode 100644 queue-6.4/asoc-da7219-check-for-failure-reading-aad-irq-events.patch create mode 100644 queue-6.4/asoc-da7219-flush-pending-aad-irq-when-suspending.patch create mode 100644 queue-6.4/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch create mode 100644 queue-6.4/asoc-rt1308-sdw-fix-random-louder-sound.patch create mode 100644 queue-6.4/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch create mode 100644 queue-6.4/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch create mode 100644 queue-6.4/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch create mode 100644 queue-6.4/asoc-rt712-sdca-fix-for-jd-event-handling-in-clockst.patch create mode 100644 queue-6.4/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch create mode 100644 queue-6.4/broadcom-b44-use-b44_writephy-return-value.patch create mode 100644 queue-6.4/cifs-fix-charset-issue-in-reconnection.patch create mode 100644 queue-6.4/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch create mode 100644 queue-6.4/drm-amd-display-exit-idle-optimizations-before-attem.patch create mode 100644 queue-6.4/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch create mode 100644 queue-6.4/drm-amd-pm-fix-temperature-unit-of-smu-v13.0.6.patch create mode 100644 queue-6.4/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch create mode 100644 queue-6.4/drm-amdgpu-match-against-exact-bootloader-status.patch create mode 100644 queue-6.4/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch create mode 100644 queue-6.4/fbdev-goldfishfb-do-not-check-0-for-platform_get_irq.patch create mode 100644 queue-6.4/fs-nls-make-load_nls-take-a-const-parameter.patch create mode 100644 queue-6.4/gpiolib-fix-reference-leaks-when-removing-gpio-chips.patch create mode 100644 queue-6.4/i2c-imx-lpi2c-return-einval-when-i2c-peripheral-clk-.patch create mode 100644 queue-6.4/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch create mode 100644 queue-6.4/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch create mode 100644 queue-6.4/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch create mode 100644 queue-6.4/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch create mode 100644 queue-6.4/ksmbd-fix-unsigned-expression-compared-with-zero.patch create mode 100644 queue-6.4/ksmbd-no-response-from-compound-read.patch create mode 100644 queue-6.4/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch create mode 100644 queue-6.4/loongarch-fix-cmdline_extend-and-cmdline_bootloader-.patch create mode 100644 queue-6.4/loongarch-only-fiddle-with-checkflags-if-need-compil.patch create mode 100644 queue-6.4/m68k-fix-invalid-.section-syntax.patch create mode 100644 queue-6.4/media-amphion-use-dev_err_probe.patch create mode 100644 queue-6.4/media-imx-jpeg-support-to-assign-slot-for-encoder-de.patch create mode 100644 queue-6.4/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch create mode 100644 queue-6.4/media-pulse8-cec-handle-possible-ping-error.patch create mode 100644 queue-6.4/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch create mode 100644 queue-6.4/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch create mode 100644 queue-6.4/net-hns3-add-tm-flush-when-setting-tm.patch create mode 100644 queue-6.4/net-hns3-restore-user-pause-configure-when-disable-a.patch create mode 100644 queue-6.4/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch create mode 100644 queue-6.4/net-usb-qmi_wwan-add-quectel-em05gv2.patch create mode 100644 queue-6.4/ovl-always-reevaluate-the-file-signature-for-ima.patch create mode 100644 queue-6.4/partially-revert-drm-amd-display-fix-possible-underf.patch create mode 100644 queue-6.4/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch create mode 100644 queue-6.4/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch create mode 100644 queue-6.4/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch create mode 100644 queue-6.4/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch create mode 100644 queue-6.4/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch create mode 100644 queue-6.4/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch create mode 100644 queue-6.4/platform-x86-intel-hid-always-call-btnl-acpi-method.patch create mode 100644 queue-6.4/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch create mode 100644 queue-6.4/powerpc-powermac-use-early_-io-variants-in-via_calib.patch create mode 100644 queue-6.4/revert-bridge-add-extack-warning-when-enabling-stp-i.patch create mode 100644 queue-6.4/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch create mode 100644 queue-6.4/s390-dasd-fix-hanging-device-after-request-requeue.patch create mode 100644 queue-6.4/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch create mode 100644 queue-6.4/scsi-lpfc-remove-reftag-check-in-dif-paths.patch create mode 100644 queue-6.4/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch create mode 100644 queue-6.4/security-keys-perform-capable-check-only-on-privileg.patch create mode 100644 queue-6.4/series create mode 100644 queue-6.4/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch create mode 100644 queue-6.4/thermal-core-constify-params-in-thermal_zone_device_.patch create mode 100644 queue-6.4/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch create mode 100644 queue-6.4/vdpa-mlx5-correct-default-number-of-queues-when-mq-i.patch create mode 100644 queue-6.4/vhost-scsi-fix-alignment-handling-with-windows.patch create mode 100644 queue-6.4/virtio-mem-check-if-the-config-changed-before-fake-o.patch create mode 100644 queue-6.4/virtio-mem-convert-most-offline_and_remove_memory-er.patch create mode 100644 queue-6.4/virtio-mem-keep-retrying-on-offline_and_remove_memor.patch create mode 100644 queue-6.4/virtio-mem-remove-unsafe-unplug-in-big-block-mode-bb.patch create mode 100644 queue-6.4/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch create mode 100644 queue-6.4/wifi-ath12k-fix-buffer-overflow-when-scanning-with-e.patch create mode 100644 queue-6.4/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch create mode 100644 queue-6.4/x86-hyperv-add-noop-functions-to-x86_init-mpparse-fu.patch diff --git a/queue-6.4/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch b/queue-6.4/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch new file mode 100644 index 00000000000..f1591d8211d --- /dev/null +++ b/queue-6.4/9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch @@ -0,0 +1,46 @@ +From de836c5711831f8337ca05cab02505890fb6efc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 16:49:26 +0900 +Subject: 9p: virtio: fix unlikely null pointer deref in handle_rerror + +From: Dominique Martinet + +[ Upstream commit 13ade4ac5c28e8a014fa85278f5a4270b215f906 ] + +handle_rerror can dereference the pages pointer, but it is not +necessarily set for small payloads. +In practice these should be filtered out by the size check, but +might as well double-check explicitly. + +This fixes the following scan-build warnings: +net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer [core.NullDereference] + memcpy_from_page(to, *pages++, offs, n); + ^~~~~~~~ +net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded from variable 'pages') [core.NullDereference] + memcpy_from_page(to, *pages, offs, size); + ^~~~~~ + +Reviewed-by: Simon Horman +Signed-off-by: Dominique Martinet +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + net/9p/trans_virtio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 3c27ffb781e3e..2c9495ccda6ba 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -384,7 +384,7 @@ static void handle_rerror(struct p9_req_t *req, int in_hdr_len, + void *to = req->rc.sdata + in_hdr_len; + + // Fits entirely into the static data? Nothing to do. +- if (req->rc.size < in_hdr_len) ++ if (req->rc.size < in_hdr_len || !pages) + return; + + // Really long error message? Tough, truncate the reply. Might get +-- +2.40.1 + diff --git a/queue-6.4/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch b/queue-6.4/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch new file mode 100644 index 00000000000..a1cb06252ec --- /dev/null +++ b/queue-6.4/9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch @@ -0,0 +1,43 @@ +From 0945a0d8d9dc0a841169fa021b960cb58bda56e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 16:49:27 +0900 +Subject: 9p: virtio: make sure 'offs' is initialized in zc_request + +From: Dominique Martinet + +[ Upstream commit 4a73edab69d3a6623f03817fe950a2d9585f80e4 ] + +Similarly to the previous patch: offs can be used in handle_rerrors +without initializing on small payloads; in this case handle_rerrors will +not use it because of the size check, but it doesn't hurt to make sure +it is zero to please scan-build. + +This fixes the following warning: +net/9p/trans_virtio.c:539:3: warning: 3rd function call argument is an uninitialized value [core.CallAndMessage] + handle_rerror(req, in_hdr_len, offs, in_pages); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Reviewed-by: Simon Horman +Signed-off-by: Dominique Martinet +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + net/9p/trans_virtio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index 2c9495ccda6ba..f3f6782894239 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -428,7 +428,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req, + struct page **in_pages = NULL, **out_pages = NULL; + struct virtio_chan *chan = client->trans; + struct scatterlist *sgs[4]; +- size_t offs; ++ size_t offs = 0; + int need_drop = 0; + int kicked = 0; + +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-cs8409-support-new-dell-dolphin-variants.patch b/queue-6.4/alsa-hda-cs8409-support-new-dell-dolphin-variants.patch new file mode 100644 index 00000000000..fd4684eae39 --- /dev/null +++ b/queue-6.4/alsa-hda-cs8409-support-new-dell-dolphin-variants.patch @@ -0,0 +1,37 @@ +From 43b93f212f529c0912766d03544025ed4524b7c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 13:30:44 +0100 +Subject: ALSA: hda/cs8409: Support new Dell Dolphin Variants + +From: Stefan Binding + +[ Upstream commit 7c761166399bedfc89c928bef8015546d85a9099 ] + +Add 4 new Dell Dolphin Systems, same configuration as older systems. + +Signed-off-by: Stefan Binding +Link: https://lore.kernel.org/r/20230811123044.1045651-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_cs8409-tables.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/patch_cs8409-tables.c b/sound/pci/hda/patch_cs8409-tables.c +index b288874e401e5..36b411d1a9609 100644 +--- a/sound/pci/hda/patch_cs8409-tables.c ++++ b/sound/pci/hda/patch_cs8409-tables.c +@@ -550,6 +550,10 @@ const struct snd_pci_quirk cs8409_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0C50, "Dolphin", CS8409_DOLPHIN), + SND_PCI_QUIRK(0x1028, 0x0C51, "Dolphin", CS8409_DOLPHIN), + SND_PCI_QUIRK(0x1028, 0x0C52, "Dolphin", CS8409_DOLPHIN), ++ SND_PCI_QUIRK(0x1028, 0x0C73, "Dolphin", CS8409_DOLPHIN), ++ SND_PCI_QUIRK(0x1028, 0x0C75, "Dolphin", CS8409_DOLPHIN), ++ SND_PCI_QUIRK(0x1028, 0x0C7D, "Dolphin", CS8409_DOLPHIN), ++ SND_PCI_QUIRK(0x1028, 0x0C7F, "Dolphin", CS8409_DOLPHIN), + {} /* terminator */ + }; + +-- +2.40.1 + diff --git a/queue-6.4/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch b/queue-6.4/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch new file mode 100644 index 00000000000..642f5bf6c0e --- /dev/null +++ b/queue-6.4/alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch @@ -0,0 +1,85 @@ +From 16a64d36efa3efd17bf5ac8edd56827675614e92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 11:20:57 +0200 +Subject: ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset + +From: Takashi Iwai + +[ Upstream commit 3da435063777f8d861ba5a165344e3f75f839357 ] + +Microsoft Modern Wireless Headset (appearing on the host as "Microsoft +USB Link") has a playback and a capture mixer volume/switch, but they +are fairly broken. The descriptor reports wrong dB ranges for +playback, and the capture volume/switch don't influence on the actual +recording at all. Moreover, there seem instabilities in the +connection, and at best, we should disable the runtime PM. + +So this ended up with a quirk entry for: +- Correct the playback dB range; + I picked up some reasonable values but it's a guess work +- Disable the capture mixer; + it's completely useless and confuses PA/PW +- Suppress get-sample-rate, apply the delay for message handling, + and suppress the auto-suspend + +The behavior of the wheel control on the headset is somehow flaky, +too, but it's an issue of HID. + +Link: https://bugzilla.suse.com/show_bug.cgi?id=1207129 +Link: https://lore.kernel.org/r/20230725092057.15115-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_maps.c | 14 ++++++++++++++ + sound/usb/quirks.c | 3 +++ + 2 files changed, 17 insertions(+) + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index f4bd1e8ae4b6c..23260aa1919d3 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -374,6 +374,15 @@ static const struct usbmix_name_map corsair_virtuoso_map[] = { + { 0 } + }; + ++/* Microsoft USB Link headset */ ++/* a guess work: raw playback volume values are from 2 to 129 */ ++static const struct usbmix_dB_map ms_usb_link_dB = { -3225, 0, true }; ++static const struct usbmix_name_map ms_usb_link_map[] = { ++ { 9, NULL, .dB = &ms_usb_link_dB }, ++ { 10, NULL }, /* Headset Capture volume; seems non-working, disabled */ ++ { 0 } /* terminator */ ++}; ++ + /* ASUS ROG Zenith II with Realtek ALC1220-VB */ + static const struct usbmix_name_map asus_zenith_ii_map[] = { + { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */ +@@ -668,6 +677,11 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x1395, 0x0025), + .map = sennheiser_pc8_map, + }, ++ { ++ /* Microsoft USB Link headset */ ++ .id = USB_ID(0x045e, 0x083c), ++ .map = ms_usb_link_map, ++ }, + { 0 } /* terminator */ + }; + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 6cf55b7f7a041..d4a7ffef82194 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2011,6 +2011,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x045e, 0x083c, /* MS USB Link headset */ ++ QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY | ++ QUIRK_FLAG_DISABLE_AUTOSUSPEND), + DEVICE_FLG(0x046d, 0x084c, /* Logitech ConferenceCam Connect */ + QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x046d, 0x0991, /* Logitech QuickCam Pro */ +-- +2.40.1 + diff --git a/queue-6.4/alsa-usb-audio-update-for-native-dsd-support-quirks.patch b/queue-6.4/alsa-usb-audio-update-for-native-dsd-support-quirks.patch new file mode 100644 index 00000000000..33bc5454141 --- /dev/null +++ b/queue-6.4/alsa-usb-audio-update-for-native-dsd-support-quirks.patch @@ -0,0 +1,136 @@ +From a237b04ded29d123618e95a39fbb962631875e53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 19:56:45 +0300 +Subject: ALSA: usb-audio: Update for native DSD support quirks + +From: Jussi Laako + +[ Upstream commit f7fea075edfa085c25eb34c44ceacf3602537f98 ] + +Maintenance patch for native DSD support. + +Remove incorrect T+A device quirks. Move set of device quirks to vendor +quirks. Add set of missing device and vendor quirks. + +Signed-off-by: Jussi Laako +Link: https://lore.kernel.org/r/20230726165645.404311-1-jussi@sonarnerd.net +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index d4a7ffef82194..4667d543f7481 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1874,8 +1874,10 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + + /* XMOS based USB DACs */ + switch (chip->usb_id) { +- case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */ +- case USB_ID(0x21ed, 0xd75a): /* Accuphase DAC-60 option card */ ++ case USB_ID(0x139f, 0x5504): /* Nagra DAC */ ++ case USB_ID(0x20b1, 0x3089): /* Mola-Mola DAC */ ++ case USB_ID(0x2522, 0x0007): /* LH Labs Geek Out 1V5 */ ++ case USB_ID(0x2522, 0x0009): /* LH Labs Geek Pulse X Inifinity 2V0 */ + case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */ + case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ + if (fp->altsetting == 2) +@@ -1885,14 +1887,18 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */ + case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */ + case USB_ID(0x16d0, 0x06b2): /* NuPrime DAC-10 */ +- case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ ++ case USB_ID(0x16d0, 0x06b4): /* NuPrime Audio HD-AVP/AVA */ + case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */ ++ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ ++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ ++ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ + case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */ + case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */ + case USB_ID(0x2622, 0x0041): /* Audiolab M-DAC+ */ ++ case USB_ID(0x278b, 0x5100): /* Rotel RC-1590 */ + case USB_ID(0x27f7, 0x3002): /* W4S DAC-2v2SE */ + case USB_ID(0x29a2, 0x0086): /* Mutec MC3+ USB */ + case USB_ID(0x6b42, 0x0042): /* MSB Technology */ +@@ -1902,9 +1908,6 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + + /* Amanero Combo384 USB based DACs with native DSD support */ + case USB_ID(0x16d0, 0x071a): /* Amanero - Combo384 */ +- case USB_ID(0x2ab6, 0x0004): /* T+A DAC8DSD-V2.0, MP1000E-V2.0, MP2000R-V2.0, MP2500R-V2.0, MP3100HV-V2.0 */ +- case USB_ID(0x2ab6, 0x0005): /* T+A USB HD Audio 1 */ +- case USB_ID(0x2ab6, 0x0006): /* T+A USB HD Audio 2 */ + if (fp->altsetting == 2) { + switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) { + case 0x199: +@@ -2049,6 +2052,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x0644, 0x805f, /* TEAC Model 12 */ + QUIRK_FLAG_FORCE_IFACE_RESET), ++ DEVICE_FLG(0x0644, 0x806b, /* TEAC UD-701 */ ++ QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY | ++ QUIRK_FLAG_IFACE_DELAY), + DEVICE_FLG(0x06f8, 0xb000, /* Hercules DJ Console (Windows Edition) */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x06f8, 0xd002, /* Hercules DJ Console (Macintosh Edition) */ +@@ -2087,6 +2093,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), + DEVICE_FLG(0x154e, 0x3006, /* Marantz SA-14S1 */ + QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY), ++ DEVICE_FLG(0x154e, 0x300b, /* Marantz SA-KI RUBY / SA-12 */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x154e, 0x500e, /* Denon DN-X1600 */ + QUIRK_FLAG_IGNORE_CLOCK_SOURCE), + DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */ +@@ -2131,6 +2139,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x21b4, 0x0230, /* Ayre QB-9 Twenty */ ++ QUIRK_FLAG_DSD_RAW), ++ DEVICE_FLG(0x21b4, 0x0232, /* Ayre QX-5 Twenty */ ++ QUIRK_FLAG_DSD_RAW), + DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */ + QUIRK_FLAG_SET_IFACE_FIRST), + DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */ +@@ -2173,12 +2185,18 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_VALIDATE_RATES), + VENDOR_FLG(0x1235, /* Focusrite Novation */ + QUIRK_FLAG_VALIDATE_RATES), ++ VENDOR_FLG(0x1511, /* AURALiC */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x152a, /* Thesycon devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x18d1, /* iBasso devices */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x1de7, /* Phoenix Audio */ + QUIRK_FLAG_GET_SAMPLE_RATE), + VENDOR_FLG(0x20b1, /* XMOS based devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x21ed, /* Accuphase Laboratory */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x22d9, /* Oppo */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x23ba, /* Playback Design */ +@@ -2194,10 +2212,14 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x2ab6, /* T+A devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x2d87, /* Cayin device */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3336, /* HEM devices */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3353, /* Khadas devices */ + QUIRK_FLAG_DSD_RAW), ++ VENDOR_FLG(0x35f4, /* MSB Technology */ ++ QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0x3842, /* EVGA */ + QUIRK_FLAG_DSD_RAW), + VENDOR_FLG(0xc502, /* HiBy devices */ +-- +2.40.1 + diff --git a/queue-6.4/arm-dts-integrator-fix-pci-bus-dtc-warnings.patch b/queue-6.4/arm-dts-integrator-fix-pci-bus-dtc-warnings.patch new file mode 100644 index 00000000000..c254e295037 --- /dev/null +++ b/queue-6.4/arm-dts-integrator-fix-pci-bus-dtc-warnings.patch @@ -0,0 +1,41 @@ +From 3ece3c2e888ceda4f8637891ce4f483d27c6cff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 09:00:06 +0200 +Subject: ARM: dts: integrator: fix PCI bus dtc warnings + +From: Lin Yujun + +[ Upstream commit 42ff49a1967af71772b264009659ce181f7d2d2a ] + +An warning is reported when allmodconfig is used to compile the kernel of the ARM architecture: + +arch/arm/boot/dts/arm/integratorap.dts:161.22-206.4: Warning (pci_bridge): /pciv3@62000000: node name is not "pci" or "pcie" + +Change the node name to pci to clear the build warning. + +Signed-off-by: Lin Yujun +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20230811-versatile-dts-v6-6-v1-1-d8cb9d1947ed@linaro.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/integratorap.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/integratorap.dts b/arch/arm/boot/dts/integratorap.dts +index 5b52d75bc6bed..d9927d3181dce 100644 +--- a/arch/arm/boot/dts/integratorap.dts ++++ b/arch/arm/boot/dts/integratorap.dts +@@ -158,7 +158,7 @@ + valid-mask = <0x003fffff>; + }; + +- pci: pciv3@62000000 { ++ pci: pci@62000000 { + compatible = "arm,integrator-ap-pci", "v3,v360epc-pci"; + device_type = "pci"; + #interrupt-cells = <1>; +-- +2.40.1 + diff --git a/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-bo.patch b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-bo.patch new file mode 100644 index 00000000000..822d31e4575 --- /dev/null +++ b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-bo.patch @@ -0,0 +1,41 @@ +From d52ed83d1c209016c90d6be5e3a225daef76250a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 08:33:35 +0200 +Subject: arm64: dts: rockchip: correct wifi interrupt flag in Box Demo + +From: Krzysztof Kozlowski + +[ Upstream commit 2d6f7e3938a7aba154c8e8afaddc8b7f1e0a1b56 ] + +GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. +These are simple defines so they could be used in DTS but they will not +have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. + +Correct the interrupt flags, assuming the author of the code wanted same +logical behavior behind the name "ACTIVE_xxx", this is: + ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230707063335.13317-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +index 410cd3e5e7bca..538db870993d4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-box-demo.dts +@@ -416,7 +416,7 @@ + compatible = "brcm,bcm4329-fmac"; + reg = <1>; + interrupt-parent = <&gpio2>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "host-wake"; + pinctrl-names = "default"; + pinctrl-0 = <&wifi_host_wake_h>; +-- +2.40.1 + diff --git a/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ea.patch b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ea.patch new file mode 100644 index 00000000000..cec50b048d2 --- /dev/null +++ b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ea.patch @@ -0,0 +1,41 @@ +From 3f606b3e73da76c71129df5ed823fddbfce6e38d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 08:33:33 +0200 +Subject: arm64: dts: rockchip: correct wifi interrupt flag in eaidk-610 + +From: Krzysztof Kozlowski + +[ Upstream commit 8183bb7e291b7818f49ea39687c2fafa01a46e27 ] + +GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. +These are simple defines so they could be used in DTS but they will not +have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. + +Correct the interrupt flags, assuming the author of the code wanted same +logical behavior behind the name "ACTIVE_xxx", this is: + ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230707063335.13317-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +index d1f343345f674..6464ef4d113dd 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-eaidk-610.dts +@@ -773,7 +773,7 @@ + compatible = "brcm,bcm4329-fmac"; + reg = <1>; + interrupt-parent = <&gpio0>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "host-wake"; + pinctrl-names = "default"; + pinctrl-0 = <&wifi_host_wake_l>; +-- +2.40.1 + diff --git a/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ro.patch b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ro.patch new file mode 100644 index 00000000000..6801bd617a7 --- /dev/null +++ b/queue-6.4/arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ro.patch @@ -0,0 +1,42 @@ +From 437553d1bffa983e5488069a9514c6efc7650902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 08:33:34 +0200 +Subject: arm64: dts: rockchip: correct wifi interrupt flag in Rock Pi 4B + +From: Krzysztof Kozlowski + +[ Upstream commit cfa12c32b96fd5b12f77d880d6a1ddd2a502756e ] + +GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. +These are simple defines so they could be used in DTS but they will not +have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. + +Correct the interrupt flags, assuming the author of the code wanted same +logical behavior behind the name "ACTIVE_xxx", this is: + ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH + +Signed-off-by: Krzysztof Kozlowski +Tested-by: Christopher Obbard +Link: https://lore.kernel.org/r/20230707063335.13317-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts +index cec3b7b1b9474..8a17c1eaae15e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4b-plus.dts +@@ -31,7 +31,7 @@ + compatible = "brcm,bcm4329-fmac"; + reg = <1>; + interrupt-parent = <&gpio0>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "host-wake"; + pinctrl-names = "default"; + pinctrl-0 = <&wifi_host_wake_l>; +-- +2.40.1 + diff --git a/queue-6.4/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch b/queue-6.4/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch new file mode 100644 index 00000000000..dc0a5e41ca0 --- /dev/null +++ b/queue-6.4/asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch @@ -0,0 +1,46 @@ +From 9a727192f21535b977eb6d997a0d5ab858cc514b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 11:06:20 +0800 +Subject: ASoC: atmel: Fix the 8K sample parameter in I2SC master + +From: Guiting Shen + +[ Upstream commit f85739c0b2b0d98a32f5ca4fcc5501d2b76df4f6 ] + +The 8K sample parameter of 12.288Mhz main system bus clock doesn't work +because the I2SC_MR.IMCKDIV must not be 0 according to the sama5d2 +series datasheet(I2SC Mode Register of Register Summary). + +So use the 6.144Mhz instead of 12.288Mhz to support 8K sample. + +Signed-off-by: Guiting Shen +Link: https://lore.kernel.org/r/20230715030620.62328-1-aarongt.shen@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-i2s.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index 49930baf5e4d6..69a88dc651652 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -163,11 +163,14 @@ struct atmel_i2s_gck_param { + + #define I2S_MCK_12M288 12288000UL + #define I2S_MCK_11M2896 11289600UL ++#define I2S_MCK_6M144 6144000UL + + /* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */ + static const struct atmel_i2s_gck_param gck_params[] = { ++ /* mck = 6.144Mhz */ ++ { 8000, I2S_MCK_6M144, 1, 47}, /* mck = 768 fs */ ++ + /* mck = 12.288MHz */ +- { 8000, I2S_MCK_12M288, 0, 47}, /* mck = 1536 fs */ + { 16000, I2S_MCK_12M288, 1, 47}, /* mck = 768 fs */ + { 24000, I2S_MCK_12M288, 3, 63}, /* mck = 512 fs */ + { 32000, I2S_MCK_12M288, 3, 47}, /* mck = 384 fs */ +-- +2.40.1 + diff --git a/queue-6.4/asoc-codecs-es8316-fix-dmic-config.patch b/queue-6.4/asoc-codecs-es8316-fix-dmic-config.patch new file mode 100644 index 00000000000..3a1b89eb907 --- /dev/null +++ b/queue-6.4/asoc-codecs-es8316-fix-dmic-config.patch @@ -0,0 +1,36 @@ +From 7c00e4f092fbe43be041bdfe102464c5ff3352db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 13:47:22 +0800 +Subject: ASoc: codecs: ES8316: Fix DMIC config + +From: Edgar + +[ Upstream commit d20d35d1ad62c6cca36368c1e8f29335a068659e ] + +According to the datasheet, the DMIC config should +be changed to { 0, 2 ,3 } + +Signed-off-by: Edgar +Link: https://lore.kernel.org/r/20230719054722.401954-1-ljijcj@163.