diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-03-27 16:27:28 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-03-27 16:27:28 +0100 |
| commit | d4bd1db699647d6f71d0dac4af0706b178859eb9 (patch) | |
| tree | e3ee679e65e3fb9b145255e813fdaa4b9fbbcf14 | |
| parent | 0a00fee28eeacfbe5f3d5e18c94986b6f76e1d98 (diff) | |
| download | stable-queue-d4bd1db699647d6f71d0dac4af0706b178859eb9.tar.gz | |
6.6-stable patches
added patches:
alsa-hda-realtek-add-headset-mic-supported-acer-nb-platform.patch
alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch
alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook.patch
arm-imx_v6_v7_defconfig-restore-config_backlight_class_device.patch
arm64-dts-qcom-sc8280xp-x13s-limit-pcie4-link-speed.patch
drm-amd-display-handle-range-offsets-in-vrr-ranges.patch
drm-amdgpu-pm-fix-the-error-of-pwm1_enable-setting.patch
drm-i915-check-before-removing-mm-notifier.patch
drm-i915-don-t-explode-when-the-dig-port-we-don-t-have-an-aux-ch.patch
fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch
i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch
iio-accel-adxl367-fix-devid-read-after-reset.patch
iio-accel-adxl367-fix-i2c-fifo-data-register.patch
iio-imu-inv_mpu6050-fix-fifo-parsing-when-empty.patch
iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch
iio-pressure-fixes-bmp38x-and-bmp390-spi-support.patch
mei-me-add-arrow-lake-point-h-did.patch
mei-me-add-arrow-lake-point-s-did.patch
misc-fastrpc-pass-proper-arguments-to-scm-call.patch
misc-lis3lv02d_i2c-fix-regulators-getting-en-dis-abled-twice-on-suspend-resume.patch
mm-vmscan-prevent-infinite-loop-for-costly-gfp_noio-__gfp_retry_mayfail-allocations.patch
revert-tty-serial-simplify-qcom_geni_serial_send_chunk_fifo.patch
serial-8250_dw-do-not-reclock-if-already-at-correct-rate.patch
serial-port-don-t-suspend-if-the-port-is-still-busy.patch
sev-disable-sev-es-debugswap-by-default.patch
tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch
tracing-use-.flush-call-to-wake-up-readers.patch
tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch
tty-serial-imx-fix-broken-rs485.patch
usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch
usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch
usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch
usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch
vt-fix-unicode-buffer-corruption-when-deleting-characters.patch
xhci-fix-failure-to-detect-ring-expansion-need.patch
36 files changed, 2317 insertions, 0 deletions
diff --git a/queue-6.6/alsa-hda-realtek-add-headset-mic-supported-acer-nb-platform.patch b/queue-6.6/alsa-hda-realtek-add-headset-mic-supported-acer-nb-platform.patch new file mode 100644 index 0000000000..91c560087f --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-headset-mic-supported-acer-nb-platform.patch @@ -0,0 +1,31 @@ +From 34ab5bbc6e82214d7f7393eba26d164b303ebb4e Mon Sep 17 00:00:00 2001 +From: Kailang Yang <kailang@realtek.com> +Date: Fri, 1 Mar 2024 15:04:02 +0800 +Subject: ALSA: hda/realtek - Add Headset Mic supported Acer NB platform + +From: Kailang Yang <kailang@realtek.com> + +commit 34ab5bbc6e82214d7f7393eba26d164b303ebb4e upstream. + +It will be enable headset Mic for Acer NB platform. + +Signed-off-by: Kailang Yang <kailang@realtek.com> +Cc: <stable@vger.kernel.org> +Link: https://lore.kernel.org/r/fe0eb6661ca240f3b7762b5b3257710d@realtek.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10935,6 +10935,8 @@ static const struct snd_hda_pin_quirk al + * at most one tbl is allowed to define for the same vendor and same codec + */ + static const struct snd_hda_pin_quirk alc269_fallback_pin_fixup_tbl[] = { ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1025, "Acer", ALC2XX_FIXUP_HEADSET_MIC, ++ {0x19, 0x40000000}), + SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, + {0x19, 0x40000000}, + {0x1b, 0x40000000}), diff --git a/queue-6.6/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch b/queue-6.6/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch new file mode 100644 index 0000000000..bec915eec8 --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch @@ -0,0 +1,45 @@ +From d397b6e56151099cf3b1f7bfccb204a6a8591720 Mon Sep 17 00:00:00 2001 +From: Kailang Yang <kailang@realtek.com> +Date: Fri, 1 Mar 2024 15:29:50 +0800 +Subject: ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform + +From: Kailang Yang <kailang@realtek.com> + +commit d397b6e56151099cf3b1f7bfccb204a6a8591720 upstream. + +Headset Mic will no show at resume back. +This patch will fix this issue. + +Fixes: d7f32791a9fc ("ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform") +Cc: <stable@vger.kernel.org> +Signed-off-by: Kailang Yang <kailang@realtek.com> +Link: https://lore.kernel.org/r/4713d48a372e47f98bba0c6120fd8254@realtek.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11624,8 +11624,7 @@ static void alc897_hp_automute_hook(stru + + snd_hda_gen_hp_automute(codec, jack); + vref = spec->gen.hp_jack_present ? (PIN_HP | AC_PINCTL_VREF_100) : PIN_HP; +- snd_hda_codec_write(codec, 0x1b, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, +- vref); ++ snd_hda_set_pin_ctl(codec, 0x1b, vref); + } + + static void alc897_fixup_lenovo_headset_mic(struct hda_codec *codec, +@@ -11634,6 +11633,10 @@ static void alc897_fixup_lenovo_headset_ + struct alc_spec *spec = codec->spec; + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + spec->gen.hp_automute_hook = alc897_hp_automute_hook; ++ spec->no_shutup_pins = 1; ++ } ++ if (action == HDA_FIXUP_ACT_PROBE) { ++ snd_hda_set_pin_ctl_cache(codec, 0x1a, PIN_IN | AC_PINCTL_VREF_100); + } + } + diff --git a/queue-6.6/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook.patch b/queue-6.6/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook.patch new file mode 100644 index 0000000000..4c504d4beb --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook.patch @@ -0,0 +1,35 @@ +From a17bd44c0146b00fcaa692915789c16bd1fb2a81 Mon Sep 17 00:00:00 2001 +From: Andy Chi <andy.chi@canonical.com> +Date: Mon, 4 Mar 2024 21:40:32 +0800 +Subject: ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook + +From: Andy Chi <andy.chi@canonical.com> + +commit a17bd44c0146b00fcaa692915789c16bd1fb2a81 upstream. + +The HP EliteBook using ALC236 codec which using 0x02 to +control mute LED and 0x01 to control micmute LED. +Therefore, add a quirk to make it works. + +Signed-off-by: Andy Chi <andy.chi@canonical.com> +Cc: <stable@vger.kernel.org> +Link: https://lore.kernel.org/r/20240304134033.773348-1-andy.chi@canonical.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9950,6 +9950,10 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8c8a, "HP EliteBook 630", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8c8c, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8c90, "HP EliteBook 640", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8c91, "HP EliteBook 660", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8c96, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8c97, "HP ZBook", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8ca1, "HP ZBook Power", ALC236_FIXUP_HP_GPIO_LED), diff --git a/queue-6.6/arm-imx_v6_v7_defconfig-restore-config_backlight_class_device.patch b/queue-6.6/arm-imx_v6_v7_defconfig-restore-config_backlight_class_device.patch new file mode 100644 index 0000000000..91ef238b8a --- /dev/null +++ b/queue-6.6/arm-imx_v6_v7_defconfig-restore-config_backlight_class_device.patch @@ -0,0 +1,47 @@ +From 2b0a5a8a397c0ae8f8cd25e7d3857c749239ceb8 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam <festevam@denx.de> +Date: Thu, 1 Feb 2024 15:00:54 -0300 +Subject: ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE + +From: Fabio Estevam <festevam@denx.de> + +commit 2b0a5a8a397c0ae8f8cd25e7d3857c749239ceb8 upstream. + +Since commit bfac19e239a7 ("fbdev: mx3fb: Remove the driver") backlight +is no longer functional. + +The fbdev mx3fb driver used to automatically select +CONFIG_BACKLIGHT_CLASS_DEVICE. + +Now that the mx3fb driver has been removed, enable the +CONFIG_BACKLIGHT_CLASS_DEVICE option so that backlight can still work +by default. + +Tested on a imx6dl-sabresd board. + +Cc: stable@vger.kernel.org +Fixes: bfac19e239a7 ("fbdev: mx3fb: Remove the driver") +Signed-off-by: Fabio Estevam <festevam@denx.de> +Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com> +Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com> # Toradex Colibri iMX7 +Signed-off-by: Shawn Guo <shawnguo@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/arm/configs/imx_v6_v7_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 0a90583f9f01..8f9dbe8d9029 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -297,6 +297,7 @@ CONFIG_FB_MODE_HELPERS=y + CONFIG_LCD_CLASS_DEVICE=y + CONFIG_LCD_L4F00242T03=y + CONFIG_LCD_PLATFORM=y ++CONFIG_BACKLIGHT_CLASS_DEVICE=y + CONFIG_BACKLIGHT_PWM=y + CONFIG_BACKLIGHT_GPIO=y + CONFIG_FRAMEBUFFER_CONSOLE=y +-- +2.44.0 + diff --git a/queue-6.6/arm64-dts-qcom-sc8280xp-x13s-limit-pcie4-link-speed.patch b/queue-6.6/arm64-dts-qcom-sc8280xp-x13s-limit-pcie4-link-speed.patch new file mode 100644 index 0000000000..86993130b6 --- /dev/null +++ b/queue-6.6/arm64-dts-qcom-sc8280xp-x13s-limit-pcie4-link-speed.patch @@ -0,0 +1,44 @@ +From 7a1c6a8bf47b0b290c79b9cc3ba6ee68be5522e8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold <johan+linaro@kernel.org> +Date: Fri, 23 Feb 2024 16:21:19 +0100 +Subject: arm64: dts: qcom: sc8280xp-x13s: limit pcie4 link speed + +From: Johan Hovold <johan+linaro@kernel.org> + +commit 7a1c6a8bf47b0b290c79b9cc3ba6ee68be5522e8 upstream. + +Limit the WiFi PCIe link speed to Gen2 speed (500 MB/s), which is the +speed that the boot firmware has brought up the link at (and that +Windows uses). + +This is specifically needed to avoid a large amount of link errors when +restarting the link during boot (but which are currently not reported). + +This also appears to fix intermittent failures to download the ath11k +firmware during boot which can be seen when there is a longer delay +between restarting the link and loading the WiFi driver (e.g. when using +full disk encryption). + +Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller") +Cc: stable@vger.kernel.org # 6.2 +Signed-off-by: Johan Hovold <johan+linaro@kernel.org> +Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org> +Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> +Link: https://lore.kernel.org/r/20240223152124.20042-8-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson <andersson@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts ++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +@@ -721,6 +721,8 @@ + }; + + &pcie4 { ++ max-link-speed = <2>; ++ + perst-gpios = <&tlmm 141 GPIO_ACTIVE_LOW>; + wake-gpios = <&tlmm 139 GPIO_ACTIVE_LOW>; + diff --git a/queue-6.6/drm-amd-display-handle-range-offsets-in-vrr-ranges.patch b/queue-6.6/drm-amd-display-handle-range-offsets-in-vrr-ranges.patch new file mode 100644 index 0000000000..2581ec407d --- /dev/null +++ b/queue-6.6/drm-amd-display-handle-range-offsets-in-vrr-ranges.patch @@ -0,0 +1,58 @@ +From 937844d661354bf142dc1c621396fdab10ecbacc Mon Sep 17 00:00:00 2001 +From: Alex Deucher <alexander.deucher@amd.com> +Date: Wed, 28 Feb 2024 15:59:22 -0500 +Subject: drm/amd/display: handle range offsets in VRR ranges +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher <alexander.deucher@amd.com> + +commit 937844d661354bf142dc1c621396fdab10ecbacc upstream. + +Need to check the offset bits for values greater than 255. + +v2: also update amdgpu_dm_connector values. + +Suggested-by: Mano Ségransan <mano.segransan@protonmail.com> +Tested-by: Mano Ségransan <mano.segransan@protonmail.com> +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3203 +Reviewed-by: Harry Wentland <harry.wentland@amd.