]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
6.6-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 7 Oct 2024 09:33:28 +0000 (11:33 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 7 Oct 2024 09:33:28 +0000 (11:33 +0200)
added patches:
dt-bindings-clock-exynos7885-fix-duplicated-binding.patch
firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch
i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch
i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch
i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch
i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch
i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch
media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch
memory-tegra186-emc-drop-unused-to_tegra186_emc.patch
ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch
platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch
rust-sync-require-t-sync-for-lockedby-access.patch
spi-bcm63xx-fix-missing-pm_runtime_disable.patch
spi-bcm63xx-fix-module-autoloading.patch

17 files changed:
queue-6.6/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch [new file with mode: 0644]
queue-6.6/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch [new file with mode: 0644]
queue-6.6/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch [new file with mode: 0644]
queue-6.6/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch [new file with mode: 0644]
queue-6.6/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch [new file with mode: 0644]
queue-6.6/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch [new file with mode: 0644]
queue-6.6/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch [new file with mode: 0644]
queue-6.6/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch [new file with mode: 0644]
queue-6.6/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch [new file with mode: 0644]
queue-6.6/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch [new file with mode: 0644]
queue-6.6/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch [new file with mode: 0644]
queue-6.6/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch [new file with mode: 0644]
queue-6.6/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch [new file with mode: 0644]
queue-6.6/rust-sync-require-t-sync-for-lockedby-access.patch [new file with mode: 0644]
queue-6.6/series
queue-6.6/spi-bcm63xx-fix-missing-pm_runtime_disable.patch [new file with mode: 0644]
queue-6.6/spi-bcm63xx-fix-module-autoloading.patch [new file with mode: 0644]

diff --git a/queue-6.6/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch b/queue-6.6/dt-bindings-clock-exynos7885-fix-duplicated-binding.patch
new file mode 100644 (file)
index 0000000..7ccc2ee
--- /dev/null
@@ -0,0 +1,46 @@
+From abf3a3ea9acb5c886c8729191a670744ecd42024 Mon Sep 17 00:00:00 2001
+From: David Virag <virag.david003@gmail.com>
+Date: Tue, 6 Aug 2024 14:11:44 +0200
+Subject: dt-bindings: clock: exynos7885: Fix duplicated binding
+
+From: David Virag <virag.david003@gmail.com>
+
+commit abf3a3ea9acb5c886c8729191a670744ecd42024 upstream.
+
+The numbering in Exynos7885's FSYS CMU bindings has 4 duplicated by
+accident, with the rest of the bindings continuing with 5.
+
+Fix this by moving CLK_MOUT_FSYS_USB30DRD_USER to the end as 11.
+
+Since CLK_MOUT_FSYS_USB30DRD_USER is not used in any device tree as of
+now, and there are no other clocks affected (maybe apart from
+CLK_MOUT_FSYS_MMC_SDIO_USER which the number was shared with, also not
+used in a device tree), this is the least impactful way to solve this
+problem.
+
+Fixes: cd268e309c29 ("dt-bindings: clock: Add bindings for Exynos7885 CMU_FSYS")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Virag <virag.david003@gmail.com>
+Link: https://lore.kernel.org/r/20240806121157.479212-2-virag.david003@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/dt-bindings/clock/exynos7885.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/dt-bindings/clock/exynos7885.h
++++ b/include/dt-bindings/clock/exynos7885.h
+@@ -136,12 +136,12 @@
+ #define CLK_MOUT_FSYS_MMC_CARD_USER   2
+ #define CLK_MOUT_FSYS_MMC_EMBD_USER   3
+ #define CLK_MOUT_FSYS_MMC_SDIO_USER   4
+-#define CLK_MOUT_FSYS_USB30DRD_USER   4
+ #define CLK_GOUT_MMC_CARD_ACLK                5
+ #define CLK_GOUT_MMC_CARD_SDCLKIN     6
+ #define CLK_GOUT_MMC_EMBD_ACLK                7
+ #define CLK_GOUT_MMC_EMBD_SDCLKIN     8
+ #define CLK_GOUT_MMC_SDIO_ACLK                9
+ #define CLK_GOUT_MMC_SDIO_SDCLKIN     10
++#define CLK_MOUT_FSYS_USB30DRD_USER   11
+ #endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */
diff --git a/queue-6.6/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch b/queue-6.6/firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch
new file mode 100644 (file)
index 0000000..459065e
--- /dev/null
@@ -0,0 +1,37 @@
+From 9c3a62c20f7fb00294a4237e287254456ba8a48b Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 16 Aug 2024 15:57:21 +0200
+Subject: firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
+
+mbox_client_to_bpmp() is not used, W=1 builds:
+
+  drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
+
+Fixes: cdfa358b248e ("firmware: tegra: Refactor BPMP driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/tegra/bpmp.c |    6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/firmware/tegra/bpmp.c
++++ b/drivers/firmware/tegra/bpmp.c
+@@ -24,12 +24,6 @@
+ #define MSG_RING      BIT(1)
+ #define TAG_SZ                32
+-static inline struct tegra_bpmp *
+-mbox_client_to_bpmp(struct mbox_client *client)
+-{
+-      return container_of(client, struct tegra_bpmp, mbox.client);
+-}
+-
+ static inline const struct tegra_bpmp_ops *
+ channel_to_ops(struct tegra_bpmp_channel *channel)
+ {
diff --git a/queue-6.6/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch b/queue-6.6/i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch
new file mode 100644 (file)
index 0000000..82adb4b
--- /dev/null
@@ -0,0 +1,133 @@
+From 5d69d5a00f80488ddcb4dee7d1374a0709398178 Mon Sep 17 00:00:00 2001
+From: Kimriver Liu <kimriver.liu@siengine.com>
+Date: Fri, 13 Sep 2024 11:31:46 +0800
+Subject: i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
+
+From: Kimriver Liu <kimriver.liu@siengine.com>
+
+commit 5d69d5a00f80488ddcb4dee7d1374a0709398178 upstream.
