--- /dev/null
+From 9c3a62c20f7fb00294a4237e287254456ba8a48b Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 16 Aug 2024 15:57:21 +0200
+Subject: firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
+
+mbox_client_to_bpmp() is not used, W=1 builds:
+
+ drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
+
+Fixes: cdfa358b248e ("firmware: tegra: Refactor BPMP driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/tegra/bpmp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/firmware/tegra/bpmp.c
++++ b/drivers/firmware/tegra/bpmp.c
+@@ -25,12 +25,6 @@
+ #define MSG_RING BIT(1)
+ #define TAG_SZ 32
+
+-static inline struct tegra_bpmp *
+-mbox_client_to_bpmp(struct mbox_client *client)
+-{
+- return container_of(client, struct tegra_bpmp, mbox.client);
+-}
+-
+ static inline const struct tegra_bpmp_ops *
+ channel_to_ops(struct tegra_bpmp_channel *channel)
+ {
--- /dev/null
+From e2c85d85a05f16af2223fcc0195ff50a7938b372 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Thu, 12 Sep 2024 11:34:59 +0800
+Subject: i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Cc: <stable@vger.kernel.org> # v4.19+
+Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -565,15 +565,13 @@ static int geni_i2c_probe(struct platfor
+ init_completion(&gi2c->done);
+ spin_lock_init(&gi2c->lock);
+ platform_set_drvdata(pdev, gi2c);
+- ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0,
++ ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN,
+ dev_name(dev), gi2c);
+ if (ret) {
+ dev_err(dev, "Request_irq failed:%d: err:%d\n",
+ gi2c->irq, ret);
+ return ret;
+ }
+- /* Disable the interrupt so that the system can enter low-power mode */
+- disable_irq(gi2c->irq);
+ i2c_set_adapdata(&gi2c->adap, gi2c);
+ gi2c->adap.dev.parent = dev;
+ gi2c->adap.dev.of_node = dev->of_node;
--- /dev/null
+From 048bbbdbf85e5e00258dfb12f5e368f908801d7b Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 30 Sep 2024 21:27:41 +0200
+Subject: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+
+From: Marek Vasut <marex@denx.de>
+
+commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
+
+In case there is any sort of clock controller attached to this I2C bus
+controller, for example Versaclock or even an AIC32x4 I2C codec, then
+an I2C transfer triggered from the clock controller clk_ops .prepare
+callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
+
+This is because the clock controller first grabs the prepare_lock mutex
+and then performs the prepare operation, including its I2C access. The
+I2C access resumes this I2C bus controller via .runtime_resume callback,
+which calls clk_prepare_enable(), which attempts to grab the prepare_lock
+mutex again and deadlocks.
+
+Since the clock are already prepared since probe() and unprepared in
+remove(), use simple clk_enable()/clk_disable() calls to enable and
+disable the clock on runtime suspend and resume, to avoid hitting the
+prepare_lock mutex.
+
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: 4e7bca6fc07b ("i2c: i2c-stm32f7: add PM Runtime support")
+Cc: <stable@vger.kernel.org> # v5.0+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -2351,7 +2351,7 @@ static int __maybe_unused stm32f7_i2c_ru
+ struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev);
+
+ if (!stm32f7_i2c_is_slave_registered(i2c_dev))
+- clk_disable_unprepare(i2c_dev->clk);
++ clk_disable(i2c_dev->clk);
+
+ return 0;
+ }
+@@ -2362,9 +2362,9 @@ static int __maybe_unused stm32f7_i2c_ru
+ int ret;
+
+ if (!stm32f7_i2c_is_slave_registered(i2c_dev)) {
+- ret = clk_prepare_enable(i2c_dev->clk);
++ ret = clk_enable(i2c_dev->clk);
+ if (ret) {
+- dev_err(dev, "failed to prepare_enable clock\n");
++ dev_err(dev, "failed to enable clock\n");
+ return ret;
+ }
+ }
--- /dev/null
+From 521da1e9225450bd323db5fa5bca942b1dc485b7 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 21 Nov 2023 18:11:16 +0000
+Subject: i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
+
+Frequently an I2C write will be followed by a read, such as a register
+address write followed by a read of the register value. In this driver,
+when the TX FIFO half empty interrupt was raised and it was determined
+that there was enough space in the TX FIFO to send the following read
+command, it would do so without waiting for the TX FIFO to actually
+empty.