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -10783,14 +10783,23 @@ void amdgpu_dm_update_freesync_caps(stru + if (range->flags != 1) + continue; + +- amdgpu_dm_connector->min_vfreq = range->min_vfreq; +- amdgpu_dm_connector->max_vfreq = range->max_vfreq; +- amdgpu_dm_connector->pixel_clock_mhz = +- range->pixel_clock_mhz * 10; +- + connector->display_info.monitor_range.min_vfreq = range->min_vfreq; + connector->display_info.monitor_range.max_vfreq = range->max_vfreq; + ++ if (edid->revision >= 4) { ++ if (data->pad2 & DRM_EDID_RANGE_OFFSET_MIN_VFREQ) ++ connector->display_info.monitor_range.min_vfreq += 255; ++ if (data->pad2 & DRM_EDID_RANGE_OFFSET_MAX_VFREQ) ++ connector->display_info.monitor_range.max_vfreq += 255; ++ } ++ ++ amdgpu_dm_connector->min_vfreq = ++ connector->display_info.monitor_range.min_vfreq; ++ amdgpu_dm_connector->max_vfreq = ++ connector->display_info.monitor_range.max_vfreq; ++ amdgpu_dm_connector->pixel_clock_mhz = ++ range->pixel_clock_mhz * 10; ++ + break; + } + diff --git a/queue-6.6/drm-amdgpu-pm-fix-the-error-of-pwm1_enable-setting.patch b/queue-6.6/drm-amdgpu-pm-fix-the-error-of-pwm1_enable-setting.patch new file mode 100644 index 0000000000..39f714a867 --- /dev/null +++ b/queue-6.6/drm-amdgpu-pm-fix-the-error-of-pwm1_enable-setting.patch @@ -0,0 +1,55 @@ +From 0dafaf659cc463f2db0af92003313a8bc46781cd Mon Sep 17 00:00:00 2001 +From: Ma Jun <Jun.Ma2@amd.com> +Date: Fri, 1 Mar 2024 15:36:58 +0800 +Subject: drm/amdgpu/pm: Fix the error of pwm1_enable setting + +From: Ma Jun <Jun.Ma2@amd.com> + +commit 0dafaf659cc463f2db0af92003313a8bc46781cd upstream. + +Fix the pwm_mode value error which used for +pwm1_enable setting + +Signed-off-by: Ma Jun <Jun.Ma2@amd.com> +Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -2395,6 +2395,7 @@ static ssize_t amdgpu_hwmon_set_pwm1_ena + { + struct amdgpu_device *adev = dev_get_drvdata(dev); + int err, ret; ++ u32 pwm_mode; + int value; + + if (amdgpu_in_reset(adev)) +@@ -2406,13 +2407,22 @@ static ssize_t amdgpu_hwmon_set_pwm1_ena + if (err) + return err; + ++ if (value == 0) ++ pwm_mode = AMD_FAN_CTRL_NONE; ++ else if (value == 1) ++ pwm_mode = AMD_FAN_CTRL_MANUAL; ++ else if (value == 2) ++ pwm_mode = AMD_FAN_CTRL_AUTO; ++ else ++ return -EINVAL; ++ + ret = pm_runtime_get_sync(adev_to_drm(adev)->dev); + if (ret < 0) { + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); + return ret; + } + +- ret = amdgpu_dpm_set_fan_control_mode(adev, value); ++ ret = amdgpu_dpm_set_fan_control_mode(adev, pwm_mode); + + pm_runtime_mark_last_busy(adev_to_drm(adev)->dev); + pm_runtime_put_autosuspend(adev_to_drm(adev)->dev); diff --git a/queue-6.6/drm-i915-check-before-removing-mm-notifier.patch b/queue-6.6/drm-i915-check-before-removing-mm-notifier.patch new file mode 100644 index 0000000000..3692e5c800 --- /dev/null +++ b/queue-6.6/drm-i915-check-before-removing-mm-notifier.patch @@ -0,0 +1,40 @@ +From 01bb1ae35006e473138c90711bad1a6b614a1823 Mon Sep 17 00:00:00 2001 +From: Nirmoy Das <nirmoy.das@intel.com> +Date: Mon, 19 Feb 2024 13:50:47 +0100 +Subject: drm/i915: Check before removing mm notifier + +From: Nirmoy Das <nirmoy.das@intel.com> + +commit 01bb1ae35006e473138c90711bad1a6b614a1823 upstream. + +Error in mmu_interval_notifier_insert() can leave a NULL +notifier.mm pointer. Catch that and return early. + +Fixes: ed29c2691188 ("drm/i915: Fix userptr so we do not have to worry about obj->mm.lock, v7.") +Cc: <stable@vger.kernel.org> # v5.13+ +[tursulin: Added Fixes and cc stable.] +Cc: Andi Shyti <andi.shyti@linux.intel.com> +Cc: Shawn Lee <shawn.c.lee@intel.com> +Signed-off-by: Nirmoy Das <nirmoy.das@intel.com> +Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20240219125047.28906-1-nirmoy.das@intel.com +Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +(cherry picked from commit db7bbd13f08774cde0332c705f042e327fe21e73) +Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c +@@ -379,6 +379,9 @@ i915_gem_userptr_release(struct drm_i915 + { + GEM_WARN_ON(obj->userptr.page_ref); + ++ if (!obj->userptr.notifier.mm) ++ return; ++ + mmu_interval_notifier_remove(&obj->userptr.notifier); + obj->userptr.notifier.mm = NULL; + } diff --git a/queue-6.6/drm-i915-don-t-explode-when-the-dig-port-we-don-t-have-an-aux-ch.patch b/queue-6.6/drm-i915-don-t-explode-when-the-dig-port-we-don-t-have-an-aux-ch.patch new file mode 100644 index 0000000000..e009991e0d --- /dev/null +++ b/queue-6.6/drm-i915-don-t-explode-when-the-dig-port-we-don-t-have-an-aux-ch.patch @@ -0,0 +1,100 @@ +From 0b385be4c3ccd5636441923d7cad5eda6b4651cb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com> +Date: Fri, 23 Feb 2024 22:32:15 +0200 +Subject: drm/i915: Don't explode when the dig port we don't have an AUX CH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä <ville.syrjala@linux.intel.com> + +commit 0b385be4c3ccd5636441923d7cad5eda6b4651cb upstream. + +The icl+ power well code currently assumes that every AUX power +well maps to an encoder which is using said power well. That is +by no menas guaranteed as we: +- only register encoders for ports declared in the VBT +- combo PHY HDMI-only encoder no longer get an AUX CH since + commit 9856308c94ca ("drm/i915: Only populate aux_ch if really needed") + +However we have places such as intel_power_domains_sanitize_state() +that blindly traverse all the possible power wells. So these bits +of code may very well encounbter an aux power well with no associated +encoder. + +In this particular case the BIOS seems to have left one AUX power +well enabled even though we're dealing with a HDMI only encoder +on a combo PHY. We then proceed to turn off said power well and +explode when we can't find a matching encoder. As a short term fix +we should be able to just skip the PHY related parts of the power +well programming since we know this situation can only happen with +combo PHYs. + +Another option might be to go back to always picking an AUX CH for +all encoders. However I'm a bit wary about that since we might in +theory end up conflicting with the VBT AUX CH assignment. Also +that wouldn't help with encoders not declared in the VBT, should +we ever need to poke the corresponding power wells. + +Longer term we need to figure out what the actual relationship +is between the PHY vs. AUX CH vs. AUX power well. Currently this +is entirely unclear. + +Cc: stable@vger.kernel.org +Fixes: 9856308c94ca ("drm/i915: Only populate aux_ch if really needed") +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10184 +Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20240223203216.15210-1-ville.syrjala@linux.intel.com +Reviewed-by: Imre Deak <imre.deak@intel.com> +(cherry picked from commit 6a8c66bf0e565c34ad0a18f820e0bb17951f7f91) +Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + .../drm/i915/display/intel_display_power_well.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display_power_well.c b/drivers/gpu/drm/i915/display/intel_display_power_well.c +index 47cd6bb04366..06900ff307b2 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_power_well.c ++++ b/drivers/gpu/drm/i915/display/intel_display_power_well.c +@@ -246,7 +246,14 @@ static enum phy icl_aux_pw_to_phy(struct drm_i915_private *i915, + enum aux_ch aux_ch = icl_aux_pw_to_ch(power_well); + struct intel_digital_port *dig_port = aux_ch_to_digital_port(i915, aux_ch); + +- return intel_port_to_phy(i915, dig_port->base.port); ++ /* ++ * FIXME should we care about the (VBT defined) dig_port->aux_ch ++ * relationship or should this be purely defined by the hardware layout? ++ * Currently if the port doesn't appear in the VBT, or if it's declared ++ * as HDMI-only and routed to a combo PHY, the encoder either won't be ++ * present at all or it will not have an aux_ch assigned. ++ */ ++ return dig_port ? intel_port_to_phy(i915, dig_port->base.port) : PHY_NONE; + } + + static void hsw_wait_for_power_well_enable(struct drm_i915_private *dev_priv, +@@ -414,7 +421,8 @@ icl_combo_phy_aux_power_well_enable(struct drm_i915_private *dev_priv, + + intel_de_rmw(dev_priv, regs->driver, 0, HSW_PWR_WELL_CTL_REQ(pw_idx)); + +- if (DISPLAY_VER(dev_priv) < 12) ++ /* FIXME this is a mess */ ++ if (phy != PHY_NONE) + intel_de_rmw(dev_priv, ICL_PORT_CL_DW12(phy), + 0, ICL_LANE_ENABLE_AUX); + +@@ -437,7 +445,10 @@ icl_combo_phy_aux_power_well_disable(struct drm_i915_private *dev_priv, + + drm_WARN_ON(&dev_priv->drm, !IS_ICELAKE(dev_priv)); + +- intel_de_rmw(dev_priv, ICL_PORT_CL_DW12(phy), ICL_LANE_ENABLE_AUX, 0); ++ /* FIXME this is a mess */ ++ if (phy != PHY_NONE) ++ intel_de_rmw(dev_priv, ICL_PORT_CL_DW12(phy), ++ ICL_LANE_ENABLE_AUX, 0); + + intel_de_rmw(dev_priv, regs->driver, HSW_PWR_WELL_CTL_REQ(pw_idx), 0); + +-- +2.44.0 + diff --git a/queue-6.6/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch b/queue-6.6/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch new file mode 100644 index 0000000000..88f0cbf466 --- /dev/null +++ b/queue-6.6/fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch @@ -0,0 +1,63 @@ +From 961ebd120565cb60cebe21cb634fbc456022db4a Mon Sep 17 00:00:00 2001 +From: Bart Van Assche <bvanassche@acm.org> +Date: Mon, 4 Mar 2024 15:57:15 -0800 +Subject: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion + +From: Bart Van Assche <bvanassche@acm.org> + +commit 961ebd120565cb60cebe21cb634fbc456022db4a upstream. + +The first kiocb_set_cancel_fn() argument may point at a struct kiocb +that is not embedded inside struct aio_kiocb. With the current code, +depending on the compiler, the req->ki_ctx read happens either before +the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such +that it is guaranteed that the IOCB_AIO_RW test happens first. + +Reported-by: Eric Biggers <ebiggers@kernel.org> +Cc: Benjamin LaHaise <ben@communityfibre.ca> +Cc: Eric Biggers <ebiggers@google.com> +Cc: Christoph Hellwig <hch@lst.de> +Cc: Avi Kivity <avi@scylladb.com> +Cc: Sandeep Dhavale <dhavale@google.com> +Cc: Jens Axboe <axboe@kernel.dk> +Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Cc: Kent Overstreet <kent.overstreet@linux.dev> +Cc: stable@vger.kernel.org +Fixes: b820de741ae4 ("fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio") +Signed-off-by: Bart Van Assche <bvanassche@acm.org> +Link: https://lore.kernel.org/r/20240304235715.3790858-1-bvanassche@acm.org +Reviewed-by: Jens Axboe <axboe@kernel.dk> +Reviewed-by: Eric Biggers <ebiggers@google.com> +Signed-off-by: Christian Brauner <brauner@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + fs/aio.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -590,8 +590,8 @@ static int aio_setup_ring(struct kioctx + + void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel) + { +- struct aio_kiocb *req = container_of(iocb, struct aio_kiocb, rw); +- struct kioctx *ctx = req->ki_ctx; ++ struct aio_kiocb *req; ++ struct kioctx *ctx; + unsigned long flags; + + /* +@@ -601,9 +601,13 @@ void kiocb_set_cancel_fn(struct kiocb *i + if (!(iocb->ki_flags & IOCB_AIO_RW)) + return; + ++ req = container_of(iocb, struct aio_kiocb, rw); ++ + if (WARN_ON_ONCE(!list_empty(&req->ki_list))) + return; + ++ ctx = req->ki_ctx; ++ + spin_lock_irqsave(&ctx->ctx_lock, flags); + list_add_tail(&req->ki_list, &ctx->active_reqs); + req->ki_cancel = cancel; diff --git a/queue-6.6/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch b/queue-6.6/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch new file mode 100644 index 0000000000..9929fe08c8 --- /dev/null +++ b/queue-6.6/i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch @@ -0,0 +1,48 @@ +From ceb013b2d9a2946035de5e1827624edc85ae9484 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit <hkallweit1@gmail.com> +Date: Mon, 4 Mar 2024 21:31:06 +0100 +Subject: i2c: i801: Avoid potential double call to gpiod_remove_lookup_table + +From: Heiner Kallweit <hkallweit1@gmail.com> + +commit ceb013b2d9a2946035de5e1827624edc85ae9484 upstream. + +If registering the platform device fails, the lookup table is +removed in the error path. On module removal we would try to +remove the lookup table again. Fix this by setting priv->lookup +only if registering the platform device was successful. +In addition free the memory allocated for the lookup table in +the error path. + +Fixes: d308dfbf62ef ("i2c: mux/i801: Switch to use descriptor passing") +Cc: stable@vger.kernel.org +Reviewed-by: Andi Shyti <andi.shyti@kernel.org> +Reviewed-by: Linus Walleij <linus.walleij@linaro.org> +Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> +Signed-off-by: Andi Shyti <andi.shyti@kernel.