+
+It was observed that issuing the ABORT bit (IC_ENABLE[1]) will not
+work when IC_ENABLE is already disabled.
+
+Check if the ENABLE bit (IC_ENABLE[0]) is disabled when the controller
+is holding SCL low. If the ENABLE bit is disabled, the software needs
+to enable it before trying to issue the ABORT bit. otherwise,
+the controller ignores any write to ABORT bit.
+
+These kernel logs show up whenever an I2C transaction is
+attempted after this failure.
+i2c_designware e95e0000.i2c: timeout waiting for bus ready
+i2c_designware e95e0000.i2c: timeout in disabling adapter
+
+The patch fixes the issue where the controller cannot be disabled
+while SCL is held low if the ENABLE bit is already disabled.
+
+Fixes: 2409205acd3c ("i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low")
+Signed-off-by: Kimriver Liu <kimriver.liu@siengine.com>
+Cc: <stable@vger.kernel.org> # v6.6+
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-designware-common.c |   14 ++++++++++
+ drivers/i2c/busses/i2c-designware-core.h   |    1 
+ drivers/i2c/busses/i2c-designware-master.c |   38 +++++++++++++++++++++++++++++
+ 3 files changed, 53 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -441,6 +441,7 @@ err_release_lock:
+ void __i2c_dw_disable(struct dw_i2c_dev *dev)
+ {
++      struct i2c_timings *t = &dev->timings;
+       unsigned int raw_intr_stats;
+       unsigned int enable;
+       int timeout = 100;
+@@ -453,6 +454,19 @@ void __i2c_dw_disable(struct dw_i2c_dev
+       abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD;
+       if (abort_needed) {
++              if (!(enable & DW_IC_ENABLE_ENABLE)) {
++                      regmap_write(dev->map, DW_IC_ENABLE, DW_IC_ENABLE_ENABLE);
++                      /*
++                       * Wait 10 times the signaling period of the highest I2C
++                       * transfer supported by the driver (for 400KHz this is
++                       * 25us) to ensure the I2C ENABLE bit is already set
++                       * as described in the DesignWare I2C databook.
++                       */
++                      fsleep(DIV_ROUND_CLOSEST_ULL(10 * MICRO, t->bus_freq_hz));
++                      /* Set ENABLE bit before setting ABORT */
++                      enable |= DW_IC_ENABLE_ENABLE;
++              }
++
+               regmap_write(dev->map, DW_IC_ENABLE, enable | DW_IC_ENABLE_ABORT);
+               ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable,
+                                              !(enable & DW_IC_ENABLE_ABORT), 10,
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -109,6 +109,7 @@
+                                                DW_IC_INTR_RX_UNDER | \
+                                                DW_IC_INTR_RD_REQ)
++#define DW_IC_ENABLE_ENABLE                   BIT(0)
+ #define DW_IC_ENABLE_ABORT                    BIT(1)
+ #define DW_IC_STATUS_ACTIVITY                 BIT(0)
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -253,6 +253,34 @@ static void i2c_dw_xfer_init(struct dw_i
+       regmap_write(dev->map, DW_IC_INTR_MASK, DW_IC_INTR_MASTER_MASK);
+ }
++/*
++ * This function waits for the controller to be idle before disabling I2C
++ * When the controller is not in the IDLE state, the MST_ACTIVITY bit
++ * (IC_STATUS[5]) is set.
++ *
++ * Values:
++ * 0x1 (ACTIVE): Controller not idle
++ * 0x0 (IDLE): Controller is idle
++ *
++ * The function is called after completing the current transfer.
++ *
++ * Returns:
++ * False when the controller is in the IDLE state.
++ * True when the controller is in the ACTIVE state.