+
+Unfortunately it appears that in some cases this can result in a NAK
+that was raised by the target device on the write, such as due to an
+unsupported register address, being ignored and the subsequent read
+being done anyway. This can potentially put the I2C bus into an
+invalid state and/or result in invalid read data being processed.
+
+To avoid this, once a message has been fully written to the TX FIFO,
+wait for the TX FIFO empty interrupt before moving on to the next
+message, to ensure NAKs are handled properly.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Cc: <stable@vger.kernel.org> # v2.6.34+
+Reviewed-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -494,14 +494,17 @@ static irqreturn_t xiic_process(int irq,
+ goto out;
+ }
+
+- xiic_fill_tx_fifo(i2c);
+-
+- /* current message sent and there is space in the fifo */
+- if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) {
++ if (xiic_tx_space(i2c)) {
++ xiic_fill_tx_fifo(i2c);
++ } else {
++ /* current message fully written */
+ dev_dbg(i2c->adap.dev.parent,
+ "%s end of message sent, nmsgs: %d\n",
+ __func__, i2c->nmsgs);
+- if (i2c->nmsgs > 1) {
++ /* Don't move onto the next message until the TX FIFO empties,
++ * to ensure that a NAK is not missed.
++ */
++ if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) {
+ i2c->nmsgs--;
+ i2c->tx_msg++;
+ xfer_more = 1;
+@@ -512,11 +515,7 @@ static irqreturn_t xiic_process(int irq,
+ "%s Got TX IRQ but no more to do...\n",
+ __func__);
+ }
+- } else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1))
+- /* current frame is sent and is last,
+- * make sure to disable tx half
+- */
+- xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
++ }
+ }
+ out:
+ dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr);
--- /dev/null
+From 7d59ac07ccb58f8f604f8057db63b8efcebeb3de Mon Sep 17 00:00:00 2001
+From: Zach Wade <zachwade.k@gmail.com>
+Date: Mon, 23 Sep 2024 22:45:08 +0800
+Subject: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+
+From: Zach Wade <zachwade.k@gmail.com>
+
+commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
+
+Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds".
+kasan report:
+[ 19.411889] ==================================================================
+[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113
+[ 19.417368]
+[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10
+[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022
+[ 19.422687] Call Trace:
+[ 19.424091] <TASK>
+[ 19.425448] dump_stack_lvl+0x5d/0x80
+[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.428694] print_report+0x19d/0x52e
+[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.433539] kasan_report+0xf0/0x170
+[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10
+[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common]
+[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]
+[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360
+[ 19.444797] cpuhp_invoke_callback+0x221/0xec0
+[ 19.446337] cpuhp_thread_fun+0x21b/0x610
+[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10
+[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0
+[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10
+[ 19.452405] kthread+0x29c/0x350
+[ 19.453817] ? __pfx_kthread+0x10/0x10
+[ 19.455253] ret_from_fork+0x31/0x70
+[ 19.456685] ? __pfx_kthread+0x10/0x10
+[ 19.458114] ret_from_fork_asm+0x1a/0x30
+[ 19.459573] </TASK>
+[ 19.460853]
+[ 19.462055] Allocated by task 1198:
+[ 19.463410] kasan_save_stack+0x30/0x50
+[ 19.464788] kasan_save_track+0x14/0x30
+[ 19.466139] __kasan_kmalloc+0xaa/0xb0
+[ 19.467465] __kmalloc+0x1cd/0x470
+[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common]
+[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]
+[ 19.471670] do_one_initcall+0xa4/0x380
+[ 19.472903] do_init_module+0x238/0x760
+[ 19.474105] load_module+0x5239/0x6f00
+[ 19.475285] init_module_from_file+0xd1/0x130
+[ 19.476506] idempotent_init_module+0x23b/0x650
+[ 19.477725] __x64_sys_finit_module+0xbe/0x130
+[ 19.476506] idempotent_init_module+0x23b/0x650
+[ 19.477725] __x64_sys_finit_module+0xbe/0x130
+[ 19.478920] do_syscall_64+0x82/0x160
+[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[ 19.481292]
+[ 19.482205] The buggy address belongs to the object at ffff888829e65000
+ which belongs to the cache kmalloc-512 of size 512
+[ 19.484818] The buggy address is located 0 bytes to the right of
+ allocated 512-byte region [ffff888829e65000, ffff888829e65200)
+[ 19.487447]
+[ 19.488328] The buggy address belongs to the physical page:
+[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60
+[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)
+[ 19.493914] page_type: 0xffffffff()
+[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff
+[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
+[ 19.503784] page dumped because: kasan: bad access detected
+[ 19.505058]
+[ 19.505970] Memory state around the buggy address:
+[ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.510014] ^
+[ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.515367] ==================================================================
+
+The reason for this error is physical_package_ids assigned by VMware VMM
+are not continuous and have gaps. This will cause value returned by
+topology_physical_package_id() to be more than topology_max_packages().
