From b8583eecee003f19297bae2d6ea41a33ad594b12 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 21 Jun 2024 11:39:26 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...a-false-positive-warning-in-packet_s.patch | 81 ++++++++ ...da-realtek-add-quirks-for-lenovo-13x.patch | 37 ++++ ...sof_sdw-add-jd2-quirk-for-hp-omen-14.patch | 42 ++++ ...hw_desc-array-overrun-in-dw-axi-dmac.patch | 77 +++++++ ...s-empty-buckets-in-batadv_purge_orig.patch | 110 ++++++++++ ...octl-prefer-different-overflow-check.patch | 88 ++++++++ ...fix-multiple-issues-reported-by-chec.patch | 190 +++++++++++++++++ ...-sec-fix-memory-leak-for-sec-resourc.patch | 42 ++++ ...exit-idle-optimizations-before-hdcp-.patch | 88 ++++++++ ...a-add-mask-irq-callback-to-gp-and-pp.patch | 145 +++++++++++++ ...qs-in-timeout-path-before-hard-reset.patch | 63 ++++++ ...r-replace-spin_lock-by-raw_spin_lock.patch | 155 ++++++++++++++ ...r-sb_inlinecrypt-flag-in-default_opt.patch | 49 +++++ ...add-quirk-for-logitech-casa-touchpad.patch | 56 +++++ ...e-n-key-report-descriptors-if-n-key-.patch | 94 +++++++++ ...work-around-a-potential-audit-memory.patch | 66 ++++++ ...-smmu-v3-free-msis-in-case-of-enomem.patch | 40 ++++ ...ftest-arm64-add-a-null-pointer-check.patch | 48 +++++ ...ps-octeon-add-pcie-link-status-check.patch | 55 +++++ ...-keep-default-led-state-in-rtl8366rb.patch | 193 ++++++++++++++++++ ...lse-lockdep-warning-on-qdisc-root-lo.patch | 192 +++++++++++++++++ ...ce-condition-in-netpoll_owner_active.patch | 52 +++++ ...bh-when-taking-works-lock-on-mt-path.patch | 62 ++++++ ...old-for-hp-pavilion-17-pc-1972-pcie-.patch | 71 +++++++ ...b-don-t-init-until-unassigned-resour.patch | 86 ++++++++ ...hiba_acpi-add-quirk-for-buttons-on-z.patch | 138 +++++++++++++ ...s_usbpd-provide-id-table-for-avoidin.patch | 66 ++++++ ...-clang-null-pointer-arithmetic-warni.patch | 85 ++++++++ ...enforce-hcall-result-buffer-validity.patch | 82 ++++++++ ...nvalid-context-warning-when-enable-s.patch | 120 +++++++++++ ...cu_torture_one_read-pipe_count-overf.patch | 39 ++++ ...stall-tasks-directly-exit-when-rcuto.patch | 103 ++++++++++ ...rash-while-reading-debugfs-attribute.patch | 95 +++++++++ ...x-flaky-test-btf_map_in_map-lookup_u.patch | 87 ++++++++ ...event-client-connect-before-server-b.patch | 82 ++++++++ ...-adding-missing-cti-and-exar-pci-ids.patch | 77 +++++++ ...duce-timeout-when-waiting-on-transmi.patch | 59 ++++++ queue-6.1/series | 44 ++++ ...ion-to-have-a-tty-reject-a-new-ldisc.patch | 111 ++++++++++ ...ent-overflow-in-udf_disk_stamp_to_ti.patch | 54 +++++ ...-t-set-linux-phy_charger_detect-prop.patch | 68 ++++++ ...ion-remove-usage-of-the-deprecated-i.patch | 98 +++++++++ ...check-for-incompatible-versions-of-t.patch | 75 +++++++ ...-work-around-memset-overflow-warning.patch | 72 +++++++ ...s-fix-potential-hung-tasks-during-ch.patch | 106 ++++++++++ 45 files changed, 3843 insertions(+) create mode 100644 queue-6.1/af_packet-avoid-a-false-positive-warning-in-packet_s.patch create mode 100644 queue-6.1/alsa-hda-realtek-add-quirks-for-lenovo-13x.patch create mode 100644 queue-6.1/asoc-intel-sof_sdw-add-jd2-quirk-for-hp-omen-14.patch create mode 100644 queue-6.1/avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch create mode 100644 queue-6.1/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch create mode 100644 queue-6.1/block-ioctl-prefer-different-overflow-check.patch create mode 100644 queue-6.1/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch create mode 100644 queue-6.1/crypto-hisilicon-sec-fix-memory-leak-for-sec-resourc.patch create mode 100644 queue-6.1/drm-amd-display-exit-idle-optimizations-before-hdcp-.patch create mode 100644 queue-6.1/drm-lima-add-mask-irq-callback-to-gp-and-pp.patch create mode 100644 queue-6.1/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch create mode 100644 queue-6.1/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch create mode 100644 queue-6.1/f2fs-remove-clear-sb_inlinecrypt-flag-in-default_opt.patch create mode 100644 queue-6.1/hid-add-quirk-for-logitech-casa-touchpad.patch create mode 100644 queue-6.1/hid-asus-fix-more-n-key-report-descriptors-if-n-key-.patch create mode 100644 queue-6.1/io_uring-sqpoll-work-around-a-potential-audit-memory.patch create mode 100644 queue-6.1/iommu-arm-smmu-v3-free-msis-in-case-of-enomem.patch create mode 100644 queue-6.1/kselftest-arm64-add-a-null-pointer-check.patch create mode 100644 queue-6.1/mips-octeon-add-pcie-link-status-check.patch create mode 100644 queue-6.1/net-dsa-realtek-keep-default-led-state-in-rtl8366rb.patch create mode 100644 queue-6.1/net-sched-fix-false-lockdep-warning-on-qdisc-root-lo.patch create mode 100644 queue-6.1/netpoll-fix-race-condition-in-netpoll_owner_active.patch create mode 100644 queue-6.1/padata-disable-bh-when-taking-works-lock-on-mt-path.patch create mode 100644 queue-6.1/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch create mode 100644 queue-6.1/platform-x86-p2sb-don-t-init-until-unassigned-resour.patch create mode 100644 queue-6.1/platform-x86-toshiba_acpi-add-quirk-for-buttons-on-z.patch create mode 100644 queue-6.1/power-supply-cros_usbpd-provide-id-table-for-avoidin.patch create mode 100644 queue-6.1/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch create mode 100644 queue-6.1/powerpc-pseries-enforce-hcall-result-buffer-validity.patch create mode 100644 queue-6.1/rcutorture-fix-invalid-context-warning-when-enable-s.patch create mode 100644 queue-6.1/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch create mode 100644 queue-6.1/rcutorture-make-stall-tasks-directly-exit-when-rcuto.patch create mode 100644 queue-6.1/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch create mode 100644 queue-6.1/selftests-bpf-fix-flaky-test-btf_map_in_map-lookup_u.patch create mode 100644 queue-6.1/selftests-bpf-prevent-client-connect-before-server-b.patch create mode 100644 queue-6.1/serial-exar-adding-missing-cti-and-exar-pci-ids.patch create mode 100644 queue-6.1/serial-imx-introduce-timeout-when-waiting-on-transmi.patch create mode 100644 queue-6.1/series create mode 100644 queue-6.1/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch create mode 100644 queue-6.1/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch create mode 100644 queue-6.1/usb-dwc3-pci-don-t-set-linux-phy_charger_detect-prop.patch create mode 100644 queue-6.1/usb-gadget-function-remove-usage-of-the-deprecated-i.patch create mode 100644 queue-6.1/usb-misc-uss720-check-for-incompatible-versions-of-t.patch create mode 100644 queue-6.1/wifi-ath9k-work-around-memset-overflow-warning.patch create mode 100644 queue-6.1/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch diff --git a/queue-6.1/af_packet-avoid-a-false-positive-warning-in-packet_s.patch b/queue-6.1/af_packet-avoid-a-false-positive-warning-in-packet_s.patch new file mode 100644 index 00000000000..68f6e083dce --- /dev/null +++ b/queue-6.1/af_packet-avoid-a-false-positive-warning-in-packet_s.patch @@ -0,0 +1,81 @@ +From 73061e228a01d3efa0a77389d280763937f678b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 11:49:39 +0000 +Subject: af_packet: avoid a false positive warning in packet_setsockopt() + +From: Eric Dumazet + +[ Upstream commit 86d43e2bf93ccac88ef71cee36a23282ebd9e427 ] + +Although the code is correct, the following line + + copy_from_sockptr(&req_u.req, optval, len)); + +triggers this warning : + +memcpy: detected field-spanning write (size 28) of single field "dst" at include/linux/sockptr.h:49 (size 16) + +Refactor the code to be more explicit. + +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Kees Cook +Cc: Willem de Bruijn +Reviewed-by: Kees Cook +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 8888c09931ce3..c48cb7664c552 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3791,28 +3791,30 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval, + case PACKET_TX_RING: + { + union tpacket_req_u req_u; +- int len; + ++ ret = -EINVAL; + lock_sock(sk); + switch (po->tp_version) { + case TPACKET_V1: + case TPACKET_V2: +- len = sizeof(req_u.req); ++ if (optlen < sizeof(req_u.req)) ++ break; ++ ret = copy_from_sockptr(&req_u.req, optval, ++ sizeof(req_u.req)) ? ++ -EINVAL : 0; + break; + case TPACKET_V3: + default: +- len = sizeof(req_u.req3); ++ if (optlen < sizeof(req_u.req3)) ++ break; ++ ret = copy_from_sockptr(&req_u.req3, optval, ++ sizeof(req_u.req3)) ? ++ -EINVAL : 0; + break; + } +- if (optlen < len) { +- ret = -EINVAL; +- } else { +- if (copy_from_sockptr(&req_u.req, optval, len)) +- ret = -EFAULT; +- else +- ret = packet_set_ring(sk, &req_u, 0, +- optname == PACKET_TX_RING); +- } ++ if (!ret) ++ ret = packet_set_ring(sk, &req_u, 0, ++ optname == PACKET_TX_RING); + release_sock(sk); + return ret; + } +-- +2.43.0 + diff --git a/queue-6.1/alsa-hda-realtek-add-quirks-for-lenovo-13x.patch b/queue-6.1/alsa-hda-realtek-add-quirks-for-lenovo-13x.patch new file mode 100644 index 00000000000..c3e429197e6 --- /dev/null +++ b/queue-6.1/alsa-hda-realtek-add-quirks-for-lenovo-13x.patch @@ -0,0 +1,37 @@ +From cbecea57cc82496df0a4da236d2f543efe29165d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 17:23:03 +0100 +Subject: ALSA: hda/realtek: Add quirks for Lenovo 13X + +From: Stefan Binding + +[ Upstream commit 25f46354dca912c84f1f79468fd636a94b8d287a ] + +Add laptop using CS35L41 HDA. +This laptop does not have _DSD, so require entries in property +configuration table for cs35l41_hda driver. + +Signed-off-by: Stefan Binding +Message-ID: <20240423162303.638211-3-sbinding@opensource.cirrus.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3a7104f72cabd..35dabe6ce0d7a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10090,6 +10090,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), + SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS), + SND_PCI_QUIRK(0x17aa, 0x3855, "Legion 7 16ITHG6", ALC287_FIXUP_LEGION_16ITHG6), ++ SND_PCI_QUIRK(0x17aa, 0x3865, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x3866, "Lenovo 13X", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), +-- +2.43.0 + diff --git a/queue-6.1/asoc-intel-sof_sdw-add-jd2-quirk-for-hp-omen-14.patch b/queue-6.1/asoc-intel-sof_sdw-add-jd2-quirk-for-hp-omen-14.patch new file mode 100644 index 00000000000..0c51cb38ab1 --- /dev/null +++ b/queue-6.1/asoc-intel-sof_sdw-add-jd2-quirk-for-hp-omen-14.patch @@ -0,0 +1,42 @@ +From 6ddf1f6e44f2457e1c6c88cc0a31954c640f5f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 17:03:38 -0500 +Subject: ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14 + +From: Pierre-Louis Bossart + +[ Upstream commit 4fee07fbf47d2a5f1065d985459e5ce7bf7969f0 ] + +The default JD1 does not seem to work, use JD2 instead. + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20240411220347.131267-4-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index d1e6e4208c376..d03de37e3578c 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -413,6 +413,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + SOF_BT_OFFLOAD_SSP(1) | + SOF_SSP_BT_OFFLOAD_PRESENT), + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN Transcend Gaming Laptop"), ++ }, ++ .driver_data = (void *)(RT711_JD2), ++ }, ++ + /* LunarLake devices */ + { + .callback = sof_sdw_quirk_cb, +-- +2.43.0 + diff --git a/queue-6.1/avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch b/queue-6.1/avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch new file mode 100644 index 00000000000..5f85ffb675d --- /dev/null +++ b/queue-6.1/avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch @@ -0,0 +1,77 @@ +From 7766c9f3c6ef8a34ad774a52027ea73522e75d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 10:49:24 +0000 +Subject: Avoid hw_desc array overrun in dw-axi-dmac + +From: Joao Pinto + +[ Upstream commit 333e11bf47fa8d477db90e2900b1ed3c9ae9b697 ] + +I have a use case where nr_buffers = 3 and in which each descriptor is composed by 3 +segments, resulting in the DMA channel descs_allocated to be 9. Since axi_desc_put() +handles the hw_desc considering the descs_allocated, this scenario would result in a +kernel panic (hw_desc array will be overrun). + +To fix this, the proposal is to add a new member to the axi_dma_desc structure, +where we keep the number of allocated hw_descs (axi_desc_alloc()) and use it in +axi_desc_put() to handle the hw_desc array correctly. + +Additionally I propose to remove the axi_chan_start_first_queued() call after completing +the transfer, since it was identified that unbalance can occur (started descriptors can +be interrupted and transfer ignored due to DMA channel not being enabled). + +Signed-off-by: Joao Pinto +Link: https://lore.kernel.org/r/1711536564-12919-1-git-send-email-jpinto@synopsys.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++---- + drivers/dma/dw-axi-dmac/dw-axi-dmac.h | 1 + + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 152c5d98524d7..7596864bf8bb2 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -250,6 +250,7 @@ static struct axi_dma_desc *axi_desc_alloc(u32 num) + kfree(desc); + return NULL; + } ++ desc->nr_hw_descs = num; + + return desc; + } +@@ -276,7 +277,7 @@ static struct axi_dma_lli *axi_desc_get(struct axi_dma_chan *chan, + static void axi_desc_put(struct axi_dma_desc *desc) + { + struct axi_dma_chan *chan = desc->chan; +- int count = atomic_read(&chan->descs_allocated); ++ int count = desc->nr_hw_descs; + struct axi_dma_hw_desc *hw_desc; + int descs_put; + +@@ -1087,9 +1088,6 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) + /* Remove the completed descriptor from issued list before completing */ + list_del(&vd->node); + vchan_cookie_complete(vd); +- +- /* Submit queued descriptors after processing the completed ones */ +- axi_chan_start_first_queued(chan); + } + + out: +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h +index e9d5eb0fd5948..764427a66f5e8 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac.h ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac.h +@@ -103,6 +103,7 @@ struct axi_dma_desc { + u32 completed_blocks; + u32 length; + u32 period_len; ++ u32 nr_hw_descs; + }; + + struct axi_dma_chan_config { +-- +2.43.0 + diff --git a/queue-6.1/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch b/queue-6.1/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch new file mode 100644 index 00000000000..0922c6e8ea0 --- /dev/null +++ b/queue-6.1/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch @@ -0,0 +1,110 @@ +From aa9ee3f70f90167eb98d8cc976e7403cb8ccab41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2024 15:54:38 +0000 +Subject: batman-adv: bypass empty buckets in batadv_purge_orig_ref() + +From: Eric Dumazet + +[ Upstream commit 40dc8ab605894acae1473e434944924a22cfaaa0 ] + +Many syzbot reports are pointing to soft lockups in +batadv_purge_orig_ref() [1] + +Root cause is unknown, but we can avoid spending too much +time there and perhaps get more interesting reports. + +[1] + +watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] +Modules linked in: +irq event stamp: 6182794 + hardirqs last enabled at (6182793): [] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 + hardirqs last disabled at (6182794): [] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] + hardirqs last disabled at (6182794): [] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 + softirqs last enabled at (6182792): [] spin_unlock_bh include/linux/spinlock.h:396 [inline] + softirqs last enabled at (6182792): [] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 + softirqs last disabled at (6182790): [] spin_lock_bh include/linux/spinlock.h:356 [inline] + softirqs last disabled at (6182790): [] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 +CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +Workqueue: bat_events batadv_purge_orig +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] + pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 + lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 +sp : ffff800099007970 +x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 +x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 +x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 +x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 +x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 +x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 +x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 +x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 +x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 +x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 +Call trace: + __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] + arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] + __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 + __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] + _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 + spin_unlock_bh include/linux/spinlock.h:396 [inline] + batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 + batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 + process_one_work+0x694/0x1204 kernel/workqueue.c:2633 + process_scheduled_works kernel/workqueue.c:2706 [inline] + worker_thread+0x938/0xef4 kernel/workqueue.c:2787 + kthread+0x288/0x310 kernel/kthread.c:388 + ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 +Sending NMI from CPU 0 to CPUs 1: +NMI backtrace for cpu 1 +CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 + lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 +sp : ffff800093a17d30 +x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 +x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 +x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 +x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 +x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 +x14: 1fffe00036805f10 x13: 0000000000000000 x12: 0000000000000003 +x11: 0000000000000001 x10: 0000000000000003 x9 : 0000000000000000 +x8 : 00000000000ce8d1 x7 : ffff8000804609e4 x6 : 0000000000000000 +x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008ad6aac0 +x2 : 0000000000000000 x1 : ffff80008aedea60 x0 : ffff800125436000 +Call trace: + __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] + arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49 + cpuidle_idle_call kernel/sched/idle.c:170 [inline] + do_idle+0x1f0/0x4e8 kernel/sched/idle.c:312 + cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:410 + secondary_start_kernel+0x198/0x1c0 arch/arm64/kernel/smp.c:272 + __secondary_switched+0xb8/0xbc arch/arm64/kernel/head.S:404 + +Signed-off-by: Eric Dumazet +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/originator.