++ */
++static bool i2c_dw_is_controller_active(struct dw_i2c_dev *dev)
++{
++      u32 status;
++
++      regmap_read(dev->map, DW_IC_STATUS, &status);
++      if (!(status & DW_IC_STATUS_MASTER_ACTIVITY))
++              return false;
++
++      return regmap_read_poll_timeout(dev->map, DW_IC_STATUS, status,
++                                     !(status & DW_IC_STATUS_MASTER_ACTIVITY),
++                                     1100, 20000) != 0;
++}
++
+ static int i2c_dw_check_stopbit(struct dw_i2c_dev *dev)
+ {
+       u32 val;
+@@ -695,6 +723,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, st
+       }
+       /*
++       * This happens rarely (~1:500) and is hard to reproduce. Debug trace
++       * showed that IC_STATUS had value of 0x23 when STOP_DET occurred,
++       * if disable IC_ENABLE.ENABLE immediately that can result in
++       * IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if
++       * controller is still ACTIVE before disabling I2C.
++       */
++      if (i2c_dw_is_controller_active(dev))
++              dev_err(dev->dev, "controller active\n");
++
++      /*
+        * We must disable the adapter before returning and signaling the end
+        * of the current transfer. Otherwise the hardware might continue
+        * generating interrupts which in turn causes a race condition with
diff --git a/queue-6.6/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.6/i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch
new file mode 100644 (file)
index 0000000..c7c4943
--- /dev/null
@@ -0,0 +1,43 @@
+From e2c85d85a05f16af2223fcc0195ff50a7938b372 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Thu, 12 Sep 2024 11:34:59 +0800
+Subject: i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Cc: <stable@vger.kernel.org> # v4.19+
+Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -819,15 +819,13 @@ static int geni_i2c_probe(struct platfor
+       init_completion(&gi2c->done);
+       spin_lock_init(&gi2c->lock);
+       platform_set_drvdata(pdev, gi2c);
+-      ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0,
++      ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN,
+                              dev_name(dev), gi2c);
+       if (ret) {
+               dev_err(dev, "Request_irq failed:%d: err:%d\n",
+                       gi2c->irq, ret);
+               return ret;
+       }
+-      /* Disable the interrupt so that the system can enter low-power mode */
+-      disable_irq(gi2c->irq);
+       i2c_set_adapdata(&gi2c->adap, gi2c);
+       gi2c->adap.dev.parent = dev;
+       gi2c->adap.dev.of_node = dev->of_node;
diff --git a/queue-6.6/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch b/queue-6.6/i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch
new file mode 100644 (file)
index 0000000..160c9f5
--- /dev/null
@@ -0,0 +1,58 @@
+From 048bbbdbf85e5e00258dfb12f5e368f908801d7b Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 30 Sep 2024 21:27:41 +0200
+Subject: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+
+From: Marek Vasut <marex@denx.de>
+
+commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
+
+In case there is any sort of clock controller attached to this I2C bus
+controller, for example Versaclock or even an AIC32x4 I2C codec, then
+an I2C transfer triggered from the clock controller clk_ops .prepare
+callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
+
+This is because the clock controller first grabs the prepare_lock mutex
+and then performs the prepare operation, including its I2C access. The
+I2C access resumes this I2C bus controller via .runtime_resume callback,
+which calls clk_prepare_enable(), which attempts to grab the prepare_lock
+mutex again and deadlocks.
+
+Since the clock are already prepared since probe() and unprepared in
+remove(), use simple clk_enable()/clk_disable() calls to enable and
+disable the clock on runtime suspend and resume, to avoid hitting the
+prepare_lock mutex.
+
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: 4e7bca6fc07b ("i2c: i2c-stm32f7: add PM Runtime support")
+Cc: <stable@vger.kernel.org> # v5.0+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -2394,7 +2394,7 @@ static int __maybe_unused stm32f7_i2c_ru
+       struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev);
+       if (!stm32f7_i2c_is_slave_registered(i2c_dev))
+-              clk_disable_unprepare(i2c_dev->clk);
++              clk_disable(i2c_dev->clk);
+       return 0;
+ }
+@@ -2405,9 +2405,9 @@ static int __maybe_unused stm32f7_i2c_ru
+       int ret;
+       if (!stm32f7_i2c_is_slave_registered(i2c_dev)) {
+-              ret = clk_prepare_enable(i2c_dev->clk);
++              ret = clk_enable(i2c_dev->clk);
+               if (ret) {
+-                      dev_err(dev, "failed to prepare_enable clock\n");
++                      dev_err(dev, "failed to enable clock\n");
+                       return ret;
+               }
+       }
diff --git a/queue-6.6/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch b/queue-6.6/i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch
new file mode 100644 (file)
index 0000000..f21b026
--- /dev/null
@@ -0,0 +1,34 @@
+From 0c8d604dea437b69a861479b413d629bc9b3da70 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 23 Sep 2024 11:42:50 +0800
+Subject: i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 0c8d604dea437b69a861479b413d629bc9b3da70 upstream.
+
+It is not valid to call pm_runtime_set_suspended() for devices
+with runtime PM enabled because it returns -EAGAIN if it is enabled
+already and working. So, call pm_runtime_disable() before to fix it.