+
+Here the allocation uses topology_max_packages(). The call to
+topology_max_packages() returns maximum logical package ID not physical
+ID. Hence use topology_logical_package_id() instead of
+topology_physical_package_id().
+
+Fixes: 9a1aac8a96dc ("platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering")
+Cc: stable@vger.kernel.org
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Zach Wade <zachwade.k@gmail.com>
+Link: https://lore.kernel.org/r/20240923144508.1764-1-zachwade.k@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+@@ -306,7 +306,9 @@ static struct pci_dev *_isst_if_get_pci_
+ cpu >= nr_cpu_ids || cpu >= num_possible_cpus())
+ return NULL;
+
+- pkg_id = topology_physical_package_id(cpu);
++ pkg_id = topology_logical_package_id(cpu);
++ if (pkg_id >= topology_max_packages())
++ return NULL;
+
+ bus_number = isst_cpu_info[cpu].bus_info[bus_no];
+ if (bus_number < 0)
--- /dev/null
+From e50a57d16f897e45de1112eb6478577b197fab52 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 8 Sep 2024 20:53:37 +0200
+Subject: power: supply: hwmon: Fix missing temp1_max_alarm attribute
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
+
+Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for
+power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX
+property.
+
+HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for
+temp channel 0, causing the hwmon temp1_max_alarm attribute to be
+missing from such power_supply devices.
+
+Add this to power_supply_hwmon_info to fix this.
+
+Fixes: f1d33ae806ec ("power: supply: remove duplicated argument in power_supply_hwmon_info")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240908185337.103696-2-hdegoede@redhat.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/power_supply_hwmon.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/supply/power_supply_hwmon.c
++++ b/drivers/power/supply/power_supply_hwmon.c
+@@ -299,7 +299,8 @@ static const struct hwmon_channel_info *
+ HWMON_T_INPUT |
+ HWMON_T_MAX |
+ HWMON_T_MIN |
+- HWMON_T_MIN_ALARM,
++ HWMON_T_MIN_ALARM |
++ HWMON_T_MAX_ALARM,
+
+ HWMON_T_LABEL |
+ HWMON_T_INPUT |
selftests-mm-fix-charge_reserved_hugetlb.sh-test.patch
selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
selftests-vdso-fix-vdso_config-for-s390.patch
+platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
+i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch
+i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch
+i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch
+firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch
+spi-bcm63xx-fix-module-autoloading.patch
+power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
--- /dev/null
+From 909f34f2462a99bf876f64c5c61c653213e32fce Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 19 Aug 2024 20:33:48 +0800
+Subject: spi: bcm63xx: Fix module autoloading
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
+based on the alias from platform_device_id table.
+
+Fixes: 44d8fb30941d ("spi/bcm63xx: move register definitions into the driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20240819123349.4020472-2-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -476,6 +476,7 @@ static const struct platform_device_id b
+ {
+ },
+ };
++MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match);
+
+ static const struct of_device_id bcm63xx_spi_of_match[] = {
+ { .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },
projects / thirdparty / kernel / stable-queue.git / commitdiff