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index 34903df4fe936..dafef3a78ad5d 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -1238,6 +1238,8 @@ void batadv_purge_orig_ref(struct batadv_priv *bat_priv) + /* for all origins... */ + for (i = 0; i < hash->size; i++) { + head = &hash->table[i]; ++ if (hlist_empty(head)) ++ continue; + list_lock = &hash->list_locks[i]; + + spin_lock_bh(list_lock); +-- +2.43.0 + diff --git a/queue-6.1/block-ioctl-prefer-different-overflow-check.patch b/queue-6.1/block-ioctl-prefer-different-overflow-check.patch new file mode 100644 index 00000000000..93fa0608873 --- /dev/null +++ b/queue-6.1/block-ioctl-prefer-different-overflow-check.patch @@ -0,0 +1,88 @@ +From f5f595de1f0953490e88edb57baa257c51db19bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2024 03:53:49 +0000 +Subject: block/ioctl: prefer different overflow check + +From: Justin Stitt + +[ Upstream commit ccb326b5f9e623eb7f130fbbf2505ec0e2dcaff9 ] + +Running syzkaller with the newly reintroduced signed integer overflow +sanitizer shows this report: + +[ 62.982337] ------------[ cut here ]------------ +[ 62.985692] cgroup: Invalid name +[ 62.986211] UBSAN: signed-integer-overflow in ../block/ioctl.c:36:46 +[ 62.989370] 9pnet_fd: p9_fd_create_tcp (7343): problem connecting socket to 127.0.0.1 +[ 62.992992] 9223372036854775807 + 4095 cannot be represented in type 'long long' +[ 62.997827] 9pnet_fd: p9_fd_create_tcp (7345): problem connecting socket to 127.0.0.1 +[ 62.999369] random: crng reseeded on system resumption +[ 63.000634] GUP no longer grows the stack in syz-executor.2 (7353): 20002000-20003000 (20001000) +[ 63.000668] CPU: 0 PID: 7353 Comm: syz-executor.2 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1 +[ 63.000677] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +[ 63.000682] Call Trace: +[ 63.000686] +[ 63.000731] dump_stack_lvl+0x93/0xd0 +[ 63.000919] __get_user_pages+0x903/0xd30 +[ 63.001030] __gup_longterm_locked+0x153e/0x1ba0 +[ 63.001041] ? _raw_read_unlock_irqrestore+0x17/0x50 +[ 63.001072] ? try_get_folio+0x29c/0x2d0 +[ 63.001083] internal_get_user_pages_fast+0x1119/0x1530 +[ 63.001109] iov_iter_extract_pages+0x23b/0x580 +[ 63.001206] bio_iov_iter_get_pages+0x4de/0x1220 +[ 63.001235] iomap_dio_bio_iter+0x9b6/0x1410 +[ 63.001297] __iomap_dio_rw+0xab4/0x1810 +[ 63.001316] iomap_dio_rw+0x45/0xa0 +[ 63.001328] ext4_file_write_iter+0xdde/0x1390 +[ 63.001372] vfs_write+0x599/0xbd0 +[ 63.001394] ksys_write+0xc8/0x190 +[ 63.001403] do_syscall_64+0xd4/0x1b0 +[ 63.001421] ? arch_exit_to_user_mode_prepare+0x3a/0x60 +[ 63.001479] entry_SYSCALL_64_after_hwframe+0x6f/0x77 +[ 63.001535] RIP: 0033:0x7f7fd3ebf539 +[ 63.001551] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 +[ 63.001562] RSP: 002b:00007f7fd32570c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +[ 63.001584] RAX: ffffffffffffffda RBX: 00007f7fd3ff3f80 RCX: 00007f7fd3ebf539 +[ 63.001590] RDX: 4db6d1e4f7e43360 RSI: 0000000020000000 RDI: 0000000000000004 +[ 63.001595] RBP: 00007f7fd3f1e496 R08: 0000000000000000 R09: 0000000000000000 +[ 63.001599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +[ 63.001604] R13: 0000000000000006 R14: 00007f7fd3ff3f80 R15: 00007ffd415ad2b8 +... +[ 63.018142] ---[ end trace ]--- + +Historically, the signed integer overflow sanitizer did not work in the +kernel due to its interaction with `-fwrapv` but this has since been +changed [1] in the newest version of Clang; It was re-enabled in the +kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow +sanitizer"). + +Let's rework this overflow checking logic to not actually perform an +overflow during the check itself, thus avoiding the UBSAN splat. + +[1]: https://github.com/llvm/llvm-project/pull/82432 + +Signed-off-by: Justin Stitt +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20240507-b4-sio-block-ioctl-v3-1-ba0c2b32275e@google.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/ioctl.c b/block/ioctl.c +index 99b8e2e448729..c7390d8c9fc73 100644 +--- a/block/ioctl.c ++++ b/block/ioctl.c +@@ -33,7 +33,7 @@ static int blkpg_do_ioctl(struct block_device *bdev, + if (op == BLKPG_DEL_PARTITION) + return bdev_del_partition(disk, p.pno); + +- if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) ++ if (p.start < 0 || p.length <= 0 || LLONG_MAX - p.length < p.start) + return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) +-- +2.43.0 + diff --git a/queue-6.1/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch b/queue-6.1/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch new file mode 100644 index 00000000000..2666ac27dfd --- /dev/null +++ b/queue-6.1/bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch @@ -0,0 +1,190 @@ +From b5e187ea91c59a8a22c9662ea9685aed1dbb2df7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 00:42:24 +0300 +Subject: Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl + +From: Uri Arev + +[ Upstream commit 68aa21054ec3a1a313af90a5f95ade16c3326d20 ] + +This fixes some CHECKs reported by the checkpatch script. + +Issues reported in ath3k.c: +------- +ath3k.c +------- +CHECK: Please don't use multiple blank lines ++ ++ + +CHECK: Blank lines aren't necessary after an open brace '{' ++static const struct usb_device_id ath3k_blist_tbl[] = { ++ + +CHECK: Alignment should match open parenthesis ++static int ath3k_load_firmware(struct usb_device *udev, ++ const struct firmware *firmware) + +CHECK: Alignment should match open parenthesis ++ err = usb_bulk_msg(udev, pipe, send_buf, size, ++ &len, 3000); + +CHECK: Unnecessary parentheses around 'len != size' ++ if (err || (len != size)) { + +CHECK: Alignment should match open parenthesis ++static int ath3k_get_version(struct usb_device *udev, ++ struct ath3k_version *version) + +CHECK: Alignment should match open parenthesis ++static int ath3k_load_fwfile(struct usb_device *udev, ++ const struct firmware *firmware) + +CHECK: Alignment should match open parenthesis ++ err = usb_bulk_msg(udev, pipe, send_buf, size, ++ &len, 3000); + +CHECK: Unnecessary parentheses around 'len != size' ++ if (err || (len != size)) { + +CHECK: Blank lines aren't necessary after an open brace '{' ++ switch (fw_version.ref_clock) { ++ + +CHECK: Alignment should match open parenthesis ++ snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s", ++ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); + +CHECK: Alignment should match open parenthesis ++static int ath3k_probe(struct usb_interface *intf, ++ const struct usb_device_id *id) + +CHECK: Alignment should match open parenthesis ++ BT_ERR("Firmware file \"%s\" not found", ++ ATH3K_FIRMWARE); + +CHECK: Alignment should match open parenthesis ++ BT_ERR("Firmware file \"%s\" request failed (err=%d)", ++ ATH3K_FIRMWARE, ret); + +total: 0 errors, 0 warnings, 14 checks, 540 lines checked + +Signed-off-by: Uri Arev +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/ath3k.c | 25 +++++++++++-------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c +index 88262d3a93923..ce97b336fbfb8 100644 +--- a/drivers/bluetooth/ath3k.c ++++ b/drivers/bluetooth/ath3k.c +@@ -3,7 +3,6 @@ + * Copyright (c) 2008-2009 Atheros Communications Inc. + */ + +- + #include + #include + #include +@@ -128,7 +127,6 @@ MODULE_DEVICE_TABLE(usb, ath3k_table); + * for AR3012 + */ + static const struct usb_device_id ath3k_blist_tbl[] = { +- + /* Atheros AR3012 with sflash firmware*/ + { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, +@@ -202,7 +200,7 @@ static inline void ath3k_log_failed_loading(int err, int len, int size, + #define TIMEGAP_USEC_MAX 100 + + static int ath3k_load_firmware(struct usb_device *udev, +- const struct firmware *firmware) ++ const struct firmware *firmware) + { + u8 *send_buf; + int len = 0; +@@ -237,9 +235,9 @@ static int ath3k_load_firmware(struct usb_device *udev, + memcpy(send_buf, firmware->data + sent, size); + + err = usb_bulk_msg(udev, pipe, send_buf, size, +- &len, 3000); ++ &len, 3000); + +- if (err || (len != size)) { ++ if (err || len != size) { + ath3k_log_failed_loading(err, len, size, count); + goto error; + } +@@ -262,7 +260,7 @@ static int ath3k_get_state(struct usb_device *udev, unsigned char *state) + } + + static int ath3k_get_version(struct usb_device *udev, +- struct ath3k_version *version) ++ struct ath3k_version *version) + { + return usb_control_msg_recv(udev, 0, ATH3K_GETVERSION, + USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, +@@ -271,7 +269,7 @@ static int ath3k_get_version(struct usb_device *udev, + } + + static int ath3k_load_fwfile(struct usb_device *udev, +- const struct firmware *firmware) ++ const struct firmware *firmware) + { + u8 *send_buf; + int len = 0; +@@ -310,8 +308,8 @@ static int ath3k_load_fwfile(struct usb_device *udev, + memcpy(send_buf, firmware->data + sent, size); + + err = usb_bulk_msg(udev, pipe, send_buf, size, +- &len, 3000); +- if (err || (len != size)) { ++ &len, 3000); ++ if (err || len != size) { + ath3k_log_failed_loading(err, len, size, count); + kfree(send_buf); + return err; +@@ -425,7 +423,6 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + switch (fw_version.ref_clock) { +- + case ATH3K_XTAL_FREQ_26M: + clk_value = 26; + break; +@@ -441,7 +438,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + snprintf(filename, ATH3K_NAME_LEN, "ar3k/ramps_0x%08x_%d%s", +- le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); ++ le32_to_cpu(fw_version.rom_version), clk_value, ".dfu"); + + ret = request_firmware(&firmware, filename, &udev->dev); + if (ret < 0) { +@@ -456,7 +453,7 @@ static int ath3k_load_syscfg(struct usb_device *udev) + } + + static int ath3k_probe(struct usb_interface *intf, +- const struct usb_device_id *id) ++ const struct usb_device_id *id) + { + const struct firmware *firmware; + struct usb_device *udev = interface_to_usbdev(intf); +@@ -505,10 +502,10 @@ static int ath3k_probe(struct usb_interface *intf, + if (ret < 0) { + if (ret == -ENOENT) + BT_ERR("Firmware file \"%s\" not found", +- ATH3K_FIRMWARE); ++ ATH3K_FIRMWARE); + else + BT_ERR("Firmware file \"%s\" request failed (err=%d)", +- ATH3K_FIRMWARE, ret); ++ ATH3K_FIRMWARE, ret); + return ret; + } + +-- +2.43.0 + diff --git a/queue-6.1/crypto-hisilicon-sec-fix-memory-leak-for-sec-resourc.patch b/queue-6.1/crypto-hisilicon-sec-fix-memory-leak-for-sec-resourc.patch new file mode 100644 index 00000000000..69aecddc99f --- /dev/null +++ b/queue-6.1/crypto-hisilicon-sec-fix-memory-leak-for-sec-resourc.patch @@ -0,0 +1,42 @@ +From 1ac9ccc42661c137fde4b2d4a19ff0670bb585a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2024 15:59:58 +0800 +Subject: crypto: hisilicon/sec - Fix memory leak for sec resource release + +From: Chenghai Huang + +[ Upstream commit bba4250757b4ae1680fea435a358d8093f254094 ] + +The AIV is one of the SEC resources. When releasing resources, +it need to release the AIV resources at the same time. +Otherwise, memory leakage occurs. + +The aiv resource release is added to the sec resource release +function. + +Signed-off-by: Chenghai Huang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index cae7c414bdaf4..09a20307d01e3 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -479,8 +479,10 @@ static void sec_alg_resource_free(struct sec_ctx *ctx, + + if (ctx->pbuf_supported) + sec_free_pbuf_resource(dev, qp_ctx->res); +- if (ctx->alg_type == SEC_AEAD) ++ if (ctx->alg_type == SEC_AEAD) { + sec_free_mac_resource(dev, qp_ctx->res); ++ sec_free_aiv_resource(dev, qp_ctx->res); ++ } + } + + static int sec_alloc_qp_ctx_resource(struct hisi_qm *qm, struct sec_ctx *ctx, +-- +2.43.0 + diff --git a/queue-6.1/drm-amd-display-exit-idle-optimizations-before-hdcp-.patch b/queue-6.1/drm-amd-display-exit-idle-optimizations-before-hdcp-.patch new file mode 100644 index 00000000000..5a084e1c71d --- /dev/null +++ b/queue-6.1/drm-amd-display-exit-idle-optimizations-before-hdcp-.patch @@ -0,0 +1,88 @@ +From 73406d923af8e8b13361a142f64d9e6d7478f170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 16:51:59 -0500 +Subject: drm/amd/display: Exit idle optimizations before HDCP execution + +From: Nicholas Kazlauskas + +[ Upstream commit f30a3bea92bdab398531129d187629fb1d28f598 ] + +[WHY] +PSP can access DCN registers during command submission and we need +to ensure that DCN is not in PG before doing so. + +[HOW] +Add a callback to DM to lock and notify DC for idle optimization exit. +It can't be DC directly because of a potential race condition with the +link protection thread and the rest of DM operation. + +Cc: Mario Limonciello +Cc: Alex Deucher +Reviewed-by: Charlene Liu +Acked-by: Alex Hung +Signed-off-by: Nicholas Kazlauskas +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c | 10 ++++++++++ + drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h | 8 ++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +index 5e01c6e24cbc8..9a5a1726acaf8 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp.c +@@ -88,6 +88,14 @@ static uint8_t is_cp_desired_hdcp2(struct mod_hdcp *hdcp) + !hdcp->connection.is_hdcp2_revoked; + } + ++static void exit_idle_optimizations(struct mod_hdcp *hdcp) ++{ ++ struct mod_hdcp_dm *dm = &hdcp->config.dm; ++ ++ if (dm->funcs.exit_idle_optimizations) ++ dm->funcs.exit_idle_optimizations(dm->handle); ++} ++ + static enum mod_hdcp_status execution(struct mod_hdcp *hdcp, + struct mod_hdcp_event_context *event_ctx, + union mod_hdcp_transition_input *input) +@@ -543,6 +551,8 @@ enum mod_hdcp_status mod_hdcp_process_event(struct mod_hdcp *hdcp, + memset(&event_ctx, 0, sizeof(struct mod_hdcp_event_context)); + event_ctx.event = event; + ++ exit_idle_optimizations(hdcp); ++ + /* execute and transition */ + exec_status = execution(hdcp, &event_ctx, &hdcp->auth.trans_input); + trans_status = transition( +diff --git a/drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h b/drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +index 3348bb97ef81a..dfa8168e51890 100644 +--- a/drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h ++++ b/drivers/gpu/drm/amd/display/modules/inc/mod_hdcp.h +@@ -155,6 +155,13 @@ struct mod_hdcp_ddc { + } funcs; + }; + ++struct mod_hdcp_dm { ++ void *handle; ++ struct { ++ void (*exit_idle_optimizations)(void *handle); ++ } funcs; ++}; ++ + struct mod_hdcp_psp { + void *handle; + void *funcs; +@@ -271,6 +278,7 @@ struct mod_hdcp_display_query { + struct mod_hdcp_config { + struct mod_hdcp_psp psp; + struct mod_hdcp_ddc ddc; ++ struct mod_hdcp_dm dm; + uint8_t index; + }; + +-- +2.43.0 + diff --git a/queue-6.1/drm-lima-add-mask-irq-callback-to-gp-and-pp.patch b/queue-6.1/drm-lima-add-mask-irq-callback-to-gp-and-pp.patch new file mode 100644 index 00000000000..5b5b12dd528 --- /dev/null +++ b/queue-6.1/drm-lima-add-mask-irq-callback-to-gp-and-pp.patch @@ -0,0 +1,145 @@ +From 8c3d34fc3b3af97f71519e199d0eeab9fcf91c57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 17:29:49 +0200 +Subject: drm/lima: add mask irq callback to gp and pp + +From: Erico Nunes + +[ Upstream commit 49c13b4d2dd4a831225746e758893673f6ae961c ] + +This is needed because we want to reset those devices in device-agnostic +code such as lima_sched. +In particular, masking irqs will be useful before a hard reset to +prevent race conditions. + +Signed-off-by: Erico Nunes +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20240405152951.1531555-2-nunes.erico@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_bcast.c | 12 ++++++++++++ + drivers/gpu/drm/lima/lima_bcast.h | 3 +++ + drivers/gpu/drm/lima/lima_gp.c | 8 ++++++++ + drivers/gpu/drm/lima/lima_pp.c | 18 ++++++++++++++++++ + drivers/gpu/drm/lima/lima_sched.h | 1 + + 5 files changed, 42 insertions(+) + +diff --git a/drivers/gpu/drm/lima/lima_bcast.c b/drivers/gpu/drm/lima/lima_bcast.c +index fbc43f243c54d..6d000504e1a4e 100644 +--- a/drivers/gpu/drm/lima/lima_bcast.c ++++ b/drivers/gpu/drm/lima/lima_bcast.c +@@ -43,6 +43,18 @@ void lima_bcast_suspend(struct lima_ip *ip) + + } + ++int lima_bcast_mask_irq(struct lima_ip *ip) ++{ ++ bcast_write(LIMA_BCAST_BROADCAST_MASK, 0); ++ bcast_write(LIMA_BCAST_INTERRUPT_MASK, 0); ++ return 0; ++} ++ ++int lima_bcast_reset(struct lima_ip *ip) ++{ ++ return lima_bcast_hw_init(ip); ++} ++ + int lima_bcast_init(struct lima_ip *ip) + { + int i; +diff --git a/drivers/gpu/drm/lima/lima_bcast.h b/drivers/gpu/drm/lima/lima_bcast.h +index 465ee587bceb2..cd08841e47879 100644 +--- a/drivers/gpu/drm/lima/lima_bcast.h ++++ b/drivers/gpu/drm/lima/lima_bcast.h +@@ -13,4 +13,7 @@ void lima_bcast_fini(struct lima_ip *ip); + + void lima_bcast_enable(struct lima_device *dev, int num_pp); + ++int lima_bcast_mask_irq(struct lima_ip *ip); ++int lima_bcast_reset(struct lima_ip *ip); ++ + #endif +diff --git a/drivers/gpu/drm/lima/lima_gp.c b/drivers/gpu/drm/lima/lima_gp.c +index 8dd501b7a3d0d..6cf46b653e810 100644 +--- a/drivers/gpu/drm/lima/lima_gp.c ++++ b/drivers/gpu/drm/lima/lima_gp.c +@@ -212,6 +212,13 @@ static void lima_gp_task_mmu_error(struct lima_sched_pipe *pipe) + lima_sched_pipe_task_done(pipe); + } + ++static void lima_gp_task_mask_irq(struct lima_sched_pipe *pipe) ++{ ++ struct lima_ip *ip = pipe->processor[0]; ++ ++ gp_write(LIMA_GP_INT_MASK, 0); ++} ++ + static int lima_gp_task_recover(struct lima_sched_pipe *pipe) + { + struct lima_ip *ip = pipe->processor[0]; +@@ -344,6 +351,7 @@ int lima_gp_pipe_init(struct lima_device *dev) + pipe->task_error = lima_gp_task_error; + pipe->task_mmu_error = lima_gp_task_mmu_error; + pipe->task_recover = lima_gp_task_recover; ++ pipe->task_mask_irq = lima_gp_task_mask_irq; + + return 0; + } +diff --git a/drivers/gpu/drm/lima/lima_pp.c b/drivers/gpu/drm/lima/lima_pp.c +index a5c95bed08c09..54b208a4a768e 100644 +--- a/drivers/gpu/drm/lima/lima_pp.c ++++ b/drivers/gpu/drm/lima/lima_pp.c +@@ -408,6 +408,9 @@ static void lima_pp_task_error(struct lima_sched_pipe *pipe) + + lima_pp_hard_reset(ip); + } ++ ++ if (pipe->bcast_processor) ++ lima_bcast_reset(pipe->bcast_processor); + } + + static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe) +@@ -416,6 +419,20 @@ static void lima_pp_task_mmu_error(struct lima_sched_pipe *pipe) + lima_sched_pipe_task_done(pipe); + } + ++static void lima_pp_task_mask_irq(struct lima_sched_pipe *pipe) ++{ ++ int i; ++ ++ for (i = 0; i < pipe->num_processor; i++) { ++ struct lima_ip *ip = pipe->processor[i]; ++ ++ pp_write(LIMA_PP_INT_MASK, 0); ++ } ++ ++ if (pipe->bcast_processor) ++ lima_bcast_mask_irq(pipe->bcast_processor); ++} ++ + static struct kmem_cache *lima_pp_task_slab; + static int lima_pp_task_slab_refcnt; + +@@ -447,6 +464,7 @@ int lima_pp_pipe_init(struct lima_device *dev) + pipe->task_fini = lima_pp_task_fini; + pipe->task_error = lima_pp_task_error; + pipe->task_mmu_error = lima_pp_task_mmu_error; ++ pipe->task_mask_irq = lima_pp_task_mask_irq; + + return 0; + } +diff --git a/drivers/gpu/drm/lima/lima_sched.h b/drivers/gpu/drm/lima/lima_sched.h +index 6a11764d87b38..edf205be43699 100644 +--- a/drivers/gpu/drm/lima/lima_sched.h ++++ b/drivers/gpu/drm/lima/lima_sched.h +@@ -80,6 +80,7 @@ struct lima_sched_pipe { + void (*task_error)(struct lima_sched_pipe *pipe); + void (*task_mmu_error)(struct lima_sched_pipe *pipe); + int (*task_recover)(struct lima_sched_pipe *pipe); ++ void (*task_mask_irq)(struct lima_sched_pipe *pipe); + + struct work_struct recover_work; + }; +-- +2.43.0 + diff --git a/queue-6.1/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch b/queue-6.1/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch new file mode 100644 index 00000000000..86aa5e00583 --- /dev/null +++ b/queue-6.1/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch @@ -0,0 +1,63 @@ +From a270510782c3bc69a1b444c3427d5f68c4b5c44b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 17:29:51 +0200 +Subject: drm/lima: mask irqs in timeout path before hard reset + +From: Erico Nunes + +[ Upstream commit a421cc7a6a001b70415aa4f66024fa6178885a14 ] + +There is a race condition in which a rendering job might take just long +enough to trigger the drm sched job timeout handler but also still +complete before the hard reset is done by the timeout handler. +This runs into race conditions not expected by the timeout handler. +In some very specific cases it currently may result in a refcount +imbalance on lima_pm_idle, with a stack dump such as: + +[10136.669170] WARNING: CPU: 0 PID: 0 at drivers/gpu/drm/lima/lima_devfreq.c:205 lima_devfreq_record_idle+0xa0/0xb0 +... +[10136.669459] pc : lima_devfreq_record_idle+0xa0/0xb0 +... +[10136.669628] Call trace: +[10136.669634] lima_devfreq_record_idle+0xa0/0xb0 +[10136.669646] lima_sched_pipe_task_done+0x5c/0xb0 +[10136.669656] lima_gp_irq_handler+0xa8/0x120 +[10136.669666] __handle_irq_event_percpu+0x48/0x160 +[10136.669679] handle_irq_event+0x4c/0xc0 + +We can prevent that race condition entirely by masking the irqs at the +beginning of the timeout handler, at which point we give up on waiting +for that job entirely. +The irqs will be enabled again at the next hard reset which is already +done as a recovery by the timeout handler. + +Signed-off-by: Erico Nunes +Reviewed-by: Qiang Yu +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20240405152951.1531555-4-nunes.erico@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_sched.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c +index e82931712d8a2..9e836fad4a654 100644 +--- a/drivers/gpu/drm/lima/lima_sched.c ++++ b/drivers/gpu/drm/lima/lima_sched.c +@@ -402,6 +402,13 @@ static enum drm_gpu_sched_stat lima_sched_timedout_job(struct drm_sched_job *job + struct lima_sched_task *task = to_lima_task(job); + struct lima_device *ldev = pipe->ldev; + ++ /* ++ * The task might still finish while this timeout handler runs. ++ * To prevent a race condition on its completion, mask all irqs ++ * on the running core until the next hard reset completes. ++ */ ++ pipe->task_mask_irq(pipe); ++ + if (!pipe->error) + DRM_ERROR("lima job timeout\n"); + +-- +2.43.0 + diff --git a/queue-6.1/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch b/queue-6.1/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch new file mode 100644 index 00000000000..2c5bfd0508f --- /dev/null +++ b/queue-6.1/drop_monitor-replace-spin_lock-by-raw_spin_lock.patch @@ -0,0 +1,155 @@ +From d3858fc08a418d1ef792450f433ef024f65e6d95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 11:13:46 -0300 +Subject: drop_monitor: replace spin_lock by raw_spin_lock + +From: Wander Lairson Costa + +[ Upstream commit f1e197a665c2148ebc25fe09c53689e60afea195 ] + +trace_drop_common() is called with preemption disabled, and it acquires +a spin_lock. This is problematic for RT kernels because spin_locks are +sleeping locks in this configuration, which causes the following splat: + +BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 +preempt_count: 1, expected: 0 +RCU nest depth: 2, expected: 2 +5 locks held by rcuc/47/449: + #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 + #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 + #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 + #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 + #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 +irq event stamp: 139909 +hardirqs last enabled at (139908): [] _raw_spin_unlock_irqrestore+0x63/0x80 +hardirqs last disabled at (139909): [] trace_drop_common.constprop.0+0x26d/0x290 +softirqs last enabled at (139892): [] __local_bh_enable_ip+0x103/0x170 +softirqs last disabled at (139898): [] rcu_cpu_kthread+0x93/0x1f0 +Preemption disabled at: +[] rt_mutex_slowunlock+0xab/0x2e0 +CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 +Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 +Call Trace: + + dump_stack_lvl+0x8c/0xd0 + dump_stack+0x14/0x20 + __might_resched+0x21e/0x2f0 + rt_spin_lock+0x5e/0x130 + ? trace_drop_common.constprop.0+0xb5/0x290 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + trace_drop_common.constprop.0+0xb5/0x290 + ? preempt_count_sub+0x1c/0xd0 + ? _raw_spin_unlock_irqrestore+0x4a/0x80 + ? __pfx_trace_drop_common.constprop.0+0x10/0x10 + ? rt_mutex_slowunlock+0x26a/0x2e0 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + ? __pfx_rt_mutex_slowunlock+0x10/0x10 + ? skb_queue_purge_reason.part.0+0x1bf/0x230 + trace_kfree_skb_hit+0x15/0x20 + trace_kfree_skb+0xe9/0x150 + kfree_skb_reason+0x7b/0x110 + skb_queue_purge_reason.part.0+0x1bf/0x230 + ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 + ? mark_lock.part.0+0x8a/0x520 +... + +trace_drop_common() also disables interrupts, but this is a minor issue +because we could easily replace it with a local_lock. + +Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic +context. + +Signed-off-by: Wander Lairson Costa +Reported-by: Hu Chunyu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/drop_monitor.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index 8e0a90b45df22..522657b597d9f 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -72,7 +72,7 @@ struct net_dm_hw_entries { + }; + + struct per_cpu_dm_data { +- spinlock_t lock; /* Protects 'skb', 'hw_entries' and ++ raw_spinlock_t lock; /* Protects 'skb', 'hw_entries' and + * 'send_timer' + */ + union { +@@ -166,9 +166,9 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) + err: + mod_timer(&data->send_timer, jiffies + HZ / 10); + out: +- spin_lock_irqsave(&data->lock, flags); ++ raw_spin_lock_irqsave(&data->lock, flags); + swap(data->skb, skb); +- spin_unlock_irqrestore(&data->lock, flags); ++ raw_spin_unlock_irqrestore(&data->lock, flags); + + if (skb) { + struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data; +@@ -223,7 +223,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + + local_irq_save(flags); + data = this_cpu_ptr(&dm_cpu_data); +- spin_lock(&data->lock); ++ raw_spin_lock(&data->lock); + dskb = data->skb; + + if (!dskb) +@@ -257,7 +257,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + } + + out: +- spin_unlock_irqrestore(&data->lock, flags); ++ raw_spin_unlock_irqrestore(&data->lock, flags); + } + + static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, +@@ -312,9 +312,9 @@ net_dm_hw_reset_per_cpu_data(struct per_cpu_dm_data *hw_data) + mod_timer(&hw_data->send_timer, jiffies + HZ / 10); + } + +- spin_lock_irqsave(&hw_data->lock, flags); ++ raw_spin_lock_irqsave(&hw_data->lock, flags); + swap(hw_data->hw_entries, hw_entries); +- spin_unlock_irqrestore(&hw_data->lock, flags); ++ raw_spin_unlock_irqrestore(&hw_data->lock, flags); + + return hw_entries; + } +@@ -446,7 +446,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink, + return; + + hw_data = this_cpu_ptr(&dm_hw_cpu_data); +- spin_lock_irqsave(&hw_data->lock, flags); ++ raw_spin_lock_irqsave(&hw_data->lock, flags); + hw_entries = hw_data->hw_entries; + + if (!hw_entries) +@@ -475,7 +475,7 @@ net_dm_hw_trap_summary_probe(void *ignore, const struct devlink *devlink, + } + + out: +- spin_unlock_irqrestore(&hw_data->lock, flags); ++ raw_spin_unlock_irqrestore(&hw_data->lock, flags); + } + + static const struct net_dm_alert_ops net_dm_alert_summary_ops = { +@@ -1658,7 +1658,7 @@ static struct notifier_block dropmon_net_notifier = { + + static void __net_dm_cpu_data_init(struct per_cpu_dm_data *data) + { +- spin_lock_init(&data->lock); ++ raw_spin_lock_init(&data->lock); + skb_queue_head_init(&data->drop_queue); + u64_stats_init(&data->stats.syncp); + } +-- +2.43.0 + diff --git a/queue-6.1/f2fs-remove-clear-sb_inlinecrypt-flag-in-default_opt.patch b/queue-6.1/f2fs-remove-clear-sb_inlinecrypt-flag-in-default_opt.patch new file mode 100644 index 00000000000..5d266e52968 --- /dev/null +++ b/queue-6.1/f2fs-remove-clear-sb_inlinecrypt-flag-in-default_opt.patch @@ -0,0 +1,49 @@ +From 83938349218da30ad0a07fa09855fb4e0efc7ecd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 14:10:43 +0800 +Subject: f2fs: remove clear SB_INLINECRYPT flag in default_options + +From: Yunlei He + +[ Upstream commit ac5eecf481c29942eb9a862e758c0c8b68090c33 ] + +In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. +If create new file or open file during this gap, these files +will not use inlinecrypt. Worse case, it may lead to data +corruption if wrappedkey_v0 is enable. + +Thread A: Thread B: + +-f2fs_remount -f2fs_file_open or f2fs_new_inode + -default_options + <- clear SB_INLINECRYPT flag + + -fscrypt_select_encryption_impl + + -parse_options + <- set SB_INLINECRYPT again + +Signed-off-by: Yunlei He +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index c529ce5d986cc..f496622921843 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2092,8 +2092,6 @@ static void default_options(struct f2fs_sb_info *sbi) + F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON; + F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL; + +- sbi->sb->s_flags &= ~SB_INLINECRYPT; +- + set_opt(sbi, INLINE_XATTR); + set_opt(sbi, INLINE_DATA); + set_opt(sbi, INLINE_DENTRY); +-- +2.43.0 + diff --git a/queue-6.1/hid-add-quirk-for-logitech-casa-touchpad.patch b/queue-6.1/hid-add-quirk-for-logitech-casa-touchpad.patch new file mode 100644 index 00000000000..1ebf81d9153 --- /dev/null +++ b/queue-6.1/hid-add-quirk-for-logitech-casa-touchpad.patch @@ -0,0 +1,56 @@ +From 9deae015d2f4fa36631e571a08de9a8812ceda44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 18:08:05 +0000 +Subject: HID: Add quirk for Logitech Casa touchpad + +From: Sean O'Brien + +[ Upstream commit dd2c345a94cfa3873cc20db87387ee509c345c1b ] + +This device sometimes doesn't send touch release signals when moving +from >=4 fingers to <4 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead +of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck. + +MT_QUIRK_FORCE_MULTI_INPUT is not necessary for this device, but does no +harm. + +Signed-off-by: Sean O'Brien +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 405d88b08908d..97745a1f9c6f1 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -802,6 +802,7 @@ + #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e + #define USB_DEVICE_ID_LOGITECH_T651 0xb00c + #define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309 ++#define USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD 0xbb00 + #define USB_DEVICE_ID_LOGITECH_C007 0xc007 + #define USB_DEVICE_ID_LOGITECH_C077 0xc077 + #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 3816fd06bc953..17efe6e2a1a44 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2084,6 +2084,12 @@ static const struct hid_device_id mt_devices[] = { + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X12_TAB) }, + ++ /* Logitech devices */ ++ { .driver_data = MT_CLS_NSMU, ++ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) }, ++ + /* MosArt panels */ + { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE, + MT_USB_DEVICE(USB_VENDOR_ID_ASUS, +-- +2.43.0 + diff --git a/queue-6.1/hid-asus-fix-more-n-key-report-descriptors-if-n-key-.patch b/queue-6.1/hid-asus-fix-more-n-key-report-descriptors-if-n-key-.patch new file mode 100644 index 00000000000..8d6d2ab9a91 --- /dev/null +++ b/queue-6.1/hid-asus-fix-more-n-key-report-descriptors-if-n-key-.patch @@ -0,0 +1,94 @@ +From 901971342067e41328bf7f673c96a8923fac8d76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 21:03:59 +1200 +Subject: HID: asus: fix more n-key report descriptors if n-key quirked + +From: Luke D. Jones + +[ Upstream commit 59d2f5b7392e988a391e6924e177c1a68d50223d ] + +Adjusts the report descriptor for N-Key devices to +make the output count 0x01 which completely avoids +the need for a block of filtering. + +Signed-off-by: Luke D. Jones +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-asus.c | 49 ++++++++++++++++++++---------------------- + 1 file changed, 23 insertions(+), 26 deletions(-) + +diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c +index 220d6b2af4d3f..70f3495a22fc5 100644 +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -334,36 +334,20 @@ static int asus_raw_event(struct hid_device *hdev, + if (drvdata->quirks & QUIRK_MEDION_E1239T) + return asus_e1239t_event(drvdata, data, size); + +- if (drvdata->quirks & QUIRK_USE_KBD_BACKLIGHT) { ++ /* ++ * Skip these report ID, the device emits a continuous stream associated ++ * with the AURA mode it is in which looks like an 'echo'. ++ */ ++ if (report->id == FEATURE_KBD_LED_REPORT_ID1 || report->id == FEATURE_KBD_LED_REPORT_ID2) ++ return -1; ++ if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) { + /* +- * Skip these report ID, the device emits a continuous stream associated +- * with the AURA mode it is in which looks like an 'echo'. ++ * G713 and G733 send these codes on some keypresses, depending on ++ * the key pressed it can trigger a shutdown event if not caught. + */ +- if (report->id == FEATURE_KBD_LED_REPORT_ID1 || +- report->id == FEATURE_KBD_LED_REPORT_ID2) { ++ if (data[0] == 0x02 && data[1] == 0x30) { + return -1; +- /* Additional report filtering */ +- } else if (report->id == FEATURE_KBD_REPORT_ID) { +- /* +- * G14 and G15 send these codes on some keypresses with no +- * discernable reason for doing so. We'll filter them out to avoid +- * unmapped warning messages later. +- */ +- if (data[1] == 0xea || data[1] == 0xec || data[1] == 0x02 || +- data[1] == 0x8a || data[1] == 0x9e) { +- return -1; +- } + } +- if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) { +- /* +- * G713 and G733 send these codes on some keypresses, depending on +- * the key pressed it can trigger a shutdown event if not caught. +- */ +- if(data[0] == 0x02 && data[1] == 0x30) { +- return -1; +- } +- } +- + } + + if (drvdata->quirks & QUIRK_ROG_CLAYMORE_II_KEYBOARD) { +@@ -1262,6 +1246,19 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc, + rdesc[205] = 0x01; + } + ++ /* match many more n-key devices */ ++ if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD) { ++ for (int i = 0; i < *rsize + 1; i++) { ++ /* offset to the count from 0x5a report part always 14 */ ++ if (rdesc[i] == 0x85 && rdesc[i + 1] == 0x5a && ++ rdesc[i + 14] == 0x95 && rdesc[i + 15] == 0x05) { ++ hid_info(hdev, "Fixing up Asus N-Key report descriptor\n"); ++ rdesc[i + 15] = 0x01; ++ break; ++ } ++ } ++ } ++ + return rdesc; + } + +-- +2.43.0 + diff --git a/queue-6.1/io_uring-sqpoll-work-around-a-potential-audit-memory.patch b/queue-6.1/io_uring-sqpoll-work-around-a-potential-audit-memory.patch new file mode 100644 index 00000000000..72e9cc85c6f --- /dev/null +++ b/queue-6.1/io_uring-sqpoll-work-around-a-potential-audit-memory.patch @@ -0,0 +1,66 @@ +From d2ed6226221cba7b9e53a4a5128e5d92284fdce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 07:38:38 -0600 +Subject: io_uring/sqpoll: work around a potential audit memory leak + +From: Jens Axboe + +[ Upstream commit c4ce0ab27646f4206a9eb502d6fe45cb080e1cae ] + +kmemleak complains that there's a memory leak related to connect +handling: + +unreferenced object 0xffff0001093bdf00 (size 128): +comm "iou-sqp-455", pid 457, jiffies 4294894164 +hex dump (first 32 bytes): +02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ +00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +backtrace (crc 2e481b1a): +[<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 +[<000000009c30bb45>] kmalloc_trace+0x228/0x358 +[<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 +[<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 +[<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 +[<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 +[<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 +[<00000000d999b491>] ret_from_fork+0x10/0x20 + +which can can happen if: + +1) The command type does something on the prep side that triggers an + audit call. +2) The thread hasn't done any operations before this that triggered + an audit call inside ->issue(), where we have audit_uring_entry() + and audit_uring_exit(). + +Work around this by issuing a blanket NOP operation before the SQPOLL +does anything. + +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/sqpoll.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c +index 7b6facf529b8d..11610a70573ab 100644 +--- a/io_uring/sqpoll.c ++++ b/io_uring/sqpoll.c +@@ -235,6 +235,14 @@ static int io_sq_thread(void *data) + set_cpus_allowed_ptr(current, cpu_online_mask); + current->flags |= PF_NO_SETAFFINITY; + ++ /* ++ * Force audit context to get setup, in case we do prep side async ++ * operations that would trigger an audit call before any issue side ++ * audit has been done. ++ */ ++ audit_uring_entry(IORING_OP_NOP); ++ audit_uring_exit(true, 0); ++ + mutex_lock(&sqd->lock); + while (1) { + bool cap_entries, sqt_spin = false; +-- +2.43.0 + diff --git a/queue-6.1/iommu-arm-smmu-v3-free-msis-in-case-of-enomem.patch b/queue-6.1/iommu-arm-smmu-v3-free-msis-in-case-of-enomem.patch new file mode 100644 index 00000000000..14faaa47105 --- /dev/null +++ b/queue-6.1/iommu-arm-smmu-v3-free-msis-in-case-of-enomem.patch @@ -0,0 +1,40 @@ +From 045482919bc4101fc46760a60e4a8a088b2967b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 12:37:59 +0700 +Subject: iommu/arm-smmu-v3: Free MSIs in case of ENOMEM + +From: Aleksandr Aprelkov + +[ Upstream commit 80fea979dd9d48d67c5b48d2f690c5da3e543ebd ] + +If devm_add_action() returns -ENOMEM, then MSIs are allocated but not +not freed on teardown. Use devm_add_action_or_reset() instead to keep +the static analyser happy. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Aleksandr Aprelkov +Link: https://lore.kernel.org/r/20240403053759.643164-1-aaprelkov@usergate.com +[will: Tweak commit message, remove warning message] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 82f100e591b5a..45b43f729f895 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -3199,7 +3199,7 @@ static void arm_smmu_setup_msis(struct arm_smmu_device *smmu) + smmu->priq.q.irq = msi_get_virq(dev, PRIQ_MSI_INDEX); + + /* Add callback to free MSIs on teardown */ +- devm_add_action(dev, arm_smmu_free_msis, dev); ++ devm_add_action_or_reset(dev, arm_smmu_free_msis, dev); + } + + static void arm_smmu_setup_unique_irqs(struct arm_smmu_device *smmu) +-- +2.43.0 + diff --git a/queue-6.1/kselftest-arm64-add-a-null-pointer-check.patch b/queue-6.1/kselftest-arm64-add-a-null-pointer-check.patch new file mode 100644 index 00000000000..fb2b3f4c1b9 --- /dev/null +++ b/queue-6.1/kselftest-arm64-add-a-null-pointer-check.patch @@ -0,0 +1,48 @@ +From 444020b211777ef04b0c02d7e770f3994fd757b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 16:21:02 +0800 +Subject: kselftest: arm64: Add a null pointer check + +From: Kunwu Chan + +[ Upstream commit 80164282b3620a3cb73de6ffda5592743e448d0e ] + +There is a 'malloc' call, which can be unsuccessful. +This patch will add the malloc failure checking +to avoid possible null dereference and give more information +about test fail reasons. + +Signed-off-by: Kunwu Chan +Reviewed-by: Muhammad Usama Anjum +Link: https://lore.kernel.org/r/20240423082102.2018886-1-chentao@kylinos.cn +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/tags/tags_test.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/arm64/tags/tags_test.c b/tools/testing/selftests/arm64/tags/tags_test.c +index 5701163460ef7..955f87c1170d7 100644 +--- a/tools/testing/selftests/arm64/tags/tags_test.c ++++ b/tools/testing/selftests/arm64/tags/tags_test.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include "../../kselftest.h" + + #define SHIFT_TAG(tag) ((uint64_t)(tag) << 56) + #define SET_TAG(ptr, tag) (((uint64_t)(ptr) & ~SHIFT_TAG(0xff)) | \ +@@ -21,6 +22,9 @@ int main(void) + if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0) + tbi_enabled = 1; + ptr = (struct utsname *)malloc(sizeof(*ptr)); ++ if (!ptr) ++ ksft_exit_fail_msg("Failed to allocate utsname buffer\n"); ++ + if (tbi_enabled) + tag = 0x42; + ptr = (struct utsname *)SET_TAG(ptr, tag); +-- +2.43.0 + diff --git a/queue-6.1/mips-octeon-add-pcie-link-status-check.patch b/queue-6.1/mips-octeon-add-pcie-link-status-check.patch new file mode 100644 index 00000000000..597cfb582b8 --- /dev/null +++ b/queue-6.1/mips-octeon-add-pcie-link-status-check.patch @@ -0,0 +1,55 @@ +From fad99a0c953b862bbbcc65ef2523b14cf60afbe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 23:22:00 +0800 +Subject: MIPS: Octeon: Add PCIe link status check + +From: Songyang Li + +[ Upstream commit 29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 ] + +The standard PCIe configuration read-write interface is used to +access the configuration space of the peripheral PCIe devices +of the mips processor after the PCIe link surprise down, it can +generate kernel panic caused by "Data bus error". So it is +necessary to add PCIe link status check for system protection. +When the PCIe link is down or in training, assigning a value +of 0 to the configuration address can prevent read-write behavior +to the configuration space of peripheral PCIe devices, thereby +preventing kernel panic. + +Signed-off-by: Songyang Li +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/pci/pcie-octeon.c | 6 ++++++ + 1 file changed, 6 insertions(+) + mode change 100644 => 100755 arch/mips/pci/pcie-octeon.c + +diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c +old mode 100644 +new mode 100755 +index c9edd3fb380df..9eaacd3d33880 +--- a/arch/mips/pci/pcie-octeon.c ++++ b/arch/mips/pci/pcie-octeon.c +@@ -230,12 +230,18 @@ static inline uint64_t __cvmx_pcie_build_config_addr(int pcie_port, int bus, + { + union cvmx_pcie_address pcie_addr; + union cvmx_pciercx_cfg006 pciercx_cfg006; ++ union cvmx_pciercx_cfg032 pciercx_cfg032; + + pciercx_cfg006.u32 = + cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG006(pcie_port)); + if ((bus <= pciercx_cfg006.s.pbnum) && (dev != 0)) + return 0; + ++ pciercx_cfg032.u32 = ++ cvmx_pcie_cfgx_read(pcie_port, CVMX_PCIERCX_CFG032(pcie_port)); ++ if ((pciercx_cfg032.s.dlla == 0) || (pciercx_cfg032.s.lt == 1)) ++ return 0; ++ + pcie_addr.u64 = 0; + pcie_addr.config.upper = 2; + pcie_addr.config.io = 1; +-- +2.43.0 + diff --git a/queue-6.1/net-dsa-realtek-keep-default-led-state-in-rtl8366rb.patch b/queue-6.1/net-dsa-realtek-keep-default-led-state-in-rtl8366rb.patch new file mode 100644 index 00000000000..91b16b327e7 --- /dev/null +++ b/queue-6.1/net-dsa-realtek-keep-default-led-state-in-rtl8366rb.patch @@ -0,0 +1,193 @@ +From dfd404dbc37454945f08248768f7d12ba9999f25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Apr 2024 02:11:28 -0300 +Subject: net: dsa: realtek: keep default LED state in rtl8366rb + +From: Luiz Angelo Daros de Luca + +[ Upstream commit 5edc6585aafefa3d44fb8a84adf241d90227f7a3 ] + +This switch family supports four LEDs for each of its six ports. Each +LED group is composed of one of these four LEDs from all six ports. LED +groups can be configured to display hardware information, such as link +activity, or manually controlled through a bitmap in registers +RTL8366RB_LED_0_1_CTRL_REG and RTL8366RB_LED_2_3_CTRL_REG. + +After a reset, the default LED group configuration for groups 0 to 3 +indicates, respectively, link activity, link at 1000M, 100M, and 10M, or +RTL8366RB_LED_CTRL_REG as 0x5432. These configurations are commonly used +for LED indications. However, the driver was replacing that +configuration to use manually controlled LEDs (RTL8366RB_LED_FORCE) +without providing a way for the OS to control them. The default +configuration is deemed more useful than fixed, uncontrollable turned-on +LEDs. + +The driver was enabling/disabling LEDs during port_enable/disable. +However, these events occur when the port is administratively controlled +(up or down) and are not related to link presence. Additionally, when a +port N was disabled, the driver was turning off all LEDs for group N, +not only the corresponding LED for port N in any of those 4 groups. In +such cases, if port 0 was brought down, the LEDs for all ports in LED +group 0 would be turned off. As another side effect, the driver was +wrongly warning that port 5 didn't have an LED ("no LED for port 5"). +Since showing the administrative state of ports is not an orthodox way +to use LEDs, it was not worth it to fix it and all this code was +dropped. + +The code to disable LEDs was simplified only changing each LED group to +the RTL8366RB_LED_OFF state. Registers RTL8366RB_LED_0_1_CTRL_REG and +RTL8366RB_LED_2_3_CTRL_REG are only used when the corresponding LED +group is configured with RTL8366RB_LED_FORCE and they don't need to be +cleaned. The code still references an LED controlled by +RTL8366RB_INTERRUPT_CONTROL_REG, but as of now, no test device has +actually used it. Also, some magic numbers were replaced by macros. + +Signed-off-by: Luiz Angelo Daros de Luca +Reviewed-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/realtek/rtl8366rb.c | 87 +++++++---------------------- + 1 file changed, 20 insertions(+), 67 deletions(-) + +diff --git a/drivers/net/dsa/realtek/rtl8366rb.c b/drivers/net/dsa/realtek/rtl8366rb.c +index 25f88022b9e44..0ea5491781001 100644 +--- a/drivers/net/dsa/realtek/rtl8366rb.c ++++ b/drivers/net/dsa/realtek/rtl8366rb.c +@@ -186,7 +186,12 @@ + #define RTL8366RB_LED_BLINKRATE_222MS 0x0004 + #define RTL8366RB_LED_BLINKRATE_446MS 0x0005 + ++/* LED trigger event for each group */ + #define RTL8366RB_LED_CTRL_REG 0x0431 ++#define RTL8366RB_LED_CTRL_OFFSET(led_group) \ ++ (4 * (led_group)) ++#define RTL8366RB_LED_CTRL_MASK(led_group) \ ++ (0xf << RTL8366RB_LED_CTRL_OFFSET(led_group)) + #define RTL8366RB_LED_OFF 0x0 + #define RTL8366RB_LED_DUP_COL 0x1 + #define RTL8366RB_LED_LINK_ACT 0x2 +@@ -203,6 +208,11 @@ + #define RTL8366RB_LED_LINK_TX 0xd + #define RTL8366RB_LED_MASTER 0xe + #define RTL8366RB_LED_FORCE 0xf ++ ++/* The RTL8366RB_LED_X_X registers are used to manually set the LED state only ++ * when the corresponding LED group in RTL8366RB_LED_CTRL_REG is ++ * RTL8366RB_LED_FORCE. Otherwise, it is ignored. ++ */ + #define RTL8366RB_LED_0_1_CTRL_REG 0x0432 + #define RTL8366RB_LED_1_OFFSET 6 + #define RTL8366RB_LED_2_3_CTRL_REG 0x0433 +@@ -998,28 +1008,20 @@ static int rtl8366rb_setup(struct dsa_switch *ds) + */ + if (priv->leds_disabled) { + /* Turn everything off */ +- regmap_update_bits(priv->map, +- RTL8366RB_LED_0_1_CTRL_REG, +- 0x0FFF, 0); +- regmap_update_bits(priv->map, +- RTL8366RB_LED_2_3_CTRL_REG, +- 0x0FFF, 0); + regmap_update_bits(priv->map, + RTL8366RB_INTERRUPT_CONTROL_REG, + RTL8366RB_P4_RGMII_LED, + 0); +- val = RTL8366RB_LED_OFF; +- } else { +- /* TODO: make this configurable per LED */ +- val = RTL8366RB_LED_FORCE; +- } +- for (i = 0; i < 4; i++) { +- ret = regmap_update_bits(priv->map, +- RTL8366RB_LED_CTRL_REG, +- 0xf << (i * 4), +- val << (i * 4)); +- if (ret) +- return ret; ++ ++ for (i = 0; i < RTL8366RB_NUM_LEDGROUPS; i++) { ++ val = RTL8366RB_LED_OFF << RTL8366RB_LED_CTRL_OFFSET(i); ++ ret = regmap_update_bits(priv->map, ++ RTL8366RB_LED_CTRL_REG, ++ RTL8366RB_LED_CTRL_MASK(i), ++ val); ++ if (ret) ++ return ret; ++ } + } + + ret = rtl8366_reset_vlan(priv); +@@ -1108,52 +1110,6 @@ rtl8366rb_mac_link_down(struct dsa_switch *ds, int port, unsigned int mode, + } + } + +-static void rb8366rb_set_port_led(struct realtek_priv *priv, +- int port, bool enable) +-{ +- u16 val = enable ? 0x3f : 0; +- int ret; +- +- if (priv->leds_disabled) +- return; +- +- switch (port) { +- case 0: +- ret = regmap_update_bits(priv->map, +- RTL8366RB_LED_0_1_CTRL_REG, +- 0x3F, val); +- break; +- case 1: +- ret = regmap_update_bits(priv->map, +- RTL8366RB_LED_0_1_CTRL_REG, +- 0x3F << RTL8366RB_LED_1_OFFSET, +- val << RTL8366RB_LED_1_OFFSET); +- break; +- case 2: +- ret = regmap_update_bits(priv->map, +- RTL8366RB_LED_2_3_CTRL_REG, +- 0x3F, val); +- break; +- case 3: +- ret = regmap_update_bits(priv->map, +- RTL8366RB_LED_2_3_CTRL_REG, +- 0x3F << RTL8366RB_LED_3_OFFSET, +- val << RTL8366RB_LED_3_OFFSET); +- break; +- case 4: +- ret = regmap_update_bits(priv->map, +- RTL8366RB_INTERRUPT_CONTROL_REG, +- RTL8366RB_P4_RGMII_LED, +- enable ? RTL8366RB_P4_RGMII_LED : 0); +- break; +- default: +- dev_err(priv->dev, "no LED for port %d\n", port); +- return; +- } +- if (ret) +- dev_err(priv->dev, "error updating LED on port %d\n", port); +-} +- + static int + rtl8366rb_port_enable(struct dsa_switch *ds, int port, + struct phy_device *phy) +@@ -1167,7 +1123,6 @@ rtl8366rb_port_enable(struct dsa_switch *ds, int port, + if (ret) + return ret; + +- rb8366rb_set_port_led(priv, port, true); + return 0; + } + +@@ -1182,8 +1137,6 @@ rtl8366rb_port_disable(struct dsa_switch *ds, int port) + BIT(port)); + if (ret) + return; +- +- rb8366rb_set_port_led(priv, port, false); + } + + static int +-- +2.43.0 + diff --git a/queue-6.1/net-sched-fix-false-lockdep-warning-on-qdisc-root-lo.patch b/queue-6.1/net-sched-fix-false-lockdep-warning-on-qdisc-root-lo.patch new file mode 100644 index 00000000000..8e2c08c48d3 --- /dev/null +++ b/queue-6.1/net-sched-fix-false-lockdep-warning-on-qdisc-root-lo.patch @@ -0,0 +1,192 @@ +From 5909dfa5c186bffb6b1b98784a393ed840766056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2024 15:50:11 +0200 +Subject: net/sched: fix false lockdep warning on qdisc root lock + +From: Davide Caratti + +[ Upstream commit af0cb3fa3f9ed258d14abab0152e28a0f9593084 ] + +Xiumei and Christoph reported the following lockdep splat, complaining of +the qdisc root lock being taken twice: + + ============================================ + WARNING: possible recursive locking detected + 6.7.0-rc3+ #598 Not tainted + -------------------------------------------- + swapper/2/0 is trying to acquire lock: + ffff888177190110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70 + + but task is already holding lock: + ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&sch->q.lock); + lock(&sch->q.lock); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 5 locks held by swapper/2/0: + #0: ffff888135a09d98 ((&in_dev->mr_ifc_timer)){+.-.}-{0:0}, at: call_timer_fn+0x11a/0x510 + #1: ffffffffaaee5260 (rcu_read_lock){....}-{1:2}, at: ip_finish_output2+0x2c0/0x1ed0 + #2: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70 + #3: ffff88811995a110 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0x1560/0x2e70 + #4: ffffffffaaee5200 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x209/0x2e70 + + stack backtrace: + CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.7.0-rc3+ #598 + Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014 + Call Trace: + + dump_stack_lvl+0x4a/0x80 + __lock_acquire+0xfdd/0x3150 + lock_acquire+0x1ca/0x540 + _raw_spin_lock+0x34/0x80 + __dev_queue_xmit+0x1560/0x2e70 + tcf_mirred_act+0x82e/0x1260 [act_mirred] + tcf_action_exec+0x161/0x480 + tcf_classify+0x689/0x1170 + prio_enqueue+0x316/0x660 [sch_prio] + dev_qdisc_enqueue+0x46/0x220 + __dev_queue_xmit+0x1615/0x2e70 + ip_finish_output2+0x1218/0x1ed0 + __ip_finish_output+0x8b3/0x1350 + ip_output+0x163/0x4e0 + igmp_ifc_timer_expire+0x44b/0x930 + call_timer_fn+0x1a2/0x510 + run_timer_softirq+0x54d/0x11a0 + __do_softirq+0x1b3/0x88f + irq_exit_rcu+0x18f/0x1e0 + sysvec_apic_timer_interrupt+0x6f/0x90 + + +This happens when TC does a mirred egress redirect from the root qdisc of +device A to the root qdisc of device B. As long as these two locks aren't +protecting the same qdisc, they can be acquired in chain: add a per-qdisc +lockdep key to silence false warnings. +This dynamic key should safely replace the static key we have in sch_htb: +it was added to allow enqueueing to the device "direct qdisc" while still +holding the qdisc root lock. + +v2: don't use static keys anymore in HTB direct qdiscs (thanks Eric Dumazet) + +CC: Maxim Mikityanskiy +CC: Xiumei Mu +Reported-by: Christoph Paasch +Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/451 +Signed-off-by: Davide Caratti +Link: https://lore.kernel.org/r/7dc06d6158f72053cf877a82e2a7a5bd23692faa.1713448007.git.dcaratti@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 1 + + net/sched/sch_generic.c | 3 +++ + net/sched/sch_htb.c | 22 +++------------------- + 3 files changed, 7 insertions(+), 19 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index b3e3128402961..aefdb080ad3d2 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -126,6 +126,7 @@ struct Qdisc { + + struct rcu_head rcu; + netdevice_tracker dev_tracker; ++ struct lock_class_key root_lock_key; + /* private data */ + long privdata[] ____cacheline_aligned; + }; +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index a5693e25b2482..d4b4e32aa0e06 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -942,7 +942,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue, + __skb_queue_head_init(&sch->gso_skb); + __skb_queue_head_init(&sch->skb_bad_txq); + gnet_stats_basic_sync_init(&sch->bstats); ++ lockdep_register_key(&sch->root_lock_key); + spin_lock_init(&sch->q.lock); ++ lockdep_set_class(&sch->q.lock, &sch->root_lock_key); + + if (ops->static_flags & TCQ_F_CPUSTATS) { + sch->cpu_bstats = +@@ -1062,6 +1064,7 @@ static void __qdisc_destroy(struct Qdisc *qdisc) + if (ops->destroy) + ops->destroy(qdisc); + ++ lockdep_unregister_key(&qdisc->root_lock_key); + module_put(ops->owner); + netdev_put(qdisc_dev(qdisc), &qdisc->dev_tracker); + +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index 67b1879ea8e10..d23f8ea630820 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -1036,13 +1036,6 @@ static void htb_work_func(struct work_struct *work) + rcu_read_unlock(); + } + +-static void htb_set_lockdep_class_child(struct Qdisc *q) +-{ +- static struct lock_class_key child_key; +- +- lockdep_set_class(qdisc_lock(q), &child_key); +-} +- + static int htb_offload(struct net_device *dev, struct tc_htb_qopt_offload *opt) + { + return dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_QDISC_HTB, opt); +@@ -1129,7 +1122,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt, + return -ENOMEM; + } + +- htb_set_lockdep_class_child(qdisc); + q->direct_qdiscs[ntx] = qdisc; + qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT; + } +@@ -1465,7 +1457,6 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, + } + + if (q->offload) { +- htb_set_lockdep_class_child(new); + /* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ + qdisc_refcount_inc(new); + old_q = htb_graft_helper(dev_queue, new); +@@ -1728,11 +1719,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg, + new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops, + cl->parent->common.classid, + NULL); +- if (q->offload) { +- if (new_q) +- htb_set_lockdep_class_child(new_q); ++ if (q->offload) + htb_parent_to_leaf_offload(sch, dev_queue, new_q); +- } + } + + sch_tree_lock(sch); +@@ -1946,13 +1934,9 @@ static int htb_change_class(struct Qdisc *sch, u32 classid, + new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops, + classid, NULL); + if (q->offload) { +- if (new_q) { +- htb_set_lockdep_class_child(new_q); +- /* One ref for cl->leaf.q, the other for +- * dev_queue->qdisc. +- */ ++ /* One ref for cl->leaf.q, the other for dev_queue->qdisc. */ ++ if (new_q) + qdisc_refcount_inc(new_q); +- } + old_q = htb_graft_helper(dev_queue, new_q); + /* No qdisc_put needed. */ + WARN_ON(!