+
+Fixes: 36ecbcab84d0 ("i2c: xiic: Implement power management")
+Cc: <stable@vger.kernel.org> # v4.6+
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-xiic.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -1337,8 +1337,8 @@ static int xiic_i2c_probe(struct platfor
+       return 0;
+ err_pm_disable:
+-      pm_runtime_set_suspended(&pdev->dev);
+       pm_runtime_disable(&pdev->dev);
++      pm_runtime_set_suspended(&pdev->dev);
+       return ret;
+ }
diff --git a/queue-6.6/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch b/queue-6.6/i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch
new file mode 100644 (file)
index 0000000..0fc6a70
--- /dev/null
@@ -0,0 +1,75 @@
+From 521da1e9225450bd323db5fa5bca942b1dc485b7 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 21 Nov 2023 18:11:16 +0000
+Subject: i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
+
+Frequently an I2C write will be followed by a read, such as a register
+address write followed by a read of the register value. In this driver,
+when the TX FIFO half empty interrupt was raised and it was determined
+that there was enough space in the TX FIFO to send the following read
+command, it would do so without waiting for the TX FIFO to actually
+empty.
+
+Unfortunately it appears that in some cases this can result in a NAK
+that was raised by the target device on the write, such as due to an
+unsupported register address, being ignored and the subsequent read
+being done anyway. This can potentially put the I2C bus into an
+invalid state and/or result in invalid read data being processed.
+
+To avoid this, once a message has been fully written to the TX FIFO,
+wait for the TX FIFO empty interrupt before moving on to the next
+message, to ensure NAKs are handled properly.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Cc: <stable@vger.kernel.org> # v2.6.34+
+Reviewed-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-xiic.c |   19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -772,14 +772,17 @@ static irqreturn_t xiic_process(int irq,
+                       goto out;
+               }
+-              xiic_fill_tx_fifo(i2c);
+-
+-              /* current message sent and there is space in the fifo */
+-              if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) {
++              if (xiic_tx_space(i2c)) {
++                      xiic_fill_tx_fifo(i2c);
++              } else {
++                      /* current message fully written */
+                       dev_dbg(i2c->adap.dev.parent,
+                               "%s end of message sent, nmsgs: %d\n",
+                               __func__, i2c->nmsgs);
+-                      if (i2c->nmsgs > 1) {
++                      /* Don't move onto the next message until the TX FIFO empties,
++                       * to ensure that a NAK is not missed.
++                       */
++                      if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) {
+                               i2c->nmsgs--;
+                               i2c->tx_msg++;
+                               xfer_more = 1;
+@@ -790,11 +793,7 @@ static irqreturn_t xiic_process(int irq,
+                                       "%s Got TX IRQ but no more to do...\n",
+                                       __func__);
+                       }
+-              } else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1))
+-                      /* current frame is sent and is last,
+-                       * make sure to disable tx half
+-                       */
+-                      xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
++              }
+       }
+       if (pend & XIIC_INTR_BNB_MASK) {
diff --git a/queue-6.6/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch b/queue-6.6/media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch
new file mode 100644 (file)
index 0000000..4229bd3
--- /dev/null
@@ -0,0 +1,74 @@
+From bee1aed819a8cda47927436685d216906ed17f62 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <eagle.alexander923@gmail.com>
+Date: Thu, 29 Aug 2024 08:48:49 +0300
+Subject: media: i2c: ar0521: Use cansleep version of gpiod_set_value()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Shiyan <eagle.alexander923@gmail.com>
+
+commit bee1aed819a8cda47927436685d216906ed17f62 upstream.
+
+If we use GPIO reset from I2C port expander, we must use *_cansleep()
+variant of GPIO functions.
+This was not done in ar0521_power_on()/ar0521_power_off() functions.
+Let's fix that.
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c
+Modules linked in:
+CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53
+Hardware name: Diasom DS-RK3568-SOM-EVB (DT)
+Workqueue: events_unbound deferred_probe_work_func
+pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : gpiod_set_value+0x74/0x7c
+lr : ar0521_power_on+0xcc/0x290
+sp : ffffff8001d7ab70
+x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000
+x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088
+x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088
+x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80
+x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000
+x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930
+x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0
+x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780
+x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
+Call trace:
+ gpiod_set_value+0x74/0x7c
+ ar0521_power_on+0xcc/0x290
+...
+
+Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
+Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver")
+Cc: stable@vger.kernel.org
+Acked-by: Krzysztof HaÅ‚asa <khalasa@piap.pl>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ar0521.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ar0521.c
++++ b/drivers/media/i2c/ar0521.c
+@@ -847,7 +847,8 @@ static int ar0521_power_off(struct devic
+       clk_disable_unprepare(sensor->extclk);
+       if (sensor->reset_gpio)
+-              gpiod_set_value(sensor->reset_gpio, 1); /* assert RESET signal */
++              /* assert RESET signal */
++              gpiod_set_value_cansleep(sensor->reset_gpio, 1);
+       for (i = ARRAY_SIZE(ar0521_supply_names) - 1; i >= 0; i--) {
+               if (sensor->supplies[i])
+@@ -881,7 +882,7 @@ static int ar0521_power_on(struct device
+       if (sensor->reset_gpio)
+               /* deassert RESET signal */
+-              gpiod_set_value(sensor->reset_gpio, 0);
++              gpiod_set_value_cansleep(sensor->reset_gpio, 0);
+       usleep_range(4500, 5000); /* min 45000 clocks */
+       for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) {
diff --git a/queue-6.6/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch b/queue-6.6/memory-tegra186-emc-drop-unused-to_tegra186_emc.patch
new file mode 100644 (file)
index 0000000..aa35c9c
--- /dev/null
@@ -0,0 +1,36 @@
+From 67dd9e861add38755a7c5d29e25dd0f6cb4116ab Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Mon, 12 Aug 2024 14:30:55 +0200
+Subject: memory: tegra186-emc: drop unused to_tegra186_emc()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 67dd9e861add38755a7c5d29e25dd0f6cb4116ab upstream.