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index ccecfdf700649..9f5522dee501d 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -153,7 +153,7 @@ static const char * const es8316_dmic_txt[] = { + "dmic data at high level", + "dmic data at low level", + }; +-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 }; ++static const unsigned int es8316_dmic_values[] = { 0, 2, 3 }; + static const struct soc_enum es8316_dmic_src_enum = + SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3, + ARRAY_SIZE(es8316_dmic_txt), +-- +2.40.1 + diff --git a/queue-6.4/asoc-cs35l56-add-an-acpi-match-table.patch b/queue-6.4/asoc-cs35l56-add-an-acpi-match-table.patch new file mode 100644 index 00000000000..e8834217db3 --- /dev/null +++ b/queue-6.4/asoc-cs35l56-add-an-acpi-match-table.patch @@ -0,0 +1,73 @@ +From b4ff3e59e0838c1132f9033541676e1796af1aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 12:27:12 +0100 +Subject: ASoC: cs35l56: Add an ACPI match table + +From: Simon Trimmer + +[ Upstream commit e8500a70270334b9abad72fea504ef38a2952274 ] + +An ACPI ID has been allocated for CS35L56 ASoC devices so that they can +be instantiated from ACPI Device entries. + +Signed-off-by: Simon Trimmer +Signed-off-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20230817112712.16637-3-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l56-i2c.c | 9 +++++++++ + sound/soc/codecs/cs35l56-spi.c | 9 +++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/sound/soc/codecs/cs35l56-i2c.c b/sound/soc/codecs/cs35l56-i2c.c +index 295caad262243..c613a2554fa31 100644 +--- a/sound/soc/codecs/cs35l56-i2c.c ++++ b/sound/soc/codecs/cs35l56-i2c.c +@@ -62,10 +62,19 @@ static const struct i2c_device_id cs35l56_id_i2c[] = { + }; + MODULE_DEVICE_TABLE(i2c, cs35l56_id_i2c); + ++#ifdef CONFIG_ACPI ++static const struct acpi_device_id cs35l56_asoc_acpi_match[] = { ++ { "CSC355C", 0 }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(acpi, cs35l56_asoc_acpi_match); ++#endif ++ + static struct i2c_driver cs35l56_i2c_driver = { + .driver = { + .name = "cs35l56", + .pm = &cs35l56_pm_ops_i2c_spi, ++ .acpi_match_table = ACPI_PTR(cs35l56_asoc_acpi_match), + }, + .id_table = cs35l56_id_i2c, + .probe_new = cs35l56_i2c_probe, +diff --git a/sound/soc/codecs/cs35l56-spi.c b/sound/soc/codecs/cs35l56-spi.c +index 996aab10500ee..302f9c47407a4 100644 +--- a/sound/soc/codecs/cs35l56-spi.c ++++ b/sound/soc/codecs/cs35l56-spi.c +@@ -59,10 +59,19 @@ static const struct spi_device_id cs35l56_id_spi[] = { + }; + MODULE_DEVICE_TABLE(spi, cs35l56_id_spi); + ++#ifdef CONFIG_ACPI ++static const struct acpi_device_id cs35l56_asoc_acpi_match[] = { ++ { "CSC355C", 0 }, ++ {}, ++}; ++MODULE_DEVICE_TABLE(acpi, cs35l56_asoc_acpi_match); ++#endif ++ + static struct spi_driver cs35l56_spi_driver = { + .driver = { + .name = "cs35l56", + .pm = &cs35l56_pm_ops_i2c_spi, ++ .acpi_match_table = ACPI_PTR(cs35l56_asoc_acpi_match), + }, + .id_table = cs35l56_id_spi, + .probe = cs35l56_spi_probe, +-- +2.40.1 + diff --git a/queue-6.4/asoc-da7219-check-for-failure-reading-aad-irq-events.patch b/queue-6.4/asoc-da7219-check-for-failure-reading-aad-irq-events.patch new file mode 100644 index 00000000000..47228b7ab58 --- /dev/null +++ b/queue-6.4/asoc-da7219-check-for-failure-reading-aad-irq-events.patch @@ -0,0 +1,51 @@ +From 147896ea7d008bad62f112ced105a101bed6f1c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 21:37:37 +0200 +Subject: ASoC: da7219: Check for failure reading AAD IRQ events + +From: Dmytro Maluka + +[ Upstream commit f0691dc16206f21b13c464434366e2cd632b8ed7 ] + +When handling an AAD interrupt, if IRQ events read failed (for example, +due to i2c "Transfer while suspended" failure, i.e. when attempting to +read it while DA7219 is suspended, which may happen due to a spurious +AAD interrupt), the events array contains garbage uninitialized values. +So instead of trying to interprete those values and doing any actions +based on them (potentially resulting in misbehavior, e.g. reporting +bogus events), refuse to handle the interrupt. + +Signed-off-by: Dmytro Maluka +Link: https://lore.kernel.org/r/20230717193737.161784-3-dmy@semihalf.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 07c5d9d354b6d..70c175744772c 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -361,11 +361,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data) + struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component); + u8 events[DA7219_AAD_IRQ_REG_MAX]; + u8 statusa; +- int i, report = 0, mask = 0; ++ int i, ret, report = 0, mask = 0; + + /* Read current IRQ events */ +- regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, +- events, DA7219_AAD_IRQ_REG_MAX); ++ ret = regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A, ++ events, DA7219_AAD_IRQ_REG_MAX); ++ if (ret) { ++ dev_warn_ratelimited(component->dev, "Failed to read IRQ events: %d\n", ret); ++ return IRQ_NONE; ++ } + + if (!events[DA7219_AAD_IRQ_REG_A] && !events[DA7219_AAD_IRQ_REG_B]) + return IRQ_NONE; +-- +2.40.1 + diff --git a/queue-6.4/asoc-da7219-flush-pending-aad-irq-when-suspending.patch b/queue-6.4/asoc-da7219-flush-pending-aad-irq-when-suspending.patch new file mode 100644 index 00000000000..9e7a36a651d --- /dev/null +++ b/queue-6.4/asoc-da7219-flush-pending-aad-irq-when-suspending.patch @@ -0,0 +1,77 @@ +From 950416fbe8a60dd9097aa55d29bc7980bc0a0073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 21:37:36 +0200 +Subject: ASoC: da7219: Flush pending AAD IRQ when suspending + +From: Dmytro Maluka + +[ Upstream commit 91e292917dad64ab8d1d5ca2ab3069ad9dac6f72 ] + +da7219_aad_suspend() disables jack detection, which should prevent +generating new interrupts by DA7219 while suspended. However, there is a +theoretical possibility that there is a pending interrupt generated just +before suspending DA7219 and not handled yet, so the IRQ handler may +still run after DA7219 is suspended. To prevent that, wait until the +pending IRQ handling is done. + +This patch arose as an attempt to fix the following I2C failure +occurring sometimes during system suspend or resume: + +[ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended +[ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440 +... +[ 355.876462] Call Trace: +[ 355.876468] +[ 355.876475] ? update_load_avg+0x1b3/0x615 +[ 355.876484] __i2c_transfer+0x101/0x1d8 +[ 355.876494] i2c_transfer+0x74/0x10d +[ 355.876504] regmap_i2c_read+0x6a/0x9c +[ 355.876513] _regmap_raw_read+0x179/0x223 +[ 355.876521] regmap_raw_read+0x1e1/0x28e +[ 355.876527] regmap_bulk_read+0x17d/0x1ba +[ 355.876532] ? __wake_up+0xed/0x1bb +[ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184] +[ 355.876556] irq_thread+0x13c/0x231 +[ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f +[ 355.876570] ? irq_thread_fn+0x4d/0x4d +[ 355.876576] kthread+0x13a/0x152 +[ 355.876581] ? synchronize_irq+0xc3/0xc3 +[ 355.876587] ? kthread_blkcg+0x31/0x31 +[ 355.876592] ret_from_fork+0x1f/0x30 +[ 355.876601] + +which indicates that the AAD IRQ handler is unexpectedly running when +DA7219 is suspended, and as a result, is trying to read data from DA7219 +over I2C and is hitting the I2C driver "Transfer while suspended" +failure. + +However, with this patch the above failure is still reproducible. So +this patch does not fix any real observed issue so far, but at least is +useful for confirming that the above issue is not caused by a pending +IRQ but rather looks like a DA7219 hardware issue with an IRQ +unexpectedly generated after jack detection is already disabled. + +Signed-off-by: Dmytro Maluka +Link: https://lore.kernel.org/r/20230717193737.161784-2-dmy@semihalf.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7219-aad.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c +index 993a0d00bc48d..07c5d9d354b6d 100644 +--- a/sound/soc/codecs/da7219-aad.c ++++ b/sound/soc/codecs/da7219-aad.c +@@ -910,6 +910,8 @@ void da7219_aad_suspend(struct snd_soc_component *component) + } + } + } ++ ++ synchronize_irq(da7219_aad->irq); + } + + void da7219_aad_resume(struct snd_soc_component *component) +-- +2.40.1 + diff --git a/queue-6.4/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch b/queue-6.4/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch new file mode 100644 index 00000000000..f6e25a263fa --- /dev/null +++ b/queue-6.4/asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch @@ -0,0 +1,99 @@ +From f058c08cf52e6c3e5ceea0678884613cdbfe20a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 17:02:41 -0300 +Subject: ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect + +From: Edson Juliano Drosdeck + +[ Upstream commit 1bc40efdaf4a0ccfdb10a1c8e4b458f4764e8e5f ] + +Add a quirk mechanism to allow specifying that active-high jack-detection +should be used on platforms where this info is not available in devicetree. + +And add an entry for the Positivo CW14Q01P-V2 to the DMI table, so that +jack-detection will work properly on this laptop. + +Signed-off-by: Edson Juliano Drosdeck +Link: https://lore.kernel.org/r/20230719200241.4865-1-edson.drosdeck@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 41 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 41 insertions(+) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index fee970427a243..42de7588fdb68 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -25,6 +26,13 @@ + #include + #include "nau8821.h" + ++#define NAU8821_JD_ACTIVE_HIGH BIT(0) ++ ++static int nau8821_quirk; ++static int quirk_override = -1; ++module_param_named(quirk, quirk_override, uint, 0444); ++MODULE_PARM_DESC(quirk, "Board-specific quirk override"); ++ + #define NAU_FREF_MAX 13500000 + #define NAU_FVCO_MAX 100000000 + #define NAU_FVCO_MIN 90000000 +@@ -1792,6 +1800,33 @@ static int nau8821_setup_irq(struct nau8821 *nau8821) + return 0; + } + ++/* Please keep this list alphabetically sorted */ ++static const struct dmi_system_id nau8821_quirk_table[] = { ++ { ++ /* Positivo CW14Q01P-V2 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"), ++ DMI_MATCH(DMI_BOARD_NAME, "CW14Q01P-V2"), ++ }, ++ .driver_data = (void *)(NAU8821_JD_ACTIVE_HIGH), ++ }, ++ {} ++}; ++ ++static void nau8821_check_quirks(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ if (quirk_override != -1) { ++ nau8821_quirk = quirk_override; ++ return; ++ } ++ ++ dmi_id = dmi_first_match(nau8821_quirk_table); ++ if (dmi_id) ++ nau8821_quirk = (unsigned long)dmi_id->driver_data; ++} ++ + static int nau8821_i2c_probe(struct i2c_client *i2c) + { + struct device *dev = &i2c->dev; +@@ -1812,6 +1847,12 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + + nau8821->dev = dev; + nau8821->irq = i2c->irq; ++ ++ nau8821_check_quirks(); ++ ++ if (nau8821_quirk & NAU8821_JD_ACTIVE_HIGH) ++ nau8821->jkdet_polarity = 0; ++ + nau8821_print_device_properties(nau8821); + + nau8821_reset_chip(nau8821->regmap); +-- +2.40.1 + diff --git a/queue-6.4/asoc-rt1308-sdw-fix-random-louder-sound.patch b/queue-6.4/asoc-rt1308-sdw-fix-random-louder-sound.patch new file mode 100644 index 00000000000..00c274cd45c --- /dev/null +++ b/queue-6.4/asoc-rt1308-sdw-fix-random-louder-sound.patch @@ -0,0 +1,69 @@ +From 405b5fceaef581ec6f80b7d6e8330bb63b835d50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 17:38:22 +0800 +Subject: ASoC: rt1308-sdw: fix random louder sound + +From: Shuming Fan + +[ Upstream commit 37aba3190891d4de189bd5192ee95220e295f34d ] + +This patch uses a vendor register to check whether the system hibernated ever. +The driver will only set the preset when the driver brings up or the system hibernated. +It will avoid the unknown issue that makes the speaker output louder and can't control the volume. + +Signed-off-by: Shuming Fan +--- + sound/soc/codecs/rt1308-sdw.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt1308-sdw.c b/sound/soc/codecs/rt1308-sdw.c +index 1797af824f60b..e2699c0b117be 100644 +--- a/sound/soc/codecs/rt1308-sdw.c ++++ b/sound/soc/codecs/rt1308-sdw.c +@@ -52,6 +52,7 @@ static bool rt1308_volatile_register(struct device *dev, unsigned int reg) + case 0x300a: + case 0xc000: + case 0xc710: ++ case 0xcf01: + case 0xc860 ... 0xc863: + case 0xc870 ... 0xc873: + return true; +@@ -213,7 +214,7 @@ static int rt1308_io_init(struct device *dev, struct sdw_slave *slave) + { + struct rt1308_sdw_priv *rt1308 = dev_get_drvdata(dev); + int ret = 0; +- unsigned int tmp; ++ unsigned int tmp, hibernation_flag; + + if (rt1308->hw_init) + return 0; +@@ -242,6 +243,10 @@ static int rt1308_io_init(struct device *dev, struct sdw_slave *slave) + + pm_runtime_get_noresume(&slave->dev); + ++ regmap_read(rt1308->regmap, 0xcf01, &hibernation_flag); ++ if ((hibernation_flag != 0x00) && rt1308->first_hw_init) ++ goto _preset_ready_; ++ + /* sw reset */ + regmap_write(rt1308->regmap, RT1308_SDW_RESET, 0); + +@@ -282,6 +287,12 @@ static int rt1308_io_init(struct device *dev, struct sdw_slave *slave) + regmap_write(rt1308->regmap, 0xc100, 0xd7); + regmap_write(rt1308->regmap, 0xc101, 0xd7); + ++ /* apply BQ params */ ++ rt1308_apply_bq_params(rt1308); ++ ++ regmap_write(rt1308->regmap, 0xcf01, 0x01); ++ ++_preset_ready_: + if (rt1308->first_hw_init) { + regcache_cache_bypass(rt1308->regmap, false); + regcache_mark_dirty(rt1308->regmap); +-- +2.40.1 + diff --git a/queue-6.4/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch b/queue-6.4/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch new file mode 100644 index 00000000000..69dbe5a37bd --- /dev/null +++ b/queue-6.4/asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch @@ -0,0 +1,46 @@ +From 56b0504677f04251d16f9af991d20dad3dcc9d0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:06:43 +0800 +Subject: ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit 02fb23d72720df2b6be3f29fc5787ca018eb92c3 ] + +When the system suspends, peripheral Imp-defined interrupt is disabled. +When system level resume is invoked, the peripheral Imp-defined interrupts +should be enabled to handle JD events. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090643.128213-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index 23f17f70d7e9b..9622aaf1b3e63 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -753,8 +753,15 @@ static int __maybe_unused rt5682_dev_resume(struct device *dev) + if (!rt5682->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt5682->disable_irq == true) { ++ mutex_lock(&rt5682->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); ++ rt5682->disable_irq = false; ++ mutex_unlock(&rt5682->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT5682_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.4/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch b/queue-6.4/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch new file mode 100644 index 00000000000..7abb4bcdb5f --- /dev/null +++ b/queue-6.4/asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch @@ -0,0 +1,46 @@ +From 066c49f6583837651457c7023c14188a04befe94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:06:54 +0800 +Subject: ASoC: rt711: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit b69de265bd0e877015a00fbba453ef72af162e0f ] + +When the system suspends, peripheral Imp-defined interrupt is disabled. +When system level resume is invoked, the peripheral Imp-defined interrupts +should be enabled to handle JD events. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090654.128230-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdw.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdw.c b/sound/soc/codecs/rt711-sdw.c +index 4fe68bcf2a7c2..9545b8a7eb192 100644 +--- a/sound/soc/codecs/rt711-sdw.c ++++ b/sound/soc/codecs/rt711-sdw.c +@@ -541,8 +541,15 @@ static int __maybe_unused rt711_dev_resume(struct device *dev) + if (!rt711->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt711->disable_irq == true) { ++ mutex_lock(&rt711->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_INTMASK1, SDW_SCP_INT1_IMPL_DEF); ++ rt711->disable_irq = false; ++ mutex_unlock(&rt711->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT711_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.4/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch b/queue-6.4/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch new file mode 100644 index 00000000000..614a9047b68 --- /dev/null +++ b/queue-6.4/asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch @@ -0,0 +1,48 @@ +From d454185210bee3022d4603e07e84d574f51d3093 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:07:11 +0800 +Subject: ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit 23adeb7056acd4fd866969f4afb91441776cc4f5 ] + +When the system suspends, peripheral SDCA interrupts are disabled. +When system level resume is invoked, the peripheral SDCA interrupts +should be enabled to handle JD events. +Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090711.128247-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdca-sdw.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdca-sdw.c b/sound/soc/codecs/rt711-sdca-sdw.c +index 51f3335343e08..76ed61e47316d 100644 +--- a/sound/soc/codecs/rt711-sdca-sdw.c ++++ b/sound/soc/codecs/rt711-sdca-sdw.c +@@ -441,8 +441,16 @@ static int __maybe_unused rt711_sdca_dev_resume(struct device *dev) + if (!rt711->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt711->disable_irq == true) { ++ mutex_lock(&rt711->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); ++ rt711->disable_irq = false; ++ mutex_unlock(&rt711->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT711_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.4/asoc-rt712-sdca-fix-for-jd-event-handling-in-clockst.patch b/queue-6.4/asoc-rt712-sdca-fix-for-jd-event-handling-in-clockst.patch new file mode 100644 index 00000000000..d7101c1aaad --- /dev/null +++ b/queue-6.4/asoc-rt712-sdca-fix-for-jd-event-handling-in-clockst.patch @@ -0,0 +1,48 @@ +From 872c0bb8a4b4e9c42a728ac7842d7f2abae7488d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:07:21 +0800 +Subject: ASoC: rt712-sdca: fix for JD event handling in ClockStop Mode0 + +From: Shuming Fan + +[ Upstream commit 7a8735c1551e489351172d0da96128f6f8b52b2d ] + +When the system suspends, peripheral SDCA interrupts are disabled. +When system level resume is invoked, the peripheral SDCA interrupts +should be enabled to handle JD events. +Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. + +Signed-off-by: Shuming Fan +Reported-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230721090721.128264-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt712-sdca-sdw.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt712-sdca-sdw.c b/sound/soc/codecs/rt712-sdca-sdw.c +index 3f319459dfec3..1c9e10fea3ddd 100644 +--- a/sound/soc/codecs/rt712-sdca-sdw.c ++++ b/sound/soc/codecs/rt712-sdca-sdw.c +@@ -441,8 +441,16 @@ static int __maybe_unused rt712_sdca_dev_resume(struct device *dev) + if (!rt712->first_hw_init) + return 0; + +- if (!slave->unattach_request) ++ if (!slave->unattach_request) { ++ if (rt712->disable_irq == true) { ++ mutex_lock(&rt712->disable_irq_lock); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK1, SDW_SCP_SDCA_INTMASK_SDCA_0); ++ sdw_write_no_pm(slave, SDW_SCP_SDCA_INTMASK2, SDW_SCP_SDCA_INTMASK_SDCA_8); ++ rt712->disable_irq = false; ++ mutex_unlock(&rt712->disable_irq_lock); ++ } + goto regmap_sync; ++ } + + time = wait_for_completion_timeout(&slave->initialization_complete, + msecs_to_jiffies(RT712_PROBE_TIMEOUT)); +-- +2.40.1 + diff --git a/queue-6.4/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch b/queue-6.4/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch new file mode 100644 index 00000000000..08385bcfb05 --- /dev/null +++ b/queue-6.4/ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch @@ -0,0 +1,40 @@ +From 7bdfa7c72c59e9b5cffe647c2c5bcfe0ad53291f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 11:06:25 +0800 +Subject: ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in + data_xfer() + +From: Minjie Du + +[ Upstream commit 4139f992c49356391fb086c0c8ce51f66c26d623 ] + +It is possible for dma_request_chan() to return EPROBE_DEFER, which +means acdev->host->dev is not ready yet. At this point dev_err() will +have no output. Use dev_err_probe() instead. + +Signed-off-by: Minjie Du +Acked-by: Viresh Kumar +Reviewed-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_arasan_cf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index 6ab294322e792..314eaa1679540 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -529,7 +529,8 @@ static void data_xfer(struct work_struct *work) + /* dma_request_channel may sleep, so calling from process context */ + acdev->dma_chan = dma_request_chan(acdev->host->dev, "data"); + if (IS_ERR(acdev->dma_chan)) { +- dev_err(acdev->host->dev, "Unable to get dma_chan\n"); ++ dev_err_probe(acdev->host->dev, PTR_ERR(acdev->dma_chan), ++ "Unable to get dma_chan\n"); + acdev->dma_chan = NULL; + goto chan_request_fail; + } +-- +2.40.1 + diff --git a/queue-6.4/broadcom-b44-use-b44_writephy-return-value.patch b/queue-6.4/broadcom-b44-use-b44_writephy-return-value.patch new file mode 100644 index 00000000000..8c41c8cf171 --- /dev/null +++ b/queue-6.4/broadcom-b44-use-b44_writephy-return-value.patch @@ -0,0 +1,44 @@ +From 45bcc984409930c3cfd9724fbe9bbead14becb09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Aug 2023 00:00:30 +0300 +Subject: broadcom: b44: Use b44_writephy() return value + +From: Artem Chernyshev + +[ Upstream commit 9944d203fa63721b87eee84a89f7275dc3d25c05 ] + +Return result of b44_writephy() instead of zero to +deal with possible error. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Artem Chernyshev +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/b44.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c +index 392ec09a1d8a6..3e4fb3c3e8342 100644 +--- a/drivers/net/ethernet/broadcom/b44.c ++++ b/drivers/net/ethernet/broadcom/b44.c +@@ -1793,11 +1793,9 @@ static int b44_nway_reset(struct net_device *dev) + b44_readphy(bp, MII_BMCR, &bmcr); + b44_readphy(bp, MII_BMCR, &bmcr); + r = -EINVAL; +- if (bmcr & BMCR_ANENABLE) { +- b44_writephy(bp, MII_BMCR, +- bmcr | BMCR_ANRESTART); +- r = 0; +- } ++ if (bmcr & BMCR_ANENABLE) ++ r = b44_writephy(bp, MII_BMCR, ++ bmcr | BMCR_ANRESTART); + spin_unlock_irq(&bp->lock); + + return r; +-- +2.40.1 + diff --git a/queue-6.4/cifs-fix-charset-issue-in-reconnection.patch b/queue-6.4/cifs-fix-charset-issue-in-reconnection.patch new file mode 100644 index 00000000000..3079dfb55b5 --- /dev/null +++ b/queue-6.4/cifs-fix-charset-issue-in-reconnection.patch @@ -0,0 +1,120 @@ +From a9e9dbe985f5d89ec9d730e139769b6ce3d03015 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 10:10:57 +0800 +Subject: cifs: fix charset issue in reconnection + +From: Winston Wen + +[ Upstream commit a43f95fdd39490f7b156fd126f1e90ec2d5553f1 ] + +We need to specify charset, like "iocharset=utf-8", in mount options for +Chinese path if the nls_default don't support it, such as iso8859-1, the +default value for CONFIG_NLS_DEFAULT. + +But now in reconnection the nls_default is used, instead of the one we +specified and used in mount, and this can lead to mount failure. + +Signed-off-by: Winston Wen +Reviewed-by: Paulo Alcantara +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsglob.h | 1 + + fs/smb/client/cifssmb.c | 3 +-- + fs/smb/client/connect.c | 5 +++++ + fs/smb/client/misc.c | 1 + + fs/smb/client/smb2pdu.c | 3 +-- + 5 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h +index ca2da713c5fe9..87c6ce54c72d0 100644 +--- a/fs/smb/client/cifsglob.h ++++ b/fs/smb/client/cifsglob.h +@@ -1062,6 +1062,7 @@ struct cifs_ses { + unsigned long chans_need_reconnect; + /* ========= end: protected by chan_lock ======== */ + struct cifs_ses *dfs_root_ses; ++ struct nls_table *local_nls; + }; + + static inline bool +diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c +index a0c4e9874b010..a49f95ea7cf6f 100644 +--- a/fs/smb/client/cifssmb.c ++++ b/fs/smb/client/cifssmb.c +@@ -129,7 +129,7 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + } + spin_unlock(&server->srv_lock); + +- nls_codepage = load_nls_default(); ++ nls_codepage = ses->local_nls; + + /* + * need to prevent multiple threads trying to simultaneously +@@ -200,7 +200,6 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + rc = -EAGAIN; + } + +- unload_nls(nls_codepage); + return rc; + } + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index 853209268f507..e965196e4f746 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1837,6 +1837,10 @@ static int match_session(struct cifs_ses *ses, struct smb3_fs_context *ctx) + CIFS_MAX_PASSWORD_LEN)) + return 0; + } ++ ++ if (strcmp(ctx->local_nls->charset, ses->local_nls->charset)) ++ return 0; ++ + return 1; + } + +@@ -2280,6 +2284,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb3_fs_context *ctx) + + ses->sectype = ctx->sectype; + ses->sign = ctx->sign; ++ ses->local_nls = load_nls(ctx->local_nls->charset); + + /* add server as first channel */ + spin_lock(&ses->chan_lock); +diff --git a/fs/smb/client/misc.c b/fs/smb/client/misc.c +index 70dbfe6584f9e..d7e85d9a26553 100644 +--- a/fs/smb/client/misc.c ++++ b/fs/smb/client/misc.c +@@ -95,6 +95,7 @@ sesInfoFree(struct cifs_ses *buf_to_free) + return; + } + ++ unload_nls(buf_to_free->local_nls); + atomic_dec(&sesInfoAllocCount); + kfree(buf_to_free->serverOS); + kfree(buf_to_free->serverDomain); +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index e04766fe6f803..a457f07f820dc 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -242,7 +242,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + } + spin_unlock(&server->srv_lock); + +- nls_codepage = load_nls_default(); ++ nls_codepage = ses->local_nls; + + /* + * need to prevent multiple threads trying to simultaneously +@@ -324,7 +324,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + rc = -EAGAIN; + } + failed: +- unload_nls(nls_codepage); + return rc; + } + +-- +2.40.1 + diff --git a/queue-6.4/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch b/queue-6.4/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch new file mode 100644 index 00000000000..b9197b11693 --- /dev/null +++ b/queue-6.4/clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch @@ -0,0 +1,52 @@ +From 023829b2094e6973c4e76d92c1336e7dfd89b033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 21:58:51 +0800 +Subject: clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM + +From: Baoquan He + +[ Upstream commit e7dd44f4f3166db45248414f5df8f615392de47a ] + +On s390 systems (aka mainframes), it has classic channel devices for +networking and permanent storage that are currently even more common +than PCI devices. Hence it could have a fully functional s390 kernel +with CONFIG_PCI=n, then the relevant iomem mapping functions +[including ioremap(), devm_ioremap(), etc.] are not available. + +Here let COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM so that it won't +be built to cause below compiling error if PCI is unset: + +------ +ld: drivers/clk/clk-fixed-mmio.o: in function `fixed_mmio_clk_setup': +clk-fixed-mmio.c:(.text+0x5e): undefined reference to `of_iomap' +ld: clk-fixed-mmio.c:(.text+0xba): undefined reference to `iounmap' +------ + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ +Signed-off-by: Baoquan He +Cc: Michael Turquette +Cc: Stephen Boyd +Cc: linux-clk@vger.kernel.org +Link: https://lore.kernel.org/r/20230707135852.24292-8-bhe@redhat.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig +index 016814e15536a..52dfbae4f361c 100644 +--- a/drivers/clk/Kconfig ++++ b/drivers/clk/Kconfig +@@ -444,6 +444,7 @@ config COMMON_CLK_BD718XX + config COMMON_CLK_FIXED_MMIO + bool "Clock driver for Memory Mapped Fixed values" + depends on COMMON_CLK && OF ++ depends on HAS_IOMEM + help + Support for Memory Mapped IO Fixed clocks + +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-exit-idle-optimizations-before-attem.patch b/queue-6.4/drm-amd-display-exit-idle-optimizations-before-attem.patch new file mode 100644 index 00000000000..4304f5935e3 --- /dev/null +++ b/queue-6.4/drm-amd-display-exit-idle-optimizations-before-attem.patch @@ -0,0 +1,45 @@ +From 6a12aaab5b7fb93f8217008140ced8505cc399df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jul 2023 16:50:15 -0400 +Subject: drm/amd/display: Exit idle optimizations before attempt to access PHY + +From: Leo Chen + +[ Upstream commit de612738e9771bd66aeb20044486c457c512f684 ] + +[Why & How] +DMUB may hang when powering down pixel clocks due to no dprefclk. + +It is fixed by exiting idle optimization before the attempt to access PHY. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Alex Hung +Signed-off-by: Leo Chen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index 58e8fda04b861..ad28fdd87797f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1795,10 +1795,13 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context) + hws->funcs.edp_backlight_control(edp_link_with_sink, false); + } + /*resume from S3, no vbios posting, no need to power down again*/ ++ clk_mgr_exit_optimized_pwr_state(dc, dc->clk_mgr); ++ + power_down_all_hw_blocks(dc); + disable_vga_and_power_gate_all_controllers(dc); + if (edp_link_with_sink && !keep_edp_vdd_on) + dc->hwss.edp_power_control(edp_link_with_sink, false); ++ clk_mgr_optimize_pwr_state(dc, dc->clk_mgr); + } + bios_set_scratch_acc_mode_change(dc->ctx->dc_bios, 1); + } +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch b/queue-6.4/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch new file mode 100644 index 00000000000..f5cfc320c04 --- /dev/null +++ b/queue-6.4/drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch @@ -0,0 +1,43 @@ +From bbcd061beb76c00ed3f21423764c54e82ef2c3cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 13:22:36 -0400 +Subject: drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family + +From: George Shen + +[ Upstream commit 25b054c3c89cb6a7106a7982f0f70e83d0797dab ] + +[Why] +Current yellow carp B0 PHYD32CLK logic is incorrectly applied to other +ASICs. + +[How] +Add guard to check chip family is yellow carp before applying logic. + +Reviewed-by: Hansen Dsouza +Acked-by: Alex Hung +Signed-off-by: George Shen +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +index 65c1d754e2d6b..01cc679ae4186 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +@@ -84,7 +84,8 @@ static enum phyd32clk_clock_source get_phy_mux_symclk( + struct dcn_dccg *dccg_dcn, + enum phyd32clk_clock_source src) + { +- if (dccg_dcn->base.ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0) { ++ if (dccg_dcn->base.ctx->asic_id.chip_family == FAMILY_YELLOW_CARP && ++ dccg_dcn->base.ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0) { + if (src == PHYD32CLKC) + src = PHYD32CLKF; + if (src == PHYD32CLKD) +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-pm-fix-temperature-unit-of-smu-v13.0.6.patch b/queue-6.4/drm-amd-pm-fix-temperature-unit-of-smu-v13.0.6.patch new file mode 100644 index 00000000000..7cce42580f5 --- /dev/null +++ b/queue-6.4/drm-amd-pm-fix-temperature-unit-of-smu-v13.0.6.patch @@ -0,0 +1,49 @@ +From e9b194df4723422530c129ebc4f1b146e01b1eeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Aug 2023 16:10:03 +0530 +Subject: drm/amd/pm: Fix temperature unit of SMU v13.0.6 + +From: Lijo Lazar + +[ Upstream commit 8d036427f0042a91136e6f19a39542eedec4e96c ] + +Temperature needs to be reported in millidegree Celsius. + +Signed-off-by: Lijo Lazar +Reviewed-by: Yang Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +index c9093517b1bda..bfa020fe0d4fe 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c +@@ -697,16 +697,19 @@ static int smu_v13_0_6_get_smu_metrics_data(struct smu_context *smu, + *value = SMUQ10_TO_UINT(metrics->SocketPower) << 8; + break; + case METRICS_TEMPERATURE_HOTSPOT: +- *value = SMUQ10_TO_UINT(metrics->MaxSocketTemperature); ++ *value = SMUQ10_TO_UINT(metrics->MaxSocketTemperature) * ++ SMU_TEMPERATURE_UNITS_PER_CENTIGRADES; + break; + case METRICS_TEMPERATURE_MEM: +- *value = SMUQ10_TO_UINT(metrics->MaxHbmTemperature); ++ *value = SMUQ10_TO_UINT(metrics->MaxHbmTemperature) * ++ SMU_TEMPERATURE_UNITS_PER_CENTIGRADES; + break; + /* This is the max of all VRs and not just SOC VR. + * No need to define another data type for the same. + */ + case METRICS_TEMPERATURE_VRSOC: +- *value = SMUQ10_TO_UINT(metrics->MaxVrTemperature); ++ *value = SMUQ10_TO_UINT(metrics->MaxVrTemperature) * ++ SMU_TEMPERATURE_UNITS_PER_CENTIGRADES; + break; + case METRICS_THROTTLER_STATUS: + *value = smu_v13_0_6_get_throttler_status(smu, metrics); +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch b/queue-6.4/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch new file mode 100644 index 00000000000..7fe8e6b0ebf --- /dev/null +++ b/queue-6.4/drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch @@ -0,0 +1,37 @@ +From 375d738fcc698f3927c40ab021a0a9de1981be20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 18:08:07 +0800 +Subject: drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr + Clock + +From: Jane Jian + +[ Upstream commit 4a37c55b859a69f429bfa7fab4fc43ee470b60ed ] + +Report current GFX clock also from average clock value as the original +CurrClock data is not valid/accurate any more as per FW team + +Signed-off-by: Jane Jian +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +index d7f09af2fb018..419a247dfbbf2 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +@@ -1323,7 +1323,7 @@ static ssize_t smu_v13_0_0_get_gpu_metrics(struct smu_context *smu, + gpu_metrics->average_vclk1_frequency = metrics->AverageVclk1Frequency; + gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency; + +- gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK]; ++ gpu_metrics->current_gfxclk = gpu_metrics->average_gfxclk_frequency; + gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK]; + gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK]; + gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0]; +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-match-against-exact-bootloader-status.patch b/queue-6.4/drm-amdgpu-match-against-exact-bootloader-status.patch new file mode 100644 index 00000000000..64bcfe8a1e4 --- /dev/null +++ b/queue-6.4/drm-amdgpu-match-against-exact-bootloader-status.patch @@ -0,0 +1,53 @@ +From cdd5b2a3b0743a173bbfedc32ea5f1b37caa236a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 19:11:54 +0530 +Subject: drm/amdgpu: Match against exact bootloader status + +From: Lijo Lazar + +[ Upstream commit d3de41ee5febe5c2d9989fe9810bce2bb54a3a8e ] + +On PSP v13.x ASICs, boot loader will set only the MSB to 1 and clear the +least significant bits for any command submission. Hence match against +the exact register value, otherwise a register value of all 0xFFs also +could falsely indicate that boot loader is ready. Also, from PSP v13.0.6 +and newer, bits[7:0] will be used to indicate command error status. + +Signed-off-by: Lijo Lazar +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +index caee76ab71105..92f2ee412908d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/psp_v13_0.c +@@ -136,14 +136,15 @@ static int psp_v13_0_wait_for_bootloader(struct psp_context *psp) + int ret; + int retry_loop; + ++ /* Wait for bootloader to signify that it is ready having bit 31 of ++ * C2PMSG_35 set to 1. All other bits are expected to be cleared. ++ * If there is an error in processing command, bits[7:0] will be set. ++ * This is applicable for PSP v13.0.6 and newer. ++ */ + for (retry_loop = 0; retry_loop < 10; retry_loop++) { +- /* Wait for bootloader to signify that is +- ready having bit 31 of C2PMSG_35 set to 1 */ +- ret = psp_wait_for(psp, +- SOC15_REG_OFFSET(MP0, 0, regMP0_SMN_C2PMSG_35), +- 0x80000000, +- 0x80000000, +- false); ++ ret = psp_wait_for( ++ psp, SOC15_REG_OFFSET(MP0, 0, regMP0_SMN_C2PMSG_35), ++ 0x80000000, 0xffffffff, false); + + if (ret == 0) + return 0; +-- +2.40.1 + diff --git a/queue-6.4/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch b/queue-6.4/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch new file mode 100644 index 00000000000..2ed292853b1 --- /dev/null +++ b/queue-6.4/ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch @@ -0,0 +1,42 @@ +From d1282a7ff3ffb98246cfce106c9b7bc37a547302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 22:42:08 +0800 +Subject: ethernet: atheros: fix return value check in atl1c_tso_csum() + +From: Yuanjun Gong + +[ Upstream commit 8d01da0a1db237c44c92859ce3612df7af8d3a53 ] + +in atl1c_tso_csum, it should check the return value of pskb_trim(), +and return an error code if an unexpected value is returned +by pskb_trim(). + +Signed-off-by: Yuanjun Gong +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +index 4a288799633f8..940c5d1ff9cfc 100644 +--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c ++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +@@ -2094,8 +2094,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter, + real_len = (((unsigned char *)ip_hdr(skb) - skb->data) + + ntohs(ip_hdr(skb)->tot_len)); + +- if (real_len < skb->len) +- pskb_trim(skb, real_len); ++ if (real_len < skb->len) { ++ err = pskb_trim(skb, real_len); ++ if (err) ++ return err; ++ } + + hdr_len = skb_tcp_all_headers(skb); + if (unlikely(skb->len == hdr_len)) { +-- +2.40.1 + diff --git a/queue-6.4/fbdev-goldfishfb-do-not-check-0-for-platform_get_irq.patch b/queue-6.4/fbdev-goldfishfb-do-not-check-0-for-platform_get_irq.patch new file mode 100644 index 00000000000..4280ebcd6c3 --- /dev/null +++ b/queue-6.4/fbdev-goldfishfb-do-not-check-0-for-platform_get_irq.patch @@ -0,0 +1,42 @@ +From a0f6e418f8f5f3ffb67f51f351b965126aed9adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 15:10:06 +0800 +Subject: fbdev: goldfishfb: Do not check 0 for platform_get_irq() + +From: Zhu Wang + +[ Upstream commit 0650d5098f8b6b232cd5ea0e15437fc38f7d63ba ] + +Since platform_get_irq() never returned zero, so it need not to check +whether it returned zero, and we use the return error code of +platform_get_irq() to replace the current return error code. + +Please refer to the commit a85a6c86c25b ("driver core: platform: Clarify +that IRQ 0 is invalid") to get that platform_get_irq() never returned +zero. + +Signed-off-by: Zhu Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/goldfishfb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 6fa2108fd912d..e41c9fef4a3b6 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -203,8 +203,8 @@ static int goldfish_fb_probe(struct platform_device *pdev) + } + + fb->irq = platform_get_irq(pdev, 0); +- if (fb->irq <= 0) { +- ret = -ENODEV; ++ if (fb->irq < 0) { ++ ret = fb->irq; + goto err_no_irq; + } + +-- +2.40.1 + diff --git a/queue-6.4/fs-nls-make-load_nls-take-a-const-parameter.patch b/queue-6.4/fs-nls-make-load_nls-take-a-const-parameter.patch new file mode 100644 index 00000000000..d6ca653d034 --- /dev/null +++ b/queue-6.4/fs-nls-make-load_nls-take-a-const-parameter.patch @@ -0,0 +1,66 @@ +From cddf12c3fe57b36261324d8d03aca7ca943cdcc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 10:10:56 +0800 +Subject: fs/nls: make load_nls() take a const parameter + +From: Winston Wen + +[ Upstream commit c1ed39ec116272935528ca9b348b8ee79b0791da ] + +load_nls() take a char * parameter, use it to find nls module in list or +construct the module name to load it. + +This change make load_nls() take a const parameter, so we don't need do +some cast like this: + + ses->local_nls = load_nls((char *)ctx->local_nls->charset); + +Suggested-by: Stephen Rothwell +Signed-off-by: Winston Wen +Reviewed-by: Paulo Alcantara +Reviewed-by: Christian Brauner +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/nls/nls_base.c | 4 ++-- + include/linux/nls.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c +index 52ccd34b1e792..a026dbd3593f6 100644 +--- a/fs/nls/nls_base.c ++++ b/fs/nls/nls_base.c +@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls) + return -EINVAL; + } + +-static struct nls_table *find_nls(char *charset) ++static struct nls_table *find_nls(const char *charset) + { + struct nls_table *nls; + spin_lock(&nls_lock); +@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset) + return nls; + } + +-struct nls_table *load_nls(char *charset) ++struct nls_table *load_nls(const char *charset) + { + return try_then_request_module(find_nls(charset), "nls_%s", charset); + } +diff --git a/include/linux/nls.h b/include/linux/nls.h +index 499e486b3722d..e0bf8367b274a 100644 +--- a/include/linux/nls.h ++++ b/include/linux/nls.h +@@ -47,7 +47,7 @@ enum utf16_endian { + /* nls_base.c */ + extern int __register_nls(struct nls_table *, struct module *); + extern int unregister_nls(struct nls_table *); +-extern struct nls_table *load_nls(char *); ++extern struct nls_table *load_nls(const char *charset); + extern void unload_nls(struct nls_table *); + extern struct nls_table *load_nls_default(void); + #define register_nls(nls) __register_nls((nls), THIS_MODULE) +-- +2.40.1 + diff --git a/queue-6.4/gpiolib-fix-reference-leaks-when-removing-gpio-chips.patch b/queue-6.4/gpiolib-fix-reference-leaks-when-removing-gpio-chips.patch new file mode 100644 index 00000000000..97b200c26a7 --- /dev/null +++ b/queue-6.4/gpiolib-fix-reference-leaks-when-removing-gpio-chips.patch @@ -0,0 +1,58 @@ +From 2164bc23dc60d2b11bc4d5872d0fbca2d4708664 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Aug 2023 21:30:34 +0200 +Subject: gpiolib: fix reference leaks when removing GPIO chips still in use + +From: Bartosz Golaszewski + +[ Upstream commit 3386fb86ecdef0d39ee3306aea8ec290e61b934f ] + +After we remove a GPIO chip that still has some requested descriptors, +gpiod_free_commit() will fail and we will never put the references to the +GPIO device and the owning module in gpiod_free(). + +Rework this function to: +- not warn on desc == NULL as this is a use-case on which most free + functions silently return +- put the references to desc->gdev and desc->gdev->owner unconditionally + so that the release callback actually gets called when the remaining + references are dropped by external GPIO users + +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 5be8ad61523eb..6e7701f80929f 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2175,12 +2175,18 @@ static bool gpiod_free_commit(struct gpio_desc *desc) + + void gpiod_free(struct gpio_desc *desc) + { +- if (desc && desc->gdev && gpiod_free_commit(desc)) { +- module_put(desc->gdev->owner); +- gpio_device_put(desc->gdev); +- } else { ++ /* ++ * We must not use VALIDATE_DESC_VOID() as the underlying gdev->chip ++ * may already be NULL but we still want to put the references. ++ */ ++ if (!desc) ++ return; ++ ++ if (!gpiod_free_commit(desc)) + WARN_ON(extra_checks); +- } ++ ++ module_put(desc->gdev->owner); ++ gpio_device_put(desc->gdev); + } + + /** +-- +2.40.1 + diff --git a/queue-6.4/i2c-imx-lpi2c-return-einval-when-i2c-peripheral-clk-.patch b/queue-6.4/i2c-imx-lpi2c-return-einval-when-i2c-peripheral-clk-.patch new file mode 100644 index 00000000000..d4e460c01ae --- /dev/null +++ b/queue-6.4/i2c-imx-lpi2c-return-einval-when-i2c-peripheral-clk-.patch @@ -0,0 +1,43 @@ +From a50a02658d5b3f7dee072728a8772b88a9610e93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 17:22:38 +0800 +Subject: i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work + +From: Carlos Song + +[ Upstream commit b610c4bbd153c2cde548db48559e170905d7c369 ] + +On MX8X platforms, the default clock rate is 0 if without explicit +clock setting in dts nodes. I2c can't work when i2c peripheral clk +rate is 0. + +Add a i2c peripheral clk rate check before configuring the clock +register. When i2c peripheral clk rate is 0 and directly return +-EINVAL. + +Signed-off-by: Carlos Song +Acked-by: Dong Aisheng +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx-lpi2c.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c b/drivers/i2c/busses/i2c-imx-lpi2c.c +index 4d24ceb57ee74..338171f76daf7 100644 +--- a/drivers/i2c/busses/i2c-imx-lpi2c.c ++++ b/drivers/i2c/busses/i2c-imx-lpi2c.c +@@ -209,6 +209,9 @@ static int lpi2c_imx_config(struct lpi2c_imx_struct *lpi2c_imx) + lpi2c_imx_set_mode(lpi2c_imx); + + clk_rate = clk_get_rate(lpi2c_imx->clks[0].clk); ++ if (!clk_rate) ++ return -EINVAL; ++ + if (lpi2c_imx->mode == HS || lpi2c_imx->mode == ULTRA_FAST) + filt = 0; + else +-- +2.40.1 + diff --git a/queue-6.4/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch b/queue-6.4/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch new file mode 100644 index 00000000000..cf09a1a597e --- /dev/null +++ b/queue-6.4/idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch @@ -0,0 +1,58 @@ +From be2b81f72f26d77150e70861605890d46c70137e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 21:58:45 +0800 +Subject: idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM + +From: Baoquan He + +[ Upstream commit b1e213a9e31c20206f111ec664afcf31cbfe0dbb ] + +On s390 systems (aka mainframes), it has classic channel devices for +networking and permanent storage that are currently even more common +than PCI devices. Hence it could have a fully functional s390 kernel +with CONFIG_PCI=n, then the relevant iomem mapping functions +[including ioremap(), devm_ioremap(), etc.] are not available. + +Here let FSL_EDMA and INTEL_IDMA64 depend on HAS_IOMEM so that it +won't be built to cause below compiling error if PCI is unset. + +-------- +ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/fsl-edma.ko] undefined! +ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/idma64.ko] undefined! +-------- + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ +Signed-off-by: Baoquan He +Cc: Vinod Koul +Cc: dmaengine@vger.kernel.org +Link: https://lore.kernel.org/r/20230707135852.24292-2-bhe@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index f5f422f9b8507..b6221b4432fd3 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -211,6 +211,7 @@ config FSL_DMA + config FSL_EDMA + tristate "Freescale eDMA engine support" + depends on OF ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +@@ -280,6 +281,7 @@ config IMX_SDMA + + config INTEL_IDMA64 + tristate "Intel integrated DMA 64-bit support" ++ depends on HAS_IOMEM + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS + help +-- +2.40.1 + diff --git a/queue-6.4/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch b/queue-6.4/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch new file mode 100644 index 00000000000..5311bcd9ba3 --- /dev/null +++ b/queue-6.4/kprobes-prohibit-probing-on-cfi-preamble-symbol.patch @@ -0,0 +1,56 @@ +From b96eed27b9d82e11bf2b9aff3677530a3a638333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 10:50:47 +0900 +Subject: kprobes: Prohibit probing on CFI preamble symbol + +From: Masami Hiramatsu (Google) + +[ Upstream commit de02f2ac5d8cfb311f44f2bf144cc20002f1fbbd ] + +Do not allow to probe on "__cfi_" or "__pfx_" started symbol, because those +are used for CFI and not executed. Probing it will break the CFI. + +Link: https://lore.kernel.org/all/168904024679.116016.18089228029322008512.stgit@devnote2/ + +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/kprobes.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 00e177de91ccd..3da9726232ff9 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1545,6 +1545,17 @@ static int check_ftrace_location(struct kprobe *p) + return 0; + } + ++static bool is_cfi_preamble_symbol(unsigned long addr) ++{ ++ char symbuf[KSYM_NAME_LEN]; ++ ++ if (lookup_symbol_name(addr, symbuf)) ++ return false; ++ ++ return str_has_prefix("__cfi_", symbuf) || ++ str_has_prefix("__pfx_", symbuf); ++} ++ + static int check_kprobe_address_safe(struct kprobe *p, + struct module **probed_mod) + { +@@ -1563,7 +1574,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + within_kprobe_blacklist((unsigned long) p->addr) || + jump_label_text_reserved(p->addr, p->addr) || + static_call_text_reserved(p->addr, p->addr) || +- find_bug((unsigned long)p->addr)) { ++ find_bug((unsigned long)p->addr) || ++ is_cfi_preamble_symbol((unsigned long)p->addr)) { + ret = -EINVAL; + goto out; + } +-- +2.40.1 + diff --git a/queue-6.4/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch b/queue-6.4/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch new file mode 100644 index 00000000000..08d2deea38f --- /dev/null +++ b/queue-6.4/ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch @@ -0,0 +1,107 @@ +From c40fa6d802e7c021c4c710d054b34bb951ab23f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:27:37 +0900 +Subject: ksmbd: fix out of bounds in init_smb2_rsp_hdr() + +From: Namjae Jeon + +[ Upstream commit 536bb492d39bb6c080c92f31e8a55fe9934f452b ] + +If client send smb2 negotiate request and then send smb1 negotiate +request, init_smb2_rsp_hdr is called for smb1 negotiate request since +need_neg is set to false. This patch ignore smb1 packets after ->need_neg +is set to false. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/server.c | 7 ++++++- + fs/smb/server/smb_common.c | 19 +++++++++++-------- + fs/smb/server/smb_common.h | 2 +- + 3 files changed, 18 insertions(+), 10 deletions(-) + +diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c +index ced7a9e916f01..9df121bdf3492 100644 +--- a/fs/smb/server/server.c ++++ b/fs/smb/server/server.c +@@ -286,6 +286,7 @@ static void handle_ksmbd_work(struct work_struct *wk) + static int queue_ksmbd_work(struct ksmbd_conn *conn) + { + struct ksmbd_work *work; ++ int err; + + work = ksmbd_alloc_work_struct(); + if (!work) { +@@ -297,7 +298,11 @@ static int queue_ksmbd_work(struct ksmbd_conn *conn) + work->request_buf = conn->request_buf; + conn->request_buf = NULL; + +- ksmbd_init_smb_server(work); ++ err = ksmbd_init_smb_server(work); ++ if (err) { ++ ksmbd_free_work_struct(work); ++ return 0; ++ } + + ksmbd_conn_enqueue_request(work); + atomic_inc(&conn->r_count); +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 3e391a7d5a3ab..27b8bd039791e 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -388,26 +388,29 @@ static struct smb_version_cmds smb1_server_cmds[1] = { + [SMB_COM_NEGOTIATE_EX] = { .proc = smb1_negotiate, }, + }; + +-static void init_smb1_server(struct ksmbd_conn *conn) ++static int init_smb1_server(struct ksmbd_conn *conn) + { + conn->ops = &smb1_server_ops; + conn->cmds = smb1_server_cmds; + conn->max_cmds = ARRAY_SIZE(smb1_server_cmds); ++ return 0; + } + +-void ksmbd_init_smb_server(struct ksmbd_work *work) ++int ksmbd_init_smb_server(struct ksmbd_work *work) + { + struct ksmbd_conn *conn = work->conn; + __le32 proto; + +- if (conn->need_neg == false) +- return; +- + proto = *(__le32 *)((struct smb_hdr *)work->request_buf)->Protocol; ++ if (conn->need_neg == false) { ++ if (proto == SMB1_PROTO_NUMBER) ++ return -EINVAL; ++ return 0; ++ } ++ + if (proto == SMB1_PROTO_NUMBER) +- init_smb1_server(conn); +- else +- init_smb3_11_server(conn); ++ return init_smb1_server(conn); ++ return init_smb3_11_server(conn); + } + + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, int info_level, +diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h +index 6b0d5f1fe85ca..f0134d16067fb 100644 +--- a/fs/smb/server/smb_common.h ++++ b/fs/smb/server/smb_common.h +@@ -427,7 +427,7 @@ bool ksmbd_smb_request(struct ksmbd_conn *conn); + + int ksmbd_lookup_dialect_by_id(__le16 *cli_dialects, __le16 dialects_count); + +-void ksmbd_init_smb_server(struct ksmbd_work *work); ++int ksmbd_init_smb_server(struct ksmbd_work *work); + + struct ksmbd_kstat; + int ksmbd_populate_dot_dotdot_entries(struct ksmbd_work *work, +-- +2.40.1 + diff --git a/queue-6.4/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch b/queue-6.4/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch new file mode 100644 index 00000000000..a607a4aaa6c --- /dev/null +++ b/queue-6.4/ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch @@ -0,0 +1,37 @@ +From b2b6002572d68c186d0a02afc0b2db2fd73d137b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 00:09:28 +0900 +Subject: ksmbd: fix out of bounds in smb3_decrypt_req() + +From: Namjae Jeon + +[ Upstream commit dc318846f3dd54574a36ae97fc8d8b75dd7cdb1e ] + +smb3_decrypt_req() validate if pdu_length is smaller than +smb2_transform_hdr size. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21589 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index 6d0896c76b098..dab4c7d710914 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -8623,7 +8623,8 @@ int smb3_decrypt_req(struct ksmbd_work *work) + struct smb2_transform_hdr *tr_hdr = smb2_get_msg(buf); + int rc = 0; + +- if (buf_data_size < sizeof(struct smb2_hdr)) { ++ if (pdu_length < sizeof(struct smb2_transform_hdr) || ++ buf_data_size < sizeof(struct smb2_hdr)) { + pr_err("Transform message is too small (%u)\n", + pdu_length); + return -ECONNABORTED; +-- +2.40.1 + diff --git a/queue-6.4/ksmbd-fix-unsigned-expression-compared-with-zero.patch b/queue-6.4/ksmbd-fix-unsigned-expression-compared-with-zero.patch new file mode 100644 index 00000000000..9dfc1206331 --- /dev/null +++ b/queue-6.4/ksmbd-fix-unsigned-expression-compared-with-zero.patch @@ -0,0 +1,52 @@ +From e76635b1603ade64438651bad290fa2b4c634b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 15:40:47 +0800 +Subject: ksmbd: Fix unsigned expression compared with zero + +From: Wang Ming + +[ Upstream commit 0266a2f791294e0b4ba36f4a1d89b8615ea3cac0 ] + +The return value of the ksmbd_vfs_getcasexattr() is signed. +However, the return value is being assigned to an unsigned +variable and subsequently recasted, causing warnings. Use +a signed type. + +Signed-off-by: Wang Ming +Acked-by: Tom Talpey +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/vfs.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c +index 911cb3d294b86..93f73c35a9c5c 100644 +--- a/fs/smb/server/vfs.c ++++ b/fs/smb/server/vfs.c +@@ -423,7 +423,8 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, + { + char *stream_buf = NULL, *wbuf; + struct mnt_idmap *idmap = file_mnt_idmap(fp->filp); +- size_t size, v_len; ++ size_t size; ++ ssize_t v_len; + int err = 0; + + ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", +@@ -440,9 +441,9 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, + fp->stream.name, + fp->stream.size, + &stream_buf); +- if ((int)v_len < 0) { ++ if (v_len < 0) { + pr_err("not found stream in xattr : %zd\n", v_len); +- err = (int)v_len; ++ err = v_len; + goto out; + } + +-- +2.40.1 + diff --git a/queue-6.4/ksmbd-no-response-from-compound-read.patch b/queue-6.4/ksmbd-no-response-from-compound-read.patch new file mode 100644 index 00000000000..c8bd05fbde7 --- /dev/null +++ b/queue-6.4/ksmbd-no-response-from-compound-read.patch @@ -0,0 +1,41 @@ +From 40329fd74fcf7c5b55e7bfc3788615b1fa1c1b88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:22:33 +0900 +Subject: ksmbd: no response from compound read + +From: Namjae Jeon + +[ Upstream commit e202a1e8634b186da38cbbff85382ea2b9e297cf ] + +ksmbd doesn't support compound read. If client send read-read in +compound to ksmbd, there can be memory leak from read buffer. +Windows and linux clients doesn't send it to server yet. For now, +No response from compound read. compound read will be supported soon. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index ca5af2d9e28bb..a61bc3a2649cb 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -6223,6 +6223,11 @@ int smb2_read(struct ksmbd_work *work) + unsigned int max_read_size = conn->vals->max_read_size; + + WORK_BUFFERS(work, req, rsp); ++ if (work->next_smb2_rcv_hdr_off) { ++ work->send_no_response = 1; ++ err = -EOPNOTSUPP; ++ goto out; ++ } + + if (test_share_config_flag(work->tcon->share_conf, + KSMBD_SHARE_FLAG_PIPE)) { +-- +2.40.1 + diff --git a/queue-6.4/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch b/queue-6.4/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch new file mode 100644 index 00000000000..62edaf70284 --- /dev/null +++ b/queue-6.4/ksmbd-validate-session-id-and-tree-id-in-compound-re.patch @@ -0,0 +1,72 @@ +From 23918e444d7e15510f8c9bb321d798f4bce05027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 15:21:11 +0900 +Subject: ksmbd: validate session id and tree id in compound request + +From: Namjae Jeon + +[ Upstream commit 3df0411e132ee74a87aa13142dfd2b190275332e ] + +`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() +will always return the first request smb2 header in a compound request. +if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will +return 0, i.e. The tree id check is skipped. +This patch use ksmbd_req_buf_next() to get current command in compound. + +Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21506 +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb2pdu.