(old_q->flags & TCQ_F_BUILTIN)); +-- +2.43.0 + diff --git a/queue-6.1/netpoll-fix-race-condition-in-netpoll_owner_active.patch b/queue-6.1/netpoll-fix-race-condition-in-netpoll_owner_active.patch new file mode 100644 index 00000000000..360077ea649 --- /dev/null +++ b/queue-6.1/netpoll-fix-race-condition-in-netpoll_owner_active.patch @@ -0,0 +1,52 @@ +From 31aed1a9d18ff0cc387fcc0667c17d7ffcbcb680 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2024 03:04:33 -0700 +Subject: netpoll: Fix race condition in netpoll_owner_active + +From: Breno Leitao + +[ Upstream commit c2e6a872bde9912f1a7579639c5ca3adf1003916 ] + +KCSAN detected a race condition in netpoll: + + BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb + write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10: + net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822) + + read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: + netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) + netpoll_send_udp (net/core/netpoll.c:?) + + value changed: 0x0000000a -> 0xffffffff + +This happens because netpoll_owner_active() needs to check if the +current CPU is the owner of the lock, touching napi->poll_owner +non atomically. The ->poll_owner field contains the current CPU holding +the lock. + +Use an atomic read to check if the poll owner is the current CPU. + +Signed-off-by: Breno Leitao +Link: https://lore.kernel.org/r/20240429100437.3487432-1-leitao@debian.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/netpoll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index 4ac8d0ad9f6fc..fd2195cfcb4aa 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -316,7 +316,7 @@ static int netpoll_owner_active(struct net_device *dev) + struct napi_struct *napi; + + list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) { +- if (napi->poll_owner == smp_processor_id()) ++ if (READ_ONCE(napi->poll_owner) == smp_processor_id()) + return 1; + } + return 0; +-- +2.43.0 + diff --git a/queue-6.1/padata-disable-bh-when-taking-works-lock-on-mt-path.patch b/queue-6.1/padata-disable-bh-when-taking-works-lock-on-mt-path.patch new file mode 100644 index 00000000000..1a4bbe46e82 --- /dev/null +++ b/queue-6.1/padata-disable-bh-when-taking-works-lock-on-mt-path.patch @@ -0,0 +1,62 @@ +From d8dd2685a5e73c6521c75f39347dbb249b648901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 17:36:18 +0800 +Subject: padata: Disable BH when taking works lock on MT path + +From: Herbert Xu + +[ Upstream commit 58329c4312031603bb1786b44265c26d5065fe72 ] + +As the old padata code can execute in softirq context, disable +softirqs for the new padata_do_mutithreaded code too as otherwise +lockdep will get antsy. + +Reported-by: syzbot+0cb5bb0f4bf9e79db3b3@syzkaller.appspotmail.com +Signed-off-by: Herbert Xu +Acked-by: Daniel Jordan +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index 7bef7dae3db54..0261bced7eb6e 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -98,7 +98,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data, + { + int i; + +- spin_lock(&padata_works_lock); ++ spin_lock_bh(&padata_works_lock); + /* Start at 1 because the current task participates in the job. */ + for (i = 1; i < nworks; ++i) { + struct padata_work *pw = padata_work_alloc(); +@@ -108,7 +108,7 @@ static int __init padata_work_alloc_mt(int nworks, void *data, + padata_work_init(pw, padata_mt_helper, data, 0); + list_add(&pw->pw_list, head); + } +- spin_unlock(&padata_works_lock); ++ spin_unlock_bh(&padata_works_lock); + + return i; + } +@@ -126,12 +126,12 @@ static void __init padata_works_free(struct list_head *works) + if (list_empty(works)) + return; + +- spin_lock(&padata_works_lock); ++ spin_lock_bh(&padata_works_lock); + list_for_each_entry_safe(cur, next, works, pw_list) { + list_del(&cur->pw_list); + padata_work_free(cur); + } +- spin_unlock(&padata_works_lock); ++ spin_unlock_bh(&padata_works_lock); + } + + static void padata_parallel_worker(struct work_struct *parallel_work) +-- +2.43.0 + diff --git a/queue-6.1/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch b/queue-6.1/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch new file mode 100644 index 00000000000..601a64eab99 --- /dev/null +++ b/queue-6.1/pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch @@ -0,0 +1,71 @@ +From 0c4830fe2accb987b692b7698366f5a1677181fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 10:37:09 -0600 +Subject: PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports + +From: Mario Limonciello + +[ Upstream commit 256df20c590bf0e4d63ac69330cf23faddac3e08 ] + +Hewlett-Packard HP Pavilion 17 Notebook PC/1972 is an Intel Ivy Bridge +system with a muxless AMD Radeon dGPU. Attempting to use the dGPU fails +with the following sequence: + + ACPI Error: Aborting method \AMD3._ON due to previous error (AE_AML_LOOP_TIMEOUT) (20230628/psparse-529) + radeon 0000:01:00.0: not ready 1023ms after resume; waiting + radeon 0000:01:00.0: not ready 2047ms after resume; waiting + radeon 0000:01:00.0: not ready 4095ms after resume; waiting + radeon 0000:01:00.0: not ready 8191ms after resume; waiting + radeon 0000:01:00.0: not ready 16383ms after resume; waiting + radeon 0000:01:00.0: not ready 32767ms after resume; waiting + radeon 0000:01:00.0: not ready 65535ms after resume; giving up + radeon 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible + +The issue is that the Root Port the dGPU is connected to can't handle the +transition from D3cold to D0 so the dGPU can't properly exit runtime PM. + +The existing logic in pci_bridge_d3_possible() checks for systems that are +newer than 2015 to decide that D3 is safe. This would nominally work for +an Ivy Bridge system (which was discontinued in 2015), but this system +appears to have continued to receive BIOS updates until 2017 and so this +existing logic doesn't appropriately capture it. + +Add the system to bridge_d3_blacklist to prevent D3cold from being used. + +Link: https://lore.kernel.org/r/20240307163709.323-1-mario.limonciello@amd.com +Reported-by: Eric Heintzmann +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3229 +Signed-off-by: Mario Limonciello +Signed-off-by: Bjorn Helgaas +Tested-by: Eric Heintzmann +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 67956bfebf879..0399204941dbe 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -2991,6 +2991,18 @@ static const struct dmi_system_id bridge_d3_blacklist[] = { + DMI_MATCH(DMI_BOARD_VERSION, "Continental Z2"), + }, + }, ++ { ++ /* ++ * Changing power state of root port dGPU is connected fails ++ * https://gitlab.freedesktop.org/drm/amd/-/issues/3229 ++ */ ++ .ident = "Hewlett-Packard HP Pavilion 17 Notebook PC/1972", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_BOARD_NAME, "1972"), ++ DMI_MATCH(DMI_BOARD_VERSION, "95.33"), ++ }, ++ }, + #endif + { } + }; +-- +2.43.0 + diff --git a/queue-6.1/platform-x86-p2sb-don-t-init-until-unassigned-resour.patch b/queue-6.1/platform-x86-p2sb-don-t-init-until-unassigned-resour.patch new file mode 100644 index 00000000000..fdaf27e01ac --- /dev/null +++ b/queue-6.1/platform-x86-p2sb-don-t-init-until-unassigned-resour.patch @@ -0,0 +1,86 @@ +From 013b611167cdc337d70c7fe51035cc0d69ba6347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 May 2024 16:49:34 +0000 +Subject: platform/x86: p2sb: Don't init until unassigned resources have been + assigned + +From: Ben Fradella + +[ Upstream commit 2c6370e6607663fc5fa0fd9ed58e2e01014898c7 ] + +The P2SB could get an invalid BAR from the BIOS, and that won't be fixed +up until pcibios_assign_resources(), which is an fs_initcall(). + +- Move p2sb_fs_init() to an fs_initcall_sync(). This is still early + enough to avoid a race with any dependent drivers. + +- Add a check for IORESOURCE_UNSET in p2sb_valid_resource() to catch + unset BARs going forward. + +- Return error values from p2sb_fs_init() so that the 'initcall_debug' + cmdline arg provides useful data. + +Signed-off-by: Ben Fradella +Acked-by: Andy Shevchenko +Tested-by: Klara Modin +Reviewed-by: Shin'ichiro Kawasaki +Link: https://lore.kernel.org/r/20240509164905.41016-1-bcfradella@proton.me +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/p2sb.c | 29 +++++++++++++++-------------- + 1 file changed, 15 insertions(+), 14 deletions(-) + +diff --git a/drivers/platform/x86/p2sb.c b/drivers/platform/x86/p2sb.c +index a64f56ddd4a44..053be5c5e0cad 100644 +--- a/drivers/platform/x86/p2sb.c ++++ b/drivers/platform/x86/p2sb.c +@@ -56,12 +56,9 @@ static int p2sb_get_devfn(unsigned int *devfn) + return 0; + } + +-static bool p2sb_valid_resource(struct resource *res) ++static bool p2sb_valid_resource(const struct resource *res) + { +- if (res->flags) +- return true; +- +- return false; ++ return res->flags & ~IORESOURCE_UNSET; + } + + /* Copy resource from the first BAR of the device in question */ +@@ -220,16 +217,20 @@ EXPORT_SYMBOL_GPL(p2sb_bar); + + static int __init p2sb_fs_init(void) + { +- p2sb_cache_resources(); +- return 0; ++ return p2sb_cache_resources(); + } + + /* +- * pci_rescan_remove_lock to avoid access to unhidden P2SB devices can +- * not be locked in sysfs pci bus rescan path because of deadlock. To +- * avoid the deadlock, access to P2SB devices with the lock at an early +- * step in kernel initialization and cache required resources. This +- * should happen after subsys_initcall which initializes PCI subsystem +- * and before device_initcall which requires P2SB resources. ++ * pci_rescan_remove_lock() can not be locked in sysfs PCI bus rescan path ++ * because of deadlock. To avoid the deadlock, access P2SB devices with the lock ++ * at an early step in kernel initialization and cache required resources. ++ * ++ * We want to run as early as possible. If the P2SB was assigned a bad BAR, ++ * we'll need to wait on pcibios_assign_resources() to fix it. So, our list of ++ * initcall dependencies looks something like this: ++ * ++ * ... ++ * subsys_initcall (pci_subsys_init) ++ * fs_initcall (pcibios_assign_resources) + */ +-fs_initcall(p2sb_fs_init); ++fs_initcall_sync(p2sb_fs_init); +-- +2.43.0 + diff --git a/queue-6.1/platform-x86-toshiba_acpi-add-quirk-for-buttons-on-z.patch b/queue-6.1/platform-x86-toshiba_acpi-add-quirk-for-buttons-on-z.patch new file mode 100644 index 00000000000..95475c4e7c7 --- /dev/null +++ b/queue-6.1/platform-x86-toshiba_acpi-add-quirk-for-buttons-on-z.patch @@ -0,0 +1,138 @@ +From e371357f8780bfbf1cf7ed33a334d092a08c639e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 12:16:41 +0100 +Subject: platform/x86: toshiba_acpi: Add quirk for buttons on Z830 + +From: Arvid Norlander + +[ Upstream commit 23f1d8b47d125dcd8c1ec62a91164e6bc5d691d0 ] + +The Z830 has some buttons that will only work properly as "quickstart" +buttons. To enable them in that mode, a value between 1 and 7 must be +used for HCI_HOTKEY_EVENT. Windows uses 0x5 on this laptop so use that for +maximum predictability and compatibility. + +As there is not yet a known way of auto detection, this patch uses a DMI +quirk table. A module parameter is exposed to allow setting this on other +models for testing. + +Signed-off-by: Arvid Norlander +Tested-by: Hans de Goede +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20240131111641.4418-3-W_Armin@gmx.de +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/toshiba_acpi.c | 36 ++++++++++++++++++++++++++--- + 1 file changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index 160abd3b3af8b..f10994b94a33a 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -57,6 +57,11 @@ module_param(turn_on_panel_on_resume, int, 0644); + MODULE_PARM_DESC(turn_on_panel_on_resume, + "Call HCI_PANEL_POWER_ON on resume (-1 = auto, 0 = no, 1 = yes"); + ++static int hci_hotkey_quickstart = -1; ++module_param(hci_hotkey_quickstart, int, 0644); ++MODULE_PARM_DESC(hci_hotkey_quickstart, ++ "Call HCI_HOTKEY_EVENT with value 0x5 for quickstart button support (-1 = auto, 0 = no, 1 = yes"); ++ + #define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100" + + /* Scan code for Fn key on TOS1900 models */ +@@ -136,6 +141,7 @@ MODULE_PARM_DESC(turn_on_panel_on_resume, + #define HCI_ACCEL_MASK 0x7fff + #define HCI_ACCEL_DIRECTION_MASK 0x8000 + #define HCI_HOTKEY_DISABLE 0x0b ++#define HCI_HOTKEY_ENABLE_QUICKSTART 0x05 + #define HCI_HOTKEY_ENABLE 0x09 + #define HCI_HOTKEY_SPECIAL_FUNCTIONS 0x10 + #define HCI_LCD_BRIGHTNESS_BITS 3 +@@ -2730,10 +2736,15 @@ static int toshiba_acpi_enable_hotkeys(struct toshiba_acpi_dev *dev) + return -ENODEV; + + /* ++ * Enable quickstart buttons if supported. ++ * + * Enable the "Special Functions" mode only if they are + * supported and if they are activated. + */ +- if (dev->kbd_function_keys_supported && dev->special_functions) ++ if (hci_hotkey_quickstart) ++ result = hci_write(dev, HCI_HOTKEY_EVENT, ++ HCI_HOTKEY_ENABLE_QUICKSTART); ++ else if (dev->kbd_function_keys_supported && dev->special_functions) + result = hci_write(dev, HCI_HOTKEY_EVENT, + HCI_HOTKEY_SPECIAL_FUNCTIONS); + else +@@ -3259,7 +3270,14 @@ static const char *find_hci_method(acpi_handle handle) + * works. toshiba_acpi_resume() uses HCI_PANEL_POWER_ON to avoid changing + * the configured brightness level. + */ +-static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { ++#define QUIRK_TURN_ON_PANEL_ON_RESUME BIT(0) ++/* ++ * Some Toshibas use "quickstart" keys. On these, HCI_HOTKEY_EVENT must use ++ * the value HCI_HOTKEY_ENABLE_QUICKSTART. ++ */ ++#define QUIRK_HCI_HOTKEY_QUICKSTART BIT(1) ++ ++static const struct dmi_system_id toshiba_dmi_quirks[] = { + { + /* Toshiba Portégé R700 */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=21012 */ +@@ -3267,6 +3285,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE R700"), + }, ++ .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, + }, + { + /* Toshiba Satellite/Portégé R830 */ +@@ -3276,6 +3295,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "R830"), + }, ++ .driver_data = (void *)QUIRK_TURN_ON_PANEL_ON_RESUME, + }, + { + /* Toshiba Satellite/Portégé Z830 */ +@@ -3283,6 +3303,7 @@ static const struct dmi_system_id turn_on_panel_on_resume_dmi_ids[] = { + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "Z830"), + }, ++ .driver_data = (void *)(QUIRK_TURN_ON_PANEL_ON_RESUME | QUIRK_HCI_HOTKEY_QUICKSTART), + }, + }; + +@@ -3291,6 +3312,8 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev) + struct toshiba_acpi_dev *dev; + const char *hci_method; + u32 dummy; ++ const struct dmi_system_id *dmi_id; ++ long quirks = 0; + int ret = 0; + + if (toshiba_acpi) +@@ -3443,8 +3466,15 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev) + } + #endif + ++ dmi_id = dmi_first_match(toshiba_dmi_quirks); ++ if (dmi_id) ++ quirks = (long)dmi_id->driver_data; ++ + if (turn_on_panel_on_resume == -1) +- turn_on_panel_on_resume = dmi_check_system(turn_on_panel_on_resume_dmi_ids); ++ turn_on_panel_on_resume = !!(quirks & QUIRK_TURN_ON_PANEL_ON_RESUME); ++ ++ if (hci_hotkey_quickstart == -1) ++ hci_hotkey_quickstart = !!(quirks & QUIRK_HCI_HOTKEY_QUICKSTART); + + toshiba_wwan_available(dev); + if (dev->wwan_supported) +-- +2.43.0 + diff --git a/queue-6.1/power-supply-cros_usbpd-provide-id-table-for-avoidin.patch b/queue-6.1/power-supply-cros_usbpd-provide-id-table-for-avoidin.patch new file mode 100644 index 00000000000..5380f0ea3b2 --- /dev/null +++ b/queue-6.1/power-supply-cros_usbpd-provide-id-table-for-avoidin.patch @@ -0,0 +1,66 @@ +From 4f44d61bd4258b1d279cf191228b30edd637972d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 11:00:49 +0800 +Subject: power: supply: cros_usbpd: provide ID table for avoiding fallback + match + +From: Tzung-Bi Shih + +[ Upstream commit 0f8678c34cbfdc63569a9b0ede1fe235ec6ec693 ] + +Instead of using fallback driver name match, provide ID table[1] for the +primary match. + +[1]: https://elixir.bootlin.com/linux/v6.8/source/drivers/base/platform.c#L1353 + +Reviewed-by: Benson Leung +Reviewed-by: Prashant Malani +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20240401030052.2887845-4-tzungbi@kernel.org +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/cros_usbpd-charger.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/cros_usbpd-charger.c b/drivers/power/supply/cros_usbpd-charger.c +index b6c96376776a9..8008e31c0c098 100644 +--- a/drivers/power/supply/cros_usbpd-charger.c ++++ b/drivers/power/supply/cros_usbpd-charger.c +@@ -5,6 +5,7 @@ + * Copyright (c) 2014 - 2018 Google, Inc + */ + ++#include + #include + #include + #include +@@ -711,16 +712,22 @@ static int cros_usbpd_charger_resume(struct device *dev) + static SIMPLE_DEV_PM_OPS(cros_usbpd_charger_pm_ops, NULL, + cros_usbpd_charger_resume); + ++static const struct platform_device_id cros_usbpd_charger_id[] = { ++ { DRV_NAME, 0 }, ++ {} ++}; ++MODULE_DEVICE_TABLE(platform, cros_usbpd_charger_id); ++ + static struct platform_driver cros_usbpd_charger_driver = { + .driver = { + .name = DRV_NAME, + .pm = &cros_usbpd_charger_pm_ops, + }, +- .probe = cros_usbpd_charger_probe ++ .probe = cros_usbpd_charger_probe, ++ .id_table = cros_usbpd_charger_id, + }; + + module_platform_driver(cros_usbpd_charger_driver); + + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("ChromeOS EC USBPD charger"); +-MODULE_ALIAS("platform:" DRV_NAME); +-- +2.43.0 + diff --git a/queue-6.1/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch b/queue-6.1/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch new file mode 100644 index 00000000000..55027e8b2b1 --- /dev/null +++ b/queue-6.1/powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch @@ -0,0 +1,85 @@ +From a545357707f243d205a539a70f78333fbedda7ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 May 2024 17:56:18 +1000 +Subject: powerpc/io: Avoid clang null pointer arithmetic warnings + +From: Michael Ellerman + +[ Upstream commit 03c0f2c2b2220fc9cf8785cd7b61d3e71e24a366 ] + +With -Wextra clang warns about pointer arithmetic using a null pointer. +When building with CONFIG_PCI=n, that triggers a warning in the IO +accessors, eg: + + In file included from linux/arch/powerpc/include/asm/io.h:672: + linux/arch/powerpc/include/asm/io-defs.h:23:1: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic] + 23 | DEF_PCI_AC_RET(inb, u8, (unsigned long port), (port), pio, port) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ... + linux/arch/powerpc/include/asm/io.h:591:53: note: expanded from macro '__do_inb' + 591 | #define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port); + | ~~~~~~~~~~~~~~~~~~~~~ ^ + +That is because when CONFIG_PCI=n, _IO_BASE is defined as 0. + +Although _IO_BASE is defined as plain 0, the cast (PCI_IO_ADDR) converts +it to void * before the addition with port happens. + +Instead the addition can be done first, and then the cast. The resulting +value will be the same, but avoids the warning, and also avoids void +pointer arithmetic which is apparently non-standard. + +Reported-by: Naresh Kamboju +Closes: https://lore.kernel.org/all/CA+G9fYtEh8zmq8k8wE-8RZwW-Qr927RLTn+KqGnq1F=ptaaNsA@mail.gmail.com +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240503075619.394467-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/io.