+
+to_tegra186_emc() is not used, W=1 builds:
+
+  tegra186-emc.c:38:36: error: unused function 'to_tegra186_emc' [-Werror,-Wunused-function]
+
+Fixes: 9a38cb27668e ("memory: tegra: Add interconnect support for DRAM scaling in Tegra234")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240812123055.124123-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memory/tegra/tegra186-emc.c |    5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/memory/tegra/tegra186-emc.c
++++ b/drivers/memory/tegra/tegra186-emc.c
+@@ -35,11 +35,6 @@ struct tegra186_emc {
+       struct icc_provider provider;
+ };
+-static inline struct tegra186_emc *to_tegra186_emc(struct icc_provider *provider)
+-{
+-      return container_of(provider, struct tegra186_emc, provider);
+-}
+-
+ /*
+  * debugfs interface
+  *
diff --git a/queue-6.6/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch b/queue-6.6/ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch
new file mode 100644 (file)
index 0000000..eae3421
--- /dev/null
@@ -0,0 +1,91 @@
+From 6c4a5f96450415735c31ed70ff354f0ee5cbf67b Mon Sep 17 00:00:00 2001
+From: Mike Baynton <mike@mbaynton.com>
+Date: Wed, 10 Jul 2024 22:52:04 -0500
+Subject: ovl: fail if trusted xattrs are needed but caller lacks permission
+
+From: Mike Baynton <mike@mbaynton.com>
+
+commit 6c4a5f96450415735c31ed70ff354f0ee5cbf67b upstream.
+
+Some overlayfs features require permission to read/write trusted.*
+xattrs. These include redirect_dir, verity, metacopy, and data-only
+layers. This patch adds additional validations at mount time to stop
+overlays from mounting in certain cases where the resulting mount would
+not function according to the user's expectations because they lack
+permission to access trusted.* xattrs (for example, not global root.)
+
+Similar checks in ovl_make_workdir() that disable features instead of
+failing are still relevant and used in cases where the resulting mount
+can still work "reasonably well." Generally, if the feature was enabled
+through kernel config or module option, any mount that worked before
+will still work the same; this applies to redirect_dir and metacopy. The
+user must explicitly request these features in order to generate a mount
+failure. Verity and data-only layers on the other hand must be explictly
+requested and have no "reasonable" disabled or degraded alternative, so
+mounts attempting either always fail.
+
+"lower data-only dirs require metacopy support" moved down in case
+userxattr is set, which disables metacopy.
+
+Cc: stable@vger.kernel.org # v6.6+
+Signed-off-by: Mike Baynton <mike@mbaynton.com>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/params.c |   38 +++++++++++++++++++++++++++++++++-----
+ 1 file changed, 33 insertions(+), 5 deletions(-)
+
+--- a/fs/overlayfs/params.c
++++ b/fs/overlayfs/params.c
+@@ -761,11 +761,6 @@ int ovl_fs_params_verify(const struct ov
+ {
+       struct ovl_opt_set set = ctx->set;
+-      if (ctx->nr_data > 0 && !config->metacopy) {
+-              pr_err("lower data-only dirs require metacopy support.\n");
+-              return -EINVAL;
+-      }
+-
+       /* Workdir/index are useless in non-upper mount */
+       if (!config->upperdir) {
+               if (config->workdir) {
+@@ -917,6 +912,39 @@ int ovl_fs_params_verify(const struct ov
+               config->metacopy = false;
+       }
++      /*
++       * Fail if we don't have trusted xattr capability and a feature was
++       * explicitly requested that requires them.
++       */
++      if (!config->userxattr && !capable(CAP_SYS_ADMIN)) {
++              if (set.redirect &&
++                  config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
++                      pr_err("redirect_dir requires permission to access trusted xattrs\n");
++                      return -EPERM;
++              }
++              if (config->metacopy && set.metacopy) {
++                      pr_err("metacopy requires permission to access trusted xattrs\n");
++                      return -EPERM;
++              }
++              if (config->verity_mode) {
++                      pr_err("verity requires permission to access trusted xattrs\n");
++                      return -EPERM;
++              }
++              if (ctx->nr_data > 0) {
++                      pr_err("lower data-only dirs require permission to access trusted xattrs\n");
++                      return -EPERM;
++              }
++              /*
++               * Other xattr-dependent features should be disabled without
++               * great disturbance to the user in ovl_make_workdir().