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/i2c/busses/i2c-i801.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1417,7 +1417,6 @@ static void i801_add_mux(struct i801_pri + lookup->table[i] = GPIO_LOOKUP(mux_config->gpio_chip, + mux_config->gpios[i], "mux", 0); + gpiod_add_lookup_table(lookup); +- priv->lookup = lookup; + + /* + * Register the mux device, we use PLATFORM_DEVID_NONE here +@@ -1431,7 +1430,10 @@ static void i801_add_mux(struct i801_pri + sizeof(struct i2c_mux_gpio_platform_data)); + if (IS_ERR(priv->mux_pdev)) { + gpiod_remove_lookup_table(lookup); ++ devm_kfree(dev, lookup); + dev_err(dev, "Failed to register i2c-mux-gpio device\n"); ++ } else { ++ priv->lookup = lookup; + } + } + diff --git a/queue-6.6/iio-accel-adxl367-fix-devid-read-after-reset.patch b/queue-6.6/iio-accel-adxl367-fix-devid-read-after-reset.patch new file mode 100644 index 0000000000..ec34585caf --- /dev/null +++ b/queue-6.6/iio-accel-adxl367-fix-devid-read-after-reset.patch @@ -0,0 +1,55 @@ +From 1b926914bbe4e30cb32f268893ef7d82a85275b8 Mon Sep 17 00:00:00 2001 +From: Cosmin Tanislav <demonsingur@gmail.com> +Date: Wed, 7 Feb 2024 05:36:50 +0200 +Subject: iio: accel: adxl367: fix DEVID read after reset + +From: Cosmin Tanislav <demonsingur@gmail.com> + +commit 1b926914bbe4e30cb32f268893ef7d82a85275b8 upstream. + +regmap_read_poll_timeout() will not sleep before reading, +causing the first read to return -ENXIO on I2C, since the +chip does not respond to it while it is being reset. + +The datasheet specifies that a soft reset operation has a +latency of 7.5ms. + +Add a 15ms sleep between reset and reading the DEVID register, +and switch to a simple regmap_read() call. + +Fixes: cbab791c5e2a ("iio: accel: add ADXL367 driver") +Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com> +Reviewed-by: Nuno Sa <nuno.sa@analog.com> +Link: https://lore.kernel.org/r/20240207033657.206171-1-demonsingur@gmail.com +Cc: <Stable@vger.kernel.org> +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/iio/accel/adxl367.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/adxl367.c ++++ b/drivers/iio/accel/adxl367.c +@@ -1429,9 +1429,11 @@ static int adxl367_verify_devid(struct a + unsigned int val; + int ret; + +- ret = regmap_read_poll_timeout(st->regmap, ADXL367_REG_DEVID, val, +- val == ADXL367_DEVID_AD, 1000, 10000); ++ ret = regmap_read(st->regmap, ADXL367_REG_DEVID, &val); + if (ret) ++ return dev_err_probe(st->dev, ret, "Failed to read dev id\n"); ++ ++ if (val != ADXL367_DEVID_AD) + return dev_err_probe(st->dev, -ENODEV, + "Invalid dev id 0x%02X, expected 0x%02X\n", + val, ADXL367_DEVID_AD); +@@ -1510,6 +1512,8 @@ int adxl367_probe(struct device *dev, co + if (ret) + return ret; + ++ fsleep(15000); ++ + ret = adxl367_verify_devid(st); + if (ret) + return ret; diff --git a/queue-6.6/iio-accel-adxl367-fix-i2c-fifo-data-register.patch b/queue-6.6/iio-accel-adxl367-fix-i2c-fifo-data-register.patch new file mode 100644 index 0000000000..5c73bbf607 --- /dev/null +++ b/queue-6.6/iio-accel-adxl367-fix-i2c-fifo-data-register.patch @@ -0,0 +1,37 @@ +From 11dadb631007324c7a8bcb2650eda88ed2b9eed0 Mon Sep 17 00:00:00 2001 +From: Cosmin Tanislav <demonsingur@gmail.com> +Date: Wed, 7 Feb 2024 05:36:51 +0200 +Subject: iio: accel: adxl367: fix I2C FIFO data register + +From: Cosmin Tanislav <demonsingur@gmail.com> + +commit 11dadb631007324c7a8bcb2650eda88ed2b9eed0 upstream. + +As specified in the datasheet, the I2C FIFO data register is +0x18, not 0x42. 0x42 was used by mistake when adapting the +ADXL372 driver. + +Fix this mistake. + +Fixes: cbab791c5e2a ("iio: accel: add ADXL367 driver") +Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com> +Reviewed-by: Nuno Sa <nuno.sa@analog.com> +Link: https://lore.kernel.org/r/20240207033657.206171-2-demonsingur@gmail.com +Cc: <Stable@vger.kernel.org> +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/iio/accel/adxl367_i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/adxl367_i2c.c ++++ b/drivers/iio/accel/adxl367_i2c.c +@@ -11,7 +11,7 @@ + + #include "adxl367.h" + +-#define ADXL367_I2C_FIFO_DATA 0x42 ++#define ADXL367_I2C_FIFO_DATA 0x18 + + struct adxl367_i2c_state { + struct regmap *regmap; diff --git a/queue-6.6/iio-imu-inv_mpu6050-fix-fifo-parsing-when-empty.patch b/queue-6.6/iio-imu-inv_mpu6050-fix-fifo-parsing-when-empty.patch new file mode 100644 index 0000000000..c083f82a2d --- /dev/null +++ b/queue-6.6/iio-imu-inv_mpu6050-fix-fifo-parsing-when-empty.patch @@ -0,0 +1,40 @@ +From 60caa8b33bd682a9ed99d1fc3f91d74e1acc9922 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> +Date: Mon, 19 Feb 2024 15:48:25 +0000 +Subject: iio: imu: inv_mpu6050: fix FIFO parsing when empty + +From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> + +commit 60caa8b33bd682a9ed99d1fc3f91d74e1acc9922 upstream. + +Now that we are reading the full FIFO in the interrupt handler, +it is possible to have an emply FIFO since we are still receiving +1 interrupt per data. Handle correctly this case instead of having +an error causing a reset of the FIFO. + +Fixes: 0829edc43e0a ("iio: imu: inv_mpu6050: read the full fifo when processing data") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> +Link: https://lore.kernel.org/r/20240219154825.90656-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c +index 66d4ba088e70..d4f9b5d8d28d 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c +@@ -109,6 +109,8 @@ irqreturn_t inv_mpu6050_read_fifo(int irq, void *p) + /* compute and process only all complete datum */ + nb = fifo_count / bytes_per_datum; + fifo_count = nb * bytes_per_datum; ++ if (nb == 0) ++ goto end_session; + /* Each FIFO data contains all sensors, so same number for FIFO and sensor data */ + fifo_period = NSEC_PER_SEC / INV_MPU6050_DIVIDER_TO_FIFO_RATE(st->chip_config.divider); + inv_sensors_timestamp_interrupt(&st->timestamp, fifo_period, nb, nb, pf->timestamp); +-- +2.44.0 + diff --git a/queue-6.6/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch b/queue-6.6/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch new file mode 100644 index 0000000000..956a527c63 --- /dev/null +++ b/queue-6.6/iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch @@ -0,0 +1,50 @@ +From daec424cc57b33a28f8621eb7ac85f8bd327bd6b Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> +Date: Mon, 19 Feb 2024 15:47:41 +0000 +Subject: iio: imu: inv_mpu6050: fix frequency setting when chip is off + +From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> + +commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream. + +Track correctly FIFO state and apply ODR change before starting +the chip. Without the fix, you cannot change ODR more than 1 time +when data buffering is off. This restriction on a single pending ODR +change should only apply when the FIFO is on. + +Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com> +Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +index 676704f9151f..e6e6e94452a3 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c +@@ -111,6 +111,7 @@ int inv_mpu6050_prepare_fifo(struct inv_mpu6050_state *st, bool enable) + if (enable) { + /* reset timestamping */ + inv_sensors_timestamp_reset(&st->timestamp); ++ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0); + /* reset FIFO */ + d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST; + ret = regmap_write(st->map, st->reg->user_ctrl, d); +@@ -184,6 +185,10 @@ static int inv_mpu6050_set_enable(struct iio_dev *indio_dev, bool enable) + if (result) + goto error_power_off; + } else { ++ st->chip_config.gyro_fifo_enable = 0; ++ st->chip_config.accl_fifo_enable = 0; ++ st->chip_config.temp_fifo_enable = 0; ++ st->chip_config.magn_fifo_enable = 0; + result = inv_mpu6050_prepare_fifo(st, false); + if (result) + goto error_power_off; +-- +2.44.0 + diff --git a/queue-6.6/iio-pressure-fixes-bmp38x-and-bmp390-spi-support.patch b/queue-6.6/iio-pressure-fixes-bmp38x-and-bmp390-spi-support.patch new file mode 100644 index 0000000000..f5ccf0151e --- /dev/null +++ b/queue-6.6/iio-pressure-fixes-bmp38x-and-bmp390-spi-support.patch @@ -0,0 +1,111 @@ +From a9dd9ba323114f366eb07f1d9630822f8df6cbb2 Mon Sep 17 00:00:00 2001 +From: Vasileios Amoiridis <vassilisamir@gmail.com> +Date: Mon, 19 Feb 2024 20:13:59 +0100 +Subject: iio: pressure: Fixes BMP38x and BMP390 SPI support + +From: Vasileios Amoiridis <vassilisamir@gmail.com> + +commit a9dd9ba323114f366eb07f1d9630822f8df6cbb2 upstream. + +According to the datasheet of BMP38x and BMP390 devices, for an SPI +read operation the first byte that is returned needs to be dropped, +and the rest of the bytes are the actual data returned from the +sensor. + +Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> +Fixes: 8d329309184d ("iio: pressure: bmp280: Add support for BMP380 sensor family") +Signed-off-by: Vasileios Amoiridis <vassilisamir@gmail.com> +Acked-by: Angel Iglesias <ang.iglesiasg@gmail.com> +Link: https://lore.kernel.org/r/20240219191359.18367-1-vassilisamir@gmail.com +Cc: <Stable@vger.kernel.org> +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/iio/pressure/bmp280-spi.c | 50 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 49 insertions(+), 1 deletion(-) + +--- a/drivers/iio/pressure/bmp280-spi.c ++++ b/drivers/iio/pressure/bmp280-spi.c +@@ -4,6 +4,7 @@ + * + * Inspired by the older BMP085 driver drivers/misc/bmp085-spi.c + */ ++#include <linux/bits.h> + #include <linux/module.h> + #include <linux/spi/spi.h> + #include <linux/err.h> +@@ -37,6 +38,34 @@ static int bmp280_regmap_spi_read(void * + return spi_write_then_read(spi, reg, reg_size, val, val_size); + } + ++static int bmp380_regmap_spi_read(void *context, const void *reg, ++ size_t reg_size, void *val, size_t val_size) ++{ ++ struct spi_device *spi = to_spi_device(context); ++ u8 rx_buf[4]; ++ ssize_t status; ++ ++ /* ++ * Maximum number of consecutive bytes read for a temperature or ++ * pressure measurement is 3. ++ */ ++ if (val_size > 3) ++ return -EINVAL; ++ ++ /* ++ * According to the BMP3xx datasheets, for a basic SPI read opertion, ++ * the first byte needs to be dropped and the rest are the requested ++ * data. ++ */ ++ status = spi_write_then_read(spi, reg, 1, rx_buf, val_size + 1); ++ if (status) ++ return status; ++ ++ memcpy(val, rx_buf + 1, val_size); ++ ++ return 0; ++} ++ + static struct regmap_bus bmp280_regmap_bus = { + .write = bmp280_regmap_spi_write, + .read = bmp280_regmap_spi_read, +@@ -44,10 +73,19 @@ static struct regmap_bus bmp280_regmap_b + .val_format_endian_default = REGMAP_ENDIAN_BIG, + }; + ++static struct regmap_bus bmp380_regmap_bus = { ++ .write = bmp280_regmap_spi_write, ++ .read = bmp380_regmap_spi_read, ++ .read_flag_mask = BIT(7), ++ .reg_format_endian_default = REGMAP_ENDIAN_BIG, ++ .val_format_endian_default = REGMAP_ENDIAN_BIG, ++}; ++ + static int bmp280_spi_probe(struct spi_device *spi) + { + const struct spi_device_id *id = spi_get_device_id(spi); + const struct bmp280_chip_info *chip_info; ++ struct regmap_bus *bmp_regmap_bus; + struct regmap *regmap; + int ret; + +@@ -62,8 +100,18 @@ static int bmp280_spi_probe(struct spi_d + if (!chip_info) + chip_info = (const struct bmp280_chip_info *) id->driver_data; + ++ switch (chip_info->chip_id[0]) { ++ case BMP380_CHIP_ID: ++ case BMP390_CHIP_ID: ++ bmp_regmap_bus = &bmp380_regmap_bus; ++ break; ++ default: ++ bmp_regmap_bus = &bmp280_regmap_bus; ++ break; ++ } ++ + regmap = devm_regmap_init(&spi->dev, +- &bmp280_regmap_bus, ++ bmp_regmap_bus, + &spi->dev, + chip_info->regmap_config); + if (IS_ERR(regmap)) { diff --git a/queue-6.6/mei-me-add-arrow-lake-point-h-did.patch b/queue-6.6/mei-me-add-arrow-lake-point-h-did.patch new file mode 100644 index 0000000000..081356fd74 --- /dev/null +++ b/queue-6.6/mei-me-add-arrow-lake-point-h-did.patch @@ -0,0 +1,41 @@ +From 8436f25802ec028ac7254990893f3e01926d9b79 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin <alexander.usyskin@intel.com> +Date: Sun, 11 Feb 2024 12:39:12 +0200 +Subject: mei: me: add arrow lake point H DID + +From: Alexander Usyskin <alexander.usyskin@intel.com> + +commit 8436f25802ec028ac7254990893f3e01926d9b79 upstream. + +Add Arrow Lake H device id. + +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> +Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> +Link: https://lore.kernel.org/r/20240211103912.117105-2-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/misc/mei/hw-me-regs.h | 1 + + drivers/misc/mei/pci-me.