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c +index dab4c7d710914..ca5af2d9e28bb 100644 +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -87,9 +87,9 @@ struct channel *lookup_chann_list(struct ksmbd_session *sess, struct ksmbd_conn + */ + int smb2_get_ksmbd_tcon(struct ksmbd_work *work) + { +- struct smb2_hdr *req_hdr = smb2_get_msg(work->request_buf); ++ struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); + unsigned int cmd = le16_to_cpu(req_hdr->Command); +- int tree_id; ++ unsigned int tree_id; + + if (cmd == SMB2_TREE_CONNECT_HE || + cmd == SMB2_CANCEL_HE || +@@ -114,7 +114,7 @@ int smb2_get_ksmbd_tcon(struct ksmbd_work *work) + pr_err("The first operation in the compound does not have tcon\n"); + return -EINVAL; + } +- if (work->tcon->id != tree_id) { ++ if (tree_id != UINT_MAX && work->tcon->id != tree_id) { + pr_err("tree id(%u) is different with id(%u) in first operation\n", + tree_id, work->tcon->id); + return -EINVAL; +@@ -559,9 +559,9 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) + */ + int smb2_check_user_session(struct ksmbd_work *work) + { +- struct smb2_hdr *req_hdr = smb2_get_msg(work->request_buf); ++ struct smb2_hdr *req_hdr = ksmbd_req_buf_next(work); + struct ksmbd_conn *conn = work->conn; +- unsigned int cmd = conn->ops->get_cmd_val(work); ++ unsigned int cmd = le16_to_cpu(req_hdr->Command); + unsigned long long sess_id; + + /* +@@ -587,7 +587,7 @@ int smb2_check_user_session(struct ksmbd_work *work) + pr_err("The first operation in the compound does not have sess\n"); + return -EINVAL; + } +- if (work->sess->id != sess_id) { ++ if (sess_id != ULLONG_MAX && work->sess->id != sess_id) { + pr_err("session id(%llu) is different with the first operation(%lld)\n", + sess_id, work->sess->id); + return -EINVAL; +-- +2.40.1 + diff --git a/queue-6.4/loongarch-fix-cmdline_extend-and-cmdline_bootloader-.patch b/queue-6.4/loongarch-fix-cmdline_extend-and-cmdline_bootloader-.patch new file mode 100644 index 00000000000..cfa04b15427 --- /dev/null +++ b/queue-6.4/loongarch-fix-cmdline_extend-and-cmdline_bootloader-.patch @@ -0,0 +1,54 @@ +From ab0589eca646c2a7bba173a1ac8989c1df137c94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 10:30:42 +0800 +Subject: LoongArch: Fix CMDLINE_EXTEND and CMDLINE_BOOTLOADER handling + +From: Zhihong Dong + +[ Upstream commit 83da30d73b86ab5898fb84f8b49c11557c3fcc67 ] + +On FDT systems these command line processing are already taken care of +by early_init_dt_scan_chosen(). Add similar handling to the ACPI (non- +FDT) code path to allow these config options to work for ACPI (non-FDT) +systems too. + +Signed-off-by: Zhihong Dong +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/setup.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 78a00359bde3c..9d830ab4e3025 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -332,9 +332,25 @@ static void __init bootcmdline_init(char **cmdline_p) + strlcat(boot_command_line, " ", COMMAND_LINE_SIZE); + + strlcat(boot_command_line, init_command_line, COMMAND_LINE_SIZE); ++ goto out; + } + #endif + ++ /* ++ * Append built-in command line to the bootloader command line if ++ * CONFIG_CMDLINE_EXTEND is enabled. ++ */ ++ if (IS_ENABLED(CONFIG_CMDLINE_EXTEND) && CONFIG_CMDLINE[0]) { ++ strlcat(boot_command_line, " ", COMMAND_LINE_SIZE); ++ strlcat(boot_command_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE); ++ } ++ ++ /* ++ * Use built-in command line if the bootloader command line is empty. ++ */ ++ if (IS_ENABLED(CONFIG_CMDLINE_BOOTLOADER) && !boot_command_line[0]) ++ strscpy(boot_command_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE); ++ + out: + *cmdline_p = boot_command_line; + } +-- +2.40.1 + diff --git a/queue-6.4/loongarch-only-fiddle-with-checkflags-if-need-compil.patch b/queue-6.4/loongarch-only-fiddle-with-checkflags-if-need-compil.patch new file mode 100644 index 00000000000..d431402229e --- /dev/null +++ b/queue-6.4/loongarch-only-fiddle-with-checkflags-if-need-compil.patch @@ -0,0 +1,51 @@ +From 12440a65a60a3a063fcb856dfd3e66834839c5cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 10:30:42 +0800 +Subject: LoongArch: Only fiddle with CHECKFLAGS if `need-compiler' + +From: Huacai Chen + +[ Upstream commit 54c2c9df083fe1d4a9df54d9876f32582ce6d77a ] + +This is a port of commit 4fe4a6374c4db9ae2b ("MIPS: Only fiddle with +CHECKFLAGS if `need-compiler'") to LoongArch. + +We have originally guarded fiddling with CHECKFLAGS in our arch Makefile +by checking for the CONFIG_LOONGARCH variable, not set for targets such +as `distclean', etc. that neither include `.config' nor use the compiler. + +Starting from commit 805b2e1d427aab4 ("kbuild: include Makefile.compiler +only when compiler is needed") we have had a generic `need-compiler' +variable explicitly telling us if the compiler will be used and thus its +capabilities need to be checked and expressed in the form of compilation +flags. If this variable is not set, then `make' functions such as +`cc-option' are undefined, causing all kinds of weirdness to happen if +we expect specific results to be returned. + +It doesn't cause problems on LoongArch now. But as a guard we replace +the check for CONFIG_LOONGARCH with one for `need-compiler' instead, so +as to prevent the compiler from being ever called for CHECKFLAGS when +not needed. + +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index 63a637fdf6c28..95629322241f5 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -106,7 +106,7 @@ KBUILD_CFLAGS += -isystem $(shell $(CC) -print-file-name=include) + + KBUILD_LDFLAGS += -m $(ld-emul) + +-ifdef CONFIG_LOONGARCH ++ifdef need-compiler + CHECKFLAGS += $(shell $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ + grep -E -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ + sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') +-- +2.40.1 + diff --git a/queue-6.4/m68k-fix-invalid-.section-syntax.patch b/queue-6.4/m68k-fix-invalid-.section-syntax.patch new file mode 100644 index 00000000000..1d46e4101e4 --- /dev/null +++ b/queue-6.4/m68k-fix-invalid-.section-syntax.patch @@ -0,0 +1,100 @@ +From 9ae622a05751f7860fd985d83c055a41fce9c834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 17:36:10 +0200 +Subject: m68k: Fix invalid .section syntax + +From: Ben Hutchings + +[ Upstream commit 922a9bd138101e3e5718f0f4d40dba68ef89bb43 ] + +gas supports several different forms for .section for ELF targets, +including: + .section NAME [, "FLAGS"[, @TYPE[,FLAG_SPECIFIC_ARGUMENTS]]] +and: + .section "NAME"[, #FLAGS...] + +In several places we use a mix of these two forms: + .section NAME, #FLAGS... + +A current development snapshot of binutils (2.40.50.20230611) treats +this mixed syntax as an error. + +Change to consistently use: + .section NAME, "FLAGS" +as is used elsewhere in the kernel. + +Link: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=m68k&ver=6.4%7Erc6-1%7Eexp1&stamp=1686907300&raw=1 +Signed-off-by: Ben Hutchings +Tested-by: Jan-Benedict Glaw +Link: https://lore.kernel.org/r/ZIyBaueWT9jnTwRC@decadent.org.uk +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/fpsp040/skeleton.S | 4 ++-- + arch/m68k/ifpsp060/os.S | 4 ++-- + arch/m68k/kernel/relocate_kernel.S | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S +index 439395aa6fb42..081922c72daaa 100644 +--- a/arch/m68k/fpsp040/skeleton.S ++++ b/arch/m68k/fpsp040/skeleton.S +@@ -499,13 +499,13 @@ in_ea: + dbf %d0,morein + rts + +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: + jbsr fpsp040_die + jbra .Lnotkern + +- .section __ex_table,#alloc ++ .section __ex_table,"a" + .align 4 + + .long in_ea,1b +diff --git a/arch/m68k/ifpsp060/os.S b/arch/m68k/ifpsp060/os.S +index 7a0d6e4280665..89e2ec224ab6c 100644 +--- a/arch/m68k/ifpsp060/os.S ++++ b/arch/m68k/ifpsp060/os.S +@@ -379,11 +379,11 @@ _060_real_access: + + + | Execption handling for movs access to illegal memory +- .section .fixup,#alloc,#execinstr ++ .section .fixup,"ax" + .even + 1: moveq #-1,%d1 + rts +-.section __ex_table,#alloc ++.section __ex_table,"a" + .align 4 + .long dmrbuae,1b + .long dmrwuae,1b +diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S +index ab0f1e7d46535..f7667079e08e9 100644 +--- a/arch/m68k/kernel/relocate_kernel.S ++++ b/arch/m68k/kernel/relocate_kernel.S +@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcopy),%a4 + 2: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 2b+2 + .previous + +@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel) + lea %pc@(.Lcont040),%a4 + 5: addl #0x00000000,%a4 /* virt_to_phys() */ + +- .section ".m68k_fixup","aw" ++ .section .m68k_fixup,"aw" + .long M68K_FIXUP_MEMOFFSET, 5b+2 + .previous + +-- +2.40.1 + diff --git a/queue-6.4/media-amphion-use-dev_err_probe.patch b/queue-6.4/media-amphion-use-dev_err_probe.patch new file mode 100644 index 00000000000..f75970e97bd --- /dev/null +++ b/queue-6.4/media-amphion-use-dev_err_probe.patch @@ -0,0 +1,44 @@ +From b05f6a7e27d6cd9ecfcbab86bca4aa097b2e9bc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 11:32:44 +0100 +Subject: media: amphion: use dev_err_probe + +From: Alexander Stein + +[ Upstream commit 517f088385e1b8015606143e6212cb30f8714070 ] + +This simplifies the code and silences -517 error messages. Also +the reason is listed in /sys/kernel/debug/devices_deferred. + +Signed-off-by: Alexander Stein +Reviewed-by: ming_qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_mbox.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/amphion/vpu_mbox.c b/drivers/media/platform/amphion/vpu_mbox.c +index bf759eb2fd46d..b6d5b4844f672 100644 +--- a/drivers/media/platform/amphion/vpu_mbox.c ++++ b/drivers/media/platform/amphion/vpu_mbox.c +@@ -46,11 +46,10 @@ static int vpu_mbox_request_channel(struct device *dev, struct vpu_mbox *mbox) + cl->rx_callback = vpu_mbox_rx_callback; + + ch = mbox_request_channel_byname(cl, mbox->name); +- if (IS_ERR(ch)) { +- dev_err(dev, "Failed to request mbox chan %s, ret : %ld\n", +- mbox->name, PTR_ERR(ch)); +- return PTR_ERR(ch); +- } ++ if (IS_ERR(ch)) ++ return dev_err_probe(dev, PTR_ERR(ch), ++ "Failed to request mbox chan %s\n", ++ mbox->name); + + mbox->ch = ch; + return 0; +-- +2.40.1 + diff --git a/queue-6.4/media-imx-jpeg-support-to-assign-slot-for-encoder-de.patch b/queue-6.4/media-imx-jpeg-support-to-assign-slot-for-encoder-de.patch new file mode 100644 index 00000000000..d69869cd4ce --- /dev/null +++ b/queue-6.4/media-imx-jpeg-support-to-assign-slot-for-encoder-de.patch @@ -0,0 +1,363 @@ +From a4489e9eaf7e537da2141e58e2f1cbd42c9e19ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 09:16:30 +0200 +Subject: media: imx-jpeg: Support to assign slot for encoder/decoder + +From: Ming Qian + +[ Upstream commit 53ebeea50599c1ed05277d7a57e331a34e6d6a82 ] + +imx jpeg encoder and decoder support 4 slots each, +aim to support some virtualization scenarios. + +driver should only enable one slot one time. + +but due to some hardware issue, +only slot 0 can be enabled in imx8q platform, +and they may be fixed in imx9 platform. + +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h | 1 - + .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 135 +++++++++--------- + .../media/platform/nxp/imx-jpeg/mxc-jpeg.h | 5 +- + 3 files changed, 68 insertions(+), 73 deletions(-) + +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h +index ed15ea348f97b..a2b4fb9e29e7d 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg-hw.h +@@ -58,7 +58,6 @@ + #define CAST_OFBSIZE_LO CAST_STATUS18 + #define CAST_OFBSIZE_HI CAST_STATUS19 + +-#define MXC_MAX_SLOTS 1 /* TODO use all 4 slots*/ + /* JPEG-Decoder Wrapper Slot Registers 0..3 */ + #define SLOT_BASE 0x10000 + #define SLOT_STATUS 0x0 +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +index c0e49be42450a..9512c0a619667 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +@@ -745,87 +745,77 @@ static void notify_src_chg(struct mxc_jpeg_ctx *ctx) + v4l2_event_queue_fh(&ctx->fh, &ev); + } + +-static int mxc_get_free_slot(struct mxc_jpeg_slot_data slot_data[], int n) ++static int mxc_get_free_slot(struct mxc_jpeg_slot_data *slot_data) + { +- int free_slot = 0; +- +- while (slot_data[free_slot].used && free_slot < n) +- free_slot++; +- +- return free_slot; /* >=n when there are no more free slots */ ++ if (!slot_data->used) ++ return slot_data->slot; ++ return -1; + } + +-static bool mxc_jpeg_alloc_slot_data(struct mxc_jpeg_dev *jpeg, +- unsigned int slot) ++static bool mxc_jpeg_alloc_slot_data(struct mxc_jpeg_dev *jpeg) + { + struct mxc_jpeg_desc *desc; + struct mxc_jpeg_desc *cfg_desc; + void *cfg_stm; + +- if (jpeg->slot_data[slot].desc) ++ if (jpeg->slot_data.desc) + goto skip_alloc; /* already allocated, reuse it */ + + /* allocate descriptor for decoding/encoding phase */ + desc = dma_alloc_coherent(jpeg->dev, + sizeof(struct mxc_jpeg_desc), +- &jpeg->slot_data[slot].desc_handle, ++ &jpeg->slot_data.desc_handle, + GFP_ATOMIC); + if (!desc) + goto err; +- jpeg->slot_data[slot].desc = desc; ++ jpeg->slot_data.desc = desc; + + /* allocate descriptor for configuration phase (encoder only) */ + cfg_desc = dma_alloc_coherent(jpeg->dev, + sizeof(struct mxc_jpeg_desc), +- &jpeg->slot_data[slot].cfg_desc_handle, ++ &jpeg->slot_data.cfg_desc_handle, + GFP_ATOMIC); + if (!cfg_desc) + goto err; +- jpeg->slot_data[slot].cfg_desc = cfg_desc; ++ jpeg->slot_data.cfg_desc = cfg_desc; + + /* allocate configuration stream */ + cfg_stm = dma_alloc_coherent(jpeg->dev, + MXC_JPEG_MAX_CFG_STREAM, +- &jpeg->slot_data[slot].cfg_stream_handle, ++ &jpeg->slot_data.cfg_stream_handle, + GFP_ATOMIC); + if (!cfg_stm) + goto err; +- jpeg->slot_data[slot].cfg_stream_vaddr = cfg_stm; ++ jpeg->slot_data.cfg_stream_vaddr = cfg_stm; + + skip_alloc: +- jpeg->slot_data[slot].used = true; ++ jpeg->slot_data.used = true; + + return true; + err: +- dev_err(jpeg->dev, "Could not allocate descriptors for slot %d", slot); ++ dev_err(jpeg->dev, "Could not allocate descriptors for slot %d", jpeg->slot_data.slot); + + return false; + } + +-static void mxc_jpeg_free_slot_data(struct mxc_jpeg_dev *jpeg, +- unsigned int slot) ++static void mxc_jpeg_free_slot_data(struct mxc_jpeg_dev *jpeg) + { +- if (slot >= MXC_MAX_SLOTS) { +- dev_err(jpeg->dev, "Invalid slot %d, nothing to free.", slot); +- return; +- } +- + /* free descriptor for decoding/encoding phase */ + dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), +- jpeg->slot_data[slot].desc, +- jpeg->slot_data[slot].desc_handle); ++ jpeg->slot_data.desc, ++ jpeg->slot_data.desc_handle); + + /* free descriptor for encoder configuration phase / decoder DHT */ + dma_free_coherent(jpeg->dev, sizeof(struct mxc_jpeg_desc), +- jpeg->slot_data[slot].cfg_desc, +- jpeg->slot_data[slot].cfg_desc_handle); ++ jpeg->slot_data.cfg_desc, ++ jpeg->slot_data.cfg_desc_handle); + + /* free configuration stream */ + dma_free_coherent(jpeg->dev, MXC_JPEG_MAX_CFG_STREAM, +- jpeg->slot_data[slot].cfg_stream_vaddr, +- jpeg->slot_data[slot].cfg_stream_handle); ++ jpeg->slot_data.cfg_stream_vaddr, ++ jpeg->slot_data.cfg_stream_handle); + +- jpeg->slot_data[slot].used = false; ++ jpeg->slot_data.used = false; + } + + static void mxc_jpeg_check_and_set_last_buffer(struct mxc_jpeg_ctx *ctx, +@@ -855,7 +845,7 @@ static void mxc_jpeg_job_finish(struct mxc_jpeg_ctx *ctx, enum vb2_buffer_state + v4l2_m2m_buf_done(dst_buf, state); + + mxc_jpeg_disable_irq(reg, ctx->slot); +- ctx->mxc_jpeg->slot_data[ctx->slot].used = false; ++ jpeg->slot_data.used = false; + if (reset) + mxc_jpeg_sw_reset(reg); + } +@@ -919,7 +909,7 @@ static irqreturn_t mxc_jpeg_dec_irq(int irq, void *priv) + goto job_unlock; + } + +- if (!jpeg->slot_data[slot].used) ++ if (!jpeg->slot_data.used) + goto job_unlock; + + dec_ret = readl(reg + MXC_SLOT_OFFSET(slot, SLOT_STATUS)); +@@ -1179,13 +1169,13 @@ static void mxc_jpeg_config_dec_desc(struct vb2_buffer *out_buf, + struct mxc_jpeg_dev *jpeg = ctx->mxc_jpeg; + void __iomem *reg = jpeg->base_reg; + unsigned int slot = ctx->slot; +- struct mxc_jpeg_desc *desc = jpeg->slot_data[slot].desc; +- struct mxc_jpeg_desc *cfg_desc = jpeg->slot_data[slot].cfg_desc; +- dma_addr_t desc_handle = jpeg->slot_data[slot].desc_handle; +- dma_addr_t cfg_desc_handle = jpeg->slot_data[slot].cfg_desc_handle; +- dma_addr_t cfg_stream_handle = jpeg->slot_data[slot].cfg_stream_handle; +- unsigned int *cfg_size = &jpeg->slot_data[slot].cfg_stream_size; +- void *cfg_stream_vaddr = jpeg->slot_data[slot].cfg_stream_vaddr; ++ struct mxc_jpeg_desc *desc = jpeg->slot_data.desc; ++ struct mxc_jpeg_desc *cfg_desc = jpeg->slot_data.cfg_desc; ++ dma_addr_t desc_handle = jpeg->slot_data.desc_handle; ++ dma_addr_t cfg_desc_handle = jpeg->slot_data.cfg_desc_handle; ++ dma_addr_t cfg_stream_handle = jpeg->slot_data.cfg_stream_handle; ++ unsigned int *cfg_size = &jpeg->slot_data.cfg_stream_size; ++ void *cfg_stream_vaddr = jpeg->slot_data.cfg_stream_vaddr; + struct mxc_jpeg_src_buf *jpeg_src_buf; + + jpeg_src_buf = vb2_to_mxc_buf(src_buf); +@@ -1245,18 +1235,18 @@ static void mxc_jpeg_config_enc_desc(struct vb2_buffer *out_buf, + struct mxc_jpeg_dev *jpeg = ctx->mxc_jpeg; + void __iomem *reg = jpeg->base_reg; + unsigned int slot = ctx->slot; +- struct mxc_jpeg_desc *desc = jpeg->slot_data[slot].desc; +- struct mxc_jpeg_desc *cfg_desc = jpeg->slot_data[slot].cfg_desc; +- dma_addr_t desc_handle = jpeg->slot_data[slot].desc_handle; +- dma_addr_t cfg_desc_handle = jpeg->slot_data[slot].cfg_desc_handle; +- void *cfg_stream_vaddr = jpeg->slot_data[slot].cfg_stream_vaddr; ++ struct mxc_jpeg_desc *desc = jpeg->slot_data.desc; ++ struct mxc_jpeg_desc *cfg_desc = jpeg->slot_data.cfg_desc; ++ dma_addr_t desc_handle = jpeg->slot_data.desc_handle; ++ dma_addr_t cfg_desc_handle = jpeg->slot_data.cfg_desc_handle; ++ void *cfg_stream_vaddr = jpeg->slot_data.cfg_stream_vaddr; + struct mxc_jpeg_q_data *q_data; + enum mxc_jpeg_image_format img_fmt; + int w, h; + + q_data = mxc_jpeg_get_q_data(ctx, src_buf->vb2_queue->type); + +- jpeg->slot_data[slot].cfg_stream_size = ++ jpeg->slot_data.cfg_stream_size = + mxc_jpeg_setup_cfg_stream(cfg_stream_vaddr, + q_data->fmt->fourcc, + q_data->crop.width, +@@ -1265,7 +1255,7 @@ static void mxc_jpeg_config_enc_desc(struct vb2_buffer *out_buf, + /* chain the config descriptor with the encoding descriptor */ + cfg_desc->next_descpt_ptr = desc_handle | MXC_NXT_DESCPT_EN; + +- cfg_desc->buf_base0 = jpeg->slot_data[slot].cfg_stream_handle; ++ cfg_desc->buf_base0 = jpeg->slot_data.cfg_stream_handle; + cfg_desc->buf_base1 = 0; + cfg_desc->line_pitch = 0; + cfg_desc->stm_bufbase = 0; /* no output expected */ +@@ -1408,7 +1398,7 @@ static void mxc_jpeg_device_run_timeout(struct work_struct *work) + unsigned long flags; + + spin_lock_irqsave(&ctx->mxc_jpeg->hw_lock, flags); +- if (ctx->slot < MXC_MAX_SLOTS && ctx->mxc_jpeg->slot_data[ctx->slot].used) { ++ if (ctx->mxc_jpeg->slot_data.used) { + dev_warn(jpeg->dev, "%s timeout, cancel it\n", + ctx->mxc_jpeg->mode == MXC_JPEG_DECODE ? "decode" : "encode"); + mxc_jpeg_job_finish(ctx, VB2_BUF_STATE_ERROR, true); +@@ -1476,12 +1466,12 @@ static void mxc_jpeg_device_run(void *priv) + mxc_jpeg_enable(reg); + mxc_jpeg_set_l_endian(reg, 1); + +- ctx->slot = mxc_get_free_slot(jpeg->slot_data, MXC_MAX_SLOTS); +- if (ctx->slot >= MXC_MAX_SLOTS) { ++ ctx->slot = mxc_get_free_slot(&jpeg->slot_data); ++ if (ctx->slot < 0) { + dev_err(dev, "No more free slots\n"); + goto end; + } +- if (!mxc_jpeg_alloc_slot_data(jpeg, ctx->slot)) { ++ if (!mxc_jpeg_alloc_slot_data(jpeg)) { + dev_err(dev, "Cannot allocate slot data\n"); + goto end; + } +@@ -2101,7 +2091,7 @@ static int mxc_jpeg_open(struct file *file) + } + ctx->fh.ctrl_handler = &ctx->ctrl_handler; + mxc_jpeg_set_default_params(ctx); +- ctx->slot = MXC_MAX_SLOTS; /* slot not allocated yet */ ++ ctx->slot = -1; /* slot not allocated yet */ + INIT_DELAYED_WORK(&ctx->task_timer, mxc_jpeg_device_run_timeout); + + if (mxc_jpeg->mode == MXC_JPEG_DECODE) +@@ -2677,6 +2667,11 @@ static int mxc_jpeg_attach_pm_domains(struct mxc_jpeg_dev *jpeg) + dev_err(dev, "No power domains defined for jpeg node\n"); + return jpeg->num_domains; + } ++ if (jpeg->num_domains == 1) { ++ /* genpd_dev_pm_attach() attach automatically if power domains count is 1 */ ++ jpeg->num_domains = 0; ++ return 0; ++ } + + jpeg->pd_dev = devm_kmalloc_array(dev, jpeg->num_domains, + sizeof(*jpeg->pd_dev), GFP_KERNEL); +@@ -2718,7 +2713,6 @@ static int mxc_jpeg_probe(struct platform_device *pdev) + int ret; + int mode; + const struct of_device_id *of_id; +- unsigned int slot; + + of_id = of_match_node(mxc_jpeg_match, dev->of_node); + if (!of_id) +@@ -2742,19 +2736,22 @@ static int mxc_jpeg_probe(struct platform_device *pdev) + if (IS_ERR(jpeg->base_reg)) + return PTR_ERR(jpeg->base_reg); + +- for (slot = 0; slot < MXC_MAX_SLOTS; slot++) { +- dec_irq = platform_get_irq(pdev, slot); +- if (dec_irq < 0) { +- ret = dec_irq; +- goto err_irq; +- } +- ret = devm_request_irq(&pdev->dev, dec_irq, mxc_jpeg_dec_irq, +- 0, pdev->name, jpeg); +- if (ret) { +- dev_err(&pdev->dev, "Failed to request irq %d (%d)\n", +- dec_irq, ret); +- goto err_irq; +- } ++ ret = of_property_read_u32_index(pdev->dev.of_node, "slot", 0, &jpeg->slot_data.slot); ++ if (ret) ++ jpeg->slot_data.slot = 0; ++ dev_info(&pdev->dev, "choose slot %d\n", jpeg->slot_data.slot); ++ dec_irq = platform_get_irq(pdev, 0); ++ if (dec_irq < 0) { ++ dev_err(&pdev->dev, "Failed to get irq %d\n", dec_irq); ++ ret = dec_irq; ++ goto err_irq; ++ } ++ ret = devm_request_irq(&pdev->dev, dec_irq, mxc_jpeg_dec_irq, ++ 0, pdev->name, jpeg); ++ if (ret) { ++ dev_err(&pdev->dev, "Failed to request irq %d (%d)\n", ++ dec_irq, ret); ++ goto err_irq; + } + + jpeg->pdev = pdev; +@@ -2914,11 +2911,9 @@ static const struct dev_pm_ops mxc_jpeg_pm_ops = { + + static void mxc_jpeg_remove(struct platform_device *pdev) + { +- unsigned int slot; + struct mxc_jpeg_dev *jpeg = platform_get_drvdata(pdev); + +- for (slot = 0; slot < MXC_MAX_SLOTS; slot++) +- mxc_jpeg_free_slot_data(jpeg, slot); ++ mxc_jpeg_free_slot_data(jpeg); + + pm_runtime_disable(&pdev->dev); + video_unregister_device(jpeg->dec_vdev); +diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +index 87157db780826..d80e94cc9d992 100644 +--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h ++++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +@@ -97,7 +97,7 @@ struct mxc_jpeg_ctx { + struct mxc_jpeg_q_data cap_q; + struct v4l2_fh fh; + enum mxc_jpeg_enc_state enc_state; +- unsigned int slot; ++ int slot; + unsigned int source_change; + bool header_parsed; + struct v4l2_ctrl_handler ctrl_handler; +@@ -106,6 +106,7 @@ struct mxc_jpeg_ctx { + }; + + struct mxc_jpeg_slot_data { ++ int slot; + bool used; + struct mxc_jpeg_desc *desc; // enc/dec descriptor + struct mxc_jpeg_desc *cfg_desc; // configuration descriptor +@@ -128,7 +129,7 @@ struct mxc_jpeg_dev { + struct v4l2_device v4l2_dev; + struct v4l2_m2m_dev *m2m_dev; + struct video_device *dec_vdev; +- struct mxc_jpeg_slot_data slot_data[MXC_MAX_SLOTS]; ++ struct mxc_jpeg_slot_data slot_data; + int num_domains; + struct device **pd_dev; + struct device_link **pd_link; +-- +2.40.1 + diff --git a/queue-6.4/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch b/queue-6.4/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch new file mode 100644 index 00000000000..799cbbea0c8 --- /dev/null +++ b/queue-6.4/media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch @@ -0,0 +1,63 @@ +From 9461ec1d2d16e1c5ede1a3e799dd008c3cde3c69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 10:09:00 +0100 +Subject: media: pci: cx23885: fix error handling for cx23885 ATSC boards + +From: Nikolay Burykin + +[ Upstream commit 4aaa96b59df5fac41ba891969df6b092061ea9d7 ] + +After having been assigned to NULL value at cx23885-dvb.c:1202, +pointer '0' is dereferenced at cx23885-dvb.c:2469. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Nikolay Burykin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx23885/cx23885-dvb.c | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c +index 8fd5b6ef24282..7551ca4a322a4 100644 +--- a/drivers/media/pci/cx23885/cx23885-dvb.c ++++ b/drivers/media/pci/cx23885/cx23885-dvb.c +@@ -2459,16 +2459,10 @@ static int dvb_register(struct cx23885_tsport *port) + request_module("%s", info.type); + client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); + if (!i2c_client_has_driver(client_tuner)) { +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + if (!try_module_get(client_tuner->dev.driver->owner)) { + i2c_unregister_device(client_tuner); +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + port->i2c_client_tuner = client_tuner; +@@ -2505,16 +2499,10 @@ static int dvb_register(struct cx23885_tsport *port) + request_module("%s", info.type); + client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); + if (!i2c_client_has_driver(client_tuner)) { +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + if (!try_module_get(client_tuner->dev.driver->owner)) { + i2c_unregister_device(client_tuner); +- module_put(client_demod->dev.driver->owner); +- i2c_unregister_device(client_demod); +- port->i2c_client_demod = NULL; + goto frontend_detach; + } + port->i2c_client_tuner = client_tuner; +-- +2.40.1 + diff --git a/queue-6.4/media-pulse8-cec-handle-possible-ping-error.patch b/queue-6.4/media-pulse8-cec-handle-possible-ping-error.patch new file mode 100644 index 00000000000..b810c1d3803 --- /dev/null +++ b/queue-6.4/media-pulse8-cec-handle-possible-ping-error.patch @@ -0,0 +1,42 @@ +From 2ebc0a0cfe9abaffb9118fdf649ad7dfb241db2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 06:38:15 +0200 +Subject: media: pulse8-cec: handle possible ping error + +From: Dmitry Antipov + +[ Upstream commit 92cbf865ea2e0f2997ff97815c6db182eb23df1b ] + +Handle (and warn about) possible error waiting for MSGCODE_PING result. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Dmitry Antipov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/usb/pulse8/pulse8-cec.c +index 04b13cdc38d2c..ba67587bd43ec 100644 +--- a/drivers/media/cec/usb/pulse8/pulse8-cec.c ++++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c +@@ -809,8 +809,11 @@ static void pulse8_ping_eeprom_work_handler(struct work_struct *work) + + mutex_lock(&pulse8->lock); + cmd = MSGCODE_PING; +- pulse8_send_and_wait(pulse8, &cmd, 1, +- MSGCODE_COMMAND_ACCEPTED, 0); ++ if (pulse8_send_and_wait(pulse8, &cmd, 1, ++ MSGCODE_COMMAND_ACCEPTED, 0)) { ++ dev_warn(pulse8->dev, "failed to ping EEPROM\n"); ++ goto unlock; ++ } + + if (pulse8->vers < 2) + goto unlock; +-- +2.40.1 + diff --git a/queue-6.4/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch b/queue-6.4/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch new file mode 100644 index 00000000000..5745cee7ec7 --- /dev/null +++ b/queue-6.4/net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch @@ -0,0 +1,116 @@ +From 3467cd14b5b8358a8fa57500301fce7487caa142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 15:03:12 +0000 +Subject: net: annotate data-races around sk->sk_{rcv|snd}timeo + +From: Eric Dumazet + +[ Upstream commit 285975dd674258ccb33e77a1803e8f2015e67105 ] + +sk_getsockopt() runs without locks, we must add annotations +to sk->sk_rcvtimeo and sk->sk_sndtimeo. + +In the future we might allow fetching these fields before +we lock the socket in TCP fast path. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 24 ++++++++++++++---------- + net/sched/em_meta.c | 4 ++-- + 2 files changed, 16 insertions(+), 12 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 8451a95266bf0..ddcf0630cc3ee 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -425,6 +425,7 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + { + struct __kernel_sock_timeval tv; + int err = sock_copy_user_timeval(&tv, optval, optlen, old_timeval); ++ long val; + + if (err) + return err; +@@ -435,7 +436,7 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + if (tv.tv_sec < 0) { + static int warned __read_mostly; + +- *timeo_p = 0; ++ WRITE_ONCE(*timeo_p, 0); + if (warned < 10 && net_ratelimit()) { + warned++; + pr_info("%s: `%s' (pid %d) tries to set negative timeout\n", +@@ -443,11 +444,12 @@ static int sock_set_timeout(long *timeo_p, sockptr_t optval, int optlen, + } + return 0; + } +- *timeo_p = MAX_SCHEDULE_TIMEOUT; +- if (tv.tv_sec == 0 && tv.tv_usec == 0) +- return 0; +- if (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) +- *timeo_p = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec, USEC_PER_SEC / HZ); ++ val = MAX_SCHEDULE_TIMEOUT; ++ if ((tv.tv_sec || tv.tv_usec) && ++ (tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1))) ++ val = tv.tv_sec * HZ + DIV_ROUND_UP((unsigned long)tv.tv_usec, ++ USEC_PER_SEC / HZ); ++ WRITE_ONCE(*timeo_p, val); + return 0; + } + +@@ -809,9 +811,9 @@ void sock_set_sndtimeo(struct sock *sk, s64 secs) + { + lock_sock(sk); + if (secs && secs < MAX_SCHEDULE_TIMEOUT / HZ - 1) +- sk->sk_sndtimeo = secs * HZ; ++ WRITE_ONCE(sk->sk_sndtimeo, secs * HZ); + else +- sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; ++ WRITE_ONCE(sk->sk_sndtimeo, MAX_SCHEDULE_TIMEOUT); + release_sock(sk); + } + EXPORT_SYMBOL(sock_set_sndtimeo); +@@ -1710,12 +1712,14 @@ int sk_getsockopt(struct sock *sk, int level, int optname, + + case SO_RCVTIMEO_OLD: + case SO_RCVTIMEO_NEW: +- lv = sock_get_timeout(sk->sk_rcvtimeo, &v, SO_RCVTIMEO_OLD == optname); ++ lv = sock_get_timeout(READ_ONCE(sk->sk_rcvtimeo), &v, ++ SO_RCVTIMEO_OLD == optname); + break; + + case SO_SNDTIMEO_OLD: + case SO_SNDTIMEO_NEW: +- lv = sock_get_timeout(sk->sk_sndtimeo, &v, SO_SNDTIMEO_OLD == optname); ++ lv = sock_get_timeout(READ_ONCE(sk->sk_sndtimeo), &v, ++ SO_SNDTIMEO_OLD == optname); + break; + + case SO_RCVLOWAT: +diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c +index af85a73c4c545..6fdba069f6bfd 100644 +--- a/net/sched/em_meta.c ++++ b/net/sched/em_meta.c +@@ -568,7 +568,7 @@ META_COLLECTOR(int_sk_rcvtimeo) + *err = -1; + return; + } +- dst->value = sk->sk_rcvtimeo / HZ; ++ dst->value = READ_ONCE(sk->sk_rcvtimeo) / HZ; + } + + META_COLLECTOR(int_sk_sndtimeo) +@@ -579,7 +579,7 @@ META_COLLECTOR(int_sk_sndtimeo) + *err = -1; + return; + } +- dst->value = sk->sk_sndtimeo / HZ; ++ dst->value = READ_ONCE(sk->sk_sndtimeo) / HZ; + } + + META_COLLECTOR(int_sk_sendmsg_off) +-- +2.40.1 + diff --git a/queue-6.4/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch b/queue-6.4/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch new file mode 100644 index 00000000000..db4f8829d15 --- /dev/null +++ b/queue-6.4/net-dsa-microchip-ksz9477-register-regmap-alignment-.patch @@ -0,0 +1,117 @@ +From d0299c47da4b16366318ed2d54a8e1329bd56809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 10:13:42 +0200 +Subject: net: dsa: microchip: KSZ9477 register regmap alignment to 32 bit + boundaries + +From: Lukasz Majewski + +[ Upstream commit 8d7ae22ae9f8c8a4407f8e993df64440bdbd0cee ] + +The commit (SHA1: 5c844d57aa7894154e49cf2fc648bfe2f1aefc1c) provided code +to apply "Module 6: Certain PHY registers must be written as pairs instead +of singly" errata for KSZ9477 as this chip for certain PHY registers +(0xN120 to 0xN13F, N=1,2,3,4,5) must be accesses as 32 bit words instead +of 16 or 8 bit access. +Otherwise, adjacent registers (no matter if reserved or not) are +overwritten with 0x0. + +Without this patch some registers (e.g. 0x113c or 0x1134) required for 32 +bit access are out of valid regmap ranges. + +As a result, following error is observed and KSZ9477 is not properly +configured: + +ksz-switch spi1.0: can't rmw 32bit reg 0x113c: -EIO +ksz-switch spi1.0: can't rmw 32bit reg 0x1134: -EIO +ksz-switch spi1.0 lan1 (uninitialized): failed to connect to PHY: -EIO +ksz-switch spi1.0 lan1 (uninitialized): error -5 setting up PHY for tree 0, switch 0, port 0 + +The solution is to modify regmap_reg_range to allow accesses with 4 bytes +boundaries. + +Signed-off-by: Lukasz Majewski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz_common.c | 35 +++++++++++--------------- + 1 file changed, 15 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c +index a0ba2605bb620..f87ed14fa2ab2 100644 +--- a/drivers/net/dsa/microchip/ksz_common.c ++++ b/drivers/net/dsa/microchip/ksz_common.c +@@ -635,10 +635,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x1030, 0x1030), + regmap_reg_range(0x1100, 0x1115), + regmap_reg_range(0x111a, 0x111f), +- regmap_reg_range(0x1122, 0x1127), +- regmap_reg_range(0x112a, 0x112b), +- regmap_reg_range(0x1136, 0x1139), +- regmap_reg_range(0x113e, 0x113f), ++ regmap_reg_range(0x1120, 0x112b), ++ regmap_reg_range(0x1134, 0x113b), ++ regmap_reg_range(0x113c, 0x113f), + regmap_reg_range(0x1400, 0x1401), + regmap_reg_range(0x1403, 0x1403), + regmap_reg_range(0x1410, 0x1417), +@@ -669,10 +668,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x2030, 0x2030), + regmap_reg_range(0x2100, 0x2115), + regmap_reg_range(0x211a, 0x211f), +- regmap_reg_range(0x2122, 0x2127), +- regmap_reg_range(0x212a, 0x212b), +- regmap_reg_range(0x2136, 0x2139), +- regmap_reg_range(0x213e, 0x213f), ++ regmap_reg_range(0x2120, 0x212b), ++ regmap_reg_range(0x2134, 0x213b), ++ regmap_reg_range(0x213c, 0x213f), + regmap_reg_range(0x2400, 0x2401), + regmap_reg_range(0x2403, 0x2403), + regmap_reg_range(0x2410, 0x2417), +@@ -703,10 +701,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x3030, 0x3030), + regmap_reg_range(0x3100, 0x3115), + regmap_reg_range(0x311a, 0x311f), +- regmap_reg_range(0x3122, 0x3127), +- regmap_reg_range(0x312a, 0x312b), +- regmap_reg_range(0x3136, 0x3139), +- regmap_reg_range(0x313e, 0x313f), ++ regmap_reg_range(0x3120, 0x312b), ++ regmap_reg_range(0x3134, 0x313b), ++ regmap_reg_range(0x313c, 0x313f), + regmap_reg_range(0x3400, 0x3401), + regmap_reg_range(0x3403, 0x3403), + regmap_reg_range(0x3410, 0x3417), +@@ -737,10 +734,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x4030, 0x4030), + regmap_reg_range(0x4100, 0x4115), + regmap_reg_range(0x411a, 0x411f), +- regmap_reg_range(0x4122, 0x4127), +- regmap_reg_range(0x412a, 0x412b), +- regmap_reg_range(0x4136, 0x4139), +- regmap_reg_range(0x413e, 0x413f), ++ regmap_reg_range(0x4120, 0x412b), ++ regmap_reg_range(0x4134, 0x413b), ++ regmap_reg_range(0x413c, 0x413f), + regmap_reg_range(0x4400, 0x4401), + regmap_reg_range(0x4403, 0x4403), + regmap_reg_range(0x4410, 0x4417), +@@ -771,10 +767,9 @@ static const struct regmap_range ksz9477_valid_regs[] = { + regmap_reg_range(0x5030, 0x5030), + regmap_reg_range(0x5100, 0x5115), + regmap_reg_range(0x511a, 0x511f), +- regmap_reg_range(0x5122, 0x5127), +- regmap_reg_range(0x512a, 0x512b), +- regmap_reg_range(0x5136, 0x5139), +- regmap_reg_range(0x513e, 0x513f), ++ regmap_reg_range(0x5120, 0x512b), ++ regmap_reg_range(0x5134, 0x513b), ++ regmap_reg_range(0x513c, 0x513f), + regmap_reg_range(0x5400, 0x5401), + regmap_reg_range(0x5403, 0x5403), + regmap_reg_range(0x5410, 0x5417), +-- +2.40.1 + diff --git a/queue-6.4/net-hns3-add-tm-flush-when-setting-tm.patch b/queue-6.4/net-hns3-add-tm-flush-when-setting-tm.patch new file mode 100644 index 00000000000..51a48be2c36 --- /dev/null +++ b/queue-6.4/net-hns3-add-tm-flush-when-setting-tm.patch @@ -0,0 +1,234 @@ +From bbd33ca760ed567970f65c063a4b06d517d374fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 10:05:08 +0800 +Subject: net: hns3: add tm flush when setting tm + +From: Hao Lan + +[ Upstream commit 6d2336120aa6e1a8a64fa5d6ee5c3f3d0809fe9b ] + +When the tm module is configured with traffic, traffic +may be abnormal. This patch fixes this problem. +Before the tm module is configured, traffic processing +should be stopped. After the tm module is configured, +traffic processing is enabled. + +Signed-off-by: Hao Lan +Signed-off-by: Jijie Shao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 4 +++ + .../hns3/hns3_common/hclge_comm_cmd.c | 1 + + .../hns3/hns3_common/hclge_comm_cmd.h | 2 ++ + .../ethernet/hisilicon/hns3/hns3_debugfs.c | 3 ++ + .../hisilicon/hns3/hns3pf/hclge_dcb.c | 34 ++++++++++++++++--- + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 31 ++++++++++++++++- + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 4 +++ + 7 files changed, 73 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +index 06f29e80104c0..6df84184173d1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -102,6 +102,7 @@ enum HNAE3_DEV_CAP_BITS { + HNAE3_DEV_SUPPORT_FEC_STATS_B, + HNAE3_DEV_SUPPORT_LANE_NUM_B, + HNAE3_DEV_SUPPORT_WOL_B, ++ HNAE3_DEV_SUPPORT_TM_FLUSH_B, + }; + + #define hnae3_ae_dev_fd_supported(ae_dev) \ +@@ -173,6 +174,9 @@ enum HNAE3_DEV_CAP_BITS { + #define hnae3_ae_dev_wol_supported(ae_dev) \ + test_bit(HNAE3_DEV_SUPPORT_WOL_B, (ae_dev)->caps) + ++#define hnae3_ae_dev_tm_flush_supported(hdev) \ ++ test_bit(HNAE3_DEV_SUPPORT_TM_FLUSH_B, (hdev)->ae_dev->caps) ++ + enum HNAE3_PF_CAP_BITS { + HNAE3_PF_SUPPORT_VLAN_FLTR_MDF_B = 0, + }; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c +index 16ba98ff2c9b1..dcecb23daac6e 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.c +@@ -156,6 +156,7 @@ static const struct hclge_comm_caps_bit_map hclge_pf_cmd_caps[] = { + {HCLGE_COMM_CAP_FEC_STATS_B, HNAE3_DEV_SUPPORT_FEC_STATS_B}, + {HCLGE_COMM_CAP_LANE_NUM_B, HNAE3_DEV_SUPPORT_LANE_NUM_B}, + {HCLGE_COMM_CAP_WOL_B, HNAE3_DEV_SUPPORT_WOL_B}, ++ {HCLGE_COMM_CAP_TM_FLUSH_B, HNAE3_DEV_SUPPORT_TM_FLUSH_B}, + }; + + static const struct hclge_comm_caps_bit_map hclge_vf_cmd_caps[] = { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h +index 18f1b4bf362da..2b7197ce0ae8f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_cmd.h +@@ -153,6 +153,7 @@ enum hclge_opcode_type { + HCLGE_OPC_TM_INTERNAL_STS = 0x0850, + HCLGE_OPC_TM_INTERNAL_CNT = 0x0851, + HCLGE_OPC_TM_INTERNAL_STS_1 = 0x0852, ++ HCLGE_OPC_TM_FLUSH = 0x0872, + + /* Packet buffer allocate commands */ + HCLGE_OPC_TX_BUFF_ALLOC = 0x0901, +@@ -349,6 +350,7 @@ enum HCLGE_COMM_CAP_BITS { + HCLGE_COMM_CAP_FEC_STATS_B = 25, + HCLGE_COMM_CAP_LANE_NUM_B = 27, + HCLGE_COMM_CAP_WOL_B = 28, ++ HCLGE_COMM_CAP_TM_FLUSH_B = 31, + }; + + enum HCLGE_COMM_API_CAP_BITS { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +index 207b2e3f3fc2b..dce158d4aeef6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +@@ -411,6 +411,9 @@ static struct hns3_dbg_cap_info hns3_dbg_cap[] = { + }, { + .name = "support wake on lan", + .cap_bit = HNAE3_DEV_SUPPORT_WOL_B, ++ }, { ++ .name = "support tm flush", ++ .cap_bit = HNAE3_DEV_SUPPORT_TM_FLUSH_B, + } + }; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index 09362823140d5..fad5a5ff3cda5 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -227,6 +227,10 @@ static int hclge_notify_down_uinit(struct hclge_dev *hdev) + if (ret) + return ret; + ++ ret = hclge_tm_flush_cfg(hdev, true); ++ if (ret) ++ return ret; ++ + return hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + } + +@@ -238,6 +242,10 @@ static int hclge_notify_init_up(struct hclge_dev *hdev) + if (ret) + return ret; + ++ ret = hclge_tm_flush_cfg(hdev, false); ++ if (ret) ++ return ret; ++ + return hclge_notify_client(hdev, HNAE3_UP_CLIENT); + } + +@@ -324,6 +332,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + struct net_device *netdev = h->kinfo.netdev; + struct hclge_dev *hdev = vport->back; + u8 i, j, pfc_map, *prio_tc; ++ int last_bad_ret = 0; + int ret; + + if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) +@@ -361,13 +370,28 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + if (ret) + return ret; + +- ret = hclge_buffer_alloc(hdev); +- if (ret) { +- hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ ret = hclge_tm_flush_cfg(hdev, true); ++ if (ret) + return ret; +- } + +- return hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ /* No matter whether the following operations are performed ++ * successfully or not, disabling the tm flush and notify ++ * the network status to up are necessary. ++ * Do not return immediately. ++ */ ++ ret = hclge_buffer_alloc(hdev); ++ if (ret) ++ last_bad_ret = ret; ++ ++ ret = hclge_tm_flush_cfg(hdev, false); ++ if (ret) ++ last_bad_ret = ret; ++ ++ ret = hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ if (ret) ++ last_bad_ret = ret; ++ ++ return last_bad_ret; + } + + static int hclge_ieee_setapp(struct hnae3_handle *h, struct dcb_app *app) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 150f146fa24fb..de509e5751a7c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -1485,7 +1485,11 @@ int hclge_tm_schd_setup_hw(struct hclge_dev *hdev) + return ret; + + /* Cfg schd mode for each level schd */ +- return hclge_tm_schd_mode_hw(hdev); ++ ret = hclge_tm_schd_mode_hw(hdev); ++ if (ret) ++ return ret; ++ ++ return hclge_tm_flush_cfg(hdev, false); + } + + static int hclge_pause_param_setup_hw(struct hclge_dev *hdev) +@@ -2114,3 +2118,28 @@ int hclge_tm_get_port_shaper(struct hclge_dev *hdev, + + return 0; + } ++ ++int hclge_tm_flush_cfg(struct hclge_dev *hdev, bool enable) ++{ ++ struct hclge_desc desc; ++ int ret; ++ ++ if (!hnae3_ae_dev_tm_flush_supported(hdev)) ++ return 0; ++ ++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_TM_FLUSH, false); ++ ++ desc.data[0] = cpu_to_le32(enable ? HCLGE_TM_FLUSH_EN_MSK : 0); ++ ++ ret = hclge_cmd_send(&hdev->hw, &desc, 1); ++ if (ret) { ++ dev_err(&hdev->pdev->dev, ++ "failed to config tm flush, ret = %d\n", ret); ++ return ret; ++ } ++ ++ if (enable) ++ msleep(HCLGE_TM_FLUSH_TIME_MS); ++ ++ return ret; ++} +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +index dd6f1fd486cf2..45dcfef3f90cc 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +@@ -33,6 +33,9 @@ enum hclge_opcode_type; + #define HCLGE_DSCP_MAP_TC_BD_NUM 2 + #define HCLGE_DSCP_TC_SHIFT(n) (((n) & 1) * 4) + ++#define HCLGE_TM_FLUSH_TIME_MS 10 ++#define HCLGE_TM_FLUSH_EN_MSK BIT(0) ++ + struct hclge_pg_to_pri_link_cmd { + u8 pg_id; + u8 rsvd1[3]; +@@ -272,4 +275,5 @@ int hclge_tm_get_port_shaper(struct hclge_dev *hdev, + struct hclge_tm_shaper_para *para); + int hclge_up_to_tc_map(struct hclge_dev *hdev); + int hclge_dscp_to_tc_map(struct hclge_dev *hdev); ++int hclge_tm_flush_cfg(struct hclge_dev *hdev, bool enable); + #endif +-- +2.40.1 + diff --git a/queue-6.4/net-hns3-restore-user-pause-configure-when-disable-a.patch b/queue-6.4/net-hns3-restore-user-pause-configure-when-disable-a.patch new file mode 100644 index 00000000000..7a1578f6e4b --- /dev/null +++ b/queue-6.4/net-hns3-restore-user-pause-configure-when-disable-a.patch @@ -0,0 +1,70 @@ +From 81e72d2f0b86d0e4fdd6480d44d9bd18ff3c07e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Aug 2023 19:34:49 +0800 +Subject: net: hns3: restore user pause configure when disable autoneg + +From: Jian Shen + +[ Upstream commit 15159ec0c831b565820c2de05114ea1b4cf07681 ] + +Restore the mac pause state to user configuration when autoneg is disabled + +Signed-off-by: Jian Shen +Signed-off-by: Peiyang Wang +Signed-off-by: Jijie Shao +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230807113452.474224-2-shaojijie@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 1 + + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index c3e94598f3983..0876890798ba4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -10936,9 +10936,12 @@ int hclge_cfg_flowctrl(struct hclge_dev *hdev) + u32 rx_pause, tx_pause; + u8 flowctl; + +- if (!phydev->link || !phydev->autoneg) ++ if (!phydev->link) + return 0; + ++ if (!phydev->autoneg) ++ return hclge_mac_pause_setup_hw(hdev); ++ + local_advertising = linkmode_adv_to_lcl_adv_t(phydev->advertising); + + if (phydev->pause) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index de509e5751a7c..c58c312217628 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -1553,7 +1553,7 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + return 0; + } + +-static int hclge_mac_pause_setup_hw(struct hclge_dev *hdev) ++int hclge_mac_pause_setup_hw(struct hclge_dev *hdev) + { + bool tx_en, rx_en; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +index 45dcfef3f90cc..53eec6df51946 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.h +@@ -245,6 +245,7 @@ int hclge_pfc_pause_en_cfg(struct hclge_dev *hdev, u8 tx_rx_bitmap, + u8 pfc_bitmap); + int hclge_mac_pause_en_cfg(struct hclge_dev *hdev, bool tx, bool rx); + int hclge_pause_addr_cfg(struct hclge_dev *hdev, const u8 *mac_addr); ++int hclge_mac_pause_setup_hw(struct hclge_dev *hdev); + void hclge_pfc_rx_stats_get(struct hclge_dev *hdev, u64 *stats); + void hclge_pfc_tx_stats_get(struct hclge_dev *hdev, u64 *stats); + int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate); +-- +2.40.1 + diff --git a/queue-6.4/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch b/queue-6.4/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch new file mode 100644 index 00000000000..d1b440dd87f --- /dev/null +++ b/queue-6.4/net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch @@ -0,0 +1,65 @@ +From 2d03232270aa56a03a754b2890d3420882e01ad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 13:05:56 +0200 +Subject: net: sfp: handle 100G/25G active optical cables in sfp_parse_support + +From: Josua Mayer + +[ Upstream commit db1a6ad77c180efc7242d7204b9a0c72c8a5a1bb ] + +Handle extended compliance code 0x1 (SFF8024_ECC_100G_25GAUI_C2M_AOC) +for active optical cables supporting 25G and 100G speeds. + +Since the specification makes no statement about transmitter range, and +as the specific sfp module that had been tested features only 2m fiber - +short-range (SR) modes are selected. + +The 100G speed is irrelevant because it would require multiple fibers / +multiple SFP28 modules combined under one netdev. +sfp-bus.c only handles a single module per netdev, so only 25Gbps modes +are selected. + +sfp_parse_support already handles SFF8024_ECC_100GBASE_SR4_25GBASE_SR +with compatible properties, however that entry is a contradiction in +itself since with SFP(28) 100GBASE_SR4 is impossible - that would likely +be a mode for qsfp modules only. + +Add a case for SFF8024_ECC_100G_25GAUI_C2M_AOC selecting 25gbase-r +interface mode and 25000baseSR link mode. +Also enforce SFP28 bitrate limits on the values read from sfp eeprom as +requested by Russell King. + +Tested with fs.com S28-AO02 AOC SFP28 module. + +Signed-off-by: Josua Mayer +Reviewed-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp-bus.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index 9372e5a4cadcf..5093fc82a0248 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -258,6 +258,16 @@ void sfp_parse_support(struct sfp_bus *bus, const struct sfp_eeprom_id *id, + switch (id->base.extended_cc) { + case SFF8024_ECC_UNSPEC: + break; ++ case SFF8024_ECC_100G_25GAUI_C2M_AOC: ++ if (br_min <= 28000 && br_max >= 25000) { ++ /* 25GBASE-R, possibly with FEC */ ++ __set_bit(PHY_INTERFACE_MODE_25GBASER, interfaces); ++ /* There is currently no link mode for 25000base ++ * with unspecified range, reuse SR. ++ */ ++ phylink_set(modes, 25000baseSR_Full); ++ } ++ break; + case SFF8024_ECC_100GBASE_SR4_25GBASE_SR: + phylink_set(modes, 100000baseSR4_Full); + phylink_set(modes, 25000baseSR_Full); +-- +2.40.1 + diff --git a/queue-6.4/net-usb-qmi_wwan-add-quectel-em05gv2.patch b/queue-6.4/net-usb-qmi_wwan-add-quectel-em05gv2.patch new file mode 100644 index 00000000000..fbc74e5f24f --- /dev/null +++ b/queue-6.4/net-usb-qmi_wwan-add-quectel-em05gv2.patch @@ -0,0 +1,64 @@ +From a59393f34ee32417c91db431cf02975cf262d297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 20:00:43 +0000 +Subject: net: usb: qmi_wwan: add Quectel EM05GV2 + +From: Martin Kohn + +[ Upstream commit d4480c9bb9258db9ddf2e632f6ef81e96b41089c ] + +Add support for Quectel EM05GV2 (G=global) with vendor ID +0x2c7c and product ID 0x030e + +Enabling DTR on this modem was necessary to ensure stable operation. +Patch for usb: serial: option: is also in progress. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=030e Rev= 3.18 +S: Manufacturer=Quectel +S: Product=Quectel EM05-G +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Martin Kohn +Link: https://lore.kernel.org/r/AM0PR04MB57648219DE893EE04FA6CC759701A@AM0PR04MB5764.eurprd04.prod.outlook.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 2e7c7b0cdc549..c1bcd2ab1488e 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1423,6 +1423,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */ + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ ++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */ + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ +-- +2.40.1 + diff --git a/queue-6.4/ovl-always-reevaluate-the-file-signature-for-ima.patch b/queue-6.4/ovl-always-reevaluate-the-file-signature-for-ima.patch new file mode 100644 index 00000000000..91e037c1fb7 --- /dev/null +++ b/queue-6.4/ovl-always-reevaluate-the-file-signature-for-ima.patch @@ -0,0 +1,44 @@ +From f16c844c7ad5a2db18bb36ae1d7f6c5e55236c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 17:56:46 -0400 +Subject: ovl: Always reevaluate the file signature for IMA + +From: Eric Snowberg + +[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ] + +Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") +partially closed an IMA integrity issue when directly modifying a file +on the lower filesystem. If the overlay file is first opened by a user +and later the lower backing file is modified by root, but the extended +attribute is NOT updated, the signature validation succeeds with the old +original signature. + +Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to +force signature reevaluation on every file access until a fine grained +solution can be found. + +Signed-off-by: Eric Snowberg +Signed-off-by: Mimi Zohar +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/overlayfs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index ae1058fbfb5b2..8c60da7b4afd8 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -2052,7 +2052,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) + ovl_trusted_xattr_handlers; + sb->s_fs_info = ofs; + sb->s_flags |= SB_POSIXACL; +- sb->s_iflags |= SB_I_SKIP_SYNC; ++ sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE; + + err = -ENOMEM; + root_dentry = ovl_get_root(sb, upperpath.dentry, oe); +-- +2.40.1 + diff --git a/queue-6.4/partially-revert-drm-amd-display-fix-possible-underf.patch b/queue-6.4/partially-revert-drm-amd-display-fix-possible-underf.patch new file mode 100644 index 00000000000..328ef021b94 --- /dev/null +++ b/queue-6.4/partially-revert-drm-amd-display-fix-possible-underf.patch @@ -0,0 +1,46 @@ +From 712e5fd7f3e5e22585329d414ed28304b08effa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:47:35 -0400 +Subject: Partially revert "drm/amd/display: Fix possible underflow for + displays with large vblank" + +From: Daniel Miess + +[ Upstream commit a99a4ff6ef205d125002fc7e0857074e4e6597b6 ] + +This partially reverts commit de231189e7bf ("drm/amd/display: Fix +possible underflow for displays with large vblank"). + +[Why] +The increased value of VBlankNomDefaultUS causes underflow at the +desktop of an IP KVM setup + +[How] +Change the value from 800 back to 668 + +Reviewed-by: Nicholas Kazlauskas +Reviewed-by: Jun Lei +Acked-by: Hamza Mahfooz +Signed-off-by: Daniel Miess +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c +index b878effa2129b..b428a343add9c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn314/dcn314_fpu.c +@@ -33,7 +33,7 @@ + #include "dml/display_mode_vba.h" + + struct _vcs_dpi_ip_params_st dcn3_14_ip = { +- .VBlankNomDefaultUS = 800, ++ .VBlankNomDefaultUS = 668, + .gpuvm_enable = 1, + .gpuvm_max_page_table_levels = 1, + .hostvm_enable = 1, +-- +2.40.1 + diff --git a/queue-6.4/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch b/queue-6.4/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch new file mode 100644 index 00000000000..c336265d6d9 --- /dev/null +++ b/queue-6.4/phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch @@ -0,0 +1,48 @@ +From e8d97d3d166acbad8bfeebf3c034e6935255e8bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 10:45:40 -0400 +Subject: phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error + code + +From: Adrien Thierry + +[ Upstream commit 8932089b566c24ea19b57e37704c492678de1420 ] + +The return value from qcom_snps_hsphy_suspend/resume is not used. Make +sure qcom_snps_hsphy_runtime_suspend/resume return this value as well. + +Signed-off-by: Adrien Thierry +Link: https://lore.kernel.org/r/20230629144542.14906-4-athierry@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index 6170f8fd118e2..d0319bee01c0f 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -214,8 +214,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_suspend(struct device *dev) + if (!hsphy->phy_initialized) + return 0; + +- qcom_snps_hsphy_suspend(hsphy); +- return 0; ++ return qcom_snps_hsphy_suspend(hsphy); + } + + static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev) +@@ -225,8 +224,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev) + if (!hsphy->phy_initialized) + return 0; + +- qcom_snps_hsphy_resume(hsphy); +- return 0; ++ return qcom_snps_hsphy_resume(hsphy); + } + + static int qcom_snps_hsphy_set_mode(struct phy *phy, enum phy_mode mode, +-- +2.40.1 + diff --git a/queue-6.4/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch b/queue-6.4/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch new file mode 100644 index 00000000000..62b6e1ad830 --- /dev/null +++ b/queue-6.4/platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch @@ -0,0 +1,40 @@ +From bdb13b5103c268746a127ea702e0c9c933a32b23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Aug 2023 11:06:27 -0400 +Subject: platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE + notifications + +From: Shih-Yi Chen + +[ Upstream commit 0848cab765c634597636810bf76d0934003cce28 ] + +rshim console does not show all entries of dmesg. + +Fixed by setting MLXBF_TM_TX_LWM_IRQ for every CONSOLE notification. + +Signed-off-by: Shih-Yi Chen +Reviewed-by: Liming Sung +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/20230821150627.26075-1-shihyic@nvidia.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-tmfifo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index a79318e90a139..b600b77d91ef2 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -887,6 +887,7 @@ static bool mlxbf_tmfifo_virtio_notify(struct virtqueue *vq) + tm_vdev = fifo->vdev[VIRTIO_ID_CONSOLE]; + mlxbf_tmfifo_console_output(tm_vdev, vring); + spin_unlock_irqrestore(&fifo->spin_lock[0], flags); ++ set_bit(MLXBF_TM_TX_LWM_IRQ, &fifo->pend_events); + } else if (test_and_set_bit(MLXBF_TM_TX_LWM_IRQ, + &fifo->pend_events)) { + return true; +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch b/queue-6.4/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch new file mode 100644 index 00000000000..487982221f5 --- /dev/null +++ b/queue-6.4/platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch @@ -0,0 +1,44 @@ +From cd6162cab2f3505fad33b08ca3f37f34c2e2e527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 09:43:15 +0800 +Subject: platform/x86/amd/pmf: Fix unsigned comparison with less than zero + +From: Yang Li + +[ Upstream commit 785c00993dc4c4bb2f7b0f3a3f29c03a6f7aab2e ] + +The return value from the call to amd_pmf_get_pprof_modes() is int. +However, the return value is being assigned to an unsigned char +variable 'mode', so making 'mode' an int. + +silence the warning: +./drivers/platform/x86/amd/pmf/sps.c:183:5-9: WARNING: Unsigned expression compared with zero: mode < 0 + +Reported-by: Abaci Robot +Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5995 +Signed-off-by: Yang Li +Link: https://lore.kernel.org/r/20230727014315.51375-1-yang.lee@linux.alibaba.