++               */
++      }
++
++      if (ctx->nr_data > 0 && !config->metacopy) {
++              pr_err("lower data-only dirs require metacopy support.\n");
++              return -EINVAL;
++      }
++
+       return 0;
+ }
diff --git a/queue-6.6/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch b/queue-6.6/platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
new file mode 100644 (file)
index 0000000..bebdf87
--- /dev/null
@@ -0,0 +1,122 @@
+From 7d59ac07ccb58f8f604f8057db63b8efcebeb3de Mon Sep 17 00:00:00 2001
+From: Zach Wade <zachwade.k@gmail.com>
+Date: Mon, 23 Sep 2024 22:45:08 +0800
+Subject: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+
+From: Zach Wade <zachwade.k@gmail.com>
+
+commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
+
+Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds".
+kasan report:
+[   19.411889] ==================================================================
+[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113
+[   19.417368]
+[   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10
+[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022
+[   19.422687] Call Trace:
+[   19.424091]  <TASK>
+[   19.425448]  dump_stack_lvl+0x5d/0x80
+[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[   19.428694]  print_report+0x19d/0x52e
+[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[   19.433539]  kasan_report+0xf0/0x170
+[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10
+[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common]
+[   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]
+[   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360
+[   19.444797]  cpuhp_invoke_callback+0x221/0xec0
+[   19.446337]  cpuhp_thread_fun+0x21b/0x610
+[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10
+[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0
+[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10
+[   19.452405]  kthread+0x29c/0x350
+[   19.453817]  ? __pfx_kthread+0x10/0x10
+[   19.455253]  ret_from_fork+0x31/0x70
+[   19.456685]  ? __pfx_kthread+0x10/0x10
+[   19.458114]  ret_from_fork_asm+0x1a/0x30
+[   19.459573]  </TASK>
+[   19.460853]
+[   19.462055] Allocated by task 1198:
+[   19.463410]  kasan_save_stack+0x30/0x50
+[   19.464788]  kasan_save_track+0x14/0x30
+[   19.466139]  __kasan_kmalloc+0xaa/0xb0
+[   19.467465]  __kmalloc+0x1cd/0x470
+[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common]
+[   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]
+[   19.471670]  do_one_initcall+0xa4/0x380
+[   19.472903]  do_init_module+0x238/0x760
+[   19.474105]  load_module+0x5239/0x6f00
+[   19.475285]  init_module_from_file+0xd1/0x130
+[   19.476506]  idempotent_init_module+0x23b/0x650
+[   19.477725]  __x64_sys_finit_module+0xbe/0x130
+[   19.476506]  idempotent_init_module+0x23b/0x650
+[   19.477725]  __x64_sys_finit_module+0xbe/0x130
+[   19.478920]  do_syscall_64+0x82/0x160
+[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[   19.481292]
+[   19.482205] The buggy address belongs to the object at ffff888829e65000
+ which belongs to the cache kmalloc-512 of size 512
+[   19.484818] The buggy address is located 0 bytes to the right of
+ allocated 512-byte region [ffff888829e65000, ffff888829e65200)
+[   19.487447]
+[   19.488328] The buggy address belongs to the physical page:
+[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60
+[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)
+[   19.493914] page_type: 0xffffffff()
+[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff
+[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
+[   19.503784] page dumped because: kasan: bad access detected
+[   19.505058]
+[   19.505970] Memory state around the buggy address:
+[   19.507172]  ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[   19.508599]  ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[   19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[   19.510014]                    ^
+[   19.510016]  ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[   19.510018]  ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[   19.515367] ==================================================================
+
+The reason for this error is physical_package_ids assigned by VMware VMM
+are not continuous and have gaps. This will cause value returned by
+topology_physical_package_id() to be more than topology_max_packages().
+
+Here the allocation uses topology_max_packages(). The call to
+topology_max_packages() returns maximum logical package ID not physical
+ID. Hence use topology_logical_package_id() instead of
+topology_physical_package_id().
+
+Fixes: 9a1aac8a96dc ("platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering")
+Cc: stable@vger.kernel.org
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Zach Wade <zachwade.k@gmail.com>
+Link: https://lore.kernel.org/r/20240923144508.1764-1-zachwade.k@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/speed_select_if/isst_if_common.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+@@ -316,7 +316,9 @@ static struct pci_dev *_isst_if_get_pci_
+           cpu >= nr_cpu_ids || cpu >= num_possible_cpus())
+               return NULL;
+-      pkg_id = topology_physical_package_id(cpu);
++      pkg_id = topology_logical_package_id(cpu);
++      if (pkg_id >= topology_max_packages())
++              return NULL;
+       bus_number = isst_cpu_info[cpu].bus_info[bus_no];
+       if (bus_number < 0)
diff --git a/queue-6.6/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch b/queue-6.6/power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
new file mode 100644 (file)
index 0000000..41cbc66
--- /dev/null
@@ -0,0 +1,41 @@
+From e50a57d16f897e45de1112eb6478577b197fab52 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 8 Sep 2024 20:53:37 +0200
+Subject: power: supply: hwmon: Fix missing temp1_max_alarm attribute
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
+
+Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for
+power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX
+property.