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -113,6 +113,7 @@ + + #define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */ + #define MEI_DEV_ID_ARL_S 0x7F68 /* Arrow Lake Point S */ ++#define MEI_DEV_ID_ARL_H 0x7770 /* Arrow Lake Point H */ + + /* + * MEI HW Section +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -120,6 +120,7 @@ static const struct pci_device_id mei_me + + {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_H, MEI_ME_PCH15_CFG)}, + + /* required last entry */ + {0, } diff --git a/queue-6.6/mei-me-add-arrow-lake-point-s-did.patch b/queue-6.6/mei-me-add-arrow-lake-point-s-did.patch new file mode 100644 index 0000000000..29cef928fd --- /dev/null +++ b/queue-6.6/mei-me-add-arrow-lake-point-s-did.patch @@ -0,0 +1,41 @@ +From 7a9b9012043e126f6d6f4683e67409312d1b707b Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin <alexander.usyskin@intel.com> +Date: Sun, 11 Feb 2024 12:39:11 +0200 +Subject: mei: me: add arrow lake point S DID + +From: Alexander Usyskin <alexander.usyskin@intel.com> + +commit 7a9b9012043e126f6d6f4683e67409312d1b707b upstream. + +Add Arrow Lake S device id. + +Cc: stable@vger.kernel.org +Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com> +Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> +Link: https://lore.kernel.org/r/20240211103912.117105-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/misc/mei/hw-me-regs.h | 1 + + drivers/misc/mei/pci-me.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -112,6 +112,7 @@ + #define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */ + + #define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */ ++#define MEI_DEV_ID_ARL_S 0x7F68 /* Arrow Lake Point S */ + + /* + * MEI HW Section +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -119,6 +119,7 @@ static const struct pci_device_id mei_me + {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)}, + + /* required last entry */ + {0, } diff --git a/queue-6.6/misc-fastrpc-pass-proper-arguments-to-scm-call.patch b/queue-6.6/misc-fastrpc-pass-proper-arguments-to-scm-call.patch new file mode 100644 index 0000000000..fcbdf67d38 --- /dev/null +++ b/queue-6.6/misc-fastrpc-pass-proper-arguments-to-scm-call.patch @@ -0,0 +1,73 @@ +From a283d7f179ff83976af27bcc71f7474cb4d7c348 Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta <quic_ekangupt@quicinc.com> +Date: Sat, 24 Feb 2024 11:42:47 +0000 +Subject: misc: fastrpc: Pass proper arguments to scm call + +From: Ekansh Gupta <quic_ekangupt@quicinc.com> + +commit a283d7f179ff83976af27bcc71f7474cb4d7c348 upstream. + +For CMA memory allocation, ownership is assigned to DSP to make it +accessible by the PD running on the DSP. With current implementation +HLOS VM is stored in the channel structure during rpmsg_probe and +this VM is passed to qcom_scm call as the source VM. + +The qcom_scm call will overwrite the passed source VM with the next +VM which would cause a problem in case the scm call is again needed. +Adding a local copy of source VM whereever scm call is made to avoid +this problem. + +Fixes: 0871561055e6 ("misc: fastrpc: Add support for audiopd") +Cc: stable <stable@kernel.org> +Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com> +Reviewed-by: Elliot Berman <quic_eberman@quicinc.com> +Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> +Link: https://lore.kernel.org/r/20240224114247.85953-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/misc/fastrpc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -263,7 +263,6 @@ struct fastrpc_channel_ctx { + int domain_id; + int sesscount; + int vmcount; +- u64 perms; + struct qcom_scm_vmperm vmperms[FASTRPC_MAX_VMIDS]; + struct rpmsg_device *rpdev; + struct fastrpc_session_ctx session[FASTRPC_MAX_SESSIONS]; +@@ -1279,9 +1278,11 @@ static int fastrpc_init_create_static_pr + + /* Map if we have any heap VMIDs associated with this ADSP Static Process. */ + if (fl->cctx->vmcount) { ++ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); ++ + err = qcom_scm_assign_mem(fl->cctx->remote_heap->phys, + (u64)fl->cctx->remote_heap->size, +- &fl->cctx->perms, ++ &src_perms, + fl->cctx->vmperms, fl->cctx->vmcount); + if (err) { + dev_err(fl->sctx->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d", +@@ -1915,8 +1916,10 @@ static int fastrpc_req_mmap(struct fastr + + /* Add memory to static PD pool, protection thru hypervisor */ + if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) { ++ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS); ++ + err = qcom_scm_assign_mem(buf->phys, (u64)buf->size, +- &fl->cctx->perms, fl->cctx->vmperms, fl->cctx->vmcount); ++ &src_perms, fl->cctx->vmperms, fl->cctx->vmcount); + if (err) { + dev_err(fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d", + buf->phys, buf->size, err); +@@ -2290,7 +2293,6 @@ static int fastrpc_rpmsg_probe(struct rp + + if (vmcount) { + data->vmcount = vmcount; +- data->perms = BIT(QCOM_SCM_VMID_HLOS); + for (i = 0; i < data->vmcount; i++) { + data->vmperms[i].vmid = vmids[i]; + data->vmperms[i].perm = QCOM_SCM_PERM_RWX; diff --git a/queue-6.6/misc-lis3lv02d_i2c-fix-regulators-getting-en-dis-abled-twice-on-suspend-resume.patch b/queue-6.6/misc-lis3lv02d_i2c-fix-regulators-getting-en-dis-abled-twice-on-suspend-resume.patch new file mode 100644 index 0000000000..709e4e4a9a --- /dev/null +++ b/queue-6.6/misc-lis3lv02d_i2c-fix-regulators-getting-en-dis-abled-twice-on-suspend-resume.patch @@ -0,0 +1,93 @@ +From ac3e0384073b2408d6cb0d972fee9fcc3776053d Mon Sep 17 00:00:00 2001 +From: Hans de Goede <hdegoede@redhat.com> +Date: Tue, 20 Feb 2024 20:00:35 +0100 +Subject: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume + +From: Hans de Goede <hdegoede@redhat.com> + +commit ac3e0384073b2408d6cb0d972fee9fcc3776053d upstream. + +When not configured for wakeup lis3lv02d_i2c_suspend() will call +lis3lv02d_poweroff() even if the device has already been turned off +by the runtime-suspend handler and if configured for wakeup and +the device is runtime-suspended at this point then it is not turned +back on to serve as a wakeup source. + +Before commit b1b9f7a49440 ("misc: lis3lv02d_i2c: Add missing setting +of the reg_ctrl callback"), lis3lv02d_poweroff() failed to disable +the regulators which as a side effect made calling poweroff() twice ok. + +Now that poweroff() correctly disables the regulators, doing this twice +triggers a WARN() in the regulator core: + +unbalanced disables for regulator-dummy +WARNING: CPU: 1 PID: 92 at drivers/regulator/core.c:2999 _regulator_disable +... + +Fix lis3lv02d_i2c_suspend() to not call poweroff() a second time if +already runtime-suspended and add a poweron() call when necessary to +make wakeup work. + +lis3lv02d_i2c_resume() has similar issues, with an added weirness that +it always powers on the device if it is runtime suspended, after which +the first runtime-resume will call poweron() again, causing the enabled +count for the regulator to increase by 1 every suspend/resume. These +unbalanced regulator_enable() calls cause the regulator to never +be turned off and trigger the following WARN() on driver unbind: + +WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put + +Fix this by making lis3lv02d_i2c_resume() mirror the new suspend(). + +Fixes: b1b9f7a49440 ("misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback") +Reported-by: Paul Menzel <pmenzel@molgen.mpg.de> +Closes: https://lore.kernel.org/regressions/5fc6da74-af0a-4aac-b4d5-a000b39a63a5@molgen.mpg.de/ +Cc: stable@vger.kernel.org +Cc: regressions@lists.linux.dev +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Tested-by: Paul Menzel <pmenzel@molgen.mpg.de> # Dell XPS 15 7590 +Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> +Link: https://lore.kernel.org/r/20240220190035.53402-1-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c ++++ b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c +@@ -198,8 +198,14 @@ static int lis3lv02d_i2c_suspend(struct + struct i2c_client *client = to_i2c_client(dev); + struct lis3lv02d *lis3 = i2c_get_clientdata(client); + +- if (!lis3->pdata || !lis3->pdata->wakeup_flags) ++ /* Turn on for wakeup if turned off by runtime suspend */ ++ if (lis3->pdata && lis3->pdata->wakeup_flags) { ++ if (pm_runtime_suspended(dev)) ++ lis3lv02d_poweron(lis3); ++ /* For non wakeup turn off if not already turned off by runtime suspend */ ++ } else if (!pm_runtime_suspended(dev)) + lis3lv02d_poweroff(lis3); ++ + return 0; + } + +@@ -208,13 +214,12 @@ static int lis3lv02d_i2c_resume(struct d + struct i2c_client *client = to_i2c_client(dev); + struct lis3lv02d *lis3 = i2c_get_clientdata(client); + +- /* +- * pm_runtime documentation says that devices should always +- * be powered on at resume. Pm_runtime turns them off after system +- * wide resume is complete. +- */ +- if (!lis3->pdata || !lis3->pdata->wakeup_flags || +- pm_runtime_suspended(dev)) ++ /* Turn back off if turned on for wakeup and runtime suspended*/ ++ if (lis3->pdata && lis3->pdata->wakeup_flags) { ++ if (pm_runtime_suspended(dev)) ++ lis3lv02d_poweroff(lis3); ++ /* For non wakeup turn back on if not runtime suspended */ ++ } else if (!pm_runtime_suspended(dev)) + lis3lv02d_poweron(lis3); + + return 0; diff --git a/queue-6.6/mm-vmscan-prevent-infinite-loop-for-costly-gfp_noio-__gfp_retry_mayfail-allocations.patch b/queue-6.6/mm-vmscan-prevent-infinite-loop-for-costly-gfp_noio-__gfp_retry_mayfail-allocations.patch new file mode 100644 index 0000000000..3a6b944236 --- /dev/null +++ b/queue-6.6/mm-vmscan-prevent-infinite-loop-for-costly-gfp_noio-__gfp_retry_mayfail-allocations.patch @@ -0,0 +1,187 @@ +From 803de9000f334b771afacb6ff3e78622916668b0 Mon Sep 17 00:00:00 2001 +From: Vlastimil Babka <vbabka@suse.cz> +Date: Wed, 21 Feb 2024 12:43:58 +0100 +Subject: mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations + +From: Vlastimil Babka <vbabka@suse.cz> + +commit 803de9000f334b771afacb6ff3e78622916668b0 upstream. + +Sven reports an infinite loop in __alloc_pages_slowpath() for costly order +__GFP_RETRY_MAYFAIL allocations that are also GFP_NOIO. Such combination +can happen in a suspend/resume context where a GFP_KERNEL allocation can +have __GFP_IO masked out via gfp_allowed_mask. + +Quoting Sven: + +1. try to do a "costly" allocation (order > PAGE_ALLOC_COSTLY_ORDER) + with __GFP_RETRY_MAYFAIL set. + +2. page alloc's __alloc_pages_slowpath tries to get a page from the + freelist. This fails because there is nothing free of that costly + order. + +3. page alloc tries to reclaim by calling __alloc_pages_direct_reclaim, + which bails out because a zone is ready to be compacted; it pretends + to have made a single page of progress. + +4. page alloc tries to compact, but this always bails out early because + __GFP_IO is not set (it's not passed by the snd allocator, and even + if