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/amd/pmf/sps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/amd/pmf/sps.c b/drivers/platform/x86/amd/pmf/sps.c +index fd448844de206..b2cf62937227c 100644 +--- a/drivers/platform/x86/amd/pmf/sps.c ++++ b/drivers/platform/x86/amd/pmf/sps.c +@@ -121,7 +121,8 @@ int amd_pmf_get_pprof_modes(struct amd_pmf_dev *pmf) + + int amd_pmf_power_slider_update_event(struct amd_pmf_dev *dev) + { +- u8 mode, flag = 0; ++ u8 flag = 0; ++ int mode; + int src; + + mode = amd_pmf_get_pprof_modes(dev); +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch b/queue-6.4/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch new file mode 100644 index 00000000000..9a10bf49c03 --- /dev/null +++ b/queue-6.4/platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch @@ -0,0 +1,56 @@ +From 56f6ff6471d5673187320502196fadb8398ab8a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 18:29:50 +0300 +Subject: platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops + +From: Kristian Angelov + +[ Upstream commit 6a758a3e831ce1a84c9c209ac6dc755f4c8ce77a ] + +This patch fixes setting the cmd values to 0xb3 and 0xb4. +This is necessary on some TUF laptops in order to set the RGB mode. + +Closes: https://lore.kernel.org/platform-driver-x86/443078148.491022.1677576298133@nm83.abv.bg +Signed-off-by: Kristian Angelov +Reviewed-by: Luke D. Jones +Link: https://lore.kernel.org/r/ZLlS7o6UdTUBkyqa@wyvern.localdomain +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 1038dfdcdd325..8bef66a2f0ce7 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -738,13 +738,23 @@ static ssize_t kbd_rgb_mode_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) + { +- u32 cmd, mode, r, g, b, speed; ++ u32 cmd, mode, r, g, b, speed; + int err; + + if (sscanf(buf, "%d %d %d %d %d %d", &cmd, &mode, &r, &g, &b, &speed) != 6) + return -EINVAL; + +- cmd = !!cmd; ++ /* B3 is set and B4 is save to BIOS */ ++ switch (cmd) { ++ case 0: ++ cmd = 0xb3; ++ break; ++ case 1: ++ cmd = 0xb4; ++ break; ++ default: ++ return -EINVAL; ++ } + + /* These are the known usable modes across all TUF/ROG */ + if (mode >= 12 || mode == 9) +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch b/queue-6.4/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch new file mode 100644 index 00000000000..254f2e751b4 --- /dev/null +++ b/queue-6.4/platform-x86-huawei-wmi-silence-ambient-light-sensor.patch @@ -0,0 +1,55 @@ +From 3f0021dd7047659f464ac6c821e6a3b4692fc543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jul 2023 18:59:20 +0300 +Subject: platform/x86: huawei-wmi: Silence ambient light sensor + +From: Konstantin Shelekhin + +[ Upstream commit c21733754cd6ecbca346f2adf9b17d4cfa50504f ] + +Currently huawei-wmi causes a lot of spam in dmesg on my +Huawei MateBook X Pro 2022: + + ... + [36409.328463] input input9: Unknown key pressed, code: 0x02c1 + [36411.335104] input input9: Unknown key pressed, code: 0x02c1 + [36412.338674] input input9: Unknown key pressed, code: 0x02c1 + [36414.848564] input input9: Unknown key pressed, code: 0x02c1 + [36416.858706] input input9: Unknown key pressed, code: 0x02c1 + ... + +Fix that by ignoring events generated by ambient light sensor. + +This issue was reported on GitHub and resolved with the following merge +request: + + https://github.com/aymanbagabas/Huawei-WMI/pull/70 + +I've contacted the mainter of this repo and he gave me the "go ahead" to +send this patch to the maling list. + +Signed-off-by: Konstantin Shelekhin +Link: https://lore.kernel.org/r/20230722155922.173856-1-k.shelekhin@ftml.net +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index 70e5c4c0574d5..0ef1c46b617b6 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -85,6 +85,8 @@ static const struct key_entry huawei_wmi_keymap[] = { + { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, + { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } }, + { KE_IGNORE, 0x295, { KEY_KBDILLUMUP } }, ++ // Ignore Ambient Light Sensoring ++ { KE_KEY, 0x2c1, { KEY_RESERVED } }, + { KE_END, 0 } + }; + +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch b/queue-6.4/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch new file mode 100644 index 00000000000..143b38119b4 --- /dev/null +++ b/queue-6.4/platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch @@ -0,0 +1,51 @@ +From f80c78833c867bc7123a80e6794893ebe515d610 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jul 2023 21:32:13 +0300 +Subject: platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks + +From: Maxim Mikityanskiy + +[ Upstream commit 7783e97f8558ad7a4d1748922461bc88483fbcdf ] + +HP Elite Dragonfly G2 (a convertible laptop/tablet) has a reliable VGBS +method. If VGBS is not called on boot, the firmware sends an initial +0xcd event shortly after calling the BTNL method, but only if the device +is booted in the laptop mode. However, if the device is booted in the +tablet mode and VGBS is not called, there is no initial 0xcc event, and +the input device for SW_TABLET_MODE is not registered up until the user +turns the device into the laptop mode. + +Call VGBS on boot on this device to get the initial state of +SW_TABLET_MODE in a reliable way. + +Tested with BIOS 1.13.1. + +Signed-off-by: Maxim Mikityanskiy +Link: https://lore.kernel.org/r/20230716183213.64173-1-maxtram95@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 641f2797406e1..7457ca2b27a60 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -150,6 +150,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"), ++ }, ++ }, + { } + }; + +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-intel-hid-always-call-btnl-acpi-method.patch b/queue-6.4/platform-x86-intel-hid-always-call-btnl-acpi-method.patch new file mode 100644 index 00000000000..cb96a51f1a5 --- /dev/null +++ b/queue-6.4/platform-x86-intel-hid-always-call-btnl-acpi-method.patch @@ -0,0 +1,73 @@ +From aeea4152f73dc093d0a4f3971767daea7b68c622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jul 2023 20:15:16 +0200 +Subject: platform/x86: intel: hid: Always call BTNL ACPI method + +From: Hans de Goede + +[ Upstream commit e3ab18de2b09361d6f0e4aafb9cfd6d002ce43a1 ] + +On a HP Elite Dragonfly G2 the 0xcc and 0xcd events for SW_TABLET_MODE +are only send after the BTNL ACPI method has been called. + +Likely more devices need this, so make the BTNL ACPI method unconditional +instead of only doing it on devices with a 5 button array. + +Note this also makes the intel_button_array_enable() call in probe() +unconditional, that function does its own priv->array check. This makes +the intel_button_array_enable() call in probe() consistent with the calls +done on suspend/resume which also rely on the priv->array check inside +the function. + +Reported-by: Maxim Mikityanskiy +Closes: https://lore.kernel.org/platform-driver-x86/20230712175023.31651-1-maxtram95@gmail.com/ +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230715181516.5173-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 5632bd3c534a3..641f2797406e1 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -620,7 +620,7 @@ static bool button_array_present(struct platform_device *device) + static int intel_hid_probe(struct platform_device *device) + { + acpi_handle handle = ACPI_HANDLE(&device->dev); +- unsigned long long mode; ++ unsigned long long mode, dummy; + struct intel_hid_priv *priv; + acpi_status status; + int err; +@@ -692,18 +692,15 @@ static int intel_hid_probe(struct platform_device *device) + if (err) + goto err_remove_notify; + +- if (priv->array) { +- unsigned long long dummy; ++ intel_button_array_enable(&device->dev, true); + +- intel_button_array_enable(&device->dev, true); +- +- /* Call button load method to enable HID power button */ +- if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, +- &dummy)) { +- dev_warn(&device->dev, +- "failed to enable HID power button\n"); +- } +- } ++ /* ++ * Call button load method to enable HID power button ++ * Always do this since it activates events on some devices without ++ * a button array too. ++ */ ++ if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, &dummy)) ++ dev_warn(&device->dev, "failed to enable HID power button\n"); + + device_init_wakeup(&device->dev, true); + /* +-- +2.40.1 + diff --git a/queue-6.4/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch b/queue-6.4/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch new file mode 100644 index 00000000000..de53f8f1c27 --- /dev/null +++ b/queue-6.4/platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch @@ -0,0 +1,43 @@ +From 03fb49b742dac8151519d67d499c76eb992c42f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 18:11:02 +0800 +Subject: platform/x86: think-lmi: Use kfree_sensitive instead of kfree + +From: Wang Ming + +[ Upstream commit 1da0893aed2e48e2bdf37c29b029f2e060d25927 ] + +key might contain private part of the key, so better use +kfree_sensitive to free it. + +Signed-off-by: Wang Ming +Link: https://lore.kernel.org/r/20230717101114.18966-1-machel@vivo.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index e4047ee0a7546..63eca13fd882f 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -719,12 +719,12 @@ static ssize_t cert_to_password_store(struct kobject *kobj, + /* Format: 'Password,Signature' */ + auth_str = kasprintf(GFP_KERNEL, "%s,%s", passwd, setting->signature); + if (!auth_str) { +- kfree(passwd); ++ kfree_sensitive(passwd); + return -ENOMEM; + } + ret = tlmi_simple_call(LENOVO_CERT_TO_PASSWORD_GUID, auth_str); + kfree(auth_str); +- kfree(passwd); ++ kfree_sensitive(passwd); + + return ret ?: count; + } +-- +2.40.1 + diff --git a/queue-6.4/powerpc-powermac-use-early_-io-variants-in-via_calib.patch b/queue-6.4/powerpc-powermac-use-early_-io-variants-in-via_calib.patch new file mode 100644 index 00000000000..2fb80241c5e --- /dev/null +++ b/queue-6.4/powerpc-powermac-use-early_-io-variants-in-via_calib.patch @@ -0,0 +1,69 @@ +From 1a8b632eac572b7ef602998ffaca7e6a63194f8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jul 2023 11:08:16 +1000 +Subject: powerpc/powermac: Use early_* IO variants in via_calibrate_decr() + +From: Benjamin Gray + +[ Upstream commit 86582e6189dd8f9f52c25d46c70fe5d111da6345 ] + +On a powermac platform, via the call path: + + start_kernel() + time_init() + ppc_md.calibrate_decr() (pmac_calibrate_decr) + via_calibrate_decr() + +ioremap() and iounmap() are called. The unmap can enable interrupts +unexpectedly (cond_resched() in vunmap_pmd_range()), which causes a +warning later in the boot sequence in start_kernel(). + +Use the early_* variants of these IO functions to prevent this. + +The issue is pre-existing, but is surfaced by commit 721255b9826b +("genirq: Use a maple tree for interrupt descriptor management"). + +Signed-off-by: Benjamin Gray +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230706010816.72682-1-bgray@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powermac/time.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/platforms/powermac/time.c b/arch/powerpc/platforms/powermac/time.c +index 4c5790aff1b54..8633891b7aa58 100644 +--- a/arch/powerpc/platforms/powermac/time.c ++++ b/arch/powerpc/platforms/powermac/time.c +@@ -26,8 +26,8 @@ + #include + #include + ++#include + #include +-#include + #include + #include + #include +@@ -182,7 +182,7 @@ static int __init via_calibrate_decr(void) + return 0; + } + of_node_put(vias); +- via = ioremap(rsrc.start, resource_size(&rsrc)); ++ via = early_ioremap(rsrc.start, resource_size(&rsrc)); + if (via == NULL) { + printk(KERN_ERR "Failed to map VIA for timer calibration !\n"); + return 0; +@@ -207,7 +207,7 @@ static int __init via_calibrate_decr(void) + + ppc_tb_freq = (dstart - dend) * 100 / 6; + +- iounmap(via); ++ early_iounmap((void *)via, resource_size(&rsrc)); + + return 1; + } +-- +2.40.1 + diff --git a/queue-6.4/revert-bridge-add-extack-warning-when-enabling-stp-i.patch b/queue-6.4/revert-bridge-add-extack-warning-when-enabling-stp-i.patch new file mode 100644 index 00000000000..ad46b8ca127 --- /dev/null +++ b/queue-6.4/revert-bridge-add-extack-warning-when-enabling-stp-i.patch @@ -0,0 +1,67 @@ +From 54ab5ce6151f04895fab91dfbe93cbf2550b5a8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 10:41:52 -0700 +Subject: Revert "bridge: Add extack warning when enabling STP in netns." + +From: Kuniyuki Iwashima + +[ Upstream commit 7ebd00a5a20c48e6020d49a3b2afb3cdfd2da8b7 ] + +This reverts commit 56a16035bb6effb37177867cea94c13a8382f745. + +Since the previous commit, STP works on bridge in netns. + + # unshare -n + # ip link add br0 type bridge + # ip link add veth0 type veth peer name veth1 + + # ip link set veth0 master br0 up + [ 50.558135] br0: port 1(veth0) entered blocking state + [ 50.558366] br0: port 1(veth0) entered disabled state + [ 50.558798] veth0: entered allmulticast mode + [ 50.564401] veth0: entered promiscuous mode + + # ip link set veth1 master br0 up + [ 54.215487] br0: port 2(veth1) entered blocking state + [ 54.215657] br0: port 2(veth1) entered disabled state + [ 54.215848] veth1: entered allmulticast mode + [ 54.219577] veth1: entered promiscuous mode + + # ip link set br0 type bridge stp_state 1 + # ip link set br0 up + [ 61.960726] br0: port 2(veth1) entered blocking state + [ 61.961097] br0: port 2(veth1) entered listening state + [ 61.961495] br0: port 1(veth0) entered blocking state + [ 61.961653] br0: port 1(veth0) entered listening state + [ 63.998835] br0: port 2(veth1) entered blocking state + [ 77.437113] br0: port 1(veth0) entered learning state + [ 86.653501] br0: received packet on veth0 with own address as source address (addr:6e:0f:e7:6f:5f:5f, vlan:0) + [ 92.797095] br0: port 1(veth0) entered forwarding state + [ 92.797398] br0: topology change detected, propagating + +Let's remove the warning. + +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/bridge/br_stp_if.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c +index b65962682771f..75204d36d7f90 100644 +--- a/net/bridge/br_stp_if.c ++++ b/net/bridge/br_stp_if.c +@@ -201,9 +201,6 @@ int br_stp_set_enabled(struct net_bridge *br, unsigned long val, + { + ASSERT_RTNL(); + +- if (!net_eq(dev_net(br->dev), &init_net)) +- NL_SET_ERR_MSG_MOD(extack, "STP does not work in non-root netns"); +- + if (br_mrp_enabled(br)) { + NL_SET_ERR_MSG_MOD(extack, + "STP can't be enabled if MRP is already enabled"); +-- +2.40.1 + diff --git a/queue-6.4/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch b/queue-6.4/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch new file mode 100644 index 00000000000..e355bed3610 --- /dev/null +++ b/queue-6.4/revert-wifi-ath6k-silence-false-positive-wno-danglin.patch @@ -0,0 +1,42 @@ +From 1167241bf286ee0e19a05425a092fc94f0b70ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 13:08:23 +0300 +Subject: Revert "wifi: ath6k: silence false positive -Wno-dangling-pointer + warning on GCC 12" + +From: Kalle Valo + +[ Upstream commit a1ce186db7f0e449f35d12fb55ae0da2a1b400e2 ] + +This reverts commit bd1d129daa3ede265a880e2c6a7f91eab0f4dc62. + +The dangling-pointer warnings were disabled kernel-wide by commit 49beadbd47c2 +("gcc-12: disable '-Wdangling-pointer' warning for now") for v5.19. So this +hack in ath6kl is not needed anymore. + +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230724100823.2948804-1-kvalo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/Makefile | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/Makefile b/drivers/net/wireless/ath/ath6kl/Makefile +index a75bfa9fd1cfd..dc2b3b46781e1 100644 +--- a/drivers/net/wireless/ath/ath6kl/Makefile ++++ b/drivers/net/wireless/ath/ath6kl/Makefile +@@ -36,11 +36,6 @@ ath6kl_core-y += wmi.o + ath6kl_core-y += core.o + ath6kl_core-y += recovery.o + +-# FIXME: temporarily silence -Wdangling-pointer on non W=1+ builds +-ifndef KBUILD_EXTRA_WARN +-CFLAGS_htc_mbox.o += $(call cc-disable-warning, dangling-pointer) +-endif +- + ath6kl_core-$(CONFIG_NL80211_TESTMODE) += testmode.o + ath6kl_core-$(CONFIG_ATH6KL_TRACING) += trace.o + +-- +2.40.1 + diff --git a/queue-6.4/s390-dasd-fix-hanging-device-after-request-requeue.patch b/queue-6.4/s390-dasd-fix-hanging-device-after-request-requeue.patch new file mode 100644 index 00000000000..1d8670a119c --- /dev/null +++ b/queue-6.4/s390-dasd-fix-hanging-device-after-request-requeue.patch @@ -0,0 +1,222 @@ +From fcd13bf19c0c3049d73ffa31714d0ad6f8060443 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 21:36:46 +0200 +Subject: s390/dasd: fix hanging device after request requeue + +From: Stefan Haberland + +[ Upstream commit 8a2278ce9c25048d999fe1a3561def75d963f471 ] + +The DASD device driver has a function to requeue requests to the +blocklayer. +This function is used in various cases when basic settings for the device +have to be changed like High Performance Ficon related parameters or copy +pair settings. + +The functions iterates over the device->ccw_queue and also removes the +requests from the block->ccw_queue. +In case the device is started on an alias device instead of the base +device it might be removed from the block->ccw_queue without having it +canceled properly before. This might lead to a hanging device since the +request is no longer on a queue and can not be handled properly. + +Fix by iterating over the block->ccw_queue instead of the +device->ccw_queue. This will take care of all blocklayer related requests +and handle them on all associated DASD devices. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20230721193647.3889634-4-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd.c | 125 +++++++++++++++----------------------- + 1 file changed, 48 insertions(+), 77 deletions(-) + +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index 9fbfce735d565..50c48a48fcae3 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2938,41 +2938,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data) + * Requeue a request back to the block request queue + * only works for block requests + */ +-static int _dasd_requeue_request(struct dasd_ccw_req *cqr) ++static void _dasd_requeue_request(struct dasd_ccw_req *cqr) + { +- struct dasd_block *block = cqr->block; + struct request *req; + +- if (!block) +- return -EINVAL; + /* + * If the request is an ERP request there is nothing to requeue. + * This will be done with the remaining original request. + */ + if (cqr->refers) +- return 0; ++ return; + spin_lock_irq(&cqr->dq->lock); + req = (struct request *) cqr->callback_data; + blk_mq_requeue_request(req, true); + spin_unlock_irq(&cqr->dq->lock); + +- return 0; ++ return; + } + +-/* +- * Go through all request on the dasd_block request queue, cancel them +- * on the respective dasd_device, and return them to the generic +- * block layer. +- */ +-static int dasd_flush_block_queue(struct dasd_block *block) ++static int _dasd_requests_to_flushqueue(struct dasd_block *block, ++ struct list_head *flush_queue) + { + struct dasd_ccw_req *cqr, *n; +- int rc, i; +- struct list_head flush_queue; + unsigned long flags; ++ int rc, i; + +- INIT_LIST_HEAD(&flush_queue); +- spin_lock_bh(&block->queue_lock); ++ spin_lock_irqsave(&block->queue_lock, flags); + rc = 0; + restart: + list_for_each_entry_safe(cqr, n, &block->ccw_queue, blocklist) { +@@ -2987,13 +2978,32 @@ static int dasd_flush_block_queue(struct dasd_block *block) + * is returned from the dasd_device layer. + */ + cqr->callback = _dasd_wake_block_flush_cb; +- for (i = 0; cqr != NULL; cqr = cqr->refers, i++) +- list_move_tail(&cqr->blocklist, &flush_queue); ++ for (i = 0; cqr; cqr = cqr->refers, i++) ++ list_move_tail(&cqr->blocklist, flush_queue); + if (i > 1) + /* moved more than one request - need to restart */ + goto restart; + } +- spin_unlock_bh(&block->queue_lock); ++ spin_unlock_irqrestore(&block->queue_lock, flags); ++ ++ return rc; ++} ++ ++/* ++ * Go through all request on the dasd_block request queue, cancel them ++ * on the respective dasd_device, and return them to the generic ++ * block layer. ++ */ ++static int dasd_flush_block_queue(struct dasd_block *block) ++{ ++ struct dasd_ccw_req *cqr, *n; ++ struct list_head flush_queue; ++ unsigned long flags; ++ int rc; ++ ++ INIT_LIST_HEAD(&flush_queue); ++ rc = _dasd_requests_to_flushqueue(block, &flush_queue); ++ + /* Now call the callback function of flushed requests */ + restart_cb: + list_for_each_entry_safe(cqr, n, &flush_queue, blocklist) { +@@ -3878,75 +3888,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_space_avail); + */ + int dasd_generic_requeue_all_requests(struct dasd_device *device) + { ++ struct dasd_block *block = device->block; + struct list_head requeue_queue; + struct dasd_ccw_req *cqr, *n; +- struct dasd_ccw_req *refers; + int rc; + +- INIT_LIST_HEAD(&requeue_queue); +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- rc = 0; +- list_for_each_entry_safe(cqr, n, &device->ccw_queue, devlist) { +- /* Check status and move request to flush_queue */ +- if (cqr->status == DASD_CQR_IN_IO) { +- rc = device->discipline->term_IO(cqr); +- if (rc) { +- /* unable to terminate requeust */ +- dev_err(&device->cdev->dev, +- "Unable to terminate request %p " +- "on suspend\n", cqr); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- dasd_put_device(device); +- return rc; +- } +- } +- list_move_tail(&cqr->devlist, &requeue_queue); +- } +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- +- list_for_each_entry_safe(cqr, n, &requeue_queue, devlist) { +- wait_event(dasd_flush_wq, +- (cqr->status != DASD_CQR_CLEAR_PENDING)); ++ if (!block) ++ return 0; + +- /* +- * requeue requests to blocklayer will only work +- * for block device requests +- */ +- if (_dasd_requeue_request(cqr)) +- continue; ++ INIT_LIST_HEAD(&requeue_queue); ++ rc = _dasd_requests_to_flushqueue(block, &requeue_queue); + +- /* remove requests from device and block queue */ +- list_del_init(&cqr->devlist); +- while (cqr->refers != NULL) { +- refers = cqr->refers; +- /* remove the request from the block queue */ +- list_del(&cqr->blocklist); +- /* free the finished erp request */ +- dasd_free_erp_request(cqr, cqr->memdev); +- cqr = refers; ++ /* Now call the callback function of flushed requests */ ++restart_cb: ++ list_for_each_entry_safe(cqr, n, &requeue_queue, blocklist) { ++ wait_event(dasd_flush_wq, (cqr->status < DASD_CQR_QUEUED)); ++ /* Process finished ERP request. */ ++ if (cqr->refers) { ++ spin_lock_bh(&block->queue_lock); ++ __dasd_process_erp(block->base, cqr); ++ spin_unlock_bh(&block->queue_lock); ++ /* restart list_for_xx loop since dasd_process_erp ++ * might remove multiple elements ++ */ ++ goto restart_cb; + } +- +- /* +- * _dasd_requeue_request already checked for a valid +- * blockdevice, no need to check again +- * all erp requests (cqr->refers) have a cqr->block +- * pointer copy from the original cqr +- */ ++ _dasd_requeue_request(cqr); + list_del_init(&cqr->blocklist); + cqr->block->base->discipline->free_cp( + cqr, (struct request *) cqr->callback_data); + } +- +- /* +- * if requests remain then they are internal request +- * and go back to the device queue +- */ +- if (!list_empty(&requeue_queue)) { +- /* move freeze_queue to start of the ccw_queue */ +- spin_lock_irq(get_ccwdev_lock(device->cdev)); +- list_splice_tail(&requeue_queue, &device->ccw_queue); +- spin_unlock_irq(get_ccwdev_lock(device->cdev)); +- } + dasd_schedule_device_bh(device); + return rc; + } +-- +2.40.1 + diff --git a/queue-6.4/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch b/queue-6.4/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch new file mode 100644 index 00000000000..8c794262068 --- /dev/null +++ b/queue-6.4/s390-dasd-use-correct-number-of-retries-for-erp-requ.patch @@ -0,0 +1,45 @@ +From 199eefef526b062a965830e90238839000ba1637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 21:36:45 +0200 +Subject: s390/dasd: use correct number of retries for ERP requests + +From: Stefan Haberland + +[ Upstream commit acea28a6b74f458defda7417d2217b051ba7d444 ] + +If a DASD request fails an error recovery procedure (ERP) request might +be built as a copy of the original request to do error recovery. + +The ERP request gets a number of retries assigned. +This number is always 256 no matter what other value might have been set +for the original request. This is not what is expected when a user +specifies a certain amount of retries for the device via sysfs. + +Correctly use the number of retries of the original request for ERP +requests. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20230721193647.3889634-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_3990_erp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index f0f210627cadf..89957bb7244d2 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2441,7 +2441,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr) + erp->block = cqr->block; + erp->magic = cqr->magic; + erp->expires = cqr->expires; +- erp->retries = 256; ++ erp->retries = device->default_retries; + erp->buildclk = get_tod_clock(); + erp->status = DASD_CQR_FILLED; + +-- +2.40.1 + diff --git a/queue-6.4/scsi-lpfc-remove-reftag-check-in-dif-paths.patch b/queue-6.4/scsi-lpfc-remove-reftag-check-in-dif-paths.patch new file mode 100644 index 00000000000..efb9649ec1f --- /dev/null +++ b/queue-6.4/scsi-lpfc-remove-reftag-check-in-dif-paths.patch @@ -0,0 +1,108 @@ +From 6ddf4428a0e3a97595d2f2625674623e99f95ed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 14:19:32 -0700 +Subject: scsi: lpfc: Remove reftag check in DIF paths + +From: Justin Tee + +[ Upstream commit 8eebf0e84f0614cebc7347f7bbccba4056d77d42 ] + +When preparing protection DIF I/O for DMA, the driver obtains reference +tags from scsi_prot_ref_tag(). Previously, there was a wrong assumption +that an all 0xffffffff value meant error and thus the driver failed the +I/O. This patch removes the evaluation code and accepts whatever the upper +layer returns. + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20230803211932.155745-1-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_scsi.c | 20 +++----------------- + 1 file changed, 3 insertions(+), 17 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index e989f130434e4..e34a41fb3e1cb 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -109,8 +109,6 @@ lpfc_sli4_set_rsp_sgl_last(struct lpfc_hba *phba, + } + } + +-#define LPFC_INVALID_REFTAG ((u32)-1) +- + /** + * lpfc_rampdown_queue_depth - Post RAMP_DOWN_QUEUE event to worker thread + * @phba: The Hba for which this call is being executed. +@@ -978,8 +976,6 @@ lpfc_bg_err_inject(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + sgpe = scsi_prot_sglist(sc); + lba = scsi_prot_ref_tag(sc); +- if (lba == LPFC_INVALID_REFTAG) +- return 0; + + /* First check if we need to match the LBA */ + if (phba->lpfc_injerr_lba != LPFC_INJERR_LBA_OFF) { +@@ -1560,8 +1556,6 @@ lpfc_bg_setup_bpl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + /* extract some info from the scsi command for pde*/ + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -1723,8 +1717,6 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + /* extract some info from the scsi command */ + blksize = scsi_prot_interval(sc); + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -1953,8 +1945,6 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + + /* extract some info from the scsi command for pde*/ + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -2154,8 +2144,6 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + /* extract some info from the scsi command */ + blksize = scsi_prot_interval(sc); + reftag = scsi_prot_ref_tag(sc); +- if (reftag == LPFC_INVALID_REFTAG) +- goto out; + + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + rc = lpfc_bg_err_inject(phba, sc, &reftag, NULL, 1); +@@ -2746,8 +2734,6 @@ lpfc_calc_bg_err(struct lpfc_hba *phba, struct lpfc_io_buf *lpfc_cmd) + + src = (struct scsi_dif_tuple *)sg_virt(sgpe); + start_ref_tag = scsi_prot_ref_tag(cmd); +- if (start_ref_tag == LPFC_INVALID_REFTAG) +- goto out; + start_app_tag = src->app_tag; + len = sgpe->length; + while (src && protsegcnt) { +@@ -3493,11 +3479,11 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, + scsi_cmnd->sc_data_direction); + + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, +- "9084 Cannot setup S/G List for HBA" +- "IO segs %d/%d SGL %d SCSI %d: %d %d\n", ++ "9084 Cannot setup S/G List for HBA " ++ "IO segs %d/%d SGL %d SCSI %d: %d %d %d\n", + lpfc_cmd->seg_cnt, lpfc_cmd->prot_seg_cnt, + phba->cfg_total_seg_cnt, phba->cfg_sg_seg_cnt, +- prot_group_type, num_sge); ++ prot_group_type, num_sge, ret); + + lpfc_cmd->seg_cnt = 0; + lpfc_cmd->prot_seg_cnt = 0; +-- +2.40.1 + diff --git a/queue-6.4/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch b/queue-6.4/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch new file mode 100644 index 00000000000..10892de9ce8 --- /dev/null +++ b/queue-6.4/scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch @@ -0,0 +1,67 @@ +From 0a632dab9136185554c4878098dd93926dcb568e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 12:56:55 +0000 +Subject: scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock + +From: Chengfeng Ye + +[ Upstream commit dd64f80587190265ca8a0f4be6c64c2fda6d3ac2 ] + +As &qedi_percpu->p_work_lock is acquired by hard IRQ qedi_msix_handler(), +other acquisitions of the same lock under process context should disable +IRQ, otherwise deadlock could happen if the IRQ preempts the execution +while the lock is held in process context on the same CPU. + +qedi_cpu_offline() is one such function which acquires the lock in process +context. + +[Deadlock Scenario] +qedi_cpu_offline() + ->spin_lock(&p->p_work_lock) + + ->qedi_msix_handler() + ->edi_process_completions() + ->spin_lock_irqsave(&p->p_work_lock, flags); (deadlock here) + +This flaw was found by an experimental static analysis tool I am developing +for IRQ-related deadlocks. + +The tentative patch fix the potential deadlock by spin_lock_irqsave() +under process context. + +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20230726125655.4197-1-dg573847474@gmail.com +Acked-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index ef62dbbc1868e..1106d26113888 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1977,8 +1977,9 @@ static int qedi_cpu_offline(unsigned int cpu) + struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu); + struct qedi_work *work, *tmp; + struct task_struct *thread; ++ unsigned long flags; + +- spin_lock_bh(&p->p_work_lock); ++ spin_lock_irqsave(&p->p_work_lock, flags); + thread = p->iothread; + p->iothread = NULL; + +@@ -1989,7 +1990,7 @@ static int qedi_cpu_offline(unsigned int cpu) + kfree(work); + } + +- spin_unlock_bh(&p->p_work_lock); ++ spin_unlock_irqrestore(&p->p_work_lock, flags); + if (thread) + kthread_stop(thread); + return 0; +-- +2.40.1 + diff --git a/queue-6.4/security-keys-perform-capable-check-only-on-privileg.patch b/queue-6.4/security-keys-perform-capable-check-only-on-privileg.patch new file mode 100644 index 00000000000..b6c53d4e38e --- /dev/null +++ b/queue-6.4/security-keys-perform-capable-check-only-on-privileg.patch @@ -0,0 +1,66 @@ +From 3ee820fc560466d04a6a84b1c078eb5aff18c407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 14:32:52 +0200 +Subject: security: keys: perform capable check only on privileged operations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Göttsche + +[ Upstream commit 2d7f105edbb3b2be5ffa4d833abbf9b6965e9ce7 ] + +If the current task fails the check for the queried capability via +`capable(CAP_SYS_ADMIN)` LSMs like SELinux generate a denial message. +Issuing such denial messages unnecessarily can lead to a policy author +granting more privileges to a subject than needed to silence them. + +Reorder CAP_SYS_ADMIN checks after the check whether the operation is +actually privileged. + +Signed-off-by: Christian Göttsche +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + security/keys/keyctl.