+
+HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for
+temp channel 0, causing the hwmon temp1_max_alarm attribute to be
+missing from such power_supply devices.
+
+Add this to power_supply_hwmon_info to fix this.
+
+Fixes: f1d33ae806ec ("power: supply: remove duplicated argument in power_supply_hwmon_info")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240908185337.103696-2-hdegoede@redhat.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/power_supply_hwmon.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/supply/power_supply_hwmon.c
++++ b/drivers/power/supply/power_supply_hwmon.c
+@@ -299,7 +299,8 @@ static const struct hwmon_channel_info *
+                          HWMON_T_INPUT     |
+                          HWMON_T_MAX       |
+                          HWMON_T_MIN       |
+-                         HWMON_T_MIN_ALARM,
++                         HWMON_T_MIN_ALARM |
++                         HWMON_T_MAX_ALARM,
+                          HWMON_T_LABEL     |
+                          HWMON_T_INPUT     |
diff --git a/queue-6.6/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch b/queue-6.6/revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch
new file mode 100644 (file)
index 0000000..328471f
--- /dev/null
@@ -0,0 +1,74 @@
+From 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 2 Oct 2024 17:59:39 +0200
+Subject: Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream.
+
+This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4.
+
+The fix seems leading to regressions for other systems.
+Also, the way to check the presence of IOMMU via get_dma_ops() isn't
+reliable and it's no longer applicable for 6.12.  After all, it's no
+right fix, so let's revert it at first.
+
+To be noted, the PCM buffer allocation has been changed to try the
+continuous pages at first since 6.12, so the problem could be already
+addressed without this hackish workaround.
+
+Reported-by: Salvatore Bonaccorso <carnil@debian.org>
+Closes: https://lore.kernel.org/ZvgCdYfKgwHpJXGE@eldamar.lan
+Link: https://patch.msgid.link/20241002155948.4859-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_controller.h |    2 +-
+ sound/pci/hda/hda_intel.c      |   10 +---------
+ 2 files changed, 2 insertions(+), 10 deletions(-)
+
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -28,7 +28,7 @@
+ #else
+ #define AZX_DCAPS_I915_COMPONENT 0            /* NOP */
+ #endif
+-#define AZX_DCAPS_AMD_ALLOC_FIX       (1 << 14)       /* AMD allocation workaround */
++/* 14 unused */
+ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15)    /* X-Fi workaround */
+ #define AZX_DCAPS_POSFIX_LPIB (1 << 16)       /* Use LPIB as default */
+ #define AZX_DCAPS_AMD_WORKAROUND (1 << 17)    /* AMD-specific workaround */
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -40,7 +40,6 @@
+ #ifdef CONFIG_X86
+ /* for snoop control */
+-#include <linux/dma-map-ops.h>
+ #include <asm/set_memory.h>
+ #include <asm/cpufeature.h>
+ #endif
+@@ -302,7 +301,7 @@ enum {
+ /* quirks for ATI HDMI with snoop off */
+ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \
+-      (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX)
++      (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
+ /* quirks for AMD SB */
+ #define AZX_DCAPS_PRESET_AMD_SB \
+@@ -1716,13 +1715,6 @@ static void azx_check_snoop_available(st
+       if (chip->driver_caps & AZX_DCAPS_SNOOP_OFF)
+               snoop = false;
+-#ifdef CONFIG_X86
+-      /* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */
+-      if ((chip->driver_caps & AZX_DCAPS_AMD_ALLOC_FIX) &&
+-          !get_dma_ops(chip->card->dev))
+-              snoop = false;
+-#endif
+-
+       chip->snoop = snoop;
+       if (!snoop) {
+               dev_info(chip->card->dev, "Force to non-snoop mode\n");
diff --git a/queue-6.6/rust-sync-require-t-sync-for-lockedby-access.patch b/queue-6.6/rust-sync-require-t-sync-for-lockedby-access.patch
new file mode 100644 (file)
index 0000000..7b35b17
--- /dev/null
@@ -0,0 +1,73 @@
+From a8ee30f45d5d57467ddb7877ed6914d0eba0af7f Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Sun, 15 Sep 2024 14:41:28 +0000
+Subject: rust: sync: require `T: Sync` for `LockedBy::access`
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit a8ee30f45d5d57467ddb7877ed6914d0eba0af7f upstream.
+
+The `LockedBy::access` method only requires a shared reference to the
+owner, so if we have shared access to the `LockedBy` from several
+threads at once, then two threads could call `access` in parallel and
+both obtain a shared reference to the inner value. Thus, require that
+`T: Sync` when calling the `access` method.
+
+An alternative is to require `T: Sync` in the `impl Sync for LockedBy`.
+This patch does not choose that approach as it gives up the ability to
+use `LockedBy` with `!Sync` types, which is okay as long as you only use
+`access_mut`.