it were, we are suspending so the __GFP_IO flag would be cleared + anyway). + +5. page alloc believes reclaim progress was made (because of the + pretense in item 3) and so it checks whether it should retry + compaction. The compaction retry logic thinks it should try again, + because: + a) reclaim is needed because of the early bail-out in item 4 + b) a zonelist is suitable for compaction + +6. goto 2. indefinite stall. + +(end quote) + +The immediate root cause is confusing the COMPACT_SKIPPED returned from +__alloc_pages_direct_compact() (step 4) due to lack of __GFP_IO to be +indicating a lack of order-0 pages, and in step 5 evaluating that in +should_compact_retry() as a reason to retry, before incrementing and +limiting the number of retries. There are however other places that +wrongly assume that compaction can happen while we lack __GFP_IO. + +To fix this, introduce gfp_compaction_allowed() to abstract the __GFP_IO +evaluation and switch the open-coded test in try_to_compact_pages() to use +it. + +Also use the new helper in: +- compaction_ready(), which will make reclaim not bail out in step 3, so + there's at least one attempt to actually reclaim, even if chances are + small for a costly order +- in_reclaim_compaction() which will make should_continue_reclaim() + return false and we don't over-reclaim unnecessarily +- in __alloc_pages_slowpath() to set a local variable can_compact, + which is then used to avoid retrying reclaim/compaction for costly + allocations (step 5) if we can't compact and also to skip the early + compaction attempt that we do in some cases + +Link: https://lkml.kernel.org/r/20240221114357.13655-2-vbabka@suse.cz +Fixes: 3250845d0526 ("Revert "mm, oom: prevent premature OOM killer invocation for high order request"") +Signed-off-by: Vlastimil Babka <vbabka@suse.cz> +Reported-by: Sven van Ashbrook <svenva@chromium.org> +Closes: https://lore.kernel.org/all/CAG-rBihs_xMKb3wrMO1%2B-%2Bp4fowP9oy1pa_OTkfxBzPUVOZF%2Bg@mail.gmail.com/ +Tested-by: Karthikeyan Ramasubramanian <kramasub@chromium.org> +Cc: Brian Geffon <bgeffon@google.com> +Cc: Curtis Malainey <cujomalainey@chromium.org> +Cc: Jaroslav Kysela <perex@perex.cz> +Cc: Mel Gorman <mgorman@techsingularity.net> +Cc: Michal Hocko <mhocko@kernel.org> +Cc: Takashi Iwai <tiwai@suse.com> +Cc: <stable@vger.kernel.org> +Signed-off-by: Andrew Morton <akpm@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + include/linux/gfp.h | 9 +++++++++ + mm/compaction.c | 7 +------ + mm/page_alloc.c | 10 ++++++---- + mm/vmscan.c | 5 ++++- + 4 files changed, 20 insertions(+), 11 deletions(-) + +--- a/include/linux/gfp.h ++++ b/include/linux/gfp.h +@@ -343,6 +343,15 @@ static inline bool gfp_has_io_fs(gfp_t g + return (gfp & (__GFP_IO | __GFP_FS)) == (__GFP_IO | __GFP_FS); + } + ++/* ++ * Check if the gfp flags allow compaction - GFP_NOIO is a really ++ * tricky context because the migration might require IO. ++ */ ++static inline bool gfp_compaction_allowed(gfp_t gfp_mask) ++{ ++ return IS_ENABLED(CONFIG_COMPACTION) && (gfp_mask & __GFP_IO); ++} ++ + extern gfp_t vma_thp_gfp_mask(struct vm_area_struct *vma); + + #ifdef CONFIG_CONTIG_ALLOC +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -2684,16 +2684,11 @@ enum compact_result try_to_compact_pages + unsigned int alloc_flags, const struct alloc_context *ac, + enum compact_priority prio, struct page **capture) + { +- int may_perform_io = (__force int)(gfp_mask & __GFP_IO); + struct zoneref *z; + struct zone *zone; + enum compact_result rc = COMPACT_SKIPPED; + +- /* +- * Check if the GFP flags allow compaction - GFP_NOIO is really +- * tricky context because the migration might require IO +- */ +- if (!may_perform_io) ++ if (!gfp_compaction_allowed(gfp_mask)) + return COMPACT_SKIPPED; + + trace_mm_compaction_try_to_compact_pages(order, gfp_mask, prio); +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3900,6 +3900,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u + struct alloc_context *ac) + { + bool can_direct_reclaim = gfp_mask & __GFP_DIRECT_RECLAIM; ++ bool can_compact = gfp_compaction_allowed(gfp_mask); + const bool costly_order = order > PAGE_ALLOC_COSTLY_ORDER; + struct page *page = NULL; + unsigned int alloc_flags; +@@ -3970,7 +3971,7 @@ restart: + * Don't try this for allocations that are allowed to ignore + * watermarks, as the ALLOC_NO_WATERMARKS attempt didn't yet happen. + */ +- if (can_direct_reclaim && ++ if (can_direct_reclaim && can_compact && + (costly_order || + (order > 0 && ac->migratetype != MIGRATE_MOVABLE)) + && !gfp_pfmemalloc_allowed(gfp_mask)) { +@@ -4068,9 +4069,10 @@ retry: + + /* + * Do not retry costly high order allocations unless they are +- * __GFP_RETRY_MAYFAIL ++ * __GFP_RETRY_MAYFAIL and we can compact + */ +- if (costly_order && !(gfp_mask & __GFP_RETRY_MAYFAIL)) ++ if (costly_order && (!can_compact || ++ !(gfp_mask & __GFP_RETRY_MAYFAIL))) + goto nopage; + + if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags, +@@ -4083,7 +4085,7 @@ retry: + * implementation of the compaction depends on the sufficient amount + * of free memory (see __compaction_suitable) + */ +- if (did_some_progress > 0 && ++ if (did_some_progress > 0 && can_compact && + should_compact_retry(ac, order, alloc_flags, + compact_result, &compact_priority, + &compaction_retries)) +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -6426,7 +6426,7 @@ static void shrink_lruvec(struct lruvec + /* Use reclaim/compaction for costly allocs or under memory pressure */ + static bool in_reclaim_compaction(struct scan_control *sc) + { +- if (IS_ENABLED(CONFIG_COMPACTION) && sc->order && ++ if (gfp_compaction_allowed(sc->gfp_mask) && sc->order && + (sc->order > PAGE_ALLOC_COSTLY_ORDER || + sc->priority < DEF_PRIORITY - 2)) + return true; +@@ -6671,6 +6671,9 @@ static inline bool compaction_ready(stru + { + unsigned long watermark; + ++ if (!gfp_compaction_allowed(sc->gfp_mask)) ++ return false; ++ + /* Allocation can already succeed, nothing to do */ + if (zone_watermark_ok(zone, sc->order, min_wmark_pages(zone), + sc->reclaim_idx, 0)) diff --git a/queue-6.6/revert-tty-serial-simplify-qcom_geni_serial_send_chunk_fifo.patch b/queue-6.6/revert-tty-serial-simplify-qcom_geni_serial_send_chunk_fifo.patch new file mode 100644 index 0000000000..20ed6f190b --- /dev/null +++ b/queue-6.6/revert-tty-serial-simplify-qcom_geni_serial_send_chunk_fifo.patch @@ -0,0 +1,92 @@ +From 3d9319c27ceb35fa3d2c8b15508967f3fc7e5b78 Mon Sep 17 00:00:00 2001 +From: Douglas Anderson <dianders@chromium.org> +Date: Mon, 4 Mar 2024 17:49:53 -0800 +Subject: Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()" + +From: Douglas Anderson <dianders@chromium.org> + +commit 3d9319c27ceb35fa3d2c8b15508967f3fc7e5b78 upstream. + +This reverts commit 5c7e105cd156fc9adf5294a83623d7a40c15f9b9. + +As identified by KASAN, the simplification done by the cleanup patch +was not legal. + +>From tracing through the code, it can be seen that we're transmitting +from a 4096-byte circular buffer. We copy anywhere from 1-4 bytes from +it each time. The simplification runs into trouble when we get near +the end of the circular buffer. For instance, we might start out with +xmit->tail = 4094 and we want to transfer 4 bytes. With the code +before simplification this was no problem. We'd read buf[4094], +buf[4095], buf[0], and buf[1]. With the new code we'll do a +memcpy(&buf[4094], 4) which reads 2 bytes past the end of the buffer +and then skips transmitting what's at buf[0] and buf[1]. + +KASAN isn't 100% consistent at reporting this for me, but to be extra +confident in the analysis, I added traces of the tail and tx_bytes and +then wrote a test program: + + while true; do + echo -n "abcdefghijklmnopqrstuvwxyz0" > /dev/ttyMSM0 + sleep .1 + done + +I watched the traces over SSH and saw: + qcom_geni_serial_send_chunk_fifo: 4093 4 + qcom_geni_serial_send_chunk_fifo: 1 3 + +Which indicated that one byte should be missing. Sure enough the +output that should have been: + + abcdefghijklmnopqrstuvwxyz0 + +In one case was actually missing a byte: + + abcdefghijklmnopqrstuvwyz0 + +Running "ls -al" on large directories also made the missing bytes +obvious since columns didn't line up. + +While the original code may not be the most elegant, we only talking +about copying up to 4 bytes here. Let's just go back to the code that +worked. + +Fixes: 5c7e105cd156 ("tty: serial: simplify qcom_geni_serial_send_chunk_fifo()") +Cc: stable <stable@kernel.org> +Signed-off-by: Douglas Anderson <dianders@chromium.org> +Acked-by: Jiri Slaby <jirislaby@kernel.org> +Tested-by: Johan Hovold <johan+linaro@kernel.org> +Link: https://lore.kernel.org/r/20240304174952.1.I920a314049b345efd1f69d708e7f74d2213d0b49@changeid +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/serial/qcom_geni_serial.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -851,19 +851,21 @@ static void qcom_geni_serial_stop_tx(str + } + + static void qcom_geni_serial_send_chunk_fifo(struct uart_port *uport, +- unsigned int remaining) ++ unsigned int chunk) + { + struct qcom_geni_serial_port *port = to_dev_port(uport); + struct circ_buf *xmit = &uport->state->xmit; +- unsigned int tx_bytes; ++ unsigned int tx_bytes, c, remaining = chunk; + u8 buf[BYTES_PER_FIFO_WORD]; + + while (remaining) { + memset(buf, 0, sizeof(buf)); + tx_bytes = min(remaining, BYTES_PER_FIFO_WORD); + +- memcpy(buf, &xmit->buf[xmit->tail], tx_bytes); +- uart_xmit_advance(uport, tx_bytes); ++ for (c = 0; c < tx_bytes ; c++) { ++ buf[c] = xmit->buf[xmit->tail]; ++ uart_xmit_advance(uport, 1); ++ } + + iowrite32_rep(uport->membase + SE_GENI_TX_FIFOn, buf, 1); + diff --git a/queue-6.6/serial-8250_dw-do-not-reclock-if-already-at-correct-rate.patch b/queue-6.6/serial-8250_dw-do-not-reclock-if-already-at-correct-rate.patch new file mode 100644 index 0000000000..478027724f --- /dev/null +++ b/queue-6.6/serial-8250_dw-do-not-reclock-if-already-at-correct-rate.patch @@ -0,0 +1,50 @@ +From e5d6bd25f93d6ae158bb4cd04956cb497a85b8ef Mon Sep 17 00:00:00 2001 +From: Peter Collingbourne <pcc@google.com> +Date: Thu, 22 Feb 2024 11:26:34 -0800 +Subject: serial: 8250_dw: Do not reclock if already at correct rate + +From: Peter Collingbourne <pcc@google.com> + +commit e5d6bd25f93d6ae158bb4cd04956cb497a85b8ef upstream. + +When userspace opens the console, we call set_termios() passing a +termios with the console's configured baud rate. Currently this causes +dw8250_set_termios() to disable and then re-enable the UART clock at +the same frequency as it was originally. This can cause corruption +of any concurrent console output. Fix it by skipping the reclocking +if we are already at the correct rate. + +Signed-off-by: Peter Collingbourne <pcc@google.com> +Fixes: 4e26b134bd17 ("serial: 8250_dw: clock rate handling for all ACPI platforms") +Cc: stable@vger.kernel.org +Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> +Link: https://lore.kernel.org/r/20240222192635.1050502-1-pcc@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/serial/8250/8250_dw.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -357,9 +357,9 @@ static void dw8250_set_termios(struct ua + long rate; + int ret; + +- clk_disable_unprepare(d->clk); + rate = clk_round_rate(d->clk, newrate); +- if (rate > 0) { ++ if (rate > 0 && p->uartclk != rate) { ++ clk_disable_unprepare(d->clk); + /* + * Note that any clock-notifer worker will block in + * serial8250_update_uartclk() until we are done. +@@ -367,8 +367,8 @@ static void dw8250_set_termios(struct ua + ret = clk_set_rate(d->clk, newrate); + if (!ret) + p->uartclk = rate; ++ clk_prepare_enable(d->clk); + } +- clk_prepare_enable(d->clk); + + dw8250_do_set_termios(p, termios, old); + } diff --git a/queue-6.6/serial-port-don-t-suspend-if-the-port-is-still-busy.patch b/queue-6.6/serial-port-don-t-suspend-if-the-port-is-still-busy.patch new file mode 100644 index 0000000000..eb025e002a --- /dev/null +++ b/queue-6.6/serial-port-don-t-suspend-if-the-port-is-still-busy.patch @@ -0,0 +1,93 @@ +From 43066e32227ecde674e8ae1fcdd4a1ede67680c2 Mon Sep 17 00:00:00 2001 +From: Yicong Yang <yangyicong@hisilicon.com> +Date: Mon, 26 Feb 2024 23:23:51 +0800 +Subject: serial: port: Don't suspend if the port is still busy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yicong Yang <yangyicong@hisilicon.com> + +commit 43066e32227ecde674e8ae1fcdd4a1ede67680c2 upstream. + +We accidently met the issue that the bash prompt is not shown after the +previous command done and until the next input if there's only one CPU +(In our issue other CPUs are isolated by isolcpus=). Further analysis +shows it's because the port entering runtime suspend even if there's +still pending chars in the buffer and the pending chars will only be +processed in next device resuming. We are using amba-pl011 and the +problematic flow is like below: + +Bash kworker +tty_write() + file_tty_write() + n_tty_write() + uart_write() + __uart_start() + pm_runtime_get() // wakeup waker + queue_work() + pm_runtime_work() + rpm_resume() + status = RPM_RESUMING + serial_port_runtime_resume() + port->ops->start_tx() + pl011_tx_chars() + uart_write_wakeup() + […] + __uart_start() + pm_runtime_get() < 0 // because runtime status = RPM_RESUMING + // later data are not commit to the port driver + status = RPM_ACTIVE + rpm_idle() -> rpm_suspend() + +This patch tries to fix this by checking the port busy before entering +runtime suspending. A runtime_suspend callback is added for the port +driver. When entering runtime suspend the callback is invoked, if there's +still pending chars in the buffer then flush the buffer. + +Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") +Cc: stable <stable@kernel.org> +Reviewed-by: Tony Lindgren <tony@atomide.com> +Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> +Signed-off-by: Yicong Yang <yangyicong@hisilicon.com> +Link: https://lore.kernel.org/r/20240226152351.40924-1-yangyicong@huawei.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/serial/serial_port.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/serial_port.c ++++ b/drivers/tty/serial/serial_port.c +@@ -46,8 +46,31 @@ out: + return 0; + } + ++static int serial_port_runtime_suspend(struct device *dev) ++{ ++ struct serial_port_device *port_dev = to_serial_base_port_device(dev); ++ struct uart_port *port = port_dev->port; ++ unsigned long flags; ++ bool busy; ++ ++ if (port->flags & UPF_DEAD) ++ return 0; ++ ++ uart_port_lock_irqsave(port, &flags); ++ busy = __serial_port_busy(port); ++ if (busy) ++ port->ops->start_tx(port); ++ uart_port_unlock_irqrestore(port, flags); ++ ++ if (busy) ++ pm_runtime_mark_last_busy(dev); ++ ++ return busy ? -EBUSY : 0; ++} ++ + static DEFINE_RUNTIME_DEV_PM_OPS(serial_port_pm, +- NULL, serial_port_runtime_resume, NULL); ++ serial_port_runtime_suspend, ++ serial_port_runtime_resume, NULL); + + static int serial_port_probe(struct device *dev) + { diff --git a/queue-6.6/series b/queue-6.6/series index baffb29868..75c6b1f1a2 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -212,3 +212,38 @@ init-kconfig-lower-gcc-version-check-for-warray-bounds.patch firewire-ohci-prevent-leak-of-left-over-irq-on-unbind.patch kvm-x86-mark-target-gfn-of-emulated-atomic-instruction-as-dirty.patch kvm-svm-flush-pages-under-kvm-lock-to-fix-uaf-in-svm_register_enc_region.patch +sev-disable-sev-es-debugswap-by-default.patch +tracing-use-.flush-call-to-wake-up-readers.patch +drm-amdgpu-pm-fix-the-error-of-pwm1_enable-setting.patch +tty-serial-imx-fix-broken-rs485.patch +drm-i915-check-before-removing-mm-notifier.patch +alsa-hda-realtek-fix-headset-mic-no-show-at-resume-back-for-lenovo-alc897-platform.patch +usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch +usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch +usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch +usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch +xhci-fix-failure-to-detect-ring-expansion-need.patch +tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch +serial-8250_dw-do-not-reclock-if-already-at-correct-rate.patch +misc-lis3lv02d_i2c-fix-regulators-getting-en-dis-abled-twice-on-suspend-resume.patch +misc-fastrpc-pass-proper-arguments-to-scm-call.patch +serial-port-don-t-suspend-if-the-port-is-still-busy.patch +mei-me-add-arrow-lake-point-s-did.patch +mei-me-add-arrow-lake-point-h-did.patch +vt-fix-unicode-buffer-corruption-when-deleting-characters.patch +revert-tty-serial-simplify-qcom_geni_serial_send_chunk_fifo.patch +fs-aio-check-iocb_aio_rw-before-the-struct-aio_kiocb-conversion.patch +alsa-hda-realtek-add-headset-mic-supported-acer-nb-platform.patch +alsa-hda-realtek-fix-mute-micmute-leds-for-hp-elitebook.patch +tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch +arm-imx_v6_v7_defconfig-restore-config_backlight_class_device.patch +mm-vmscan-prevent-infinite-loop-for-costly-gfp_noio-__gfp_retry_mayfail-allocations.patch +arm64-dts-qcom-sc8280xp-x13s-limit-pcie4-link-speed.patch +iio-pressure-fixes-bmp38x-and-bmp390-spi-support.patch +iio-accel-adxl367-fix-devid-read-after-reset.patch +iio-accel-adxl367-fix-i2c-fifo-data-register.patch +i2c-i801-avoid-potential-double-call-to-gpiod_remove_lookup_table.patch +iio-imu-inv_mpu6050-fix-frequency-setting-when-chip-is-off.patch +iio-imu-inv_mpu6050-fix-fifo-parsing-when-empty.patch +drm-i915-don-t-explode-when-the-dig-port-we-don-t-have-an-aux-ch.patch +drm-amd-display-handle-range-offsets-in-vrr-ranges.patch diff --git a/queue-6.6/sev-disable-sev-es-debugswap-by-default.patch b/queue-6.6/sev-disable-sev-es-debugswap-by-default.patch new file mode 100644 index 0000000000..8978060af7 --- /dev/null +++ b/queue-6.6/sev-disable-sev-es-debugswap-by-default.patch @@ -0,0 +1,60 @@ +From 5abf6dceb066f2b02b225fd561440c98a8062681 Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini <pbonzini@redhat.com> +Date: Sat, 9 Mar 2024 11:24:58 -0500 +Subject: SEV: disable SEV-ES DebugSwap by default + +From: Paolo Bonzini <pbonzini@redhat.com> + +commit 5abf6dceb066f2b02b225fd561440c98a8062681 upstream. + +The DebugSwap feature of SEV-ES provides a way for confidential guests to use +data breakpoints. However, because the status of the DebugSwap feature is +recorded in the VMSA, enabling it by default invalidates the attestation +signatures. In 6.10 we will introduce a new API to create SEV VMs that +will allow enabling DebugSwap based on what the user tells KVM to do. +Contextually, we will change the legacy KVM_SEV_ES_INIT API to never +enable DebugSwap. + +For compatibility with kernels that pre-date the introduction of DebugSwap, +as well as with those where KVM_SEV_ES_INIT will never enable it, do not enable +the feature by default. If anybody wants to use it, for now they can enable +the sev_es_debug_swap_enabled module parameter, but this will result in a +warning. + +Fixes: d1f85fbe836e ("KVM: SEV: Enable data breakpoints in SEV-ES") +Cc: stable@vger.kernel.org +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + arch/x86/kvm/svm/sev.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c +index a132547fcfb5..a8ce5226b3b5 100644 +--- a/arch/x86/kvm/svm/sev.c ++++ b/arch/x86/kvm/svm/sev.c +@@ -57,7 +57,7 @@ static bool sev_es_enabled = true; + module_param_named(sev_es, sev_es_enabled, bool, 0444); + + /* enable/disable SEV-ES DebugSwap support */ +-static bool sev_es_debug_swap_enabled = true; ++static bool sev_es_debug_swap_enabled = false; + module_param_named(debug_swap, sev_es_debug_swap_enabled, bool, 0444); + #else + #define sev_enabled false +@@ -612,8 +612,11 @@ static int sev_es_sync_vmsa(struct vcpu_svm *svm) + save->xss = svm->vcpu.arch.ia32_xss; + save->dr6 = svm->vcpu.arch.dr6; + +- if (sev_es_debug_swap_enabled) ++ if (sev_es_debug_swap_enabled) { + save->sev_features |= SVM_SEV_FEAT_DEBUG_SWAP; ++ pr_warn_once("Enabling DebugSwap with KVM_SEV_ES_INIT. " ++ "This will not work starting with Linux 6.10\n"); ++ } + + pr_debug("Virtual Machine Save Area (VMSA):\n"); + print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, save, sizeof(*save), false); +-- +2.44.0 + diff --git a/queue-6.6/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch b/queue-6.6/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch new file mode 100644 index 0000000000..a911514993 --- /dev/null +++ b/queue-6.6/tee-optee-fix-kernel-panic-caused-by-incorrect-error-handling.patch @@ -0,0 +1,59 @@ +From 95915ba4b987cf2b222b0f251280228a1ff977ac Mon Sep 17 00:00:00 2001 +From: Sumit Garg <sumit.garg@linaro.org> +Date: Fri, 1 Mar 2024 20:07:31 +0530 +Subject: tee: optee: Fix kernel panic caused by incorrect error handling + +From: Sumit Garg <sumit.garg@linaro.org> + +commit 95915ba4b987cf2b222b0f251280228a1ff977ac upstream. + +The error path while failing to register devices on the TEE bus has a +bug leading to kernel panic as follows: + +[ 15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c +[ 15.406913] Mem abort info: +[ 15.409722] ESR = 0x0000000096000005 +[ 15.413490] EC = 0x25: DABT (current EL), IL = 32 bits +[ 15.418814] SET = 0, FnV = 0 +[ 15.421878] EA = 0, S1PTW = 0 +[ 15.425031] FSC = 0x05: level 1 translation fault +[ 15.429922] Data abort info: +[ 15.432813] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 +[ 15.438310] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 15.443372] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000 +[ 15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000 +[ 15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP + +Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") +lead to the introduction of this bug. So fix it appropriately. + +Reported-by: Mikko Rapeli <mikko.rapeli@linaro.org> +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218542 +Fixes: 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") +Cc: stable@vger.kernel.org +Signed-off-by: Sumit Garg <sumit.garg@linaro.org> +Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tee/optee/device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/tee/optee/device.c ++++ b/drivers/tee/optee/device.c +@@ -90,13 +90,14 @@ static int optee_register_device(const u + if (rc) { + pr_err("device registration failed, err: %d\n", rc); + put_device(&optee_device->dev); ++ return rc; + } + + if (func == PTA_CMD_GET_DEVICES_SUPP) + device_create_file(&optee_device->dev, + &dev_attr_need_supplicant); + +- return rc; ++ return 0; + } + + static int __optee_enumerate_devices(u32 func) diff --git a/queue-6.6/tracing-use-.flush-call-to-wake-up-readers.patch b/queue-6.6/tracing-use-.flush-call-to-wake-up-readers.patch new file mode 100644 index 0000000000..21b211bdaa --- /dev/null +++ b/queue-6.6/tracing-use-.flush-call-to-wake-up-readers.patch @@ -0,0 +1,89 @@ +From e5d7c1916562f0e856eb3d6f569629fcd535fed2 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" <rostedt@goodmis.org> +Date: Fri, 8 Mar 2024 15:24:05 -0500 +Subject: tracing: Use .flush() call to wake up readers + +From: Steven Rostedt (Google) <rostedt@goodmis.org> + +commit e5d7c1916562f0e856eb3d6f569629fcd535fed2 upstream. + +The .release() function does not get called until all readers of a file +descriptor are finished. + +If a thread is blocked on reading a file descriptor in ring_buffer_wait(), +and another thread closes the file descriptor, it will not wake up the +other thread as ring_buffer_wake_waiters() is called by .release(), and +that will not get called until the .read() is finished. + +The issue originally showed up in trace-cmd, but the readers are actually +other processes with their own file descriptors. So calling close() would wake +up the other tasks because they are blocked on another descriptor then the +one that was closed(). But there's other wake ups that solve that issue. + +When a thread is blocked on a read, it can still hang even when another +thread closed its descriptor. + +This is what the .flush() callback is for. Have the .flush() wake up the +readers. + +Link: https://lore.kernel.org/linux-trace-kernel/20240308202432.107909457@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu <mhiramat@kernel.org> +Cc: Mark Rutland <mark.rutland@arm.com> +Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: linke li <lilinke99@qq.com> +Cc: Rabin Vincent <rabin@rab.in> +Fixes: f3ddb74ad0790 ("tracing: Wake up ring buffer waiters on closing of the file") +Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + kernel/trace/trace.