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index d54f73c558f72..19be69fa4d052 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -980,14 +980,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) + ret = -EACCES; + down_write(&key->sem); + +- if (!capable(CAP_SYS_ADMIN)) { ++ { ++ bool is_privileged_op = false; ++ + /* only the sysadmin can chown a key to some other UID */ + if (user != (uid_t) -1 && !uid_eq(key->uid, uid)) +- goto error_put; ++ is_privileged_op = true; + + /* only the sysadmin can set the key's GID to a group other + * than one of those that the current process subscribes to */ + if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid)) ++ is_privileged_op = true; ++ ++ if (is_privileged_op && !capable(CAP_SYS_ADMIN)) + goto error_put; + } + +@@ -1088,7 +1093,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm) + down_write(&key->sem); + + /* if we're not the sysadmin, we can only change a key that we own */ +- if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { ++ if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) { + key->perm = perm; + notify_key(key, NOTIFY_KEY_SETATTR, 0); + ret = 0; +-- +2.40.1 + diff --git a/queue-6.4/series b/queue-6.4/series new file mode 100644 index 00000000000..08a65ae63aa --- /dev/null +++ b/queue-6.4/series @@ -0,0 +1,85 @@ +revert-bridge-add-extack-warning-when-enabling-stp-i.patch +partially-revert-drm-amd-display-fix-possible-underf.patch +ksmbd-fix-unsigned-expression-compared-with-zero.patch +phy-qcom-snps-femto-v2-use-qcom_snps_hsphy_suspend-r.patch +media-amphion-use-dev_err_probe.patch +media-imx-jpeg-support-to-assign-slot-for-encoder-de.patch +media-pulse8-cec-handle-possible-ping-error.patch +media-pci-cx23885-fix-error-handling-for-cx23885-ats.patch +9p-virtio-fix-unlikely-null-pointer-deref-in-handle_.patch +9p-virtio-make-sure-offs-is-initialized-in-zc_reques.patch +ksmbd-fix-out-of-bounds-in-smb3_decrypt_req.patch +ksmbd-validate-session-id-and-tree-id-in-compound-re.patch +ksmbd-no-response-from-compound-read.patch +ksmbd-fix-out-of-bounds-in-init_smb2_rsp_hdr.patch +asoc-da7219-flush-pending-aad-irq-when-suspending.patch +asoc-da7219-check-for-failure-reading-aad-irq-events.patch +asoc-nau8821-add-dmi-quirk-mechanism-for-active-high.patch +thermal-core-constify-params-in-thermal_zone_device_.patch +net-hns3-add-tm-flush-when-setting-tm.patch +ethernet-atheros-fix-return-value-check-in-atl1c_tso.patch +m68k-fix-invalid-.section-syntax.patch +s390-dasd-use-correct-number-of-retries-for-erp-requ.patch +s390-dasd-fix-hanging-device-after-request-requeue.patch +fs-nls-make-load_nls-take-a-const-parameter.patch +cifs-fix-charset-issue-in-reconnection.patch +asoc-rt5682-sdw-fix-for-jd-event-handling-in-clockst.patch +asoc-codecs-es8316-fix-dmic-config.patch +asoc-rt712-sdca-fix-for-jd-event-handling-in-clockst.patch +asoc-rt711-fix-for-jd-event-handling-in-clockstop-mo.patch +asoc-rt711-sdca-fix-for-jd-event-handling-in-clockst.patch +asoc-atmel-fix-the-8k-sample-parameter-in-i2sc-maste.patch +alsa-usb-audio-add-quirk-for-microsoft-modern-wirele.patch +platform-x86-intel-hid-always-call-btnl-acpi-method.patch +platform-x86-intel-hid-add-hp-dragonfly-g2-to-vgbs-d.patch +platform-x86-think-lmi-use-kfree_sensitive-instead-o.patch +platform-x86-asus-wmi-fix-setting-rgb-mode-on-some-t.patch +platform-x86-huawei-wmi-silence-ambient-light-sensor.patch +drm-amd-smu-use-averagegfxclkfrequency-to-replace-pr.patch +drm-amd-display-guard-dcn31-phyd32clk-logic-against-.patch +drm-amd-display-exit-idle-optimizations-before-attem.patch +ovl-always-reevaluate-the-file-signature-for-ima.patch +ata-pata_arasan_cf-use-dev_err_probe-instead-dev_err.patch +alsa-usb-audio-update-for-native-dsd-support-quirks.patch +staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch +loongarch-only-fiddle-with-checkflags-if-need-compil.patch +loongarch-fix-cmdline_extend-and-cmdline_bootloader-.patch +security-keys-perform-capable-check-only-on-privileg.patch +kprobes-prohibit-probing-on-cfi-preamble-symbol.patch +clk-fixed-mmio-make-common_clk_fixed_mmio-depend-on-.patch +vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch +revert-wifi-ath6k-silence-false-positive-wno-danglin.patch +net-dsa-microchip-ksz9477-register-regmap-alignment-.patch +net-annotate-data-races-around-sk-sk_-rcv-snd-timeo.patch +net-usb-qmi_wwan-add-quectel-em05gv2.patch +wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch +powerpc-powermac-use-early_-io-variants-in-via_calib.patch +x86-hyperv-add-noop-functions-to-x86_init-mpparse-fu.patch +idmaengine-make-fsl_edma-and-intel_idma64-depends-on.patch +platform-x86-amd-pmf-fix-unsigned-comparison-with-le.patch +scsi-lpfc-remove-reftag-check-in-dif-paths.patch +scsi-qedi-fix-potential-deadlock-on-qedi_percpu-p_wo.patch +net-hns3-restore-user-pause-configure-when-disable-a.patch +wifi-ath12k-fix-buffer-overflow-when-scanning-with-e.patch +drm-amdgpu-match-against-exact-bootloader-status.patch +arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ea.patch +arm64-dts-rockchip-correct-wifi-interrupt-flag-in-ro.patch +arm64-dts-rockchip-correct-wifi-interrupt-flag-in-bo.patch +vhost-scsi-fix-alignment-handling-with-windows.patch +vdpa-mlx5-correct-default-number-of-queues-when-mq-i.patch +virtio-mem-remove-unsafe-unplug-in-big-block-mode-bb.patch +virtio-mem-convert-most-offline_and_remove_memory-er.patch +virtio-mem-keep-retrying-on-offline_and_remove_memor.patch +virtio-mem-check-if-the-config-changed-before-fake-o.patch +alsa-hda-cs8409-support-new-dell-dolphin-variants.patch +arm-dts-integrator-fix-pci-bus-dtc-warnings.patch +asoc-rt1308-sdw-fix-random-louder-sound.patch +i2c-imx-lpi2c-return-einval-when-i2c-peripheral-clk-.patch +fbdev-goldfishfb-do-not-check-0-for-platform_get_irq.patch +broadcom-b44-use-b44_writephy-return-value.patch +gpiolib-fix-reference-leaks-when-removing-gpio-chips.patch +drm-amd-pm-fix-temperature-unit-of-smu-v13.0.6.patch +asoc-cs35l56-add-an-acpi-match-table.patch +net-sfp-handle-100g-25g-active-optical-cables-in-sfp.patch +tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch +platform-mellanox-fix-mlxbf-tmfifo-not-handling-all-.patch diff --git a/queue-6.4/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch b/queue-6.4/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch new file mode 100644 index 00000000000..edc27b4c3fb --- /dev/null +++ b/queue-6.4/staging-fbtft-ili9341-use-macro-fbtft_register_spi_d.patch @@ -0,0 +1,36 @@ +From 733307b9df50aa6ce522241fd3c62636de502628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 19:20:24 +0200 +Subject: staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER + +From: Raphael Gallais-Pou + +[ Upstream commit 4912649e1cf0317bf563f91655e04a303cacaf8d ] + +Using FBTFT_REGISTER_DRIVER resolves to a NULL struct spi_device_id. This +ultimately causes a warning when the module probes. Fixes it. + +Signed-off-by: Raphael Gallais-Pou +Link: https://lore.kernel.org/r/20230718172024.67488-1-rgallaispou@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fb_ili9341.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/fbtft/fb_ili9341.c b/drivers/staging/fbtft/fb_ili9341.c +index 9ccd0823c3ab3..47e72b87d76d9 100644 +--- a/drivers/staging/fbtft/fb_ili9341.c ++++ b/drivers/staging/fbtft/fb_ili9341.c +@@ -145,7 +145,7 @@ static struct fbtft_display display = { + }, + }; + +-FBTFT_REGISTER_DRIVER(DRVNAME, "ilitek,ili9341", &display); ++FBTFT_REGISTER_SPI_DRIVER(DRVNAME, "ilitek", "ili9341", &display); + + MODULE_ALIAS("spi:" DRVNAME); + MODULE_ALIAS("platform:" DRVNAME); +-- +2.40.1 + diff --git a/queue-6.4/thermal-core-constify-params-in-thermal_zone_device_.patch b/queue-6.4/thermal-core-constify-params-in-thermal_zone_device_.patch new file mode 100644 index 00000000000..6d86c249c11 --- /dev/null +++ b/queue-6.4/thermal-core-constify-params-in-thermal_zone_device_.patch @@ -0,0 +1,82 @@ +From 92638c3dbe239bf16f4abbca9fb93696959d341f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jul 2023 13:27:19 +0200 +Subject: thermal: core: constify params in thermal_zone_device_register + +From: Ahmad Fatoum + +[ Upstream commit 80ddce5f2dbd0e83eadc9f9d373439180d599fe5 ] + +Since commit 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone +parameters structure"), thermal_zone_device_register() allocates a copy +of the tzp argument and callers need not explicitly manage its lifetime. + +This means the function no longer cares about the parameter being +mutable, so constify it. + +No functional change. + +Signed-off-by: Ahmad Fatoum +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_core.c | 4 ++-- + include/linux/thermal.h | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 842f678c1c3e1..cc2b5e81c6205 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -1203,7 +1203,7 @@ EXPORT_SYMBOL_GPL(thermal_zone_get_crit_temp); + struct thermal_zone_device * + thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *trips, int num_trips, int mask, + void *devdata, struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, int passive_delay, ++ const struct thermal_zone_params *tzp, int passive_delay, + int polling_delay) + { + struct thermal_zone_device *tz; +@@ -1371,7 +1371,7 @@ EXPORT_SYMBOL_GPL(thermal_zone_device_register_with_trips); + + struct thermal_zone_device *thermal_zone_device_register(const char *type, int ntrips, int mask, + void *devdata, struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, int passive_delay, ++ const struct thermal_zone_params *tzp, int passive_delay, + int polling_delay) + { + return thermal_zone_device_register_with_trips(type, NULL, ntrips, mask, +diff --git a/include/linux/thermal.h b/include/linux/thermal.h +index 87837094d549f..dee66ade89a03 100644 +--- a/include/linux/thermal.h ++++ b/include/linux/thermal.h +@@ -301,14 +301,14 @@ int thermal_acpi_critical_trip_temp(struct acpi_device *adev, int *ret_temp); + #ifdef CONFIG_THERMAL + struct thermal_zone_device *thermal_zone_device_register(const char *, int, int, + void *, struct thermal_zone_device_ops *, +- struct thermal_zone_params *, int, int); ++ const struct thermal_zone_params *, int, int); + + void thermal_zone_device_unregister(struct thermal_zone_device *); + + struct thermal_zone_device * + thermal_zone_device_register_with_trips(const char *, struct thermal_trip *, int, int, + void *, struct thermal_zone_device_ops *, +- struct thermal_zone_params *, int, int); ++ const struct thermal_zone_params *, int, int); + + void *thermal_zone_device_priv(struct thermal_zone_device *tzd); + const char *thermal_zone_device_type(struct thermal_zone_device *tzd); +@@ -348,7 +348,7 @@ void thermal_zone_device_critical(struct thermal_zone_device *tz); + static inline struct thermal_zone_device *thermal_zone_device_register( + const char *type, int trips, int mask, void *devdata, + struct thermal_zone_device_ops *ops, +- struct thermal_zone_params *tzp, ++ const struct thermal_zone_params *tzp, + int passive_delay, int polling_delay) + { return ERR_PTR(-ENODEV); } + static inline void thermal_zone_device_unregister( +-- +2.40.1 + diff --git a/queue-6.4/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch b/queue-6.4/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch new file mode 100644 index 00000000000..79ea1dcef9e --- /dev/null +++ b/queue-6.4/tracing-introduce-pipe_cpumask-to-avoid-race-on-trac.patch @@ -0,0 +1,211 @@ +From b942991706487e16ae7916dba9a9d860807ee316 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Aug 2023 10:26:45 +0800 +Subject: tracing: Introduce pipe_cpumask to avoid race on trace_pipes + +From: Zheng Yejian + +[ Upstream commit c2489bb7e6be2e8cdced12c16c42fa128403ac03 ] + +There is race issue when concurrently splice_read main trace_pipe and +per_cpu trace_pipes which will result in data read out being different +from what actually writen. + +As suggested by Steven: + > I believe we should add a ref count to trace_pipe and the per_cpu + > trace_pipes, where if they are opened, nothing else can read it. + > + > Opening trace_pipe locks all per_cpu ref counts, if any of them are + > open, then the trace_pipe open will fail (and releases any ref counts + > it had taken). + > + > Opening a per_cpu trace_pipe will up the ref count for just that + > CPU buffer. This will allow multiple tasks to read different per_cpu + > trace_pipe files, but will prevent the main trace_pipe file from + > being opened. + +But because we only need to know whether per_cpu trace_pipe is open or +not, using a cpumask instead of using ref count may be easier. + +After this patch, users will find that: + - Main trace_pipe can be opened by only one user, and if it is + opened, all per_cpu trace_pipes cannot be opened; + - Per_cpu trace_pipes can be opened by multiple users, but each per_cpu + trace_pipe can only be opened by one user. And if one of them is + opened, main trace_pipe cannot be opened. + +Link: https://lore.kernel.org/linux-trace-kernel/20230818022645.1948314-1-zhengyejian1@huawei.com + +Suggested-by: Steven Rostedt (Google) +Signed-off-by: Zheng Yejian +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 55 ++++++++++++++++++++++++++++++++++++++------ + kernel/trace/trace.h | 2 ++ + 2 files changed, 50 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index f4855be6ac2b5..9614248b98f1a 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -6690,10 +6690,36 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf, + + #endif + ++static int open_pipe_on_cpu(struct trace_array *tr, int cpu) ++{ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ if (cpumask_empty(tr->pipe_cpumask)) { ++ cpumask_setall(tr->pipe_cpumask); ++ return 0; ++ } ++ } else if (!cpumask_test_cpu(cpu, tr->pipe_cpumask)) { ++ cpumask_set_cpu(cpu, tr->pipe_cpumask); ++ return 0; ++ } ++ return -EBUSY; ++} ++ ++static void close_pipe_on_cpu(struct trace_array *tr, int cpu) ++{ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ WARN_ON(!cpumask_full(tr->pipe_cpumask)); ++ cpumask_clear(tr->pipe_cpumask); ++ } else { ++ WARN_ON(!cpumask_test_cpu(cpu, tr->pipe_cpumask)); ++ cpumask_clear_cpu(cpu, tr->pipe_cpumask); ++ } ++} ++ + static int tracing_open_pipe(struct inode *inode, struct file *filp) + { + struct trace_array *tr = inode->i_private; + struct trace_iterator *iter; ++ int cpu; + int ret; + + ret = tracing_check_open_get_tr(tr); +@@ -6701,13 +6727,16 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + return ret; + + mutex_lock(&trace_types_lock); ++ cpu = tracing_get_cpu(inode); ++ ret = open_pipe_on_cpu(tr, cpu); ++ if (ret) ++ goto fail_pipe_on_cpu; + + /* create a buffer to store the information to pass to userspace */ + iter = kzalloc(sizeof(*iter), GFP_KERNEL); + if (!iter) { + ret = -ENOMEM; +- __trace_array_put(tr); +- goto out; ++ goto fail_alloc_iter; + } + + trace_seq_init(&iter->seq); +@@ -6730,7 +6759,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + + iter->tr = tr; + iter->array_buffer = &tr->array_buffer; +- iter->cpu_file = tracing_get_cpu(inode); ++ iter->cpu_file = cpu; + mutex_init(&iter->mutex); + filp->private_data = iter; + +@@ -6740,12 +6769,15 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) + nonseekable_open(inode, filp); + + tr->trace_ref++; +-out: ++ + mutex_unlock(&trace_types_lock); + return ret; + + fail: + kfree(iter); ++fail_alloc_iter: ++ close_pipe_on_cpu(tr, cpu); ++fail_pipe_on_cpu: + __trace_array_put(tr); + mutex_unlock(&trace_types_lock); + return ret; +@@ -6762,7 +6794,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file) + + if (iter->trace->pipe_close) + iter->trace->pipe_close(iter); +- ++ close_pipe_on_cpu(tr, iter->cpu_file); + mutex_unlock(&trace_types_lock); + + free_cpumask_var(iter->started); +@@ -9426,6 +9458,9 @@ static struct trace_array *trace_array_create(const char *name) + if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL)) + goto out_free_tr; + ++ if (!alloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL)) ++ goto out_free_tr; ++ + tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS; + + cpumask_copy(tr->tracing_cpumask, cpu_all_mask); +@@ -9467,6 +9502,7 @@ static struct trace_array *trace_array_create(const char *name) + out_free_tr: + ftrace_free_ftrace_ops(tr); + free_trace_buffers(tr); ++ free_cpumask_var(tr->pipe_cpumask); + free_cpumask_var(tr->tracing_cpumask); + kfree(tr->name); + kfree(tr); +@@ -9569,6 +9605,7 @@ static int __remove_instance(struct trace_array *tr) + } + kfree(tr->topts); + ++ free_cpumask_var(tr->pipe_cpumask); + free_cpumask_var(tr->tracing_cpumask); + kfree(tr->name); + kfree(tr); +@@ -10366,12 +10403,14 @@ __init static int tracer_alloc_buffers(void) + if (trace_create_savedcmd() < 0) + goto out_free_temp_buffer; + ++ if (!alloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL)) ++ goto out_free_savedcmd; ++ + /* TODO: make the number of buffers hot pluggable with CPUS */ + if (allocate_trace_buffers(&global_trace, ring_buf_size) < 0) { + MEM_FAIL(1, "tracer: failed to allocate ring buffer!\n"); +- goto out_free_savedcmd; ++ goto out_free_pipe_cpumask; + } +- + if (global_trace.buffer_disabled) + tracing_off(); + +@@ -10424,6 +10463,8 @@ __init static int tracer_alloc_buffers(void) + + return 0; + ++out_free_pipe_cpumask: ++ free_cpumask_var(global_trace.pipe_cpumask); + out_free_savedcmd: + free_saved_cmdlines_buffer(savedcmd); + out_free_temp_buffer: +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 2daeac8e690a6..b577f65a63f11 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -366,6 +366,8 @@ struct trace_array { + struct list_head events; + struct trace_event_file *trace_marker_file; + cpumask_var_t tracing_cpumask; /* only trace on set CPUs */ ++ /* one per_cpu trace_pipe can be opened by only one user */ ++ cpumask_var_t pipe_cpumask; + int ref; + int trace_ref; + #ifdef CONFIG_FUNCTION_TRACER +-- +2.40.1 + diff --git a/queue-6.4/vdpa-mlx5-correct-default-number-of-queues-when-mq-i.patch b/queue-6.4/vdpa-mlx5-correct-default-number-of-queues-when-mq-i.patch new file mode 100644 index 00000000000..47142f8ae9b --- /dev/null +++ b/queue-6.4/vdpa-mlx5-correct-default-number-of-queues-when-mq-i.patch @@ -0,0 +1,50 @@ +From 7267b6ffc1c695b970be5c025df4617a3e720e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jul 2023 20:23:46 +0300 +Subject: vdpa/mlx5: Correct default number of queues when MQ is on +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dragos Tatulea + +[ Upstream commit 3fe024193340b225d1fd410d78c495434a9d68e0 ] + +The standard specifies that the initial number of queues is the +default, which is 1 (1 tx, 1 rx). + +Signed-off-by: Dragos Tatulea +Reviewed-by: Eugenio Pérez +Message-Id: <20230727172354.68243-2-dtatulea@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Tested-by: Lei Yang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index f18a9301ab94e..6b79ae746ab93 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -2447,7 +2447,15 @@ static int mlx5_vdpa_set_driver_features(struct vdpa_device *vdev, u64 features) + else + ndev->rqt_size = 1; + +- ndev->cur_num_vqs = 2 * ndev->rqt_size; ++ /* Device must start with 1 queue pair, as per VIRTIO v1.2 spec, section ++ * 5.1.6.5.5 "Device operation in multiqueue mode": ++ * ++ * Multiqueue is disabled by default. ++ * The driver enables multiqueue by sending a command using class ++ * VIRTIO_NET_CTRL_MQ. The command selects the mode of multiqueue ++ * operation, as follows: ... ++ */ ++ ndev->cur_num_vqs = 2; + + update_cvq_info(mvdev); + return err; +-- +2.40.1 + diff --git a/queue-6.4/vhost-scsi-fix-alignment-handling-with-windows.patch b/queue-6.4/vhost-scsi-fix-alignment-handling-with-windows.patch new file mode 100644 index 00000000000..c8cb0418a01 --- /dev/null +++ b/queue-6.4/vhost-scsi-fix-alignment-handling-with-windows.patch @@ -0,0 +1,343 @@ +From 712b5b1e0e97855f23dea4547d4faca6893b013b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jul 2023 15:28:58 -0500 +Subject: vhost-scsi: Fix alignment handling with windows + +From: Mike Christie + +[ Upstream commit 5ced58bfa132c8ba0f9c893eb621595a84cfee12 ] + +The linux block layer requires bios/requests to have lengths with a 512 +byte alignment. Some drivers/layers like dm-crypt and the directi IO code +will test for it and just fail. Other drivers like SCSI just assume the +requirement is met and will end up in infinte retry loops. The problem +for drivers like SCSI is that it uses functions like blk_rq_cur_sectors +and blk_rq_sectors which divide the request's length by 512. If there's +lefovers then it just gets dropped. But other code in the block/scsi +layer may use blk_rq_bytes/blk_rq_cur_bytes and end up thinking there is +still data left and try to retry the cmd. We can then end up getting +stuck in retry loops where part of the block/scsi thinks there is data +left, but other parts think we want to do IOs of zero length. + +Linux will always check for alignment, but windows will not. When +vhost-scsi then translates the iovec it gets from a windows guest to a +scatterlist, we can end up with sg items where the sg->length is not +divisible by 512 due to the misaligned offset: + +sg[0].offset = 255; +sg[0].length = 3841; +sg... +sg[N].offset = 0; +sg[N].length = 255; + +When the lio backends then convert the SG to bios or other iovecs, we +end up sending them with the same misaligned values and can hit the +issues above. + +This just has us drop down to allocating a temp page and copying the data +when we detect a misaligned buffer and the IO is large enough that it +will get split into multiple bad IOs. + +Signed-off-by: Mike Christie +Message-Id: <20230709202859.138387-2-michael.christie@oracle.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Stefan Hajnoczi +Signed-off-by: Sasha Levin +--- + drivers/vhost/scsi.c | 186 +++++++++++++++++++++++++++++++++++++------ + 1 file changed, 161 insertions(+), 25 deletions(-) + +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index bb10fa4bb4f6e..fa19c3f043b12 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -25,6 +25,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -75,6 +77,9 @@ struct vhost_scsi_cmd { + u32 tvc_prot_sgl_count; + /* Saved unpacked SCSI LUN for vhost_scsi_target_queue_cmd() */ + u32 tvc_lun; ++ u32 copied_iov:1; ++ const void *saved_iter_addr; ++ struct iov_iter saved_iter; + /* Pointer to the SGL formatted memory from virtio-scsi */ + struct scatterlist *tvc_sgl; + struct scatterlist *tvc_prot_sgl; +@@ -328,8 +333,13 @@ static void vhost_scsi_release_cmd_res(struct se_cmd *se_cmd) + int i; + + if (tv_cmd->tvc_sgl_count) { +- for (i = 0; i < tv_cmd->tvc_sgl_count; i++) +- put_page(sg_page(&tv_cmd->tvc_sgl[i])); ++ for (i = 0; i < tv_cmd->tvc_sgl_count; i++) { ++ if (tv_cmd->copied_iov) ++ __free_page(sg_page(&tv_cmd->tvc_sgl[i])); ++ else ++ put_page(sg_page(&tv_cmd->tvc_sgl[i])); ++ } ++ kfree(tv_cmd->saved_iter_addr); + } + if (tv_cmd->tvc_prot_sgl_count) { + for (i = 0; i < tv_cmd->tvc_prot_sgl_count; i++) +@@ -502,6 +512,28 @@ static void vhost_scsi_evt_work(struct vhost_work *work) + mutex_unlock(&vq->mutex); + } + ++static int vhost_scsi_copy_sgl_to_iov(struct vhost_scsi_cmd *cmd) ++{ ++ struct iov_iter *iter = &cmd->saved_iter; ++ struct scatterlist *sg = cmd->tvc_sgl; ++ struct page *page; ++ size_t len; ++ int i; ++ ++ for (i = 0; i < cmd->tvc_sgl_count; i++) { ++ page = sg_page(&sg[i]); ++ len = sg[i].length; ++ ++ if (copy_page_to_iter(page, 0, len, iter) != len) { ++ pr_err("Could not copy data while handling misaligned cmd. Error %zu\n", ++ len); ++ return -1; ++ } ++ } ++ ++ return 0; ++} ++ + /* Fill in status and signal that we are done processing this command + * + * This is scheduled in the vhost work queue so we are called with the owner +@@ -525,15 +557,20 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) + + pr_debug("%s tv_cmd %p resid %u status %#02x\n", __func__, + cmd, se_cmd->residual_count, se_cmd->scsi_status); +- + memset(&v_rsp, 0, sizeof(v_rsp)); +- v_rsp.resid = cpu_to_vhost32(cmd->tvc_vq, se_cmd->residual_count); +- /* TODO is status_qualifier field needed? */ +- v_rsp.status = se_cmd->scsi_status; +- v_rsp.sense_len = cpu_to_vhost32(cmd->tvc_vq, +- se_cmd->scsi_sense_length); +- memcpy(v_rsp.sense, cmd->tvc_sense_buf, +- se_cmd->scsi_sense_length); ++ ++ if (cmd->saved_iter_addr && vhost_scsi_copy_sgl_to_iov(cmd)) { ++ v_rsp.response = VIRTIO_SCSI_S_BAD_TARGET; ++ } else { ++ v_rsp.resid = cpu_to_vhost32(cmd->tvc_vq, ++ se_cmd->residual_count); ++ /* TODO is status_qualifier field needed? */ ++ v_rsp.status = se_cmd->scsi_status; ++ v_rsp.sense_len = cpu_to_vhost32(cmd->tvc_vq, ++ se_cmd->scsi_sense_length); ++ memcpy(v_rsp.sense, cmd->tvc_sense_buf, ++ se_cmd->scsi_sense_length); ++ } + + iov_iter_init(&iov_iter, ITER_DEST, cmd->tvc_resp_iov, + cmd->tvc_in_iovs, sizeof(v_rsp)); +@@ -615,12 +652,12 @@ static int + vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd, + struct iov_iter *iter, + struct scatterlist *sgl, +- bool write) ++ bool is_prot) + { + struct page **pages = cmd->tvc_upages; + struct scatterlist *sg = sgl; +- ssize_t bytes; +- size_t offset; ++ ssize_t bytes, mapped_bytes; ++ size_t offset, mapped_offset; + unsigned int npages = 0; + + bytes = iov_iter_get_pages2(iter, pages, LONG_MAX, +@@ -629,13 +666,53 @@ vhost_scsi_map_to_sgl(struct vhost_scsi_cmd *cmd, + if (bytes <= 0) + return bytes < 0 ? bytes : -EFAULT; + ++ mapped_bytes = bytes; ++ mapped_offset = offset; ++ + while (bytes) { + unsigned n = min_t(unsigned, PAGE_SIZE - offset, bytes); ++ /* ++ * The block layer requires bios/requests to be a multiple of ++ * 512 bytes, but Windows can send us vecs that are misaligned. ++ * This can result in bios and later requests with misaligned ++ * sizes if we have to break up a cmd/scatterlist into multiple ++ * bios. ++ * ++ * We currently only break up a command into multiple bios if ++ * we hit the vec/seg limit, so check if our sgl_count is ++ * greater than the max and if a vec in the cmd has a ++ * misaligned offset/size. ++ */ ++ if (!is_prot && ++ (offset & (SECTOR_SIZE - 1) || n & (SECTOR_SIZE - 1)) && ++ cmd->tvc_sgl_count > BIO_MAX_VECS) { ++ WARN_ONCE(true, ++ "vhost-scsi detected misaligned IO. Performance may be degraded."); ++ goto revert_iter_get_pages; ++ } ++ + sg_set_page(sg++, pages[npages++], n, offset); + bytes -= n; + offset = 0; + } ++ + return npages; ++ ++revert_iter_get_pages: ++ iov_iter_revert(iter, mapped_bytes); ++ ++ npages = 0; ++ while (mapped_bytes) { ++ unsigned int n = min_t(unsigned int, PAGE_SIZE - mapped_offset, ++ mapped_bytes); ++ ++ put_page(pages[npages++]); ++ ++ mapped_bytes -= n; ++ mapped_offset = 0; ++ } ++ ++ return -EINVAL; + } + + static int +@@ -659,25 +736,80 @@ vhost_scsi_calc_sgls(struct iov_iter *iter, size_t bytes, int max_sgls) + } + + static int +-vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, +- struct iov_iter *iter, +- struct scatterlist *sg, int sg_count) ++vhost_scsi_copy_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, ++ struct scatterlist *sg, int sg_count) ++{ ++ size_t len = iov_iter_count(iter); ++ unsigned int nbytes = 0; ++ struct page *page; ++ int i; ++ ++ if (cmd->tvc_data_direction == DMA_FROM_DEVICE) { ++ cmd->saved_iter_addr = dup_iter(&cmd->saved_iter, iter, ++ GFP_KERNEL); ++ if (!cmd->saved_iter_addr) ++ return -ENOMEM; ++ } ++ ++ for (i = 0; i < sg_count; i++) { ++ page = alloc_page(GFP_KERNEL); ++ if (!page) { ++ i--; ++ goto err; ++ } ++ ++ nbytes = min_t(unsigned int, PAGE_SIZE, len); ++ sg_set_page(&sg[i], page, nbytes, 0); ++ ++ if (cmd->tvc_data_direction == DMA_TO_DEVICE && ++ copy_page_from_iter(page, 0, nbytes, iter) != nbytes) ++ goto err; ++ ++ len -= nbytes; ++ } ++ ++ cmd->copied_iov = 1; ++ return 0; ++ ++err: ++ pr_err("Could not read %u bytes while handling misaligned cmd\n", ++ nbytes); ++ ++ for (; i >= 0; i--) ++ __free_page(sg_page(&sg[i])); ++ kfree(cmd->saved_iter_addr); ++ return -ENOMEM; ++} ++ ++static int ++vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, struct iov_iter *iter, ++ struct scatterlist *sg, int sg_count, bool is_prot) + { + struct scatterlist *p = sg; ++ size_t revert_bytes; + int ret; + + while (iov_iter_count(iter)) { +- ret = vhost_scsi_map_to_sgl(cmd, iter, sg, write); ++ ret = vhost_scsi_map_to_sgl(cmd, iter, sg, is_prot); + if (ret < 0) { ++ revert_bytes = 0; ++ + while (p < sg) { +- struct page *page = sg_page(p++); +- if (page) ++ struct page *page = sg_page(p); ++ ++ if (page) { + put_page(page); ++ revert_bytes += p->length; ++ } ++ p++; + } ++ ++ iov_iter_revert(iter, revert_bytes); + return ret; + } + sg += ret; + } ++ + return 0; + } + +@@ -687,7 +819,6 @@ vhost_scsi_mapal(struct vhost_scsi_cmd *cmd, + size_t data_bytes, struct iov_iter *data_iter) + { + int sgl_count, ret; +- bool write = (cmd->tvc_data_direction == DMA_FROM_DEVICE); + + if (prot_bytes) { + sgl_count = vhost_scsi_calc_sgls(prot_iter, prot_bytes, +@@ -700,9 +831,8 @@ vhost_scsi_mapal(struct vhost_scsi_cmd *cmd, + pr_debug("%s prot_sg %p prot_sgl_count %u\n", __func__, + cmd->tvc_prot_sgl, cmd->tvc_prot_sgl_count); + +- ret = vhost_scsi_iov_to_sgl(cmd, write, prot_iter, +- cmd->tvc_prot_sgl, +- cmd->tvc_prot_sgl_count); ++ ret = vhost_scsi_iov_to_sgl(cmd, prot_iter, cmd->tvc_prot_sgl, ++ cmd->tvc_prot_sgl_count, true); + if (ret < 0) { + cmd->tvc_prot_sgl_count = 0; + return ret; +@@ -718,8 +848,14 @@ vhost_scsi_mapal(struct vhost_scsi_cmd *cmd, + pr_debug("%s data_sg %p data_sgl_count %u\n", __func__, + cmd->tvc_sgl, cmd->tvc_sgl_count); + +- ret = vhost_scsi_iov_to_sgl(cmd, write, data_iter, +- cmd->tvc_sgl, cmd->tvc_sgl_count); ++ ret = vhost_scsi_iov_to_sgl(cmd, data_iter, cmd->tvc_sgl, ++ cmd->tvc_sgl_count, false); ++ if (ret == -EINVAL) { ++ sg_init_table(cmd->tvc_sgl, cmd->tvc_sgl_count); ++ ret = vhost_scsi_copy_iov_to_sgl(cmd, data_iter, cmd->tvc_sgl, ++ cmd->tvc_sgl_count); ++ } ++ + if (ret < 0) { + cmd->tvc_sgl_count = 0; + return ret; +-- +2.40.1 + diff --git a/queue-6.4/virtio-mem-check-if-the-config-changed-before-fake-o.patch b/queue-6.4/virtio-mem-check-if-the-config-changed-before-fake-o.patch new file mode 100644 index 00000000000..9dce40f0dac --- /dev/null +++ b/queue-6.4/virtio-mem-check-if-the-config-changed-before-fake-o.patch @@ -0,0 +1,79 @@ +From 403876b5c1d464671cd74446f976bc0211a2b7ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 16:55:51 +0200 +Subject: virtio-mem: check if the config changed before fake offlining memory + +From: David Hildenbrand + +[ Upstream commit f55484fd7be923b740e8e1fc304070ba53675cb4 ] + +If we repeatedly fail to fake offline memory to unplug it, we won't be +sending any unplug requests to the device. However, we only check if the +config changed when sending such (un)plug requests. + +We could end up trying for a long time to unplug memory, even though +the config changed already and we're not supposed to unplug memory +anymore. For example, the hypervisor might detect a low-memory situation +while unplugging memory and decide to replug some memory. Continuing +trying to unplug memory in that case can be problematic. + +So let's check on a more regular basis. + +Signed-off-by: David Hildenbrand +Message-Id: <20230713145551.2824980-5-david@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mem.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c +index a5cf92e3e5af2..fa5226c198cc6 100644 +--- a/drivers/virtio/virtio_mem.c ++++ b/drivers/virtio/virtio_mem.c +@@ -1189,7 +1189,8 @@ static void virtio_mem_fake_online(unsigned long pfn, unsigned long nr_pages) + * Try to allocate a range, marking pages fake-offline, effectively + * fake-offlining them. + */ +-static int virtio_mem_fake_offline(unsigned long pfn, unsigned long nr_pages) ++static int virtio_mem_fake_offline(struct virtio_mem *vm, unsigned long pfn, ++ unsigned long nr_pages) + { + const bool is_movable = is_zone_movable_page(pfn_to_page(pfn)); + int rc, retry_count; +@@ -1202,6 +1203,14 @@ static int virtio_mem_fake_offline(unsigned long pfn, unsigned long nr_pages) + * some guarantees. + */ + for (retry_count = 0; retry_count < 5; retry_count++) { ++ /* ++ * If the config changed, stop immediately and go back to the ++ * main loop: avoid trying to keep unplugging if the device ++ * might have decided to not remove any more memory. ++ */ ++ if (atomic_read(&vm->config_changed)) ++ return -EAGAIN; ++ + rc = alloc_contig_range(pfn, pfn + nr_pages, MIGRATE_MOVABLE, + GFP_KERNEL); + if (rc == -ENOMEM) +@@ -1951,7 +1960,7 @@ static int virtio_mem_sbm_unplug_sb_online(struct virtio_mem *vm, + start_pfn = PFN_DOWN(virtio_mem_mb_id_to_phys(mb_id) + + sb_id * vm->sbm.sb_size); + +- rc = virtio_mem_fake_offline(start_pfn, nr_pages); ++ rc = virtio_mem_fake_offline(vm, start_pfn, nr_pages); + if (rc) + return rc; + +@@ -2149,7 +2158,7 @@ static int virtio_mem_bbm_offline_remove_and_unplug_bb(struct virtio_mem *vm, + if (!page) + continue; + +- rc = virtio_mem_fake_offline(pfn, PAGES_PER_SECTION); ++ rc = virtio_mem_fake_offline(vm, pfn, PAGES_PER_SECTION); + if (rc) { + end_pfn = pfn; + goto rollback; +-- +2.40.1 + diff --git a/queue-6.4/virtio-mem-convert-most-offline_and_remove_memory-er.patch b/queue-6.4/virtio-mem-convert-most-offline_and_remove_memory-er.patch new file mode 100644 index 00000000000..0a0ad54d119 --- /dev/null +++ b/queue-6.4/virtio-mem-convert-most-offline_and_remove_memory-er.patch @@ -0,0 +1,49 @@ +From 7deefe5794ce56bb9e9e035b47c0cd377e0426bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 16:55:49 +0200 +Subject: virtio-mem: convert most offline_and_remove_memory() errors to -EBUSY + +From: David Hildenbrand + +[ Upstream commit ddf409851461f515cc32974714b73efe2e012bde ] + +Just like we do with alloc_contig_range(), let's convert all unknown +errors to -EBUSY, but WARN so we can look into the issue. For example, +offline_pages() could fail with -EINTR, which would be unexpected in our +case. + +Signed-off-by: David Hildenbrand +Message-Id: <20230713145551.2824980-3-david@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mem.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c +index ed15d2a4bd96b..1a76ba2bc118c 100644 +--- a/drivers/virtio/virtio_mem.c ++++ b/drivers/virtio/virtio_mem.c +@@ -741,11 +741,15 @@ static int virtio_mem_offline_and_remove_memory(struct virtio_mem *vm, + * immediately instead of waiting. + */ + virtio_mem_retry(vm); +- } else { +- dev_dbg(&vm->vdev->dev, +- "offlining and removing memory failed: %d\n", rc); ++ return 0; + } +- return rc; ++ dev_dbg(&vm->vdev->dev, "offlining and removing memory failed: %d\n", rc); ++ /* ++ * We don't really expect this to fail, because we fake-offlined all ++ * memory already. But it could fail in corner cases. ++ */ ++ WARN_ON_ONCE(rc != -ENOMEM && rc != -EBUSY); ++ return rc == -ENOMEM ? -ENOMEM : -EBUSY; + } + + /* +-- +2.40.1 + diff --git a/queue-6.4/virtio-mem-keep-retrying-on-offline_and_remove_memor.patch b/queue-6.4/virtio-mem-keep-retrying-on-offline_and_remove_memor.patch new file mode 100644 index 00000000000..ab84de263e3 --- /dev/null +++ b/queue-6.4/virtio-mem-keep-retrying-on-offline_and_remove_memor.patch @@ -0,0 +1,183 @@ +From cafd0e8de2b54feff722ca11a621000199f5d99c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 16:55:50 +0200 +Subject: virtio-mem: keep retrying on offline_and_remove_memory() errors in + Sub Block Mode (SBM) + +From: David Hildenbrand + +[ Upstream commit a31648fd4f96fbe0a4d0aeb16b57a2405c6943c0 ] + +In case offline_and_remove_memory() fails in SBM, we leave a completely +unplugged Linux memory block stick around until we try plugging memory +again. We won't try removing that memory block again. + +offline_and_remove_memory() may, for example, fail if we're racing with +another alloc_contig_range() user, if allocating temporary memory fails, +or if some memory notifier rejected the offlining request. + +Let's handle that case better, by simple retrying to offline and remove +such memory. + +Tested using CONFIG_MEMORY_NOTIFIER_ERROR_INJECT. + +Signed-off-by: David Hildenbrand +Message-Id: <20230713145551.2824980-4-david@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mem.c | 92 +++++++++++++++++++++++++++++-------- + 1 file changed, 73 insertions(+), 19 deletions(-) + +diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c +index 1a76ba2bc118c..a5cf92e3e5af2 100644 +--- a/drivers/virtio/virtio_mem.c ++++ b/drivers/virtio/virtio_mem.c +@@ -168,6 +168,13 @@ struct virtio_mem { + /* The number of subblocks per Linux memory block. */ + uint32_t sbs_per_mb; + ++ /* ++ * Some of the Linux memory blocks tracked as "partially ++ * plugged" are completely unplugged and can be offlined ++ * and removed -- which previously failed. ++ */ ++ bool have_unplugged_mb; ++ + /* Summary of all memory block states. */ + unsigned long mb_count[VIRTIO_MEM_SBM_MB_COUNT]; + +@@ -765,6 +772,34 @@ static int virtio_mem_sbm_offline_and_remove_mb(struct virtio_mem *vm, + return virtio_mem_offline_and_remove_memory(vm, addr, size); + } + ++/* ++ * Try (offlining and) removing memory from Linux in case all subblocks are ++ * unplugged. Can be called on online and offline memory blocks. ++ * ++ * May modify the state of memory blocks in virtio-mem. ++ */ ++static int virtio_mem_sbm_try_remove_unplugged_mb(struct virtio_mem *vm, ++ unsigned long mb_id) ++{ ++ int rc; ++ ++ /* ++ * Once all subblocks of a memory block were unplugged, offline and ++ * remove it. ++ */ ++ if (!virtio_mem_sbm_test_sb_unplugged(vm, mb_id, 0, vm->sbm.sbs_per_mb)) ++ return 0; ++ ++ /* offline_and_remove_memory() works for online and offline memory. */ ++ mutex_unlock(&vm->hotplug_mutex); ++ rc = virtio_mem_sbm_offline_and_remove_mb(vm, mb_id); ++ mutex_lock(&vm->hotplug_mutex); ++ if (!rc) ++ virtio_mem_sbm_set_mb_state(vm, mb_id, ++ VIRTIO_MEM_SBM_MB_UNUSED); ++ return rc; ++} ++ + /* + * See virtio_mem_offline_and_remove_memory(): Try to offline and remove a + * all Linux memory blocks covered by the big block. +@@ -1988,20 +2023,10 @@ static int virtio_mem_sbm_unplug_any_sb_online(struct virtio_mem *vm, + } + + unplugged: +- /* +- * Once all subblocks of a memory block were unplugged, offline and +- * remove it. This will usually not fail, as no memory is in use +- * anymore - however some other notifiers might NACK the request. +- */ +- if (virtio_mem_sbm_test_sb_unplugged(vm, mb_id, 0, vm->sbm.sbs_per_mb)) { +- mutex_unlock(&vm->hotplug_mutex); +- rc = virtio_mem_sbm_offline_and_remove_mb(vm, mb_id); +- mutex_lock(&vm->hotplug_mutex); +- if (!rc) +- virtio_mem_sbm_set_mb_state(vm, mb_id, +- VIRTIO_MEM_SBM_MB_UNUSED); +- } +- ++ rc = virtio_mem_sbm_try_remove_unplugged_mb(vm, mb_id); ++ if (rc) ++ vm->sbm.have_unplugged_mb = 1; ++ /* Ignore errors, this is not critical. We'll retry later. */ + return 0; + } + +@@ -2253,12 +2278,13 @@ static int virtio_mem_unplug_request(struct virtio_mem *vm, uint64_t diff) + + /* + * Try to unplug all blocks that couldn't be unplugged before, for example, +- * because the hypervisor was busy. ++ * because the hypervisor was busy. Further, offline and remove any memory ++ * blocks where we previously failed. + */ +-static int virtio_mem_unplug_pending_mb(struct virtio_mem *vm) ++static int virtio_mem_cleanup_pending_mb(struct virtio_mem *vm) + { + unsigned long id; +- int rc; ++ int rc = 0; + + if (!vm->in_sbm) { + virtio_mem_bbm_for_each_bb(vm, id, +@@ -2280,6 +2306,27 @@ static int virtio_mem_unplug_pending_mb(struct virtio_mem *vm) + VIRTIO_MEM_SBM_MB_UNUSED); + } + ++ if (!vm->sbm.have_unplugged_mb) ++ return 0; ++ ++ /* ++ * Let's retry (offlining and) removing completely unplugged Linux ++ * memory blocks. ++ */ ++ vm->sbm.have_unplugged_mb = false; ++ ++ mutex_lock(&vm->hotplug_mutex); ++ virtio_mem_sbm_for_each_mb(vm, id, VIRTIO_MEM_SBM_MB_MOVABLE_PARTIAL) ++ rc |= virtio_mem_sbm_try_remove_unplugged_mb(vm, id); ++ virtio_mem_sbm_for_each_mb(vm, id, VIRTIO_MEM_SBM_MB_KERNEL_PARTIAL) ++ rc |= virtio_mem_sbm_try_remove_unplugged_mb(vm, id); ++ virtio_mem_sbm_for_each_mb(vm, id, VIRTIO_MEM_SBM_MB_OFFLINE_PARTIAL) ++ rc |= virtio_mem_sbm_try_remove_unplugged_mb(vm, id); ++ mutex_unlock(&vm->hotplug_mutex); ++ ++ if (rc) ++ vm->sbm.have_unplugged_mb = true; ++ /* Ignore errors, this is not critical. We'll retry later. */ + return 0; + } + +@@ -2361,9 +2408,9 @@ static void virtio_mem_run_wq(struct work_struct *work) + virtio_mem_refresh_config(vm); + } + +- /* Unplug any leftovers from previous runs */ ++ /* Cleanup any leftovers from previous runs */ + if (!rc) +- rc = virtio_mem_unplug_pending_mb(vm); ++ rc = virtio_mem_cleanup_pending_mb(vm); + + if (!rc && vm->requested_size != vm->plugged_size) { + if (vm->requested_size > vm->plugged_size) { +@@ -2375,6 +2422,13 @@ static void virtio_mem_run_wq(struct work_struct *work) + } + } + ++ /* ++ * Keep retrying to offline and remove completely unplugged Linux ++ * memory blocks. ++ */ ++ if (!rc && vm->in_sbm && vm->sbm.have_unplugged_mb) ++ rc = -EBUSY; ++ + switch (rc) { + case 0: + vm->retry_timer_ms = VIRTIO_MEM_RETRY_TIMER_MIN_MS; +-- +2.40.1 + diff --git a/queue-6.4/virtio-mem-remove-unsafe-unplug-in-big-block-mode-bb.patch b/queue-6.4/virtio-mem-remove-unsafe-unplug-in-big-block-mode-bb.patch new file mode 100644 index 00000000000..938f469f955 --- /dev/null +++ b/queue-6.4/virtio-mem-remove-unsafe-unplug-in-big-block-mode-bb.patch @@ -0,0 +1,124 @@ +From 2f2aa2f2c45ab0956cc982cc21c87ca3ff2378f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 16:55:48 +0200 +Subject: virtio-mem: remove unsafe unplug in Big Block Mode (BBM) + +From: David Hildenbrand + +[ Upstream commit f504e15b94eb4e5b47f8715da59c0207f68dffe1 ] + +When "unsafe unplug" is enabled, we don't fake-offline all memory ahead of +actual memory offlining using alloc_contig_range(). Instead, we rely on +offline_pages() to also perform actual page migration, which might fail +or take a very long time. + +In that case, it's possible to easily run into endless loops that cannot be +aborted anymore (as offlining is triggered by a workqueue then): For +example, a single (accidentally) permanently unmovable page in +ZONE_MOVABLE results in an endless loop. For ZONE_NORMAL, races between +isolating the pageblock (and checking for unmovable pages) and +concurrent page allocation are possible and similarly result in endless +loops. + +The idea of the unsafe unplug mode was to make it possible to more +reliably unplug large memory blocks. However, (a) we really should be +tackling that differently, by extending the alloc_contig_range()-based +mechanism; and (b) this mode is not the default and as far as I know, +it's unused either way. + +So let's simply get rid of it. + +Signed-off-by: David Hildenbrand +Message-Id: <20230713145551.2824980-2-david@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mem.c | 51 +++++++++++++++---------------------- + 1 file changed, 20 insertions(+), 31 deletions(-) + +diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c +index 835f6cc2fb664..ed15d2a4bd96b 100644 +--- a/drivers/virtio/virtio_mem.c ++++ b/drivers/virtio/virtio_mem.c +@@ -38,11 +38,6 @@ module_param(bbm_block_size, ulong, 0444); + MODULE_PARM_DESC(bbm_block_size, + "Big Block size in bytes. Default is 0 (auto-detection)."); + +-static bool bbm_safe_unplug = true; +-module_param(bbm_safe_unplug, bool, 0444); +-MODULE_PARM_DESC(bbm_safe_unplug, +- "Use a safe unplug mechanism in BBM, avoiding long/endless loops"); +- + /* + * virtio-mem currently supports the following modes of operation: + * +@@ -2111,38 +2106,32 @@ static int virtio_mem_bbm_offline_remove_and_unplug_bb(struct virtio_mem *vm, + VIRTIO_MEM_BBM_BB_ADDED)) + return -EINVAL; + +- if (bbm_safe_unplug) { +- /* +- * Start by fake-offlining all memory. Once we marked the device +- * block as fake-offline, all newly onlined memory will +- * automatically be kept fake-offline. Protect from concurrent +- * onlining/offlining until we have a consistent state. +- */ +- mutex_lock(&vm->hotplug_mutex); +- virtio_mem_bbm_set_bb_state(vm, bb_id, +- VIRTIO_MEM_BBM_BB_FAKE_OFFLINE); ++ /* ++ * Start by fake-offlining all memory. Once we marked the device ++ * block as fake-offline, all newly onlined memory will ++ * automatically be kept fake-offline. Protect from concurrent ++ * onlining/offlining until we have a consistent state. ++ */ ++ mutex_lock(&vm->hotplug_mutex); ++ virtio_mem_bbm_set_bb_state(vm, bb_id, VIRTIO_MEM_BBM_BB_FAKE_OFFLINE); + +- for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) { +- page = pfn_to_online_page(pfn); +- if (!page) +- continue; ++ for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) { ++ page = pfn_to_online_page(pfn); ++ if (!page) ++ continue; + +- rc = virtio_mem_fake_offline(pfn, PAGES_PER_SECTION); +- if (rc) { +- end_pfn = pfn; +- goto rollback_safe_unplug; +- } ++ rc = virtio_mem_fake_offline(pfn, PAGES_PER_SECTION); ++ if (rc) { ++ end_pfn = pfn; ++ goto rollback; + } +- mutex_unlock(&vm->hotplug_mutex); + } ++ mutex_unlock(&vm->hotplug_mutex); + + rc = virtio_mem_bbm_offline_and_remove_bb(vm, bb_id); + if (rc) { +- if (bbm_safe_unplug) { +- mutex_lock(&vm->hotplug_mutex); +- goto rollback_safe_unplug; +- } +- return rc; ++ mutex_lock(&vm->hotplug_mutex); ++ goto rollback; + } + + rc = virtio_mem_bbm_unplug_bb(vm, bb_id); +@@ -2154,7 +2143,7 @@ static int virtio_mem_bbm_offline_remove_and_unplug_bb(struct virtio_mem *vm, + VIRTIO_MEM_BBM_BB_UNUSED); + return rc; + +-rollback_safe_unplug: ++rollback: + for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) { + page = pfn_to_online_page(pfn); + if (!page) +-- +2.40.1 + diff --git a/queue-6.4/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch b/queue-6.4/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch new file mode 100644 index 00000000000..6ecf17842f4 --- /dev/null +++ b/queue-6.4/vmbus_testing-fix-wrong-python-syntax-for-integer-va.patch @@ -0,0 +1,52 @@ +From 7818823479c60662641b32a9ec3982f57a0e84b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 19:14:07 +0530 +Subject: vmbus_testing: fix wrong python syntax for integer value comparison + +From: Ani Sinha + +[ Upstream commit ed0cf84e9cc42e6310961c87709621f1825c2bb8 ] + +It is incorrect in python to compare integer values using the "is" keyword. +The "is" keyword in python is used to compare references to two objects, +not their values. Newer version of python3 (version 3.8) throws a warning +when such incorrect comparison is made. For value comparison, "==" should +be used. + +Fix this in the code and suppress the following warning: + +/usr/sbin/vmbus_testing:167: SyntaxWarning: "is" with a literal. Did you mean "=="? + +Signed-off-by: Ani Sinha +Link: https://lore.kernel.org/r/20230705134408.6302-1-anisinha@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + tools/hv/vmbus_testing | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/hv/vmbus_testing b/tools/hv/vmbus_testing +index e7212903dd1d9..4467979d8f699 100755 +--- a/tools/hv/vmbus_testing ++++ b/tools/hv/vmbus_testing +@@ -164,7 +164,7 @@ def recursive_file_lookup(path, file_map): + def get_all_devices_test_status(file_map): + + for device in file_map: +- if (get_test_state(locate_state(device, file_map)) is 1): ++ if (get_test_state(locate_state(device, file_map)) == 1): + print("Testing = ON for: {}" + .format(device.split("/")[5])) + else: +@@ -203,7 +203,7 @@ def write_test_files(path, value): + def set_test_state(state_path, state_value, quiet): + + write_test_files(state_path, state_value) +- if (get_test_state(state_path) is 1): ++ if (get_test_state(state_path) == 1): + if (not quiet): + print("Testing = ON for device: {}" + .format(state_path.split("/")[5])) +-- +2.40.1 + diff --git a/queue-6.4/wifi-ath12k-fix-buffer-overflow-when-scanning-with-e.patch b/queue-6.4/wifi-ath12k-fix-buffer-overflow-when-scanning-with-e.patch new file mode 100644 index 00000000000..e0adf5e5ede --- /dev/null +++ b/queue-6.4/wifi-ath12k-fix-buffer-overflow-when-scanning-with-e.patch @@ -0,0 +1,56 @@ +From a8fac88b77e7c2aa98fca3c79b87ccb80cf5ea79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 04:12:41 -0400 +Subject: wifi: ath12k: Fix buffer overflow when scanning with extraie + +From: Wen Gong + +[ Upstream commit 06f2ab86a5b6ed55f013258de4be9319841853ea ] + +If cfg80211 is providing extraie's for a scanning process then ath12k will +copy that over to the firmware. The extraie.len is a 32 bit value in struct +element_info and describes the amount of bytes for the vendor information +elements. + +The problem is the allocation of the buffer. It has to align the TLV +sections by 4 bytes. But the code was using an u8 to store the newly +calculated length of this section (with alignment). And the new +calculated length was then used to allocate the skbuff. But the actual +code to copy in the data is using the extraie.len and not the calculated +"aligned" length. + +The length of extraie with IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS enabled +was 264 bytes during tests with a wifi card. But it only allocated 8 +bytes (264 bytes % 256) for it. As consequence, the code to memcpy the +extraie into the skb was then just overwriting data after skb->end. Things +like shinfo were therefore corrupted. This could usually be seen by a crash +in skb_zcopy_clear which tried to call a ubuf_info callback (using a bogus +address). + +Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 + +Signed-off-by: Wen Gong +Link: https://lore.kernel.org/r/20230809081241.32765-1-quic_wgong@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath12k/wmi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c +index 7ae0bb78b2b53..1e65e35b5f3a6 100644 +--- a/drivers/net/wireless/ath/ath12k/wmi.c ++++ b/drivers/net/wireless/ath/ath12k/wmi.c +@@ -2144,8 +2144,7 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar, + struct wmi_tlv *tlv; + void *ptr; + int i, ret, len; +- u32 *tmp_ptr; +- u8 extraie_len_with_pad = 0; ++ u32 *tmp_ptr, extraie_len_with_pad = 0; + struct ath12k_wmi_hint_short_ssid_arg *s_ssid = NULL; + struct ath12k_wmi_hint_bssid_arg *hint_bssid = NULL; + +-- +2.40.1 + diff --git a/queue-6.4/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch b/queue-6.4/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch new file mode 100644 index 00000000000..82008185e88 --- /dev/null +++ b/queue-6.4/wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch @@ -0,0 +1,66 @@ +From e178a8c085111f45b089f94a139f7ef6be5c6a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jul 2023 16:05:00 +0200 +Subject: wifi: brcmfmac: Fix field-spanning write in + brcmf_scan_params_v2_to_v1() + +From: Hans de Goede + +[ Upstream commit 16e455a465fca91907af0108f3d013150386df30 ] + +Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers +a backtrace caused by the following field-spanning warning: + +memcpy: detected field-spanning write (size 120) of single field + "¶ms_le->channel_list[0]" at + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) + +The driver still works after this warning. The warning was introduced by the +new field-spanning write checks which were enabled recently. + +Fix this by replacing the channel_list[1] declaration at the end of +the struct with a flexible array declaration. + +Most users of struct brcmf_scan_params_le calculate the size to alloc +using the size of the non flex-array part of the struct + needed extra +space, so they do not care about sizeof(struct brcmf_scan_params_le). + +brcmf_notify_escan_complete() however uses the struct on the stack, +expecting there to be room for at least 1 entry in the channel-list +to store the special -1 abort channel-id. + +To make this work use an anonymous union with a padding member +added + the actual channel_list flexible array. + +Cc: Kees Cook +Signed-off-by: Hans de Goede +Reviewed-by: Kees Cook +Reviewed-by: Franky Lin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +index 792adaf880b44..bece26741d3a3 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +@@ -398,7 +398,12 @@ struct brcmf_scan_params_le { + * fixed parameter portion is assumed, otherwise + * ssid in the fixed portion is ignored + */ +- __le16 channel_list[1]; /* list of chanspecs */ ++ union { ++ __le16 padding; /* Reserve space for at least 1 entry for abort ++ * which uses an on stack brcmf_scan_params_le ++ */ ++ DECLARE_FLEX_ARRAY(__le16, channel_list); /* chanspecs */ ++ }; + }; + + struct brcmf_scan_params_v2_le { +-- +2.40.1 + diff --git a/queue-6.4/x86-hyperv-add-noop-functions-to-x86_init-mpparse-fu.patch b/queue-6.4/x86-hyperv-add-noop-functions-to-x86_init-mpparse-fu.patch new file mode 100644 index 00000000000..d9262f56ccc --- /dev/null +++ b/queue-6.4/x86-hyperv-add-noop-functions-to-x86_init-mpparse-fu.patch @@ -0,0 +1,51 @@ +From b98c5dfbcea783e6b4c62ea455672cca8a99a86a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 09:28:08 -0700 +Subject: x86/hyperv: add noop functions to x86_init mpparse functions + +From: Saurabh Sengar + +[ Upstream commit 9e2d0c336524706fb327e9b87477f5f3337ad7a6 ] + +Hyper-V can run VMs at different privilege "levels" known as Virtual +Trust Levels (VTL). Sometimes, it chooses to run two different VMs +at different levels but they share some of their address space. In +such setups VTL2 (higher level VM) has visibility of all of the +VTL0 (level 0) memory space. + +When the CONFIG_X86_MPPARSE is enabled for VTL2, the VTL2 kernel +performs a search within the low memory to locate MP tables. However, +in systems where VTL0 manages the low memory and may contain valid +tables, this scanning can result in incorrect MP table information +being provided to the VTL2 kernel, mistakenly considering VTL0's MP +table as its own + +Add noop functions to avoid MP parse scan by VTL2. + +Signed-off-by: Saurabh Sengar +Acked-by: Dave Hansen +Link: https://lore.kernel.org/r/1687537688-5397-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/hv_vtl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/hyperv/hv_vtl.c b/arch/x86/hyperv/hv_vtl.c +index 85d38b9f35861..db5d2ea39fc0d 100644 +--- a/arch/x86/hyperv/hv_vtl.c ++++ b/arch/x86/hyperv/hv_vtl.c +@@ -25,6 +25,10 @@ void __init hv_vtl_init_platform(void) + x86_init.irqs.pre_vector_init = x86_init_noop; + x86_init.timers.timer_init = x86_init_noop; + ++ /* Avoid searching for BIOS MP tables */ ++ x86_init.mpparse.find_smp_config = x86_init_noop; ++ x86_init.mpparse.get_smp_config = x86_init_uint_noop; ++ + x86_platform.get_wallclock = get_rtc_noop; + x86_platform.set_wallclock = set_rtc_noop; + x86_platform.get_nmi_reason = hv_get_nmi_reason; +-- +2.40.1 + -- 2.47.3