+
+Cc: stable@vger.kernel.org
+Fixes: 7b1f55e3a984 ("rust: sync: introduce `LockedBy`")
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Suggested-by: Boqun Feng <boqun.feng@gmail.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://lore.kernel.org/r/20240915-locked-by-sync-fix-v2-1-1a8d89710392@google.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/sync/locked_by.rs |   18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/rust/kernel/sync/locked_by.rs
++++ b/rust/kernel/sync/locked_by.rs
+@@ -80,8 +80,12 @@ pub struct LockedBy<T: ?Sized, U: ?Sized
+ // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
+ unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
+-// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the
+-// data it protects is `Send`.
++// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use
++// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is
++// sufficient to allow that.
++//
++// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain
++// several `&T` from several threads at once. However, this is okay as `T` is `Sync`.
+ unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
+ impl<T, U> LockedBy<T, U> {
+@@ -115,7 +119,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {
+     ///
+     /// Panics if `owner` is different from the data protected by the lock used in
+     /// [`new`](LockedBy::new).
+-    pub fn access<'a>(&'a self, owner: &'a U) -> &'a T {
++    pub fn access<'a>(&'a self, owner: &'a U) -> &'a T
++    where
++        T: Sync,
++    {
+         build_assert!(
+             size_of::<U>() > 0,
+             "`U` cannot be a ZST because `owner` wouldn't be unique"
+@@ -124,7 +131,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {
+             panic!("mismatched owners");
+         }
+-        // SAFETY: `owner` is evidence that the owner is locked.
++        // SAFETY: `owner` is evidence that there are only shared references to the owner for the
++        // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable
++        // reference to the inner value that aliases with this shared reference. The type is `Sync`
++        // so there are no other requirements.
+         unsafe { &*self.data.get() }
+     }
index 2a2fc2ba0185c39851bcf1d4438fe153f76cbbc4..07c2ee7b608184a77e246e6523dd17fc2821120a 100644 (file)
@@ -202,3 +202,19 @@ selftests-mm-fix-charge_reserved_hugetlb.sh-test.patch
 powerpc-vdso-fix-vdso-data-access-when-running-in-a-.patch
 selftests-vdso-fix-elf-hash-table-entry-size-for-s39.patch
 selftests-vdso-fix-vdso_config-for-s390.patch
+revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch
+platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
+i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch
+i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch
+i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch
+media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch
+i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch
+i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch
+rust-sync-require-t-sync-for-lockedby-access.patch
+ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch
+firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch
+memory-tegra186-emc-drop-unused-to_tegra186_emc.patch
+dt-bindings-clock-exynos7885-fix-duplicated-binding.patch
+spi-bcm63xx-fix-module-autoloading.patch
+spi-bcm63xx-fix-missing-pm_runtime_disable.patch
+power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
diff --git a/queue-6.6/spi-bcm63xx-fix-missing-pm_runtime_disable.patch b/queue-6.6/spi-bcm63xx-fix-missing-pm_runtime_disable.patch
new file mode 100644 (file)
index 0000000..46b52dd
--- /dev/null
@@ -0,0 +1,53 @@
+From 265697288ec2160ca84707565d6641d46f69b0ff Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 19 Aug 2024 20:33:49 +0800
+Subject: spi: bcm63xx: Fix missing pm_runtime_disable()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 265697288ec2160ca84707565d6641d46f69b0ff upstream.
+
+The pm_runtime_disable() is missing in the remove function, fix it
+by using devm_pm_runtime_enable(), so the pm_runtime_disable() in
+the probe error path can also be removed.
+
+Fixes: 2d13f2ff6073 ("spi: bcm63xx-spi: fix pm_runtime")
+Cc: stable@vger.kernel.org # v5.13+
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20240819123349.4020472-3-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -584,13 +584,15 @@ static int bcm63xx_spi_probe(struct plat
+       bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
+-      pm_runtime_enable(&pdev->dev);
++      ret = devm_pm_runtime_enable(&pdev->dev);
++      if (ret)
++              goto out_clk_disable;
+       /* register and we are done */
+       ret = devm_spi_register_controller(dev, host);
+       if (ret) {
+               dev_err(dev, "spi register failed\n");
+-              goto out_pm_disable;
++              goto out_clk_disable;
+       }
+       dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
+@@ -598,8 +600,6 @@ static int bcm63xx_spi_probe(struct plat
+       return 0;
+-out_pm_disable:
+-      pm_runtime_disable(&pdev->dev);
+ out_clk_disable:
+       clk_disable_unprepare(clk);
+ out_err:
diff --git a/queue-6.6/spi-bcm63xx-fix-module-autoloading.patch b/queue-6.6/spi-bcm63xx-fix-module-autoloading.patch
new file mode 100644 (file)
index 0000000..4fac79b
--- /dev/null
@@ -0,0 +1,33 @@
+From 909f34f2462a99bf876f64c5c61c653213e32fce Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 19 Aug 2024 20:33:48 +0800
+Subject: spi: bcm63xx: Fix module autoloading
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
+based on the alias from platform_device_id table.
+
+Fixes: 44d8fb30941d ("spi/bcm63xx: move register definitions into the driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20240819123349.4020472-2-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -466,6 +466,7 @@ static const struct platform_device_id b
+       {
+       },
+ };
++MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match);
+ static const struct of_device_id bcm63xx_spi_of_match[] = {
+       { .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },