From e448121bdc069d428d53e829b967925dde1b45fd Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 28 Dec 2024 09:19:50 -0500 Subject: [PATCH] Fixes for 6.6 Signed-off-by: Sasha Levin --- ...exant-fix-z60mr100-startup-pop-issue.patch | 100 +++++++++ ...-standard-helper-for-buffer-accesses.patch | 65 ++++++ ...p-callback-registering-out-of-q-sysf.patch | 198 ++++++++++++++++++ ...cpuhp-callback-after-hctx-is-added-t.patch | 73 +++++++ ...e-mst_primary-pointer-is-valid-in-dr.patch | 99 +++++++++ ...pf-adjust-the-parameter-of-emit_jirl.patch | 103 +++++++++ ...serving-screen-info-memory-for-above.patch | 39 ++++ ...sus-nb-wmi-ignore-unknown-event-0xcf.patch | 70 +++++++ ...vas-add-close-callback-in-vas_vm_ops.patch | 155 ++++++++++++++ ...ct-format-specifier-for-logging-rang.patch | 43 ++++ ...aid_sas-fix-for-a-potential-deadlock.patch | 48 +++++ ...g-reset-when-doorbell-in-use-bit-is-.patch | 53 +++++ ...-hw-revision-numbering-for-isp1020-1.patch | 49 +++++ ...not-flag-maintenance_in-return-of-sr.patch | 72 +++++++ queue-6.6/series | 23 ++ .../smb-server-fix-building-with-gcc-15.patch | 47 +++++ ...-panther-lake-spi-controller-support.patch | 40 ++++ ...fix-the-is_err-bug-for-devm_clk_get_.patch | 46 ++++ ...-make-__struct_group-uapi-c-friendly.patch | 116 ++++++++++ ...ake-trace_kprobe-s-module-callback-c.patch | 41 ++++ ...t-dir-link-count-update-if-corrupted.patch | 39 ++++ ...-keep-queue-frozen-during-system-sus.patch | 72 +++++++ ...t-add-pwrgd-enable-quirk-for-qotom-q.patch | 121 +++++++++++ ...ek-add-support-for-mt6735-toprgu-wdt.patch | 57 +++++ 24 files changed, 1769 insertions(+) create mode 100644 queue-6.6/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch create mode 100644 queue-6.6/alsa-sh-use-standard-helper-for-buffer-accesses.patch create mode 100644 queue-6.6/blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch create mode 100644 queue-6.6/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch create mode 100644 queue-6.6/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch create mode 100644 queue-6.6/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch create mode 100644 queue-6.6/loongarch-fix-reserving-screen-info-memory-for-above.patch create mode 100644 queue-6.6/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch create mode 100644 queue-6.6/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch create mode 100644 queue-6.6/regmap-use-correct-format-specifier-for-logging-rang.patch create mode 100644 queue-6.6/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch create mode 100644 queue-6.6/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch create mode 100644 queue-6.6/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch create mode 100644 queue-6.6/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch create mode 100644 queue-6.6/smb-server-fix-building-with-gcc-15.patch create mode 100644 queue-6.6/spi-intel-add-panther-lake-spi-controller-support.patch create mode 100644 queue-6.6/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch create mode 100644 queue-6.6/stddef-make-__struct_group-uapi-c-friendly.patch create mode 100644 queue-6.6/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch create mode 100644 queue-6.6/udf-skip-parent-dir-link-count-update-if-corrupted.patch create mode 100644 queue-6.6/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch create mode 100644 queue-6.6/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch create mode 100644 queue-6.6/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch diff --git a/queue-6.6/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch b/queue-6.6/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch new file mode 100644 index 00000000000..e074fbc2954 --- /dev/null +++ b/queue-6.6/alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch @@ -0,0 +1,100 @@ +From baced3ee4d94dfd739cd7960df046b9d3734c56b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Nov 2024 09:44:41 +0800 +Subject: ALSA: hda/conexant: fix Z60MR100 startup pop issue + +From: bo liu + +[ Upstream commit 947c4012f8f03a8bb946beb6e5294d5e32817d67 ] + +When Z60MR100 startup, speaker will output a pop. To fix this issue, +we mute codec by init verbs in bios when system startup, and set GPIO +to low to unmute codec in codec driver when it loaded . + +[ white space fixes and compile warning fix by tiwai ] + +Signed-off-by: bo liu +Link: https://patch.msgid.link/20241129014441.437205-1-bo.liu@senarytech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_conexant.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index b3208b068dd8..989ce0fb6291 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -311,6 +311,7 @@ enum { + CXT_FIXUP_HP_MIC_NO_PRESENCE, + CXT_PINCFG_SWS_JS201D, + CXT_PINCFG_TOP_SPEAKER, ++ CXT_FIXUP_HP_A_U, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -778,6 +779,18 @@ static void cxt_setup_mute_led(struct hda_codec *codec, + } + } + ++static void cxt_setup_gpio_unmute(struct hda_codec *codec, ++ unsigned int gpio_mute_mask) ++{ ++ if (gpio_mute_mask) { ++ // set gpio data to 0. ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask); ++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0); ++ } ++} ++ + static void cxt_fixup_mute_led_gpio(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -792,6 +805,15 @@ static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec, + cxt_setup_mute_led(codec, 0x10, 0x20); + } + ++static void cxt_fixup_hp_a_u(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ // Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise, ++ // so need to unmute once by clearing the gpio data when runs into the system. ++ if (action == HDA_FIXUP_ACT_INIT) ++ cxt_setup_gpio_unmute(codec, 0x2); ++} ++ + /* ThinkPad X200 & co with cxt5051 */ + static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { + { 0x16, 0x042140ff }, /* HP (seq# overridden) */ +@@ -1002,6 +1024,10 @@ static const struct hda_fixup cxt_fixups[] = { + { } + }, + }, ++ [CXT_FIXUP_HP_A_U] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = cxt_fixup_hp_a_u, ++ }, + }; + + static const struct hda_quirk cxt5045_fixups[] = { +@@ -1076,6 +1102,7 @@ static const struct hda_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), ++ SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U), + SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +@@ -1121,6 +1148,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { + { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" }, + { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" }, ++ { .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" }, + {} + }; + +-- +2.39.5 + diff --git a/queue-6.6/alsa-sh-use-standard-helper-for-buffer-accesses.patch b/queue-6.6/alsa-sh-use-standard-helper-for-buffer-accesses.patch new file mode 100644 index 00000000000..ab5f3ccc497 --- /dev/null +++ b/queue-6.6/alsa-sh-use-standard-helper-for-buffer-accesses.patch @@ -0,0 +1,65 @@ +From be4c3ec5c576b2a4a33efdedbfd08d277cf54776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 11:49:38 +0100 +Subject: ALSA: sh: Use standard helper for buffer accesses + +From: Takashi Iwai + +[ Upstream commit 9b5f8ee43e48c25fbe1a10163ec04343d750acd0 ] + +The SH DAC audio driver uses the kmalloc'ed buffer as the main PCM +buffer, and the data is transferred via hrtimer callbacks manually +from there to the hardware. Meanwhile, some of its code are written +as if the buffer is on iomem and use the special helpers for the iomem +(e.g. copy_from_iter_toio() or memset_io()). Those are rather useless +and the standard helpers should be used. + +Similarly, the PCM mmap callback is set to a special one with +snd_pcm_lib_mmap_iomem, but this is also nonsense, because SH +architecture doesn't support this function, hence it leads just to +NULL -- the fallback to the standard helper. + +This patch replaces those special setups with the standard ones. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202411281337.I4M07b7i-lkp@intel.com/ +Link: https://patch.msgid.link/20241128104939.13755-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/sh/sh_dac_audio.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c +index 95ba3abd4e47..36a973d1c46d 100644 +--- a/sound/sh/sh_dac_audio.c ++++ b/sound/sh/sh_dac_audio.c +@@ -163,7 +163,7 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream, + /* channel is not used (interleaved data) */ + struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); + +- if (copy_from_iter_toio(chip->data_buffer + pos, src, count)) ++ if (copy_from_iter(chip->data_buffer + pos, src, count) != count) + return -EFAULT; + chip->buffer_end = chip->data_buffer + pos + count; + +@@ -182,7 +182,7 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream, + /* channel is not used (interleaved data) */ + struct snd_sh_dac *chip = snd_pcm_substream_chip(substream); + +- memset_io(chip->data_buffer + pos, 0, count); ++ memset(chip->data_buffer + pos, 0, count); + chip->buffer_end = chip->data_buffer + pos + count; + + if (chip->empty) { +@@ -211,7 +211,6 @@ static const struct snd_pcm_ops snd_sh_dac_pcm_ops = { + .pointer = snd_sh_dac_pcm_pointer, + .copy = snd_sh_dac_pcm_copy, + .fill_silence = snd_sh_dac_pcm_silence, +- .mmap = snd_pcm_lib_mmap_iomem, + }; + + static int snd_sh_dac_pcm(struct snd_sh_dac *chip, int device) +-- +2.39.5 + diff --git a/queue-6.6/blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch b/queue-6.6/blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch new file mode 100644 index 00000000000..1c21ad923c9 --- /dev/null +++ b/queue-6.6/blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch @@ -0,0 +1,198 @@ +From 6a971dfc9e563f6ffb2cda79c75bdaa0224e5461 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 19:16:07 +0800 +Subject: blk-mq: move cpuhp callback registering out of q->sysfs_lock + +From: Ming Lei + +[ Upstream commit 22465bbac53c821319089016f268a2437de9b00a ] + +Registering and unregistering cpuhp callback requires global cpu hotplug lock, +which is used everywhere. Meantime q->sysfs_lock is used in block layer +almost everywhere. + +It is easy to trigger lockdep warning[1] by connecting the two locks. + +Fix the warning by moving blk-mq's cpuhp callback registering out of +q->sysfs_lock. Add one dedicated global lock for covering registering & +unregistering hctx's cpuhp, and it is safe to do so because hctx is +guaranteed to be live if our request_queue is live. + +[1] https://lore.kernel.org/lkml/Z04pz3AlvI4o0Mr8@agluck-desk3/ + +Cc: Reinette Chatre +Cc: Fenghua Yu +Cc: Peter Newman +Cc: Babu Moger +Reported-by: Luck Tony +Signed-off-by: Ming Lei +Tested-by: Tony Luck +Link: https://lore.kernel.org/r/20241206111611.978870-3-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 103 +++++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 92 insertions(+), 11 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index f4a9eed1b977..9efc2fd3e4c4 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -43,6 +43,7 @@ + + static DEFINE_PER_CPU(struct llist_head, blk_cpu_done); + static DEFINE_PER_CPU(call_single_data_t, blk_cpu_csd); ++static DEFINE_MUTEX(blk_mq_cpuhp_lock); + + static void blk_mq_insert_request(struct request *rq, blk_insert_t flags); + static void blk_mq_request_bypass_insert(struct request *rq, +@@ -3623,13 +3624,91 @@ static int blk_mq_hctx_notify_dead(unsigned int cpu, struct hlist_node *node) + return 0; + } + +-static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) ++static void __blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) + { +- if (!(hctx->flags & BLK_MQ_F_STACKING)) ++ lockdep_assert_held(&blk_mq_cpuhp_lock); ++ ++ if (!(hctx->flags & BLK_MQ_F_STACKING) && ++ !hlist_unhashed(&hctx->cpuhp_online)) { + cpuhp_state_remove_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, + &hctx->cpuhp_online); +- cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD, +- &hctx->cpuhp_dead); ++ INIT_HLIST_NODE(&hctx->cpuhp_online); ++ } ++ ++ if (!hlist_unhashed(&hctx->cpuhp_dead)) { ++ cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD, ++ &hctx->cpuhp_dead); ++ INIT_HLIST_NODE(&hctx->cpuhp_dead); ++ } ++} ++ ++static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx) ++{ ++ mutex_lock(&blk_mq_cpuhp_lock); ++ __blk_mq_remove_cpuhp(hctx); ++ mutex_unlock(&blk_mq_cpuhp_lock); ++} ++ ++static void __blk_mq_add_cpuhp(struct blk_mq_hw_ctx *hctx) ++{ ++ lockdep_assert_held(&blk_mq_cpuhp_lock); ++ ++ if (!(hctx->flags & BLK_MQ_F_STACKING) && ++ hlist_unhashed(&hctx->cpuhp_online)) ++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, ++ &hctx->cpuhp_online); ++ ++ if (hlist_unhashed(&hctx->cpuhp_dead)) ++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, ++ &hctx->cpuhp_dead); ++} ++ ++static void __blk_mq_remove_cpuhp_list(struct list_head *head) ++{ ++ struct blk_mq_hw_ctx *hctx; ++ ++ lockdep_assert_held(&blk_mq_cpuhp_lock); ++ ++ list_for_each_entry(hctx, head, hctx_list) ++ __blk_mq_remove_cpuhp(hctx); ++} ++ ++/* ++ * Unregister cpuhp callbacks from exited hw queues ++ * ++ * Safe to call if this `request_queue` is live ++ */ ++static void blk_mq_remove_hw_queues_cpuhp(struct request_queue *q) ++{ ++ LIST_HEAD(hctx_list); ++ ++ spin_lock(&q->unused_hctx_lock); ++ list_splice_init(&q->unused_hctx_list, &hctx_list); ++ spin_unlock(&q->unused_hctx_lock); ++ ++ mutex_lock(&blk_mq_cpuhp_lock); ++ __blk_mq_remove_cpuhp_list(&hctx_list); ++ mutex_unlock(&blk_mq_cpuhp_lock); ++ ++ spin_lock(&q->unused_hctx_lock); ++ list_splice(&hctx_list, &q->unused_hctx_list); ++ spin_unlock(&q->unused_hctx_lock); ++} ++ ++/* ++ * Register cpuhp callbacks from all hw queues ++ * ++ * Safe to call if this `request_queue` is live ++ */ ++static void blk_mq_add_hw_queues_cpuhp(struct request_queue *q) ++{ ++ struct blk_mq_hw_ctx *hctx; ++ unsigned long i; ++ ++ mutex_lock(&blk_mq_cpuhp_lock); ++ queue_for_each_hw_ctx(q, hctx, i) ++ __blk_mq_add_cpuhp(hctx); ++ mutex_unlock(&blk_mq_cpuhp_lock); + } + + /* +@@ -3680,8 +3759,6 @@ static void blk_mq_exit_hctx(struct request_queue *q, + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); + +- blk_mq_remove_cpuhp(hctx); +- + xa_erase(&q->hctx_table, hctx_idx); + + spin_lock(&q->unused_hctx_lock); +@@ -3698,6 +3775,7 @@ static void blk_mq_exit_hw_queues(struct request_queue *q, + queue_for_each_hw_ctx(q, hctx, i) { + if (i == nr_queue) + break; ++ blk_mq_remove_cpuhp(hctx); + blk_mq_exit_hctx(q, set, hctx, i); + } + } +@@ -3721,11 +3799,6 @@ static int blk_mq_init_hctx(struct request_queue *q, + if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL)) + goto exit_flush_rq; + +- if (!(hctx->flags & BLK_MQ_F_STACKING)) +- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, +- &hctx->cpuhp_online); +- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); +- + return 0; + + exit_flush_rq: +@@ -3760,6 +3833,8 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set, + INIT_DELAYED_WORK(&hctx->run_work, blk_mq_run_work_fn); + spin_lock_init(&hctx->lock); + INIT_LIST_HEAD(&hctx->dispatch); ++ INIT_HLIST_NODE(&hctx->cpuhp_dead); ++ INIT_HLIST_NODE(&hctx->cpuhp_online); + hctx->queue = q; + hctx->flags = set->flags & ~BLK_MQ_F_TAG_QUEUE_SHARED; + +@@ -4278,6 +4353,12 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, + xa_for_each_start(&q->hctx_table, j, hctx, j) + blk_mq_exit_hctx(q, set, hctx, j); + mutex_unlock(&q->sysfs_lock); ++ ++ /* unregister cpuhp callbacks for exited hctxs */ ++ blk_mq_remove_hw_queues_cpuhp(q); ++ ++ /* register cpuhp for new initialized hctxs */ ++ blk_mq_add_hw_queues_cpuhp(q); + } + + static void blk_mq_update_poll_flag(struct request_queue *q) +-- +2.39.5 + diff --git a/queue-6.6/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch b/queue-6.6/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch new file mode 100644 index 00000000000..4fb09cea3ef --- /dev/null +++ b/queue-6.6/blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch @@ -0,0 +1,73 @@ +From 6c16535877f053a6a4493459513b69a2c20192be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 19:16:06 +0800 +Subject: blk-mq: register cpuhp callback after hctx is added to xarray table + +From: Ming Lei + +[ Upstream commit 4bf485a7db5d82ddd0f3ad2b299893199090375e ] + +We need to retrieve 'hctx' from xarray table in the cpuhp callback, so the +callback should be registered after this 'hctx' is added to xarray table. + +Cc: Reinette Chatre +Cc: Fenghua Yu +Cc: Peter Newman +Cc: Babu Moger +Cc: Luck Tony +Signed-off-by: Ming Lei +Tested-by: Tony Luck +Link: https://lore.kernel.org/r/20241206111611.978870-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 6c71add013bf..f4a9eed1b977 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3708,16 +3708,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + { + hctx->queue_num = hctx_idx; + +- if (!