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -8359,6 +8359,20 @@ tracing_buffers_read(struct file *filp, + return size; + } + ++static int tracing_buffers_flush(struct file *file, fl_owner_t id) ++{ ++ struct ftrace_buffer_info *info = file->private_data; ++ struct trace_iterator *iter = &info->iter; ++ ++ iter->wait_index++; ++ /* Make sure the waiters see the new wait_index */ ++ smp_wmb(); ++ ++ ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file); ++ ++ return 0; ++} ++ + static int tracing_buffers_release(struct inode *inode, struct file *file) + { + struct ftrace_buffer_info *info = file->private_data; +@@ -8370,12 +8384,6 @@ static int tracing_buffers_release(struc + + __trace_array_put(iter->tr); + +- iter->wait_index++; +- /* Make sure the waiters see the new wait_index */ +- smp_wmb(); +- +- ring_buffer_wake_waiters(iter->array_buffer->buffer, iter->cpu_file); +- + if (info->spare) + ring_buffer_free_read_page(iter->array_buffer->buffer, + info->spare_cpu, info->spare); +@@ -8589,6 +8597,7 @@ static const struct file_operations trac + .read = tracing_buffers_read, + .poll = tracing_buffers_poll, + .release = tracing_buffers_release, ++ .flush = tracing_buffers_flush, + .splice_read = tracing_buffers_splice_read, + .unlocked_ioctl = tracing_buffers_ioctl, + .llseek = no_llseek, diff --git a/queue-6.6/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch b/queue-6.6/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch new file mode 100644 index 0000000000..c4f3e2fb4a --- /dev/null +++ b/queue-6.6/tty-serial-fsl_lpuart-avoid-idle-preamble-pending-if-cts-is-enabled.patch @@ -0,0 +1,52 @@ +From 74cb7e0355fae9641f825afa389d3fba3b617714 Mon Sep 17 00:00:00 2001 +From: Sherry Sun <sherry.sun@nxp.com> +Date: Tue, 5 Mar 2024 09:57:06 +0800 +Subject: tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sherry Sun <sherry.sun@nxp.com> + +commit 74cb7e0355fae9641f825afa389d3fba3b617714 upstream. + +If the remote uart device is not connected or not enabled after booting +up, the CTS line is high by default. At this time, if we enable the flow +control when opening the device(for example, using “stty -F /dev/ttyLP4 +crtscts” command), there will be a pending idle preamble(first writing 0 +and then writing 1 to UARTCTRL_TE will queue an idle preamble) that +cannot be sent out, resulting in the uart port fail to close(waiting for +TX empty), so the user space stty will have to wait for a long time or +forever. + +This is an LPUART IP bug(idle preamble has higher priority than CTS), +here add a workaround patch to enable TX CTS after enabling UARTCTRL_TE, +so that the idle preamble does not get stuck due to CTS is deasserted. + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Cc: stable <stable@kernel.org> +Signed-off-by: Sherry Sun <sherry.sun@nxp.com> +Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> +Link: https://lore.kernel.org/r/20240305015706.1050769-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/serial/fsl_lpuart.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2345,9 +2345,12 @@ lpuart32_set_termios(struct uart_port *p + + lpuart32_write(&sport->port, bd, UARTBAUD); + lpuart32_serial_setbrg(sport, baud); +- lpuart32_write(&sport->port, modem, UARTMODIR); +- lpuart32_write(&sport->port, ctrl, UARTCTRL); ++ /* disable CTS before enabling UARTCTRL_TE to avoid pending idle preamble */ ++ lpuart32_write(&sport->port, modem & ~UARTMODIR_TXCTSE, UARTMODIR); + /* restore control register */ ++ lpuart32_write(&sport->port, ctrl, UARTCTRL); ++ /* re-enable the CTS if needed */ ++ lpuart32_write(&sport->port, modem, UARTMODIR); + + if ((ctrl & (UARTCTRL_PE | UARTCTRL_M)) == UARTCTRL_PE) + sport->is_cs7 = true; diff --git a/queue-6.6/tty-serial-imx-fix-broken-rs485.patch b/queue-6.6/tty-serial-imx-fix-broken-rs485.patch new file mode 100644 index 0000000000..7b34c349da --- /dev/null +++ b/queue-6.6/tty-serial-imx-fix-broken-rs485.patch @@ -0,0 +1,85 @@ +From 672448ccf9b6a676f96f9352cbf91f4d35f4084a Mon Sep 17 00:00:00 2001 +From: Rickard x Andersson <rickaran@axis.com> +Date: Wed, 21 Feb 2024 12:53:04 +0100 +Subject: tty: serial: imx: Fix broken RS485 + +From: Rickard x Andersson <rickaran@axis.com> + +commit 672448ccf9b6a676f96f9352cbf91f4d35f4084a upstream. + +When about to transmit the function imx_uart_start_tx is called and in +some RS485 configurations this function will call imx_uart_stop_rx. The +problem is that imx_uart_stop_rx will enable loopback in order to +release the RS485 bus, but when loopback is enabled transmitted data +will just be looped to RX. + +This patch fixes the above problem by not enabling loopback when about +to transmit. + +This driver now works well when used for RS485 half duplex master +configurations. + +Fixes: 79d0224f6bf2 ("tty: serial: imx: Handle RS485 DE signal active high") +Cc: stable <stable@kernel.org> +Signed-off-by: Rickard x Andersson <rickaran@axis.com> +Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com> +Link: https://lore.kernel.org/r/20240221115304.509811-1-rickaran@axis.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/serial/imx.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -468,8 +468,7 @@ static void imx_uart_stop_tx(struct uart + } + } + +-/* called with port.lock taken and irqs off */ +-static void imx_uart_stop_rx(struct uart_port *port) ++static void imx_uart_stop_rx_with_loopback_ctrl(struct uart_port *port, bool loopback) + { + struct imx_port *sport = (struct imx_port *)port; + u32 ucr1, ucr2, ucr4, uts; +@@ -491,7 +490,7 @@ static void imx_uart_stop_rx(struct uart + /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */ + if (port->rs485.flags & SER_RS485_ENABLED && + port->rs485.flags & SER_RS485_RTS_ON_SEND && +- sport->have_rtscts && !sport->have_rtsgpio) { ++ sport->have_rtscts && !sport->have_rtsgpio && loopback) { + uts = imx_uart_readl(sport, imx_uart_uts_reg(sport)); + uts |= UTS_LOOP; + imx_uart_writel(sport, uts, imx_uart_uts_reg(sport)); +@@ -504,6 +503,16 @@ static void imx_uart_stop_rx(struct uart + } + + /* called with port.lock taken and irqs off */ ++static void imx_uart_stop_rx(struct uart_port *port) ++{ ++ /* ++ * Stop RX and enable loopback in order to make sure RS485 bus ++ * is not blocked. Se comment in imx_uart_probe(). ++ */ ++ imx_uart_stop_rx_with_loopback_ctrl(port, true); ++} ++ ++/* called with port.lock taken and irqs off */ + static void imx_uart_enable_ms(struct uart_port *port) + { + struct imx_port *sport = (struct imx_port *)port; +@@ -688,9 +697,14 @@ static void imx_uart_start_tx(struct uar + imx_uart_rts_inactive(sport, &ucr2); + imx_uart_writel(sport, ucr2, UCR2); + ++ /* ++ * Since we are about to transmit we can not stop RX ++ * with loopback enabled because that will make our ++ * transmitted data being just looped to RX. ++ */ + if (!(port->rs485.flags & SER_RS485_RX_DURING_TX) && + !port->rs485_rx_during_tx_gpio) +- imx_uart_stop_rx(port); ++ imx_uart_stop_rx_with_loopback_ctrl(port, false); + + sport->tx_state = WAIT_AFTER_RTS; + diff --git a/queue-6.6/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch b/queue-6.6/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch new file mode 100644 index 0000000000..38ede0b264 --- /dev/null +++ b/queue-6.6/usb-gadget-ncm-fix-handling-of-zero-block-length-packets.patch @@ -0,0 +1,63 @@ +From f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati <quic_kriskura@quicinc.com> +Date: Wed, 28 Feb 2024 17:24:41 +0530 +Subject: usb: gadget: ncm: Fix handling of zero block length packets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krishna Kurapati <quic_kriskura@quicinc.com> + +commit f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 upstream. + +While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX +set to 65536, it has been observed that we receive short packets, +which come at interval of 5-10 seconds sometimes and have block +length zero but still contain 1-2 valid datagrams present. + +According to the NCM spec: + +"If wBlockLength = 0x0000, the block is terminated by a +short packet. In this case, the USB transfer must still +be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If +exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, +and the size is a multiple of wMaxPacketSize for the +given pipe, then no ZLP shall be sent. + +wBlockLength= 0x0000 must be used with extreme care, because +of the possibility that the host and device may get out of +sync, and because of test issues. + +wBlockLength = 0x0000 allows the sender to reduce latency by +starting to send a very large NTB, and then shortening it when +the sender discovers that there’s not sufficient data to justify +sending a large NTB" + +However, there is a potential issue with the current implementation, +as it checks for the occurrence of multiple NTBs in a single +giveback by verifying if the leftover bytes to be processed is zero +or not. If the block length reads zero, we would process the same +NTB infintely because the leftover bytes is never zero and it leads +to a crash. Fix this by bailing out if block length reads zero. + +Cc: stable@vger.kernel.org +Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call") +Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com> +Reviewed-by: Maciej Żenczykowski <maze@google.com> +Link: https://lore.kernel.org/r/20240228115441.2105585-1-quic_kriskura@quicinc.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/gadget/function/f_ncm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -1333,7 +1333,7 @@ parse_ntb: + if (to_process == 1 && + (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) { + to_process--; +- } else if (to_process > 0) { ++ } else if ((to_process > 0) && (block_len != 0)) { + ntb_ptr = (unsigned char *)(ntb_ptr + block_len); + goto parse_ntb; + } diff --git a/queue-6.6/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch b/queue-6.6/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch new file mode 100644 index 0000000000..d3f63a0e96 --- /dev/null +++ b/queue-6.6/usb-port-don-t-try-to-peer-unused-usb-ports-based-on-location.patch @@ -0,0 +1,59 @@ +From 69c63350e573367f9c8594162288cffa8a26d0d1 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman <mathias.nyman@linux.intel.com> +Date: Fri, 23 Feb 2024 01:33:43 +0200 +Subject: usb: port: Don't try to peer unused USB ports based on location + +From: Mathias Nyman <mathias.nyman@linux.intel.com> + +commit 69c63350e573367f9c8594162288cffa8a26d0d1 upstream. + +Unused USB ports may have bogus location data in ACPI PLD tables. +This causes port peering failures as these unused USB2 and USB3 ports +location may match. + +Due to these failures the driver prints a +"usb: port power management may be unreliable" warning, and +unnecessarily blocks port power off during runtime suspend. + +This was debugged on a couple DELL systems where the unused ports +all returned zeroes in their location data. +Similar bugreports exist for other systems. + +Don't try to peer or match ports that have connect type set to +USB_PORT_NOT_USED. + +Fixes: 3bfd659baec8 ("usb: find internal hub tier mismatch via acpi") +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218465 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218486 +Tested-by: Paul Menzel <pmenzel@molgen.mpg.de> +Link: https://lore.kernel.org/linux-usb/5406d361-f5b7-4309-b0e6-8c94408f7d75@molgen.mpg.de +Cc: stable@vger.kernel.org # v3.16+ +Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218490 +Link: https://lore.kernel.org/r/20240222233343.71856-1-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/core/port.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/port.c ++++ b/drivers/usb/core/port.c +@@ -573,7 +573,7 @@ static int match_location(struct usb_dev + struct usb_hub *peer_hub = usb_hub_to_struct_hub(peer_hdev); + struct usb_device *hdev = to_usb_device(port_dev->dev.parent->parent); + +- if (!peer_hub) ++ if (!peer_hub || port_dev->connect_type == USB_PORT_NOT_USED) + return 0; + + hcd = bus_to_hcd(hdev->bus); +@@ -584,7 +584,8 @@ static int match_location(struct usb_dev + + for (port1 = 1; port1 <= peer_hdev->maxchild; port1++) { + peer = peer_hub->ports[port1 - 1]; +- if (peer && peer->location == port_dev->location) { ++ if (peer && peer->connect_type != USB_PORT_NOT_USED && ++ peer->location == port_dev->location) { + link_peers_report(port_dev, peer); + return 1; /* done */ + } diff --git a/queue-6.6/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch b/queue-6.6/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch new file mode 100644 index 0000000000..f5226eeb3a --- /dev/null +++ b/queue-6.6/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch @@ -0,0 +1,91 @@ +From 165376f6b23e9a779850e750fb2eb06622e5a531 Mon Sep 17 00:00:00 2001 +From: RD Babiera <rdbabiera@google.com> +Date: Thu, 29 Feb 2024 00:11:02 +0000 +Subject: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group + +From: RD Babiera <rdbabiera@google.com> + +commit 165376f6b23e9a779850e750fb2eb06622e5a531 upstream. + +The DisplayPort driver's sysfs nodes may be present to the userspace before +typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that +a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in +hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns +NULL in those cases. + +Remove manual sysfs node creation in favor of adding attribute group as +default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is +not used here otherwise the path to the sysfs nodes is no longer compliant +with the ABI. + +Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") +Cc: stable@vger.kernel.org +Signed-off-by: RD Babiera <rdbabiera@google.com> +Link: https://lore.kernel.org/r/20240229001101.3889432-2-rdbabiera@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/typec/altmodes/displayport.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -554,16 +554,21 @@ static ssize_t hpd_show(struct device *d + } + static DEVICE_ATTR_RO(hpd); + +-static struct attribute *dp_altmode_attrs[] = { ++static struct attribute *displayport_attrs[] = { + &dev_attr_configuration.attr, + &dev_attr_pin_assignment.attr, + &dev_attr_hpd.attr, + NULL + }; + +-static const struct attribute_group dp_altmode_group = { ++static const struct attribute_group displayport_group = { + .name = "displayport", +- .attrs = dp_altmode_attrs, ++ .attrs = displayport_attrs, ++}; ++ ++static const struct attribute_group *displayport_groups[] = { ++ &displayport_group, ++ NULL, + }; + + int dp_altmode_probe(struct typec_altmode *alt) +@@ -571,7 +576,6 @@ int dp_altmode_probe(struct typec_altmod + const struct typec_altmode *port = typec_altmode_get_partner(alt); + struct fwnode_handle *fwnode; + struct dp_altmode *dp; +- int ret; + + /* FIXME: Port can only be DFP_U. */ + +@@ -582,10 +586,6 @@ int dp_altmode_probe(struct typec_altmod + DP_CAP_PIN_ASSIGN_DFP_D(alt->vdo))) + return -ENODEV; + +- ret = sysfs_create_group(&alt->dev.kobj, &dp_altmode_group); +- if (ret) +- return ret; +- + dp = devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL); + if (!dp) + return -ENOMEM; +@@ -619,7 +619,6 @@ void dp_altmode_remove(struct typec_altm + { + struct dp_altmode *dp = typec_altmode_get_drvdata(alt); + +- sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group); + cancel_work_sync(&dp->work); + + if (dp->connector_fwnode) { +@@ -644,6 +643,7 @@ static struct typec_altmode_driver dp_al + .driver = { + .name = "typec_displayport", + .owner = THIS_MODULE, ++ .dev_groups = displayport_groups, + }, + }; + module_typec_altmode_driver(dp_altmode_driver); diff --git a/queue-6.6/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch b/queue-6.6/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch new file mode 100644 index 0000000000..4843a7bf41 --- /dev/null +++ b/queue-6.6/usb-usb-storage-prevent-divide-by-0-error-in-isd200_ata_command.patch @@ -0,0 +1,101 @@ +From 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Thu, 29 Feb 2024 14:30:06 -0500 +Subject: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 upstream. + +The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values +in the ATA ID information to calculate cylinder and head values when +creating a CDB for READ or WRITE commands. The calculation involves +division and modulus operations, which will cause a crash if either of +these values is 0. While this never happens with a genuine device, it +could happen with a flawed or subversive emulation, as reported by the +syzbot fuzzer. + +Protect against this possibility by refusing to bind to the device if +either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID +information is 0. This requires isd200_Initialization() to return a +negative error code when initialization fails; currently it always +returns 0 (even when there is an error). + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Reported-and-tested-by: syzbot+28748250ab47a8f04100@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-usb/0000000000003eb868061245ba7f@google.com/ +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar@gmail.com> +Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> +Link: https://lore.kernel.org/r/b1e605ea-333f-4ac0-9511-da04f411763e@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/storage/isd200.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/usb/storage/isd200.c ++++ b/drivers/usb/storage/isd200.c +@@ -1105,7 +1105,7 @@ static void isd200_dump_driveid(struct u + static int isd200_get_inquiry_data( struct us_data *us ) + { + struct isd200_info *info = (struct isd200_info *)us->extra; +- int retStatus = ISD200_GOOD; ++ int retStatus; + u16 *id = info->id; + + usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n"); +@@ -1137,6 +1137,13 @@ static int isd200_get_inquiry_data( stru + isd200_fix_driveid(id); + isd200_dump_driveid(us, id); + ++ /* Prevent division by 0 in isd200_scsi_to_ata() */ ++ if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) { ++ usb_stor_dbg(us, " Invalid ATA Identify data\n"); ++ retStatus = ISD200_ERROR; ++ goto Done; ++ } ++ + memset(&info->InquiryData, 0, sizeof(info->InquiryData)); + + /* Standard IDE interface only supports disks */ +@@ -1202,6 +1209,7 @@ static int isd200_get_inquiry_data( stru + } + } + ++ Done: + usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus); + + return(retStatus); +@@ -1481,22 +1489,27 @@ static int isd200_init_info(struct us_da + + static int isd200_Initialization(struct us_data *us) + { ++ int rc = 0; ++ + usb_stor_dbg(us, "ISD200 Initialization...\n"); + + /* Initialize ISD200 info struct */ + +- if (isd200_init_info(us) == ISD200_ERROR) { ++ if (isd200_init_info(us) < 0) { + usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n"); ++ rc = -ENOMEM; + } else { + /* Get device specific data */ + +- if (isd200_get_inquiry_data(us) != ISD200_GOOD) ++ if (isd200_get_inquiry_data(us) != ISD200_GOOD) { + usb_stor_dbg(us, "ISD200 Initialization Failure\n"); +- else ++ rc = -EINVAL; ++ } else { + usb_stor_dbg(us, "ISD200 Initialization complete\n"); ++ } + } + +- return 0; ++ return rc; + } + + diff --git a/queue-6.6/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch b/queue-6.6/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch new file mode 100644 index 0000000000..6cfb8a3f2f --- /dev/null +++ b/queue-6.6/vt-fix-unicode-buffer-corruption-when-deleting-characters.patch @@ -0,0 +1,34 @@ +From 1581dafaf0d34bc9c428a794a22110d7046d186d Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre <nico@fluxnic.net> +Date: Thu, 29 Feb 2024 17:15:27 -0500 +Subject: vt: fix unicode buffer corruption when deleting characters + +From: Nicolas Pitre <nico@fluxnic.net> + +commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. + +This is the same issue that was fixed for the VGA text buffer in commit +39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the +buffer"). The cure is also the same i.e. replace memcpy() with memmove() +due to the overlaping buffers. + +Signed-off-by: Nicolas Pitre <nico@fluxnic.net> +Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") +Cc: stable <stable@kernel.org> +Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -381,7 +381,7 @@ static void vc_uniscr_delete(struct vc_d + u32 *ln = vc->vc_uni_lines[vc->state.y]; + unsigned int x = vc->state.x, cols = vc->vc_cols; + +- memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); ++ memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memset32(&ln[cols - nr], ' ', nr); + } + } diff --git a/queue-6.6/xhci-fix-failure-to-detect-ring-expansion-need.patch b/queue-6.6/xhci-fix-failure-to-detect-ring-expansion-need.patch new file mode 100644 index 0000000000..260e8b1225 --- /dev/null +++ b/queue-6.6/xhci-fix-failure-to-detect-ring-expansion-need.patch @@ -0,0 +1,60 @@ +From b234c70fefa7532d34ebee104de64cc16f1b21e4 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman <mathias.nyman@linux.intel.com> +Date: Tue, 5 Mar 2024 15:23:12 +0200 +Subject: xhci: Fix failure to detect ring expansion need. + +From: Mathias Nyman <mathias.nyman@linux.intel.com> + +commit b234c70fefa7532d34ebee104de64cc16f1b21e4 upstream. + +Ring expansion checker may incorrectly assume a completely full ring +is empty, missing the need for expansion. + +This is due to a special empty ring case where the dequeue ends up +ahead of the enqueue pointer. This is seen when enqueued TRBs fill up +exactly a segment, with enqueue then pointing to the end link TRB. +Once those TRBs are handled the dequeue pointer will follow the link +TRB and end up pointing to the first entry on the next segment, past +the enqueue. + +This same enqueue - dequeue condition can be true if a ring is full, +with enqueue ending on that last link TRB before the dequeue pointer +on the next segment. + +This can be seen when queuing several ~510 small URBs via usbfs in +one go before a single one is handled (i.e. dequeue not moved from first +entry in segment). + +Expand the ring already when enqueue reaches the link TRB before the +dequeue segment, instead of expanding it when enqueue moves into the +dequeue segment. + +Reported-by: Chris Yokum <linux-usb@mail.totalphase.com> +Closes: https://lore.kernel.org/all/949223224.833962.1709339266739.JavaMail.zimbra@totalphase.com +Tested-by: Chris Yokum <linux-usb@mail.totalphase.com> +Fixes: f5af638f0609 ("xhci: Fix transfer ring expansion size calculation") +Cc: stable@vger.kernel.org # v6.5+ +Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> +Link: https://lore.kernel.org/r/20240305132312.955171-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/host/xhci-ring.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -326,7 +326,13 @@ static unsigned int xhci_ring_expansion_ + /* how many trbs will be queued past the enqueue segment? */ + trbs_past_seg = enq_used + num_trbs - (TRBS_PER_SEGMENT - 1); + +- if (trbs_past_seg <= 0) ++ /* ++ * Consider expanding the ring already if num_trbs fills the current ++ * segment (i.e. trbs_past_seg == 0), not only when num_trbs goes into ++ * the next segment. Avoids confusing full ring with special empty ring ++ * case below ++ */ ++ if (trbs_past_seg < 0) + return 0; + + /* Empty ring special case, enqueue stuck on link trb while dequeue advanced */ |