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index fc112a91d0c2f..0e1745e5125b0 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -553,12 +553,12 @@ __do_out_asm(_rec_outl, "stwbrx") + #define __do_inw(port) _rec_inw(port) + #define __do_inl(port) _rec_inl(port) + #else /* CONFIG_PPC32 */ +-#define __do_outb(val, port) writeb(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_outw(val, port) writew(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_outl(val, port) writel(val,(PCI_IO_ADDR)_IO_BASE+port); +-#define __do_inb(port) readb((PCI_IO_ADDR)_IO_BASE + port); +-#define __do_inw(port) readw((PCI_IO_ADDR)_IO_BASE + port); +-#define __do_inl(port) readl((PCI_IO_ADDR)_IO_BASE + port); ++#define __do_outb(val, port) writeb(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_outw(val, port) writew(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_outl(val, port) writel(val,(PCI_IO_ADDR)(_IO_BASE+port)); ++#define __do_inb(port) readb((PCI_IO_ADDR)(_IO_BASE + port)); ++#define __do_inw(port) readw((PCI_IO_ADDR)(_IO_BASE + port)); ++#define __do_inl(port) readl((PCI_IO_ADDR)(_IO_BASE + port)); + #endif /* !CONFIG_PPC32 */ + + #ifdef CONFIG_EEH +@@ -574,12 +574,12 @@ __do_out_asm(_rec_outl, "stwbrx") + #define __do_writesw(a, b, n) _outsw(PCI_FIX_ADDR(a),(b),(n)) + #define __do_writesl(a, b, n) _outsl(PCI_FIX_ADDR(a),(b),(n)) + +-#define __do_insb(p, b, n) readsb((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_insw(p, b, n) readsw((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_insl(p, b, n) readsl((PCI_IO_ADDR)_IO_BASE+(p), (b), (n)) +-#define __do_outsb(p, b, n) writesb((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +-#define __do_outsw(p, b, n) writesw((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) +-#define __do_outsl(p, b, n) writesl((PCI_IO_ADDR)_IO_BASE+(p),(b),(n)) ++#define __do_insb(p, b, n) readsb((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_insw(p, b, n) readsw((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_insl(p, b, n) readsl((PCI_IO_ADDR)(_IO_BASE+(p)), (b), (n)) ++#define __do_outsb(p, b, n) writesb((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) ++#define __do_outsw(p, b, n) writesw((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) ++#define __do_outsl(p, b, n) writesl((PCI_IO_ADDR)(_IO_BASE+(p)),(b),(n)) + + #define __do_memset_io(addr, c, n) \ + _memset_io(PCI_FIX_ADDR(addr), c, n) +-- +2.43.0 + diff --git a/queue-6.1/powerpc-pseries-enforce-hcall-result-buffer-validity.patch b/queue-6.1/powerpc-pseries-enforce-hcall-result-buffer-validity.patch new file mode 100644 index 00000000000..5e6aa91fe78 --- /dev/null +++ b/queue-6.1/powerpc-pseries-enforce-hcall-result-buffer-validity.patch @@ -0,0 +1,82 @@ +From 247fafce75603565898d573daa81f0bbaac1b930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2024 09:08:31 -0500 +Subject: powerpc/pseries: Enforce hcall result buffer validity and size + +From: Nathan Lynch + +[ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ] + +plpar_hcall(), plpar_hcall9(), and related functions expect callers to +provide valid result buffers of certain minimum size. Currently this +is communicated only through comments in the code and the compiler has +no idea. + +For example, if I write a bug like this: + + long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE + plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...); + +This compiles with no diagnostics emitted, but likely results in stack +corruption at runtime when plpar_hcall9() stores results past the end +of the array. (To be clear this is a contrived example and I have not +found a real instance yet.) + +To make this class of error less likely, we can use explicitly-sized +array parameters instead of pointers in the declarations for the hcall +APIs. When compiled with -Warray-bounds[1], the code above now +provokes a diagnostic like this: + +error: array argument is too small; +is of size 32, callee requires at least 72 [-Werror,-Warray-bounds] + 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, + | ^ ~~~~~~ + +[1] Enabled for LLVM builds but not GCC for now. See commit + 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and + related changes. + +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/hvcall.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index 47bc10cdb70b5..a56ec2f124eae 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -493,7 +493,7 @@ long plpar_hcall_norets_notrace(unsigned long opcode, ...); + * Used for all but the craziest of phyp interfaces (see plpar_hcall9) + */ + #define PLPAR_HCALL_BUFSIZE 4 +-long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); + + /** + * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats +@@ -507,7 +507,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); + * plpar_hcall, but plpar_hcall_raw works in real mode and does not + * calculate hypervisor call statistics. + */ +-long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); + + /** + * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments +@@ -518,8 +518,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); + * PLPAR_HCALL9_BUFSIZE to size the return argument buffer. + */ + #define PLPAR_HCALL9_BUFSIZE 9 +-long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...); +-long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...); ++long plpar_hcall9(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); ++long plpar_hcall9_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); + + /* pseries hcall tracing */ + extern struct static_key hcall_tracepoint_key; +-- +2.43.0 + diff --git a/queue-6.1/rcutorture-fix-invalid-context-warning-when-enable-s.patch b/queue-6.1/rcutorture-fix-invalid-context-warning-when-enable-s.patch new file mode 100644 index 00000000000..16663cd2bae --- /dev/null +++ b/queue-6.1/rcutorture-fix-invalid-context-warning-when-enable-s.patch @@ -0,0 +1,120 @@ +From aa05fee877450b61d47ff0a8fa6dda6c5bcce8b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 15:52:19 +0800 +Subject: rcutorture: Fix invalid context warning when enable srcu barrier + testing + +From: Zqiang + +[ Upstream commit 668c0406d887467d53f8fe79261dda1d22d5b671 ] + +When the torture_type is set srcu or srcud and cb_barrier is +non-zero, running the rcutorture test will trigger the +following warning: + +[ 163.910989][ C1] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 +[ 163.910994][ C1] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 +[ 163.910999][ C1] preempt_count: 10001, expected: 0 +[ 163.911002][ C1] RCU nest depth: 0, expected: 0 +[ 163.911005][ C1] INFO: lockdep is turned off. +[ 163.911007][ C1] irq event stamp: 30964 +[ 163.911010][ C1] hardirqs last enabled at (30963): [] do_idle+0x362/0x500 +[ 163.911018][ C1] hardirqs last disabled at (30964): [] sysvec_call_function_single+0xf/0xd0 +[ 163.911025][ C1] softirqs last enabled at (0): [] copy_process+0x16ff/0x6580 +[ 163.911033][ C1] softirqs last disabled at (0): [<0000000000000000>] 0x0 +[ 163.911038][ C1] Preemption disabled at: +[ 163.911039][ C1] [] stack_depot_save_flags+0x24b/0x6c0 +[ 163.911063][ C1] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W 6.8.0-rc4-rt4-yocto-preempt-rt+ #3 1e39aa9a737dd024a3275c4f835a872f673a7d3a +[ 163.911071][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 +[ 163.911075][ C1] Call Trace: +[ 163.911078][ C1] +[ 163.911080][ C1] dump_stack_lvl+0x88/0xd0 +[ 163.911089][ C1] dump_stack+0x10/0x20 +[ 163.911095][ C1] __might_resched+0x36f/0x530 +[ 163.911105][ C1] rt_spin_lock+0x82/0x1c0 +[ 163.911112][ C1] spin_lock_irqsave_ssp_contention+0xb8/0x100 +[ 163.911121][ C1] srcu_gp_start_if_needed+0x782/0xf00 +[ 163.911128][ C1] ? _raw_spin_unlock_irqrestore+0x46/0x70 +[ 163.911136][ C1] ? debug_object_active_state+0x336/0x470 +[ 163.911148][ C1] ? __pfx_srcu_gp_start_if_needed+0x10/0x10 +[ 163.911156][ C1] ? __pfx_lock_release+0x10/0x10 +[ 163.911165][ C1] ? __pfx_rcu_torture_barrier_cbf+0x10/0x10 +[ 163.911188][ C1] __call_srcu+0x9f/0xe0 +[ 163.911196][ C1] call_srcu+0x13/0x20 +[ 163.911201][ C1] srcu_torture_call+0x1b/0x30 +[ 163.911224][ C1] rcu_torture_barrier1cb+0x4a/0x60 +[ 163.911247][ C1] __flush_smp_call_function_queue+0x267/0xca0 +[ 163.911256][ C1] ? __pfx_rcu_torture_barrier1cb+0x10/0x10 +[ 163.911281][ C1] generic_smp_call_function_single_interrupt+0x13/0x20 +[ 163.911288][ C1] __sysvec_call_function_single+0x7d/0x280 +[ 163.911295][ C1] sysvec_call_function_single+0x93/0xd0 +[ 163.911302][ C1] +[ 163.911304][ C1] +[ 163.911308][ C1] asm_sysvec_call_function_single+0x1b/0x20 +[ 163.911313][ C1] RIP: 0010:default_idle+0x17/0x20 +[ 163.911326][ C1] RSP: 0018:ffff888001997dc8 EFLAGS: 00000246 +[ 163.911333][ C1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffffae618b51 +[ 163.911337][ C1] RDX: 0000000000000000 RSI: ffffffffaea80920 RDI: ffffffffaec2de80 +[ 163.911342][ C1] RBP: ffff888001997dc8 R08: 0000000000000001 R09: ffffed100d740cad +[ 163.911346][ C1] R10: ffffed100d740cac R11: ffff88806ba06563 R12: 0000000000000001 +[ 163.911350][ C1] R13: ffffffffafe460c0 R14: ffffffffafe460c0 R15: 0000000000000000 +[ 163.911358][ C1] ? ct_kernel_exit.constprop.3+0x121/0x160 +[ 163.911369][ C1] ? lockdep_hardirqs_on+0xc4/0x150 +[ 163.911376][ C1] arch_cpu_idle+0x9/0x10 +[ 163.911383][ C1] default_idle_call+0x7a/0xb0 +[ 163.911390][ C1] do_idle+0x362/0x500 +[ 163.911398][ C1] ? __pfx_do_idle+0x10/0x10 +[ 163.911404][ C1] ? complete_with_flags+0x8b/0xb0 +[ 163.911416][ C1] cpu_startup_entry+0x58/0x70 +[ 163.911423][ C1] start_secondary+0x221/0x280 +[ 163.911430][ C1] ? __pfx_start_secondary+0x10/0x10 +[ 163.911440][ C1] secondary_startup_64_no_verify+0x17f/0x18b +[ 163.911455][ C1] + +This commit therefore use smp_call_on_cpu() instead of +smp_call_function_single(), make rcu_torture_barrier1cb() invoked +happens on task-context. + +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcutorture.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index a42141033577e..8c45df910763a 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -2968,11 +2968,12 @@ static void rcu_torture_barrier_cbf(struct rcu_head *rcu) + } + + /* IPI handler to get callback posted on desired CPU, if online. */ +-static void rcu_torture_barrier1cb(void *rcu_void) ++static int rcu_torture_barrier1cb(void *rcu_void) + { + struct rcu_head *rhp = rcu_void; + + cur_ops->call(rhp, rcu_torture_barrier_cbf); ++ return 0; + } + + /* kthread function to register callbacks used to test RCU barriers. */ +@@ -2998,11 +2999,9 @@ static int rcu_torture_barrier_cbs(void *arg) + * The above smp_load_acquire() ensures barrier_phase load + * is ordered before the following ->call(). + */ +- if (smp_call_function_single(myid, rcu_torture_barrier1cb, +- &rcu, 1)) { +- // IPI failed, so use direct call from current CPU. ++ if (smp_call_on_cpu(myid, rcu_torture_barrier1cb, &rcu, 1)) + cur_ops->call(&rcu, rcu_torture_barrier_cbf); +- } ++ + if (atomic_dec_and_test(&barrier_cbs_count)) + wake_up(&barrier_wq); + } while (!torture_must_stop()); +-- +2.43.0 + diff --git a/queue-6.1/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch b/queue-6.1/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch new file mode 100644 index 00000000000..cf512d0113c --- /dev/null +++ b/queue-6.1/rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch @@ -0,0 +1,39 @@ +From aacce1ee02da534180c2d9188ba6b5cd3044bf71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 19:21:47 -0800 +Subject: rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment + +From: Paul E. McKenney + +[ Upstream commit 8b9b443fa860276822b25057cb3ff3b28734dec0 ] + +The "pipe_count > RCU_TORTURE_PIPE_LEN" check has a comment saying "Should +not happen, but...". This is only true when testing an RCU whose grace +periods are always long enough. This commit therefore fixes this comment. + +Reported-by: Linus Torvalds +Closes: https://lore.kernel.org/lkml/CAHk-=wi7rJ-eGq+xaxVfzFEgbL9tdf6Kc8Z89rCpfcQOKm74Tw@mail.gmail.com/ +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcutorture.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 503c2aa845a4a..2f6c52a863f2e 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -1946,7 +1946,8 @@ static bool rcu_torture_one_read(struct torture_random_state *trsp, long myid) + preempt_disable(); + pipe_count = READ_ONCE(p->rtort_pipe_count); + if (pipe_count > RCU_TORTURE_PIPE_LEN) { +- /* Should not happen, but... */ ++ // Should not happen in a correct RCU implementation, ++ // happens quite often for torture_type=busted. + pipe_count = RCU_TORTURE_PIPE_LEN; + } + completed = cur_ops->get_gp_seq(); +-- +2.43.0 + diff --git a/queue-6.1/rcutorture-make-stall-tasks-directly-exit-when-rcuto.patch b/queue-6.1/rcutorture-make-stall-tasks-directly-exit-when-rcuto.patch new file mode 100644 index 00000000000..05585b565b0 --- /dev/null +++ b/queue-6.1/rcutorture-make-stall-tasks-directly-exit-when-rcuto.patch @@ -0,0 +1,103 @@ +From 94cac45f1cd74c4084ee8aae96b549ff49071caa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 16:28:50 +0800 +Subject: rcutorture: Make stall-tasks directly exit when rcutorture tests end + +From: Zqiang + +[ Upstream commit 431315a563015f259b28e34c5842f6166439e969 ] + +When the rcutorture tests start to exit, the rcu_torture_cleanup() is +invoked to stop kthreads and release resources, if the stall-task +kthreads exist, cpu-stall has started and the rcutorture.stall_cpu +is set to a larger value, the rcu_torture_cleanup() will be blocked +for a long time and the hung-task may occur, this commit therefore +add kthread_should_stop() to the loop of cpu-stall operation, when +rcutorture tests ends, no need to wait for cpu-stall to end, exit +directly. + +Use the following command to test: + +insmod rcutorture.ko torture_type=srcu fwd_progress=0 stat_interval=4 +stall_cpu_block=1 stall_cpu=200 stall_cpu_holdoff=10 read_exit_burst=0 +object_debug=1 +rmmod rcutorture + +[15361.918610] INFO: task rmmod:878 blocked for more than 122 seconds. +[15361.918613] Tainted: G W +6.8.0-rc2-yoctodev-standard+ #25 +[15361.918615] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" +disables this message. +[15361.918616] task:rmmod state:D stack:0 pid:878 +tgid:878 ppid:773 flags:0x00004002 +[15361.918621] Call Trace: +[15361.918623] +[15361.918626] __schedule+0xc0d/0x28f0 +[15361.918631] ? __pfx___schedule+0x10/0x10 +[15361.918635] ? rcu_is_watching+0x19/0xb0 +[15361.918638] ? schedule+0x1f6/0x290 +[15361.918642] ? __pfx_lock_release+0x10/0x10 +[15361.918645] ? schedule+0xc9/0x290 +[15361.918648] ? schedule+0xc9/0x290 +[15361.918653] ? trace_preempt_off+0x54/0x100 +[15361.918657] ? schedule+0xc9/0x290 +[15361.918661] schedule+0xd0/0x290 +[15361.918665] schedule_timeout+0x56d/0x7d0 +[15361.918669] ? debug_smp_processor_id+0x1b/0x30 +[15361.918672] ? rcu_is_watching+0x19/0xb0 +[15361.918676] ? __pfx_schedule_timeout+0x10/0x10 +[15361.918679] ? debug_smp_processor_id+0x1b/0x30 +[15361.918683] ? rcu_is_watching+0x19/0xb0 +[15361.918686] ? wait_for_completion+0x179/0x4c0 +[15361.918690] ? __pfx_lock_release+0x10/0x10 +[15361.918693] ? __kasan_check_write+0x18/0x20 +[15361.918696] ? wait_for_completion+0x9d/0x4c0 +[15361.918700] ? _raw_spin_unlock_irq+0x36/0x50 +[15361.918703] ? wait_for_completion+0x179/0x4c0 +[15361.918707] ? _raw_spin_unlock_irq+0x36/0x50 +[15361.918710] ? wait_for_completion+0x179/0x4c0 +[15361.918714] ? trace_preempt_on+0x54/0x100 +[15361.918718] ? wait_for_completion+0x179/0x4c0 +[15361.918723] wait_for_completion+0x181/0x4c0 +[15361.918728] ? __pfx_wait_for_completion+0x10/0x10 +[15361.918738] kthread_stop+0x152/0x470 +[15361.918742] _torture_stop_kthread+0x44/0xc0 [torture +7af7f9cbba28271a10503b653f9e05d518fbc8c3] +[15361.918752] rcu_torture_cleanup+0x2ac/0xe90 [rcutorture +f2cb1f556ee7956270927183c4c2c7749a336529] +[15361.918766] ? __pfx_rcu_torture_cleanup+0x10/0x10 [rcutorture +f2cb1f556ee7956270927183c4c2c7749a336529] +[15361.918777] ? __kasan_check_write+0x18/0x20 +[15361.918781] ? __mutex_unlock_slowpath+0x17c/0x670 +[15361.918789] ? __might_fault+0xcd/0x180 +[15361.918793] ? find_module_all+0x104/0x1d0 +[15361.918799] __x64_sys_delete_module+0x2a4/0x3f0 +[15361.918803] ? __pfx___x64_sys_delete_module+0x10/0x10 +[15361.918807] ? syscall_exit_to_user_mode+0x149/0x280 + +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Uladzislau Rezki (Sony) +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcutorture.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 2f6c52a863f2e..a42141033577e 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -2419,8 +2419,8 @@ static int rcu_torture_stall(void *args) + preempt_disable(); + pr_alert("%s start on CPU %d.\n", + __func__, raw_smp_processor_id()); +- while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(), +- stop_at)) ++ while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(), stop_at) && ++ !kthread_should_stop()) + if (stall_cpu_block) { + #ifdef CONFIG_PREEMPTION + preempt_schedule(); +-- +2.43.0 + diff --git a/queue-6.1/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch b/queue-6.1/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch new file mode 100644 index 00000000000..019a4b8af14 --- /dev/null +++ b/queue-6.1/scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch @@ -0,0 +1,95 @@ +From 8ad28ea80f834a6e43d4aa49e1695b4059d6fb54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2024 12:51:55 +0530 +Subject: scsi: qedi: Fix crash while reading debugfs attribute + +From: Manish Rangankar + +[ Upstream commit 28027ec8e32ecbadcd67623edb290dad61e735b5 ] + +The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly +on a __user pointer, which results into the crash. + +To fix this issue, use a small local stack buffer for sprintf() and then +call simple_read_from_buffer(), which in turns make the copy_to_user() +call. + +BUG: unable to handle page fault for address: 00007f4801111000 +PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0 +Oops: 0002 [#1] PREEMPT SMP PTI +Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023 +RIP: 0010:memcpy_orig+0xcd/0x130 +RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202 +RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f +RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000 +RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572 +R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff +R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af +FS: 00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + ? __die_body+0x1a/0x60 + ? page_fault_oops+0x183/0x510 + ? exc_page_fault+0x69/0x150 + ? asm_exc_page_fault+0x22/0x30 + ? memcpy_orig+0xcd/0x130 + vsnprintf+0x102/0x4c0 + sprintf+0x51/0x80 + qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324] + full_proxy_read+0x50/0x80 + vfs_read+0xa5/0x2e0 + ? folio_add_new_anon_rmap+0x44/0xa0 + ? set_pte_at+0x15/0x30 + ? do_pte_missing+0x426/0x7f0 + ksys_read+0xa5/0xe0 + do_syscall_64+0x58/0x80 + ? __count_memcg_events+0x46/0x90 + ? count_memcg_event_mm+0x3d/0x60 + ? handle_mm_fault+0x196/0x2f0 + ? do_user_addr_fault+0x267/0x890 + ? exc_page_fault+0x69/0x150 + entry_SYSCALL_64_after_hwframe+0x72/0xdc +RIP: 0033:0x7f4800f20b4d + +Tested-by: Martin Hoyer +Reviewed-by: John Meneghini +Signed-off-by: Manish Rangankar +Link: https://lore.kernel.org/r/20240415072155.30840-1-mrangankar@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_debugfs.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/qedi/qedi_debugfs.c b/drivers/scsi/qedi/qedi_debugfs.c +index 8deb2001dc2ff..37eed6a278164 100644 +--- a/drivers/scsi/qedi/qedi_debugfs.c ++++ b/drivers/scsi/qedi/qedi_debugfs.c +@@ -120,15 +120,11 @@ static ssize_t + qedi_dbg_do_not_recover_cmd_read(struct file *filp, char __user *buffer, + size_t count, loff_t *ppos) + { +- size_t cnt = 0; +- +- if (*ppos) +- return 0; ++ char buf[64]; ++ int len; + +- cnt = sprintf(buffer, "do_not_recover=%d\n", qedi_do_not_recover); +- cnt = min_t(int, count, cnt - *ppos); +- *ppos += cnt; +- return cnt; ++ len = sprintf(buf, "do_not_recover=%d\n", qedi_do_not_recover); ++ return simple_read_from_buffer(buffer, count, ppos, buf, len); + } + + static int +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-fix-flaky-test-btf_map_in_map-lookup_u.patch b/queue-6.1/selftests-bpf-fix-flaky-test-btf_map_in_map-lookup_u.patch new file mode 100644 index 00000000000..8d4d7776de0 --- /dev/null +++ b/queue-6.1/selftests-bpf-fix-flaky-test-btf_map_in_map-lookup_u.patch @@ -0,0 +1,87 @@ +From 43b1df8f7cd614f0c418ff4f6903eea46440a68d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 23:13:53 -0700 +Subject: selftests/bpf: Fix flaky test btf_map_in_map/lookup_update + +From: Yonghong Song + +[ Upstream commit 14bb1e8c8d4ad5d9d2febb7d19c70a3cf536e1e5 ] + +Recently, I frequently hit the following test failure: + + [root@arch-fb-vm1 bpf]# ./test_progs -n 33/1 + test_lookup_update:PASS:skel_open 0 nsec + [...] + test_lookup_update:PASS:sync_rcu 0 nsec + test_lookup_update:FAIL:map1_leak inner_map1 leaked! + #33/1 btf_map_in_map/lookup_update:FAIL + #33 btf_map_in_map:FAIL + +In the test, after map is closed and then after two rcu grace periods, +it is assumed that map_id is not available to user space. + +But the above assumption cannot be guaranteed. After zero or one +or two rcu grace periods in different siturations, the actual +freeing-map-work is put into a workqueue. Later on, when the work +is dequeued, the map will be actually freed. +See bpf_map_put() in kernel/bpf/syscall.c. + +By using workqueue, there is no ganrantee that map will be actually +freed after a couple of rcu grace periods. This patch removed +such map leak detection and then the test can pass consistently. + +Signed-off-by: Yonghong Song +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20240322061353.632136-1-yonghong.song@linux.dev +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/prog_tests/btf_map_in_map.c | 26 +------------------ + 1 file changed, 1 insertion(+), 25 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c +index eb90a6b8850d2..f4d753185001a 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c +@@ -25,7 +25,7 @@ static void test_lookup_update(void) + int map1_fd, map2_fd, map3_fd, map4_fd, map5_fd, map1_id, map2_id; + int outer_arr_fd, outer_hash_fd, outer_arr_dyn_fd; + struct test_btf_map_in_map *skel; +- int err, key = 0, val, i, fd; ++ int err, key = 0, val, i; + + skel = test_btf_map_in_map__open_and_load(); + if (CHECK(!skel, "skel_open", "failed to open&load skeleton\n")) +@@ -102,30 +102,6 @@ static void test_lookup_update(void) + CHECK(map1_id == 0, "map1_id", "failed to get ID 1\n"); + CHECK(map2_id == 0, "map2_id", "failed to get ID 2\n"); + +- test_btf_map_in_map__destroy(skel); +- skel = NULL; +- +- /* we need to either wait for or force synchronize_rcu(), before +- * checking for "still exists" condition, otherwise map could still be +- * resolvable by ID, causing false positives. +- * +- * Older kernels (5.8 and earlier) freed map only after two +- * synchronize_rcu()s, so trigger two, to be entirely sure. +- */ +- CHECK(kern_sync_rcu(), "sync_rcu", "failed\n"); +- CHECK(kern_sync_rcu(), "sync_rcu", "failed\n"); +- +- fd = bpf_map_get_fd_by_id(map1_id); +- if (CHECK(fd >= 0, "map1_leak", "inner_map1 leaked!\n")) { +- close(fd); +- goto cleanup; +- } +- fd = bpf_map_get_fd_by_id(map2_id); +- if (CHECK(fd >= 0, "map2_leak", "inner_map2 leaked!\n")) { +- close(fd); +- goto cleanup; +- } +- + cleanup: + test_btf_map_in_map__destroy(skel); + } +-- +2.43.0 + diff --git a/queue-6.1/selftests-bpf-prevent-client-connect-before-server-b.patch b/queue-6.1/selftests-bpf-prevent-client-connect-before-server-b.patch new file mode 100644 index 00000000000..3a09160e3a9 --- /dev/null +++ b/queue-6.1/selftests-bpf-prevent-client-connect-before-server-b.patch @@ -0,0 +1,82 @@ +From 24117337dbce2330b6176f491f03243b74d63e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 10:59:11 +0000 +Subject: selftests/bpf: Prevent client connect before server bind in + test_tc_tunnel.sh + +From: Alessandro Carminati (Red Hat) + +[ Upstream commit f803bcf9208a2540acb4c32bdc3616673169f490 ] + +In some systems, the netcat server can incur in delay to start listening. +When this happens, the test can randomly fail in various points. +This is an example error message: + + # ip gre none gso + # encap 192.168.1.1 to 192.168.1.2, type gre, mac none len 2000 + # test basic connectivity + # Ncat: Connection refused. + +The issue stems from a race condition between the netcat client and server. +The test author had addressed this problem by implementing a sleep, which +I have removed in this patch. +This patch introduces a function capable of sleeping for up to two seconds. +However, it can terminate the waiting period early if the port is reported +to be listening. + +Signed-off-by: Alessandro Carminati (Red Hat) +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20240314105911.213411-1-alessandro.carminati@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_tc_tunnel.sh | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index 334bdfeab9403..365a2c7a89bad 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -72,7 +72,6 @@ cleanup() { + server_listen() { + ip netns exec "${ns2}" nc "${netcat_opt}" -l "${port}" > "${outfile}" & + server_pid=$! +- sleep 0.2 + } + + client_connect() { +@@ -93,6 +92,16 @@ verify_data() { + fi + } + ++wait_for_port() { ++ for i in $(seq 20); do ++ if ip netns exec "${ns2}" ss ${2:--4}OHntl | grep -q "$1"; then ++ return 0 ++ fi ++ sleep 0.1 ++ done ++ return 1 ++} ++ + set -e + + # no arguments: automated test, run all +@@ -190,6 +199,7 @@ setup + # basic communication works + echo "test basic connectivity" + server_listen ++wait_for_port ${port} ${netcat_opt} + client_connect + verify_data + +@@ -201,6 +211,7 @@ ip netns exec "${ns1}" tc filter add dev veth1 egress \ + section "encap_${tuntype}_${mac}" + echo "test bpf encap without decap (expect failure)" + server_listen ++wait_for_port ${port} ${netcat_opt} + ! client_connect + + if [[ "$tuntype" =~ "udp" ]]; then +-- +2.43.0 + diff --git a/queue-6.1/serial-exar-adding-missing-cti-and-exar-pci-ids.patch b/queue-6.1/serial-exar-adding-missing-cti-and-exar-pci-ids.patch new file mode 100644 index 00000000000..76db9d0a7ae --- /dev/null +++ b/queue-6.1/serial-exar-adding-missing-cti-and-exar-pci-ids.patch @@ -0,0 +1,77 @@ +From 98d9925fc033f3da76f781d43d5ac6ad43e1bf62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 08:55:28 -0400 +Subject: serial: exar: adding missing CTI and Exar PCI ids + +From: Parker Newman + +[ Upstream commit b86ae40ffcf5a16b9569b1016da4a08c4f352ca2 ] + +- Added Connect Tech and Exar IDs not already in pci_ids.h + +Signed-off-by: Parker Newman +Link: https://lore.kernel.org/r/7c3d8e795a864dd9b0a00353b722060dc27c4e09.1713270624.git.pnewman@connecttech.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_exar.c | 42 +++++++++++++++++++++++++++++ + 1 file changed, 42 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 55451ff846520..b5ae6ec61c9fb 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -41,8 +41,50 @@ + #define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021 + #define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022 + ++#define PCI_VENDOR_ID_CONNECT_TECH 0x12c4 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_SP_OPTO 0x0340 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_A 0x0341 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_SP_OPTO_B 0x0342 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS 0x0350 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_A 0x0351 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_B 0x0352 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS 0x0353 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_A 0x0354 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_16_XPRS_B 0x0355 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XPRS_OPTO 0x0360 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_A 0x0361 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XPRS_OPTO_B 0x0362 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP 0x0370 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232 0x0371 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_485 0x0372 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_SP 0x0373 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_6_2_SP 0x0374 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_6_SP 0x0375 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_SP_232_NS 0x0376 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_LEFT 0x0380 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_XP_OPTO_RIGHT 0x0381 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_XP_OPTO 0x0382 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_4_4_XPRS_OPTO 0x0392 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP 0x03A0 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232 0x03A1 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_485 0x03A2 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_XPRS_LP_232_NS 0x03A3 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XEG001 0x0602 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_BASE 0x1000 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_2 0x1002 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_4 0x1004 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_8 0x1008 ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_12 0x100C ++#define PCI_SUBDEVICE_ID_CONNECT_TECH_PCIE_XR35X_16 0x1010 ++#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG00X 0x110c ++#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_12_XIG01X 0x110d ++#define PCI_DEVICE_ID_CONNECT_TECH_PCI_XR79X_16 0x1110 ++ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 ++#define PCI_DEVICE_ID_EXAR_XR17V252 0x0252 ++#define PCI_DEVICE_ID_EXAR_XR17V254 0x0254 ++#define PCI_DEVICE_ID_EXAR_XR17V258 0x0258 + + #define PCI_SUBDEVICE_ID_USR_2980 0x0128 + #define PCI_SUBDEVICE_ID_USR_2981 0x0129 +-- +2.43.0 + diff --git a/queue-6.1/serial-imx-introduce-timeout-when-waiting-on-transmi.patch b/queue-6.1/serial-imx-introduce-timeout-when-waiting-on-transmi.patch new file mode 100644 index 00000000000..4d2e15ec721 --- /dev/null +++ b/queue-6.1/serial-imx-introduce-timeout-when-waiting-on-transmi.patch @@ -0,0 +1,59 @@ +From f1693c4d71dc7788cd41c85e73ba742738dfd566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 14:19:23 +0200 +Subject: serial: imx: Introduce timeout when waiting on transmitter empty + +From: Esben Haabendal + +[ Upstream commit e533e4c62e9993e62e947ae9bbec34e4c7ae81c2 ] + +By waiting at most 1 second for USR2_TXDC to be set, we avoid a potential +deadlock. + +In case of the timeout, there is not much we can do, so we simply ignore +the transmitter state and optimistically try to continue. + +Signed-off-by: Esben Haabendal +Acked-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/919647898c337a46604edcabaf13d42d80c0915d.1712837613.git.esben@geanix.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 573bf7e9b7978..b20abaa9ef150 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -2028,7 +2029,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) + struct imx_port *sport = imx_uart_ports[co->index]; + struct imx_port_ucrs old_ucr; + unsigned long flags; +- unsigned int ucr1; ++ unsigned int ucr1, usr2; + int locked = 1; + + if (sport->port.sysrq) +@@ -2059,8 +2060,8 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count) + * Finally, wait for transmitter to become empty + * and restore UCR1/2/3 + */ +- while (!(imx_uart_readl(sport, USR2) & USR2_TXDC)); +- ++ read_poll_timeout_atomic(imx_uart_readl, usr2, usr2 & USR2_TXDC, ++ 0, USEC_PER_SEC, false, sport, USR2); + imx_uart_ucrs_restore(sport, &old_ucr); + + if (locked) +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..46173e3d9ba --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,44 @@ +padata-disable-bh-when-taking-works-lock-on-mt-path.patch +crypto-hisilicon-sec-fix-memory-leak-for-sec-resourc.patch +io_uring-sqpoll-work-around-a-potential-audit-memory.patch +rcutorture-fix-rcu_torture_one_read-pipe_count-overf.patch +rcutorture-make-stall-tasks-directly-exit-when-rcuto.patch +rcutorture-fix-invalid-context-warning-when-enable-s.patch +block-ioctl-prefer-different-overflow-check.patch +selftests-bpf-prevent-client-connect-before-server-b.patch +selftests-bpf-fix-flaky-test-btf_map_in_map-lookup_u.patch +batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch +wifi-ath9k-work-around-memset-overflow-warning.patch +af_packet-avoid-a-false-positive-warning-in-packet_s.patch +drop_monitor-replace-spin_lock-by-raw_spin_lock.patch +scsi-qedi-fix-crash-while-reading-debugfs-attribute.patch +net-sched-fix-false-lockdep-warning-on-qdisc-root-lo.patch +kselftest-arm64-add-a-null-pointer-check.patch +net-dsa-realtek-keep-default-led-state-in-rtl8366rb.patch +netpoll-fix-race-condition-in-netpoll_owner_active.patch +wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch +hid-add-quirk-for-logitech-casa-touchpad.patch +hid-asus-fix-more-n-key-report-descriptors-if-n-key-.patch +bluetooth-ath3k-fix-multiple-issues-reported-by-chec.patch +drm-amd-display-exit-idle-optimizations-before-hdcp-.patch +platform-x86-toshiba_acpi-add-quirk-for-buttons-on-z.patch +asoc-intel-sof_sdw-add-jd2-quirk-for-hp-omen-14.patch +drm-lima-add-mask-irq-callback-to-gp-and-pp.patch +drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch +alsa-hda-realtek-add-quirks-for-lenovo-13x.patch +powerpc-pseries-enforce-hcall-result-buffer-validity.patch +powerpc-io-avoid-clang-null-pointer-arithmetic-warni.patch +platform-x86-p2sb-don-t-init-until-unassigned-resour.patch +power-supply-cros_usbpd-provide-id-table-for-avoidin.patch +iommu-arm-smmu-v3-free-msis-in-case-of-enomem.patch +f2fs-remove-clear-sb_inlinecrypt-flag-in-default_opt.patch +usb-misc-uss720-check-for-incompatible-versions-of-t.patch +avoid-hw_desc-array-overrun-in-dw-axi-dmac.patch +usb-dwc3-pci-don-t-set-linux-phy_charger_detect-prop.patch +udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch +pci-pm-avoid-d3cold-for-hp-pavilion-17-pc-1972-pcie-.patch +mips-octeon-add-pcie-link-status-check.patch +serial-imx-introduce-timeout-when-waiting-on-transmi.patch +serial-exar-adding-missing-cti-and-exar-pci-ids.patch +usb-gadget-function-remove-usage-of-the-deprecated-i.patch +tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch diff --git a/queue-6.1/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch b/queue-6.1/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch new file mode 100644 index 00000000000..ab71a0e9658 --- /dev/null +++ b/queue-6.1/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch @@ -0,0 +1,111 @@ +From 66ba59dd74fc288fc8f19cc6b642cbba27afd0ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 09:33:39 -0700 +Subject: tty: add the option to have a tty reject a new ldisc + +From: Linus Torvalds + +[ Upstream commit 6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b ] + +... and use it to limit the virtual terminals to just N_TTY. They are +kind of special, and in particular, the "con_write()" routine violates +the "writes cannot sleep" rule that some ldiscs rely on. + +This avoids the + + BUG: sleeping function called from invalid context at kernel/printk/printk.c:2659 + +when N_GSM has been attached to a virtual console, and gsmld_write() +calls con_write() while holding a spinlock, and con_write() then tries +to get the console lock. + +Tested-by: Tetsuo Handa +Cc: Jiri Slaby +Cc: Andrew Morton +Cc: Daniel Starke +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=dbac96d8e73b61aa559c +Signed-off-by: Linus Torvalds +Link: https://lore.kernel.org/r/20240423163339.59780-1-torvalds@linux-foundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_ldisc.c | 6 ++++++ + drivers/tty/vt/vt.c | 10 ++++++++++ + include/linux/tty_driver.h | 8 ++++++++ + 3 files changed, 24 insertions(+) + +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 776d8a62f77cc..7ca7731fa78ae 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -546,6 +546,12 @@ int tty_set_ldisc(struct tty_struct *tty, int disc) + goto out; + } + ++ if (tty->ops->ldisc_ok) { ++ retval = tty->ops->ldisc_ok(tty, disc); ++ if (retval) ++ goto out; ++ } ++ + old_ldisc = tty->ldisc; + + /* Shutdown the old discipline. */ +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 48a9ed7c93c97..e2f9348725ff1 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3440,6 +3440,15 @@ static void con_cleanup(struct tty_struct *tty) + tty_port_put(&vc->port); + } + ++/* ++ * We can't deal with anything but the N_TTY ldisc, ++ * because we can sleep in our write() routine. ++ */ ++static int con_ldisc_ok(struct tty_struct *tty, int ldisc) ++{ ++ return ldisc == N_TTY ? 0 : -EINVAL; ++} ++ + static int default_color = 7; /* white */ + static int default_italic_color = 2; // green (ASCII) + static int default_underline_color = 3; // cyan (ASCII) +@@ -3566,6 +3575,7 @@ static const struct tty_operations con_ops = { + .resize = vt_resize, + .shutdown = con_shutdown, + .cleanup = con_cleanup, ++ .ldisc_ok = con_ldisc_ok, + }; + + static struct cdev vc0_cdev; +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index e00034118c7bc..1df868130adce 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -155,6 +155,13 @@ struct serial_struct; + * + * Optional. Called under the @tty->termios_rwsem. May sleep. + * ++ * @ldisc_ok: ``int ()(struct tty_struct *tty, int ldisc)`` ++ * ++ * This routine allows the @tty driver to decide if it can deal ++ * with a particular @ldisc. ++ * ++ * Optional. Called under the @tty->ldisc_sem and @tty->termios_rwsem. ++ * + * @set_ldisc: ``void ()(struct tty_struct *tty)`` + * + * This routine allows the @tty driver to be notified when the device's +@@ -374,6 +381,7 @@ struct tty_operations { + void (*hangup)(struct tty_struct *tty); + int (*break_ctl)(struct tty_struct *tty, int state); + void (*flush_buffer)(struct tty_struct *tty); ++ int (*ldisc_ok)(struct tty_struct *tty, int ldisc); + void (*set_ldisc)(struct tty_struct *tty); + void (*wait_until_sent)(struct tty_struct *tty, int timeout); + void (*send_xchar)(struct tty_struct *tty, char ch); +-- +2.43.0 + diff --git a/queue-6.1/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch b/queue-6.1/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch new file mode 100644 index 00000000000..2068aec70a2 --- /dev/null +++ b/queue-6.1/udf-udftime-prevent-overflow-in-udf_disk_stamp_to_ti.patch @@ -0,0 +1,54 @@ +From 7812b0a358cd60a17a6208752a781aca853a8a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Mar 2024 16:27:55 +0300 +Subject: udf: udftime: prevent overflow in udf_disk_stamp_to_time() + +From: Roman Smirnov + +[ Upstream commit 3b84adf460381169c085e4bc09e7b57e9e16db0a ] + +An overflow can occur in a situation where src.centiseconds +takes the value of 255. This situation is unlikely, but there +is no validation check anywere in the code. + +Found by Linux Verification Center (linuxtesting.org) with Svace. + +Suggested-by: Jan Kara +Signed-off-by: Roman Smirnov +Reviewed-by: Sergey Shtylyov +Signed-off-by: Jan Kara +Message-Id: <20240327132755.13945-1-r.smirnov@omp.ru> +Signed-off-by: Sasha Levin +--- + fs/udf/udftime.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c +index fce4ad976c8c2..26169b1f482c3 100644 +--- a/fs/udf/udftime.c ++++ b/fs/udf/udftime.c +@@ -60,13 +60,18 @@ udf_disk_stamp_to_time(struct timespec64 *dest, struct timestamp src) + dest->tv_sec = mktime64(year, src.month, src.day, src.hour, src.minute, + src.second); + dest->tv_sec -= offset * 60; +- dest->tv_nsec = 1000 * (src.centiseconds * 10000 + +- src.hundredsOfMicroseconds * 100 + src.microseconds); ++ + /* + * Sanitize nanosecond field since reportedly some filesystems are + * recorded with bogus sub-second values. + */ +- dest->tv_nsec %= NSEC_PER_SEC; ++ if (src.centiseconds < 100 && src.hundredsOfMicroseconds < 100 && ++ src.microseconds < 100) { ++ dest->tv_nsec = 1000 * (src.centiseconds * 10000 + ++ src.hundredsOfMicroseconds * 100 + src.microseconds); ++ } else { ++ dest->tv_nsec = 0; ++ } + } + + void +-- +2.43.0 + diff --git a/queue-6.1/usb-dwc3-pci-don-t-set-linux-phy_charger_detect-prop.patch b/queue-6.1/usb-dwc3-pci-don-t-set-linux-phy_charger_detect-prop.patch new file mode 100644 index 00000000000..4e16be67c25 --- /dev/null +++ b/queue-6.1/usb-dwc3-pci-don-t-set-linux-phy_charger_detect-prop.patch @@ -0,0 +1,68 @@ +From 84ae3b3c2cfbca5a72fb9b052d21a0f1895c5abe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Apr 2024 16:01:27 +0200 +Subject: usb: dwc3: pci: Don't set "linux,phy_charger_detect" property on + Lenovo Yoga Tab2 1380 + +From: Hans de Goede + +[ Upstream commit 0fb782b5d5c462b2518b3b4fe7d652114c28d613 ] + +The Lenovo Yoga Tablet 2 Pro 1380 model is the exception to the rule that +devices which use the Crystal Cove PMIC without using ACPI for battery and +AC power_supply class support use the USB-phy for charger detection. + +Unlike the Lenovo Yoga Tablet 2 830 / 1050 models this model has an extra +LC824206XA Micro USB switch which does the charger detection. + +Add a DMI quirk to not set the "linux,phy_charger_detect" property on +the 1380 model. This quirk matches on the BIOS version to differentiate +the 1380 model from the 830 and 1050 models which otherwise have +the same DMI strings. + +Signed-off-by: Hans de Goede +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240406140127.17885-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index ae25ee832ec03..6110ab1f91318 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -8,6 +8,7 @@ + * Sebastian Andrzej Siewior + */ + ++#include + #include + #include + #include +@@ -219,6 +220,7 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc, + + if (pdev->device == PCI_DEVICE_ID_INTEL_BYT) { + struct gpio_desc *gpio; ++ const char *bios_ver; + int ret; + + /* On BYT the FW does not always enable the refclock */ +@@ -276,8 +278,12 @@ static int dwc3_pci_quirks(struct dwc3_pci *dwc, + * detection. These can be identified by them _not_ + * using the standard ACPI battery and ac drivers. + */ ++ bios_ver = dmi_get_system_info(DMI_BIOS_VERSION); + if (acpi_dev_present("INT33FD", "1", 2) && +- acpi_quirk_skip_acpi_ac_and_battery()) { ++ acpi_quirk_skip_acpi_ac_and_battery() && ++ /* Lenovo Yoga Tablet 2 Pro 1380 uses LC824206XA instead */ ++ !(bios_ver && ++ strstarts(bios_ver, "BLADE_21.X64.0005.R00.1504101516"))) { + dev_info(&pdev->dev, "Using TUSB1211 phy for charger detection\n"); + swnode = &dwc3_pci_intel_phy_charger_detect_swnode; + } +-- +2.43.0 + diff --git a/queue-6.1/usb-gadget-function-remove-usage-of-the-deprecated-i.patch b/queue-6.1/usb-gadget-function-remove-usage-of-the-deprecated-i.patch new file mode 100644 index 00000000000..11e14106d4a --- /dev/null +++ b/queue-6.1/usb-gadget-function-remove-usage-of-the-deprecated-i.patch @@ -0,0 +1,98 @@ +From 96542c36f19d87199a0035e909a4e628b4e1c84a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Apr 2024 17:10:32 +0200 +Subject: usb: gadget: function: Remove usage of the deprecated ida_simple_xx() + API + +From: Christophe JAILLET + +[ Upstream commit 920e7522e3bab5ebc2fb0cc1a034f4470c87fa97 ] + +ida_alloc() and ida_free() should be preferred to the deprecated +ida_simple_get() and ida_simple_remove(). + +Note that the upper limit of ida_simple_get() is exclusive, but the one of +ida_alloc_max() is inclusive. So a -1 has been added when needed. + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/7cd361e2b377a5373968fa7deee4169229992a1e.1713107386.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 6 +++--- + drivers/usb/gadget/function/f_printer.c | 6 +++--- + drivers/usb/gadget/function/rndis.c | 4 ++-- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index f1ca9250cad96..bb558a575cb15 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -1025,9 +1025,9 @@ static inline int hidg_get_minor(void) + { + int ret; + +- ret = ida_simple_get(&hidg_ida, 0, 0, GFP_KERNEL); ++ ret = ida_alloc(&hidg_ida, GFP_KERNEL); + if (ret >= HIDG_MINORS) { +- ida_simple_remove(&hidg_ida, ret); ++ ida_free(&hidg_ida, ret); + ret = -ENODEV; + } + +@@ -1172,7 +1172,7 @@ static const struct config_item_type hid_func_type = { + + static inline void hidg_put_minor(int minor) + { +- ida_simple_remove(&hidg_ida, minor); ++ ida_free(&hidg_ida, minor); + } + + static void hidg_free_inst(struct usb_function_instance *f) +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index a881c69b1f2bf..8545656419c71 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -1316,9 +1316,9 @@ static inline int gprinter_get_minor(void) + { + int ret; + +- ret = ida_simple_get(&printer_ida, 0, 0, GFP_KERNEL); ++ ret = ida_alloc(&printer_ida, GFP_KERNEL); + if (ret >= PRINTER_MINORS) { +- ida_simple_remove(&printer_ida, ret); ++ ida_free(&printer_ida, ret); + ret = -ENODEV; + } + +@@ -1327,7 +1327,7 @@ static inline int gprinter_get_minor(void) + + static inline void gprinter_put_minor(int minor) + { +- ida_simple_remove(&printer_ida, minor); ++ ida_free(&printer_ida, minor); + } + + static int gprinter_setup(int); +diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c +index 29bf8664bf582..12c5d9cf450c1 100644 +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -869,12 +869,12 @@ EXPORT_SYMBOL_GPL(rndis_msg_parser); + + static inline int rndis_get_nr(void) + { +- return ida_simple_get(&rndis_ida, 0, 1000, GFP_KERNEL); ++ return ida_alloc_max(&rndis_ida, 999, GFP_KERNEL); + } + + static inline void rndis_put_nr(int nr) + { +- ida_simple_remove(&rndis_ida, nr); ++ ida_free(&rndis_ida, nr); + } + + struct rndis_params *rndis_register(void (*resp_avail)(void *v), void *v) +-- +2.43.0 + diff --git a/queue-6.1/usb-misc-uss720-check-for-incompatible-versions-of-t.patch b/queue-6.1/usb-misc-uss720-check-for-incompatible-versions-of-t.patch new file mode 100644 index 00000000000..df940df7396 --- /dev/null +++ b/queue-6.1/usb-misc-uss720-check-for-incompatible-versions-of-t.patch @@ -0,0 +1,75 @@ +From c3e8f2cfac0e6b4023d69ac75f2bfef0b3ee952d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 09:07:11 -0600 +Subject: usb: misc: uss720: check for incompatible versions of the Belkin + F5U002 + +From: Alex Henrie + +[ Upstream commit 3295f1b866bfbcabd625511968e8a5c541f9ab32 ] + +The incompatible device in my possession has a sticker that says +"F5U002 Rev 2" and "P80453-B", and lsusb identifies it as +"050d:0002 Belkin Components IEEE-1284 Controller". There is a bug +report from 2007 from Michael Trausch who was seeing the exact same +errors that I saw in 2024 trying to use this cable. + +Link: https://lore.kernel.org/all/46DE5830.9060401@trausch.us/ +Signed-off-by: Alex Henrie +Link: https://lore.kernel.org/r/20240326150723.99939-5-alexhenrie24@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/uss720.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index b00d92db5dfd1..eb5a8e0d9e2d6 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -677,7 +677,7 @@ static int uss720_probe(struct usb_interface *intf, + struct parport_uss720_private *priv; + struct parport *pp; + unsigned char reg; +- int i; ++ int ret; + + dev_dbg(&intf->dev, "probe: vendor id 0x%x, device id 0x%x\n", + le16_to_cpu(usbdev->descriptor.idVendor), +@@ -688,8 +688,8 @@ static int uss720_probe(struct usb_interface *intf, + usb_put_dev(usbdev); + return -ENODEV; + } +- i = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2); +- dev_dbg(&intf->dev, "set interface result %d\n", i); ++ ret = usb_set_interface(usbdev, intf->altsetting->desc.bInterfaceNumber, 2); ++ dev_dbg(&intf->dev, "set interface result %d\n", ret); + + interface = intf->cur_altsetting; + +@@ -725,12 +725,18 @@ static int uss720_probe(struct usb_interface *intf, + set_1284_register(pp, 7, 0x00, GFP_KERNEL); + set_1284_register(pp, 6, 0x30, GFP_KERNEL); /* PS/2 mode */ + set_1284_register(pp, 2, 0x0c, GFP_KERNEL); +- /* debugging */ +- get_1284_register(pp, 0, ®, GFP_KERNEL); ++ ++ /* The Belkin F5U002 Rev 2 P80453-B USB parallel port adapter shares the ++ * device ID 050d:0002 with some other device that works with this ++ * driver, but it itself does not. Detect and handle the bad cable ++ * here. */ ++ ret = get_1284_register(pp, 0, ®, GFP_KERNEL); + dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg); ++ if (ret < 0) ++ return ret; + +- i = usb_find_last_int_in_endpoint(interface, &epd); +- if (!i) { ++ ret = usb_find_last_int_in_endpoint(interface, &epd); ++ if (!ret) { + dev_dbg(&intf->dev, "epaddr %d interval %d\n", + epd->bEndpointAddress, epd->bInterval); + } +-- +2.43.0 + diff --git a/queue-6.1/wifi-ath9k-work-around-memset-overflow-warning.patch b/queue-6.1/wifi-ath9k-work-around-memset-overflow-warning.patch new file mode 100644 index 00000000000..f9cc9722a68 --- /dev/null +++ b/queue-6.1/wifi-ath9k-work-around-memset-overflow-warning.patch @@ -0,0 +1,72 @@ +From 412213ea200af9e1550079e7e5b52266d64aea18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2024 09:35:59 +0300 +Subject: wifi: ath9k: work around memset overflow warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 61752ac69b69ed2e04444d090f6917c77ab36d42 ] + +gcc-9 and some other older versions produce a false-positive warning +for zeroing two fields + +In file included from include/linux/string.h:369, + from drivers/net/wireless/ath/ath9k/main.c:18: +In function 'fortify_memset_chk', + inlined from 'ath9k_ps_wakeup' at drivers/net/wireless/ath/ath9k/main.c:140:3: +include/linux/fortify-string.h:462:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] + 462 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Using a struct_group seems to reliably avoid the warning and +not make the code much uglier. The combined memset() should even +save a couple of cpu cycles. + +Signed-off-by: Arnd Bergmann +Acked-by: Toke Høiland-Jørgensen +Reviewed-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240328135509.3755090-3-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath.h | 6 ++++-- + drivers/net/wireless/ath/ath9k/main.c | 3 +-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h +index f02a308a9ffc5..34654f710d8a1 100644 +--- a/drivers/net/wireless/ath/ath.h ++++ b/drivers/net/wireless/ath/ath.h +@@ -171,8 +171,10 @@ struct ath_common { + unsigned int clockrate; + + spinlock_t cc_lock; +- struct ath_cycle_counters cc_ani; +- struct ath_cycle_counters cc_survey; ++ struct_group(cc, ++ struct ath_cycle_counters cc_ani; ++ struct ath_cycle_counters cc_survey; ++ ); + + struct ath_regulatory regulatory; + struct ath_regulatory reg_world_copy; +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index 6360d3356e256..81412a67c1cbd 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -135,8 +135,7 @@ void ath9k_ps_wakeup(struct ath_softc *sc) + if (power_mode != ATH9K_PM_AWAKE) { + spin_lock(&common->cc_lock); + ath_hw_cycle_counters_update(common); +- memset(&common->cc_survey, 0, sizeof(common->cc_survey)); +- memset(&common->cc_ani, 0, sizeof(common->cc_ani)); ++ memset(&common->cc, 0, sizeof(common->cc)); + spin_unlock(&common->cc_lock); + } + +-- +2.43.0 + diff --git a/queue-6.1/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch b/queue-6.1/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch new file mode 100644 index 00000000000..808c3cee6ec --- /dev/null +++ b/queue-6.1/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch @@ -0,0 +1,106 @@ +From fed487a3f8a8b5f619aafa4df423fec0c7f5a2e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 17:46:32 +0800 +Subject: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery + +From: Leon Yen + +[ Upstream commit ecf0b2b8a37c8464186620bef37812a117ff6366 ] + +During chip recovery (e.g. chip reset), there is a possible situation that +kernel worker reset_work is holding the lock and waiting for kernel thread +stat_worker to be parked, while stat_worker is waiting for the release of +the same lock. +It causes a deadlock resulting in the dumping of hung tasks messages and +possible rebooting of the device. + +This patch prevents the execution of stat_worker during the chip recovery. + +Signed-off-by: Leon Yen +Signed-off-by: Ming Yen Hsieh +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 2 ++ + drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c | 2 -- + drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c | 2 -- + drivers/net/wireless/mediatek/mt76/sdio.c | 3 ++- + 4 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +index 49ddca84f7862..cae7c21ca1f8b 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -883,6 +883,7 @@ void mt7921_mac_reset_work(struct work_struct *work) + int i, ret; + + dev_dbg(dev->mt76.dev, "chip reset\n"); ++ set_bit(MT76_RESET, &dev->mphy.state); + dev->hw_full_reset = true; + ieee80211_stop_queues(hw); + +@@ -911,6 +912,7 @@ void mt7921_mac_reset_work(struct work_struct *work) + } + + dev->hw_full_reset = false; ++ clear_bit(MT76_RESET, &dev->mphy.state); + pm->suspended = false; + ieee80211_wake_queues(hw); + ieee80211_iterate_active_interfaces(hw, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c +index 8dd60408b117e..cb20ddcad137c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mac.c +@@ -78,7 +78,6 @@ int mt7921e_mac_reset(struct mt7921_dev *dev) + mt76_wr(dev, MT_WFDMA0_HOST_INT_ENA, 0); + mt76_wr(dev, MT_PCIE_MAC_INT_ENABLE, 0x0); + +- set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); + wake_up(&dev->mt76.mcu.wait); + skb_queue_purge(&dev->mt76.mcu.res_q); +@@ -129,7 +128,6 @@ int mt7921e_mac_reset(struct mt7921_dev *dev) + + err = __mt7921_start(&dev->phy); + out: +- clear_bit(MT76_RESET, &dev->mphy.state); + + local_bh_disable(); + napi_enable(&dev->mt76.tx_napi); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +index fd07b66233920..46af03803de73 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +@@ -98,7 +98,6 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) + mt76_connac_free_pending_tx_skbs(&dev->pm, NULL); + mt76_txq_schedule_all(&dev->mphy); + mt76_worker_disable(&dev->mt76.tx_worker); +- set_bit(MT76_RESET, &dev->mphy.state); + set_bit(MT76_MCU_RESET, &dev->mphy.state); + wake_up(&dev->mt76.mcu.wait); + skb_queue_purge(&dev->mt76.mcu.res_q); +@@ -135,7 +134,6 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) + + err = __mt7921_start(&dev->phy); + out: +- clear_bit(MT76_RESET, &dev->mphy.state); + + mt76_worker_enable(&dev->mt76.tx_worker); + +diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c +index fc4fb94635645..2a81c2f663449 100644 +--- a/drivers/net/wireless/mediatek/mt76/sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/sdio.c +@@ -499,7 +499,8 @@ static void mt76s_tx_status_data(struct mt76_worker *worker) + dev = container_of(sdio, struct mt76_dev, sdio); + + while (true) { +- if (test_bit(MT76_REMOVED, &dev->phy.state)) ++ if (test_bit(MT76_RESET, &dev->phy.state) || ++ test_bit(MT76_REMOVED, &dev->phy.state)) + break; + + if (!dev->drv->tx_status_data(dev, &update)) +-- +2.43.0 + -- 2.47.3