(hctx->flags & BLK_MQ_F_STACKING)) +- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, +- &hctx->cpuhp_online); +- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); +- + hctx->tags = set->tags[hctx_idx]; + + if (set->ops->init_hctx && + set->ops->init_hctx(hctx, set->driver_data, hctx_idx)) +- goto unregister_cpu_notifier; ++ goto fail; + + if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx, + hctx->numa_node)) +@@ -3726,6 +3721,11 @@ static int blk_mq_init_hctx(struct request_queue *q, + if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL)) + goto exit_flush_rq; + ++ if (!(hctx->flags & BLK_MQ_F_STACKING)) ++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE, ++ &hctx->cpuhp_online); ++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead); ++ + return 0; + + exit_flush_rq: +@@ -3734,8 +3734,7 @@ static int blk_mq_init_hctx(struct request_queue *q, + exit_hctx: + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); +- unregister_cpu_notifier: +- blk_mq_remove_cpuhp(hctx); ++ fail: + return -1; + } + +-- +2.39.5 + diff --git a/queue-6.6/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch b/queue-6.6/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch new file mode 100644 index 00000000000..b09f29240c5 --- /dev/null +++ b/queue-6.6/drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch @@ -0,0 +1,99 @@ +From a64387937534ebe992d2f1abfbed03cbcae0e410 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 15:20:07 +0200 +Subject: drm/dp_mst: Ensure mst_primary pointer is valid in + drm_dp_mst_handle_up_req() + +From: Imre Deak + +[ Upstream commit e54b00086f7473dbda1a7d6fc47720ced157c6a8 ] + +While receiving an MST up request message from one thread in +drm_dp_mst_handle_up_req(), the MST topology could be removed from +another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing +mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. +This could lead to a NULL deref/use-after-free of mst_primary in +drm_dp_mst_handle_up_req(). + +Avoid the above by holding a reference for mst_primary in +drm_dp_mst_handle_up_req() while it's used. + +v2: Fix kfreeing the request if getting an mst_primary reference fails. + +Cc: Lyude Paul +Reviewed-by: Lyude Paul (v1) +Signed-off-by: Imre Deak +Link: https://patchwork.freedesktop.org/patch/msgid/20241204132007.3132494-1-imre.deak@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 24 ++++++++++++++----- + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c +index 90bfb1e988fb..d6c5de190c27 100644 +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -4033,9 +4033,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work) + static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + { + struct drm_dp_pending_up_req *up_req; ++ struct drm_dp_mst_branch *mst_primary; + + if (!drm_dp_get_one_sb_msg(mgr, true, NULL)) +- goto out; ++ goto out_clear_reply; + + if (!mgr->up_req_recv.have_eomt) + return 0; +@@ -4053,10 +4054,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n", + up_req->msg.req_type); + kfree(up_req); +- goto out; ++ goto out_clear_reply; ++ } ++ ++ mutex_lock(&mgr->lock); ++ mst_primary = mgr->mst_primary; ++ if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) { ++ mutex_unlock(&mgr->lock); ++ kfree(up_req); ++ goto out_clear_reply; + } ++ mutex_unlock(&mgr->lock); + +- drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type, ++ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type, + false); + + if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) { +@@ -4073,13 +4083,13 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + conn_stat->peer_device_type); + + mutex_lock(&mgr->probe_lock); +- handle_csn = mgr->mst_primary->link_address_sent; ++ handle_csn = mst_primary->link_address_sent; + mutex_unlock(&mgr->probe_lock); + + if (!handle_csn) { + drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it."); + kfree(up_req); +- goto out; ++ goto out_put_primary; + } + } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) { + const struct drm_dp_resource_status_notify *res_stat = +@@ -4096,7 +4106,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) + mutex_unlock(&mgr->up_req_lock); + queue_work(system_long_wq, &mgr->up_req_work); + +-out: ++out_put_primary: ++ drm_dp_mst_topology_put_mstb(mst_primary); ++out_clear_reply: + memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); + return 0; + } +-- +2.39.5 + diff --git a/queue-6.6/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch b/queue-6.6/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch new file mode 100644 index 00000000000..3199782d4b1 --- /dev/null +++ b/queue-6.6/loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch @@ -0,0 +1,103 @@ +From 2b79bd3e5332d80faf7cce4e7c73861ae45e7fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 16:42:08 +0800 +Subject: LoongArch: BPF: Adjust the parameter of emit_jirl() + +From: Tiezhu Yang + +[ Upstream commit c1474bb0b7cff4e8481095bd0618b8f6c2f0aeb4 ] + +The branch instructions beq, bne, blt, bge, bltu, bgeu and jirl belong +to the format reg2i16, but the sequence of oprand is different for the +instruction jirl. So adjust the parameter order of emit_jirl() to make +it more readable correspond with the Instruction Set Architecture manual. + +Here are the instruction formats: + + beq rj, rd, offs16 + bne rj, rd, offs16 + blt rj, rd, offs16 + bge rj, rd, offs16 + bltu rj, rd, offs16 + bgeu rj, rd, offs16 + jirl rd, rj, offs16 + +Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#branch-instructions +Suggested-by: Huacai Chen +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/inst.h | 12 +++++++++++- + arch/loongarch/kernel/inst.c | 2 +- + arch/loongarch/net/bpf_jit.c | 6 +++--- + 3 files changed, 15 insertions(+), 5 deletions(-) + +diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h +index 71e1ed4165c8..4fa53ad82efb 100644 +--- a/arch/loongarch/include/asm/inst.h ++++ b/arch/loongarch/include/asm/inst.h +@@ -655,7 +655,17 @@ DEF_EMIT_REG2I16_FORMAT(blt, blt_op) + DEF_EMIT_REG2I16_FORMAT(bge, bge_op) + DEF_EMIT_REG2I16_FORMAT(bltu, bltu_op) + DEF_EMIT_REG2I16_FORMAT(bgeu, bgeu_op) +-DEF_EMIT_REG2I16_FORMAT(jirl, jirl_op) ++ ++static inline void emit_jirl(union loongarch_instruction *insn, ++ enum loongarch_gpr rd, ++ enum loongarch_gpr rj, ++ int offset) ++{ ++ insn->reg2i16_format.opcode = jirl_op; ++ insn->reg2i16_format.immediate = offset; ++ insn->reg2i16_format.rd = rd; ++ insn->reg2i16_format.rj = rj; ++} + + #define DEF_EMIT_REG2BSTRD_FORMAT(NAME, OP) \ + static inline void emit_##NAME(union loongarch_instruction *insn, \ +diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c +index 3050329556d1..14d7d700bcb9 100644 +--- a/arch/loongarch/kernel/inst.c ++++ b/arch/loongarch/kernel/inst.c +@@ -332,7 +332,7 @@ u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm) + return INSN_BREAK; + } + +- emit_jirl(&insn, rj, rd, imm >> 2); ++ emit_jirl(&insn, rd, rj, imm >> 2); + + return insn.word; + } +diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c +index 497f8b0a5f1e..6595e992fda8 100644 +--- a/arch/loongarch/net/bpf_jit.c ++++ b/arch/loongarch/net/bpf_jit.c +@@ -181,13 +181,13 @@ static void __build_epilogue(struct jit_ctx *ctx, bool is_tail_call) + /* Set return value */ + emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0); + /* Return to the caller */ +- emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_RA, 0); + } else { + /* + * Call the next bpf prog and skip the first instruction + * of TCC initialization. + */ +- emit_insn(ctx, jirl, LOONGARCH_GPR_T3, LOONGARCH_GPR_ZERO, 1); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_T3, 1); + } + } + +@@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext + return ret; + + move_addr(ctx, t1, func_addr); +- emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0); ++ emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); + move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + break; + +-- +2.39.5 + diff --git a/queue-6.6/loongarch-fix-reserving-screen-info-memory-for-above.patch b/queue-6.6/loongarch-fix-reserving-screen-info-memory-for-above.patch new file mode 100644 index 00000000000..96f643e99f5 --- /dev/null +++ b/queue-6.6/loongarch-fix-reserving-screen-info-memory-for-above.patch @@ -0,0 +1,39 @@ +From c4ccd32490a5e310d673409306fe663eafe6b245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 16:42:07 +0800 +Subject: LoongArch: Fix reserving screen info memory for above-4G firmware + +From: Huacai Chen + +[ Upstream commit 55dc2f8f263448f1e6c7ef135d08e640d5a4826e ] + +Since screen_info.lfb_base is a __u32 type, an above-4G address need an +ext_lfb_base to present its higher 32bits. In init_screen_info() we can +use __screen_info_lfb_base() to handle this case for reserving screen +info memory. + +Signed-off-by: Xuefeng Zhao +Signed-off-by: Jianmin Lv +Signed-off-by: Tianyang Zhang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/kernel/efi.c b/arch/loongarch/kernel/efi.c +index de4f3def4af0..4ae77e9300d5 100644 +--- a/arch/loongarch/kernel/efi.c ++++ b/arch/loongarch/kernel/efi.c +@@ -90,7 +90,7 @@ static void __init init_screen_info(void) + memset(si, 0, sizeof(*si)); + early_memunmap(si, sizeof(*si)); + +- memblock_reserve(screen_info.lfb_base, screen_info.lfb_size); ++ memblock_reserve(__screen_info_lfb_base(&screen_info), screen_info.lfb_size); + } + + void __init efi_init(void) +-- +2.39.5 + diff --git a/queue-6.6/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch b/queue-6.6/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch new file mode 100644 index 00000000000..f616379530e --- /dev/null +++ b/queue-6.6/platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch @@ -0,0 +1,70 @@ +From a60392f2291eab5ad1dfe15ae5d9aa2001606266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Nov 2024 23:47:00 +0100 +Subject: platform/x86: asus-nb-wmi: Ignore unknown event 0xCF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit e9fba20c29e27dc99e55e1c550573a114561bf8c ] + +On the Asus X541UAK an unknown event 0xCF is emited when the charger +is plugged in. This is caused by the following AML code: + + If (ACPS ()) + { + ACPF = One + Local0 = 0x58 + If (ATKP) + { + ^^^^ATKD.IANE (0xCF) + } + } + Else + { + ACPF = Zero + Local0 = 0x57 + } + + Notify (AC0, 0x80) // Status Change + If (ATKP) + { + ^^^^ATKD.IANE (Local0) + } + + Sleep (0x64) + PNOT () + Sleep (0x0A) + NBAT (0x80) + +Ignore the 0xCF event to silence the unknown event warning. + +Reported-by: Pau Espin Pedrol +Closes: https://lore.kernel.org/platform-driver-x86/54d4860b-ec9c-4992-acf6-db3f90388293@espeweb.net +Signed-off-by: Armin Wolf +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241123224700.18530-1-W_Armin@gmx.de +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index af3da303e2b1..cba515ce3444 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -590,6 +590,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_IGNORE, 0xCF, }, /* AC mode */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ + { KE_END, 0}, +-- +2.39.5 + diff --git a/queue-6.6/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch b/queue-6.6/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch new file mode 100644 index 00000000000..a57c14a9d18 --- /dev/null +++ b/queue-6.6/powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch @@ -0,0 +1,155 @@ +From 560b14523c3b412442838791835eb3ab1a4f1379 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2024 21:17:58 -0800 +Subject: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct + +From: Haren Myneni + +[ Upstream commit 05aa156e156ef3168e7ab8a68721945196495c17 ] + +The mapping VMA address is saved in VAS window struct when the +paste address is mapped. This VMA address is used during migration +to unmap the paste address if the window is active. The paste +address mapping will be removed when the window is closed or with +the munmap(). But the VMA address in the VAS window is not updated +with munmap() which is causing invalid access during migration. + +The KASAN report shows: +[16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8 +[16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928 + +[16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2 +[16386.255128] Tainted: [B]=BAD_PAGE +[16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries +[16386.255181] Call Trace: +[16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable) +[16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764 +[16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8 +[16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0 +[16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8 +[16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc +[16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4 +... + +[16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s: +[16386.256149] kasan_save_stack+0x34/0x68 +[16386.256163] kasan_save_track+0x34/0x80 +[16386.256175] kasan_save_alloc_info+0x58/0x74 +[16386.256196] __kasan_slab_alloc+0xb8/0xdc +[16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0 +[16386.256225] vm_area_alloc+0x44/0x150 +[16386.256245] mmap_region+0x214/0x10c4 +[16386.256265] do_mmap+0x5fc/0x750 +[16386.256277] vm_mmap_pgoff+0x14c/0x24c +[16386.256292] ksys_mmap_pgoff+0x20c/0x348 +[16386.256303] sys_mmap+0xd0/0x160 +... + +[16386.256350] Freed by task 0 on cpu 31 at 16386.204848s: +[16386.256363] kasan_save_stack+0x34/0x68 +[16386.256374] kasan_save_track+0x34/0x80 +[16386.256384] kasan_save_free_info+0x64/0x10c +[16386.256396] __kasan_slab_free+0x120/0x204 +[16386.256415] kmem_cache_free+0x128/0x450 +[16386.256428] vm_area_free_rcu_cb+0xa8/0xd8 +[16386.256441] rcu_do_batch+0x2c8/0xcf0 +[16386.256458] rcu_core+0x378/0x3c4 +[16386.256473] handle_softirqs+0x20c/0x60c +[16386.256495] do_softirq_own_stack+0x6c/0x88 +[16386.256509] do_softirq_own_stack+0x58/0x88 +[16386.256521] __irq_exit_rcu+0x1a4/0x20c +[16386.256533] irq_exit+0x20/0x38 +[16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c +... + +[16386.256717] Last potentially related work creation: +[16386.256729] kasan_save_stack+0x34/0x68 +[16386.256741] __kasan_record_aux_stack+0xcc/0x12c +[16386.256753] __call_rcu_common.constprop.0+0x94/0xd04 +[16386.256766] vm_area_free+0x28/0x3c +[16386.256778] remove_vma+0xf4/0x114 +[16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870 +[16386.256811] __vm_munmap+0xe0/0x1f8 +[16386.256821] sys_munmap+0x54/0x6c +[16386.256830] system_call_exception+0x1a0/0x4a0 +[16386.256841] system_call_vectored_common+0x15c/0x2ec + +[16386.256868] The buggy address belongs to the object at c00000014a819670 + which belongs to the cache vm_area_struct of size 168 +[16386.256887] The buggy address is located 0 bytes inside of + freed 168-byte region [c00000014a819670, c00000014a819718) + +[16386.256915] The buggy address belongs to the physical page: +[16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81 +[16386.256950] memcg:c0000000ba430001 +[16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff) +[16386.256975] page_type: 0xfdffffff(slab) +[16386.256990] raw: 043ffff800000000 c00000000501c080 0000000000000000 5deadbee00000001 +[16386.257003] raw: 0000000000000000 00000000011a011a 00000001fdffffff c0000000ba430001 +[16386.257018] page dumped because: kasan: bad access detected + +This patch adds close() callback in vas_vm_ops vm_operations_struct +which will be executed during munmap() before freeing VMA. The VMA +address in the VAS window is set to NULL after holding the window +mmap_mutex. + +Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler") +Signed-off-by: Haren Myneni +Signed-off-by: Madhavan Srinivasan +Link: https://patch.msgid.link/20241214051758.997759-1-haren@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/book3s/vas-api.c | 36 +++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c +index f381b177ea06..0b6365d85d11 100644 +--- a/arch/powerpc/platforms/book3s/vas-api.c ++++ b/arch/powerpc/platforms/book3s/vas-api.c +@@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf) + return VM_FAULT_SIGBUS; + } + ++/* ++ * During mmap() paste address, mapping VMA is saved in VAS window ++ * struct which is used to unmap during migration if the window is ++ * still open. But the user space can remove this mapping with ++ * munmap() before closing the window and the VMA address will ++ * be invalid. Set VAS window VMA to NULL in this function which ++ * is called before VMA free. ++ */ ++static void vas_mmap_close(struct vm_area_struct *vma) ++{ ++ struct file *fp = vma->vm_file; ++ struct coproc_instance *cp_inst = fp->private_data; ++ struct vas_window *txwin; ++ ++ /* Should not happen */ ++ if (!cp_inst || !cp_inst->txwin) { ++ pr_err("No attached VAS window for the paste address mmap\n"); ++ return; ++ } ++ ++ txwin = cp_inst->txwin; ++ /* ++ * task_ref.vma is set in coproc_mmap() during mmap paste ++ * address. So it has to be the same VMA that is getting freed. ++ */ ++ if (WARN_ON(txwin->task_ref.vma != vma)) { ++ pr_err("Invalid paste address mmaping\n"); ++ return; ++ } ++ ++ mutex_lock(&txwin->task_ref.mmap_mutex); ++ txwin->task_ref.vma = NULL; ++ mutex_unlock(&txwin->task_ref.mmap_mutex); ++} ++ + static const struct vm_operations_struct vas_vm_ops = { ++ .close = vas_mmap_close, + .fault = vas_mmap_fault, + }; + +-- +2.39.5 + diff --git a/queue-6.6/regmap-use-correct-format-specifier-for-logging-rang.patch b/queue-6.6/regmap-use-correct-format-specifier-for-logging-rang.patch new file mode 100644 index 00000000000..e0f081641f0 --- /dev/null +++ b/queue-6.6/regmap-use-correct-format-specifier-for-logging-rang.patch @@ -0,0 +1,43 @@ +From 81b32bfc080cf8845e38023d8aafee042efa7a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:35:06 +0000 +Subject: regmap: Use correct format specifier for logging range errors + +From: Mark Brown + +[ Upstream commit 3f1aa0c533d9dd8a835caf9a6824449c463ee7e2 ] + +The register addresses are unsigned ints so we should use %u not %d to +log them. + +Signed-off-by: Mark Brown +Link: https://patch.msgid.link/20241127-regmap-test-high-addr-v1-1-74a48a9e0dc5@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1db04886def6..3011f7f9381b 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1062,13 +1062,13 @@ struct regmap *__regmap_init(struct device *dev, + + /* Sanity check */ + if (range_cfg->range_max < range_cfg->range_min) { +- dev_err(map->dev, "Invalid range %d: %d < %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u < %u\n", i, + range_cfg->range_max, range_cfg->range_min); + goto err_range; + } + + if (range_cfg->range_max > map->max_register) { +- dev_err(map->dev, "Invalid range %d: %d > %d\n", i, ++ dev_err(map->dev, "Invalid range %d: %u > %u\n", i, + range_cfg->range_max, map->max_register); + goto err_range; + } +-- +2.39.5 + diff --git a/queue-6.6/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch b/queue-6.6/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch new file mode 100644 index 00000000000..7610d211f6c --- /dev/null +++ b/queue-6.6/scsi-megaraid_sas-fix-for-a-potential-deadlock.patch @@ -0,0 +1,48 @@ +From d2f712ca618a85613ecc469e43eb9dcb0003be6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2024 19:48:33 +0200 +Subject: scsi: megaraid_sas: Fix for a potential deadlock + +From: Tomas Henzl + +[ Upstream commit 50740f4dc78b41dec7c8e39772619d5ba841ddd7 ] + +This fixes a 'possible circular locking dependency detected' warning + CPU0 CPU1 + ---- ---- + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + lock(&instance->reset_mutex); + lock(&shost->scan_mutex); + +Fix this by temporarily releasing the reset_mutex. + +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20240923174833.45345-1-thenzl@redhat.com +Acked-by: Chandrakanth Patil +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 3d4f13da1ae8..4cc93cb79b8b 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -8904,8 +8904,11 @@ megasas_aen_polling(struct work_struct *work) + (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), + (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL), + 0); +- if (sdev1) ++ if (sdev1) { ++ mutex_unlock(&instance->reset_mutex); + megasas_remove_scsi_device(sdev1); ++ mutex_lock(&instance->reset_mutex); ++ } + + event_type = SCAN_VD_CHANNEL; + break; +-- +2.39.5 + diff --git a/queue-6.6/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch b/queue-6.6/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch new file mode 100644 index 00000000000..acee2f99516 --- /dev/null +++ b/queue-6.6/scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch @@ -0,0 +1,53 @@ +From bb925ad20ab14ea28603b6e8036e3d05cda9ec70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2024 23:03:40 +0530 +Subject: scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during + driver load time + +From: Ranjan Kumar + +[ Upstream commit 3f5eb062e8aa335643181c480e6c590c6cedfd22 ] + +Issue a Diag-Reset when the "Doorbell-In-Use" bit is set during the +driver load/initialization. + +Signed-off-by: Ranjan Kumar +Link: https://lore.kernel.org/r/20241110173341.11595-2-ranjan.kumar@broadcom.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 8acf586dc8b2..a5d12b95fbd0 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -7050,11 +7050,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + int i; + u8 failed; + __le32 *mfp; ++ int ret_val; + + /* make sure doorbell is not in use */ + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); +- return -EFAULT; ++ goto doorbell_diag_reset; + } + + /* clear pending doorbell interrupts from previous state changes */ +@@ -7144,6 +7145,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + le32_to_cpu(mfp[i])); + } + return 0; ++ ++doorbell_diag_reset: ++ ret_val = _base_diag_reset(ioc); ++ return ret_val; + } + + /** +-- +2.39.5 + diff --git a/queue-6.6/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch b/queue-6.6/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch new file mode 100644 index 00000000000..1e969d09303 --- /dev/null +++ b/queue-6.6/scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch @@ -0,0 +1,49 @@ +From b6257d5d2c10b8d432222ba1b186987e9fecda05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 23:51:49 +0100 +Subject: scsi: qla1280: Fix hw revision numbering for ISP1020/1040 + +From: Magnus Lindholm + +[ Upstream commit c064de86d2a3909222d5996c5047f64c7a8f791b ] + +Fix the hardware revision numbering for Qlogic ISP1020/1040 boards. HWMASK +suggests that the revision number only needs four bits, this is consistent +with how NetBSD does things in their ISP driver. Verified on a IPS1040B +which is seen as rev 5 not as BIT_4. + +Signed-off-by: Magnus Lindholm +Link: https://lore.kernel.org/r/20241113225636.2276-1-linmag7@gmail.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla1280.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h +index d309e2ca14de..dea2290b37d4 100644 +--- a/drivers/scsi/qla1280.h ++++ b/drivers/scsi/qla1280.h +@@ -116,12 +116,12 @@ struct device_reg { + uint16_t id_h; /* ID high */ + uint16_t cfg_0; /* Configuration 0 */ + #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */ +-#define ISP_CFG0_1020 BIT_0 /* ISP1020 */ +-#define ISP_CFG0_1020A BIT_1 /* ISP1020A */ +-#define ISP_CFG0_1040 BIT_2 /* ISP1040 */ +-#define ISP_CFG0_1040A BIT_3 /* ISP1040A */ +-#define ISP_CFG0_1040B BIT_4 /* ISP1040B */ +-#define ISP_CFG0_1040C BIT_5 /* ISP1040C */ ++#define ISP_CFG0_1020 1 /* ISP1020 */ ++#define ISP_CFG0_1020A 2 /* ISP1020A */ ++#define ISP_CFG0_1040 3 /* ISP1040 */ ++#define ISP_CFG0_1040A 4 /* ISP1040A */ ++#define ISP_CFG0_1040B 5 /* ISP1040B */ ++#define ISP_CFG0_1040C 6 /* ISP1040C */ + uint16_t cfg_1; /* Configuration 1 */ + #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */ + #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */ +-- +2.39.5 + diff --git a/queue-6.6/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch b/queue-6.6/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch new file mode 100644 index 00000000000..1f369674e2d --- /dev/null +++ b/queue-6.6/scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch @@ -0,0 +1,72 @@ +From dcf3cb4f5cb8f1d4b8137d4087cc691374c3e026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2024 13:13:24 -0500 +Subject: scsi: storvsc: Do not flag MAINTENANCE_IN return of + SRB_STATUS_DATA_OVERRUN as an error + +From: Cathy Avery + +[ Upstream commit b1aee7f034615b6824d2c70ddb37ef9fc23493b7 ] + +This partially reverts commit 812fe6420a6e ("scsi: storvsc: Handle +additional SRB status values"). + +HyperV does not support MAINTENANCE_IN resulting in FC passthrough +returning the SRB_STATUS_DATA_OVERRUN value. Now that +SRB_STATUS_DATA_OVERRUN is treated as an error, multipath ALUA paths go +into a faulty state as multipath ALUA submits RTPG commands via +MAINTENANCE_IN. + +[ 3.215560] hv_storvsc 1d69d403-9692-4460-89f9-a8cbcc0f94f3: +tag#230 cmd 0xa3 status: scsi 0x0 srb 0x12 hv 0xc0000001 +[ 3.215572] scsi 1:0:0:32: alua: rtpg failed, result 458752 + +Make MAINTENANCE_IN return success to avoid the error path as is +currently done with INQUIRY and MODE_SENSE. + +Suggested-by: Michael Kelley +Signed-off-by: Cathy Avery +Link: https://lore.kernel.org/r/20241127181324.3318443-1-cavery@redhat.com +Reviewed-by: Michael Kelley +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 7ceb982040a5..d0b55c1fa908 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -149,6 +149,8 @@ struct hv_fc_wwn_packet { + */ + static int vmstor_proto_version; + ++static bool hv_dev_is_fc(struct hv_device *hv_dev); ++ + #define STORVSC_LOGGING_NONE 0 + #define STORVSC_LOGGING_ERROR 1 + #define STORVSC_LOGGING_WARN 2 +@@ -1138,6 +1140,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + * not correctly handle: + * INQUIRY command with page code parameter set to 0x80 + * MODE_SENSE command with cmd[2] == 0x1c ++ * MAINTENANCE_IN is not supported by HyperV FC passthrough + * + * Setup srb and scsi status so this won't be fatal. + * We do this so we can distinguish truly fatal failues +@@ -1145,7 +1148,9 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, + */ + + if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || +- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) { ++ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || ++ (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && ++ hv_dev_is_fc(device))) { + vstor_packet->vm_srb.scsi_status = 0; + vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; + } +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series index cc1e7831ddb..13d3cd69156 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -26,3 +26,26 @@ dmaengine-fsl-edma-implement-the-cleanup-path-of-fsl_edma3_attach_pd.patch dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch +powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch +stddef-make-__struct_group-uapi-c-friendly.patch +tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch +watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch +watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch +scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch +scsi-megaraid_sas-fix-for-a-potential-deadlock.patch +udf-skip-parent-dir-link-count-update-if-corrupted.patch +alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch +alsa-sh-use-standard-helper-for-buffer-accesses.patch +smb-server-fix-building-with-gcc-15.patch +regmap-use-correct-format-specifier-for-logging-rang.patch +loongarch-fix-reserving-screen-info-memory-for-above.patch +loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch +platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch +spi-intel-add-panther-lake-spi-controller-support.patch +scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch +scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch +spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch +drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch +virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch +blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch +blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch diff --git a/queue-6.6/smb-server-fix-building-with-gcc-15.patch b/queue-6.6/smb-server-fix-building-with-gcc-15.patch new file mode 100644 index 00000000000..81fa5e1cbef --- /dev/null +++ b/queue-6.6/smb-server-fix-building-with-gcc-15.patch @@ -0,0 +1,47 @@ +From 897f1261c093a3d1f0456da110528d739625c734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 11:41:35 +0530 +Subject: smb: server: Fix building with GCC 15 + +From: Brahmajit Das + +[ Upstream commit e18655cf35a5958fbf4ae9ca3ebf28871a3a1801 ] + +GCC 15 introduces -Werror=unterminated-string-initialization by default, +this results in the following build error + +fs/smb/server/smb_common.c:21:35: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-ini +tialization] + 21 | static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +To this we are replacing char basechars[43] with a character pointer +and then using strlen to get the length. + +Signed-off-by: Brahmajit Das +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/smb_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c +index 663b014b9d18..23537e1b3468 100644 +--- a/fs/smb/server/smb_common.c ++++ b/fs/smb/server/smb_common.c +@@ -18,8 +18,8 @@ + #include "mgmt/share_config.h" + + /*for shortname implementation */ +-static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; +-#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1) ++static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%"; ++#define MANGLE_BASE (strlen(basechars) - 1) + #define MAGIC_CHAR '~' + #define PERIOD '.' + #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE])) +-- +2.39.5 + diff --git a/queue-6.6/spi-intel-add-panther-lake-spi-controller-support.patch b/queue-6.6/spi-intel-add-panther-lake-spi-controller-support.patch new file mode 100644 index 00000000000..5e775e30c70 --- /dev/null +++ b/queue-6.6/spi-intel-add-panther-lake-spi-controller-support.patch @@ -0,0 +1,40 @@ +From fa6e24b34180d995e5623e11301c9e6b26aafb3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2024 10:02:08 +0200 +Subject: spi: intel: Add Panther Lake SPI controller support + +From: Aapo Vienamo + +[ Upstream commit ceb259e43bf572ba7d766e1679ba73861d16203a ] + +The Panther Lake SPI controllers are compatible with the Cannon Lake +controllers. Add support for following SPI controller device IDs: + - H-series: 0xe323 + - P-series: 0xe423 + - U-series: 0xe423 + +Signed-off-by: Aapo Vienamo +Signed-off-by: Mika Westerberg +Link: https://patch.msgid.link/20241204080208.1036537-1-mika.westerberg@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-intel-pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c +index 4337ca51d7aa..5c0dec90eec1 100644 +--- a/drivers/spi/spi-intel-pci.c ++++ b/drivers/spi/spi-intel-pci.c +@@ -86,6 +86,8 @@ static const struct pci_device_id intel_spi_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info }, + { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info }, ++ { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info }, + { }, + }; + MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids); +-- +2.39.5 + diff --git a/queue-6.6/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch b/queue-6.6/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch new file mode 100644 index 00000000000..87ecae8d4db --- /dev/null +++ b/queue-6.6/spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch @@ -0,0 +1,46 @@ +From 246fd29c8a48ebf4ca9389d032e076aca9bf20a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 12:34:26 +0530 +Subject: spi: omap2-mcspi: Fix the IS_ERR() bug for + devm_clk_get_optional_enabled() + +From: Purushothama Siddaiah + +[ Upstream commit 4c6ac5446d060f0bf435ccc8bc3aa7b7b5f718ad ] + +The devm_clk_get_optional_enabled() function returns error +pointers(PTR_ERR()). So use IS_ERR() to check it. + +Verified on K3-J7200 EVM board, without clock node mentioned +in the device tree. + +Signed-off-by: Purushothama Siddaiah +Reviewed-by: Corey Minyard +Link: https://patch.msgid.link/20241205070426.1861048-1-psiddaiah@mvista.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index ddf1c684bcc7..3cfd262c1abc 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1521,10 +1521,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev) + } + + mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL); +- if (mcspi->ref_clk) +- mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); +- else ++ if (IS_ERR(mcspi->ref_clk)) + mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ; ++ else ++ mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk); + ctlr->max_speed_hz = mcspi->ref_clk_hz; + ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15; + +-- +2.39.5 + diff --git a/queue-6.6/stddef-make-__struct_group-uapi-c-friendly.patch b/queue-6.6/stddef-make-__struct_group-uapi-c-friendly.patch new file mode 100644 index 00000000000..be8ed2ec5ed --- /dev/null +++ b/queue-6.6/stddef-make-__struct_group-uapi-c-friendly.patch @@ -0,0 +1,116 @@ +From 12707e3649a0f3ece54cae38e897b079294f646b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 14:57:34 +0100 +Subject: stddef: make __struct_group() UAPI C++-friendly + +From: Alexander Lobakin + +[ Upstream commit 724c6ce38bbaeb4b3f109b0e066d6c0ecd15446c ] + +For the most part of the C++ history, it couldn't have type +declarations inside anonymous unions for different reasons. At the +same time, __struct_group() relies on the latters, so when the @TAG +argument is not empty, C++ code doesn't want to build (even under +`extern "C"`): + +../linux/include/uapi/linux/pkt_cls.h:25:24: error: +'struct tc_u32_sel::::tc_u32_sel_hdr,' invalid; +an anonymous union may only have public non-static data members +[-fpermissive] + +The safest way to fix this without trying to switch standards (which +is impossible in UAPI anyway) etc., is to disable tag declaration +for that language. This won't break anything since for now it's not +buildable at all. +Use a separate definition for __struct_group() when __cplusplus is +defined to mitigate the error, including the version from tools/. + +Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro") +Reported-by: Christopher Ferris +Closes: https://lore.kernel.org/linux-hardening/Z1HZpe3WE5As8UAz@google.com +Suggested-by: Kees Cook # __struct_group_tag() +Signed-off-by: Alexander Lobakin +Reviewed-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/20241219135734.2130002-1-aleksander.lobakin@intel.com +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + include/uapi/linux/stddef.h | 13 ++++++++++--- + tools/include/uapi/linux/stddef.h | 15 +++++++++++---- + 2 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h +index 2ec6f35cda32..473ad86706d8 100644 +--- a/include/uapi/linux/stddef.h ++++ b/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline inline + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,13 +27,13 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ + } ATTRS + + #ifdef __cplusplus +diff --git a/tools/include/uapi/linux/stddef.h b/tools/include/uapi/linux/stddef.h +index bb6ea517efb5..c53cde425406 100644 +--- a/tools/include/uapi/linux/stddef.h ++++ b/tools/include/uapi/linux/stddef.h +@@ -8,6 +8,13 @@ + #define __always_inline __inline__ + #endif + ++/* Not all C++ standards support type declarations inside an anonymous union */ ++#ifndef __cplusplus ++#define __struct_group_tag(TAG) TAG ++#else ++#define __struct_group_tag(TAG) ++#endif ++ + /** + * __struct_group() - Create a mirrored named and anonyomous struct + * +@@ -20,14 +27,14 @@ + * and size: one anonymous and one named. The former's members can be used + * normally without sub-struct naming, and the latter can be used to + * reason about the start, end, and size of the group of struct members. +- * The named struct can also be explicitly tagged for layer reuse, as well +- * as both having struct attributes appended. ++ * The named struct can also be explicitly tagged for layer reuse (C only), ++ * as well as both having struct attributes appended. + */ + #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \ + union { \ + struct { MEMBERS } ATTRS; \ +- struct TAG { MEMBERS } ATTRS NAME; \ +- } ++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \ ++ } ATTRS + + /** + * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union +-- +2.39.5 + diff --git a/queue-6.6/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch b/queue-6.6/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch new file mode 100644 index 00000000000..4004703c378 --- /dev/null +++ b/queue-6.6/tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch @@ -0,0 +1,41 @@ +From 7ad3b21a048242b9c8c7bdd9570f0224936de14f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 09:10:55 +0900 +Subject: tracing/kprobe: Make trace_kprobe's module callback called after + jump_label update + +From: Masami Hiramatsu (Google) + +[ Upstream commit d685d55dfc86b1a4bdcec77c3c1f8a83f181264e ] + +Make sure the trace_kprobe's module notifer callback function is called +after jump_label's callback is called. Since the trace_kprobe's callback +eventually checks jump_label address during registering new kprobe on +the loading module, jump_label must be updated before this registration +happens. + +Link: https://lore.kernel.org/all/173387585556.995044.3157941002975446119.stgit@devnote2/ + +Fixes: 614243181050 ("tracing/kprobes: Support module init function probing") +Signed-off-by: Masami Hiramatsu (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 94cb09d44115..508c10414a93 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -702,7 +702,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb, + + static struct notifier_block trace_kprobe_module_nb = { + .notifier_call = trace_kprobe_module_callback, +- .priority = 1 /* Invoked after kprobe module callback */ ++ .priority = 2 /* Invoked after kprobe and jump_label module callback */ + }; + + static int count_symbols(void *data, unsigned long unused) +-- +2.39.5 + diff --git a/queue-6.6/udf-skip-parent-dir-link-count-update-if-corrupted.patch b/queue-6.6/udf-skip-parent-dir-link-count-update-if-corrupted.patch new file mode 100644 index 00000000000..a1721bcfd19 --- /dev/null +++ b/queue-6.6/udf-skip-parent-dir-link-count-update-if-corrupted.patch @@ -0,0 +1,39 @@ +From 5f5434426d4e1e3e3017bd83f1e0574519d4ae9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 12:46:00 +0100 +Subject: udf: Skip parent dir link count update if corrupted + +From: Jan Kara + +[ Upstream commit c5566903af56dd1abb092f18dcb0c770d6cd8dcb ] + +If the parent directory link count is too low (likely directory inode +corruption), just skip updating its link count as if it goes to 0 too +early it can cause unexpected issues. + +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/namei.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 605f182da42c..b3f57ad2b869 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -521,7 +521,11 @@ static int udf_rmdir(struct inode *dir, struct dentry *dentry) + inode->i_nlink); + clear_nlink(inode); + inode->i_size = 0; +- inode_dec_link_count(dir); ++ if (dir->i_nlink >= 3) ++ inode_dec_link_count(dir); ++ else ++ udf_warn(inode->i_sb, "parent dir link count too low (%u)\n", ++ dir->i_nlink); + udf_add_fid_counter(dir->i_sb, true, -1); + dir->i_mtime = inode_set_ctime_to_ts(dir, + inode_set_ctime_current(inode)); +-- +2.39.5 + diff --git a/queue-6.6/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch b/queue-6.6/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch new file mode 100644 index 00000000000..9cc402b8b7e --- /dev/null +++ b/queue-6.6/virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch @@ -0,0 +1,72 @@ +From c8491114f84b7a6436266b025c0d5c3aec53e034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2024 20:58:21 +0800 +Subject: virtio-blk: don't keep queue frozen during system suspend + +From: Ming Lei + +[ Upstream commit 7678abee0867e6b7fb89aa40f6e9f575f755fb37 ] + +Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before +deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's +PM callbacks. And the motivation is to drain inflight IOs before suspending. + +block layer's queue freeze looks very handy, but it is also easy to cause +deadlock, such as, any attempt to call into bio_queue_enter() may run into +deadlock if the queue is frozen in current context. There are all kinds +of ->suspend() called in suspend context, so keeping queue frozen in the +whole suspend context isn't one good idea. And Marek reported lockdep +warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). + +[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ + +Given the motivation is to drain in-flight IOs, it can be done by calling +freeze & unfreeze, meantime restore to previous behavior by keeping queue +quiesced during suspend. + +Cc: Yi Sun +Cc: Michael S. Tsirkin +Cc: Jason Wang +Cc: Stefan Hajnoczi +Cc: virtualization@lists.linux.dev +Reported-by: Marek Szyprowski +Signed-off-by: Ming Lei +Acked-by: Stefan Hajnoczi +Link: https://lore.kernel.org/r/20241112125821.1475793-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 997106fe73e4..65a1f1576e55 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1624,9 +1624,12 @@ static void virtblk_remove(struct virtio_device *vdev) + static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; ++ struct request_queue *q = vblk->disk->queue; + + /* Ensure no requests in virtqueues before deleting vqs. */ +- blk_mq_freeze_queue(vblk->disk->queue); ++ blk_mq_freeze_queue(q); ++ blk_mq_quiesce_queue_nowait(q); ++ blk_mq_unfreeze_queue(q); + + /* Ensure we don't receive any more interrupts */ + virtio_reset_device(vdev); +@@ -1650,8 +1653,8 @@ static int virtblk_restore(struct virtio_device *vdev) + return ret; + + virtio_device_ready(vdev); ++ blk_mq_unquiesce_queue(vblk->disk->queue); + +- blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +-- +2.39.5 + diff --git a/queue-6.6/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch b/queue-6.6/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch new file mode 100644 index 00000000000..80ea72184c4 --- /dev/null +++ b/queue-6.6/watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch @@ -0,0 +1,121 @@ +From be70d7e9272abeb9a1f42157a167395bef19083a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2024 00:34:40 -0600 +Subject: watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 + +From: James Hilliard + +[ Upstream commit 43439076383a7611300334d1357c0f8883f40816 ] + +For the watchdog timer to work properly on the QCML04 board we need to +set PWRGD enable in the Environment Controller Configuration Registers +Special Configuration Register 1 when it is not already set, this may +be the case when the watchdog is not enabled from within the BIOS. + +Signed-off-by: James Hilliard +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241025063441.3494837-1-james.hilliard1@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/it87_wdt.c | 39 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c +index 843f9f8e3917..239947df613d 100644 +--- a/drivers/watchdog/it87_wdt.c ++++ b/drivers/watchdog/it87_wdt.c +@@ -20,6 +20,8 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include ++#include + #include + #include + #include +@@ -40,6 +42,7 @@ + #define VAL 0x2f + + /* Logical device Numbers LDN */ ++#define EC 0x04 + #define GPIO 0x07 + + /* Configuration Registers and Functions */ +@@ -71,6 +74,12 @@ + #define IT8784_ID 0x8784 + #define IT8786_ID 0x8786 + ++/* Environment Controller Configuration Registers LDN=0x04 */ ++#define SCR1 0xfa ++ ++/* Environment Controller Bits SCR1 */ ++#define WDT_PWRGD 0x20 ++ + /* GPIO Configuration Registers LDN=0x07 */ + #define WDTCTRL 0x71 + #define WDTCFG 0x72 +@@ -233,6 +242,21 @@ static int wdt_set_timeout(struct watchdog_device *wdd, unsigned int t) + return ret; + } + ++enum { ++ IT87_WDT_OUTPUT_THROUGH_PWRGD = BIT(0), ++}; ++ ++static const struct dmi_system_id it87_quirks[] = { ++ { ++ /* Qotom Q30900P (IT8786) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"), ++ }, ++ .driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD, ++ }, ++ {} ++}; ++ + static const struct watchdog_info ident = { + .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING, + .firmware_version = 1, +@@ -254,8 +278,10 @@ static struct watchdog_device wdt_dev = { + + static int __init it87_wdt_init(void) + { ++ const struct dmi_system_id *dmi_id; + u8 chip_rev; + u8 ctrl; ++ int quirks = 0; + int rc; + + rc = superio_enter(); +@@ -266,6 +292,10 @@ static int __init it87_wdt_init(void) + chip_rev = superio_inb(CHIPREV) & 0x0f; + superio_exit(); + ++ dmi_id = dmi_first_match(it87_quirks); ++ if (dmi_id) ++ quirks = (long)dmi_id->driver_data; ++ + switch (chip_type) { + case IT8702_ID: + max_units = 255; +@@ -326,6 +356,15 @@ static int __init it87_wdt_init(void) + superio_outb(0x00, WDTCTRL); + } + ++ if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) { ++ superio_select(EC); ++ ctrl = superio_inb(SCR1); ++ if (!(ctrl & WDT_PWRGD)) { ++ ctrl |= WDT_PWRGD; ++ superio_outb(ctrl, SCR1); ++ } ++ } ++ + superio_exit(); + + if (timeout < 1 || timeout > max_units * 60) { +-- +2.39.5 + diff --git a/queue-6.6/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch b/queue-6.6/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch new file mode 100644 index 00000000000..fab95ff55a1 --- /dev/null +++ b/queue-6.6/watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch @@ -0,0 +1,57 @@ +From 923d50eca9ba2894a26d2adfd2930d3ff715b423 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 10:47:55 +0000 +Subject: watchdog: mediatek: Add support for MT6735 TOPRGU/WDT + +From: Yassine Oudjana + +[ Upstream commit 15ddf704f56f8c95ff74dfd1157ed8646b322fa1 ] + +Add support for the Top Reset Generation Unit/Watchdog Timer found on +MT6735. + +Signed-off-by: Yassine Oudjana +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20241106104738.195968-3-y.oudjana@protonmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/mtk_wdt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c +index 0559d9f2d97b..66bb68ceb14c 100644 +--- a/drivers/watchdog/mtk_wdt.c ++++ b/drivers/watchdog/mtk_wdt.c +@@ -10,6 +10,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -81,6 +82,10 @@ static const struct mtk_wdt_data mt2712_data = { + .toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM, + }; + ++static const struct mtk_wdt_data mt6735_data = { ++ .toprgu_sw_rst_num = MT6735_TOPRGU_RST_NUM, ++}; ++ + static const struct mtk_wdt_data mt6795_data = { + .toprgu_sw_rst_num = MT6795_TOPRGU_SW_RST_NUM, + }; +@@ -448,6 +453,7 @@ static int mtk_wdt_resume(struct device *dev) + static const struct of_device_id mtk_wdt_dt_ids[] = { + { .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data }, + { .compatible = "mediatek,mt6589-wdt" }, ++ { .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data }, + { .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data }, + { .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data }, + { .compatible = "mediatek,mt8183-wdt", .data = &mt8183_data }, +-- +2.39.5 + -- 2.47.3