--- /dev/null
+From 1442ee0011983f0c5c4b92380e6853afb513841a Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Wed, 2 Oct 2024 21:49:59 +0100
+Subject: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 1442ee0011983f0c5c4b92380e6853afb513841a upstream.
+
+Kunkun Jiang reported that there is a small window of opportunity for
+userspace to force a change of affinity for a VPE while the VPE has already
+been unmapped, but the corresponding doorbell interrupt still visible in
+/proc/irq/.
+
+Plug the race by checking the value of vmapp_count, which tracks whether
+the VPE is mapped ot not, and returning an error in this case.
+
+This involves making vmapp_count common to both GICv4.1 and its v4.0
+ancestor.
+
+Fixes: 64edfaa9a234 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP")
+Reported-by: Kunkun Jiang <jiangkunkun@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/c182ece6-2ba0-ce4f-3404-dba7a3ab6c52@huawei.com
+Link: https://lore.kernel.org/all/20241002204959.2051709-1-maz@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 18 ++++++++++++------
+ include/linux/irqchip/arm-gic-v4.h | 4 +++-
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -797,8 +797,8 @@ static struct its_vpe *its_build_vmapp_c
+ its_encode_valid(cmd, desc->its_vmapp_cmd.valid);
+
+ if (!desc->its_vmapp_cmd.valid) {
++ alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count);
+ if (is_v4_1(its)) {
+- alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count);
+ its_encode_alloc(cmd, alloc);
+ /*
+ * Unmapping a VPE is self-synchronizing on GICv4.1,
+@@ -817,13 +817,13 @@ static struct its_vpe *its_build_vmapp_c
+ its_encode_vpt_addr(cmd, vpt_addr);
+ its_encode_vpt_size(cmd, LPI_NRBITS - 1);
+
++ alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);
++
+ if (!is_v4_1(its))
+ goto out;
+
+ vconf_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->its_vm->vprop_page));
+
+- alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count);
+-
+ its_encode_alloc(cmd, alloc);
+
+ /*
+@@ -3807,6 +3807,13 @@ static int its_vpe_set_affinity(struct i
+ unsigned long flags;
+
+ /*
++ * Check if we're racing against a VPE being destroyed, for
++ * which we don't want to allow a VMOVP.
++ */
++ if (!atomic_read(&vpe->vmapp_count))
++ return -EINVAL;
++
++ /*
+ * Changing affinity is mega expensive, so let's be as lazy as
+ * we can and only do it if we really have to. Also, if mapped
+ * into the proxy device, we need to move the doorbell
+@@ -4463,9 +4470,8 @@ static int its_vpe_init(struct its_vpe *
+ raw_spin_lock_init(&vpe->vpe_lock);
+ vpe->vpe_id = vpe_id;
+ vpe->vpt_page = vpt_page;
+- if (gic_rdists->has_rvpeid)
+- atomic_set(&vpe->vmapp_count, 0);
+- else
++ atomic_set(&vpe->vmapp_count, 0);
++ if (!gic_rdists->has_rvpeid)
+ vpe->vpe_proxy_event = -1;
+
+ return 0;
+--- a/include/linux/irqchip/arm-gic-v4.h
++++ b/include/linux/irqchip/arm-gic-v4.h
+@@ -66,10 +66,12 @@ struct its_vpe {
+ bool enabled;
+ bool group;
+ } sgi_config[16];
+- atomic_t vmapp_count;
+ };
+ };
+
++ /* Track the VPE being mapped */
++ atomic_t vmapp_count;
++
+ /*
+ * Ensures mutual exclusion between affinity setting of the
+ * vPE and vLPI operations using vpe->col_idx.
--- /dev/null
+From 6eabf656048d904d961584de2e1d45bc0854f9fb Mon Sep 17 00:00:00 2001
+From: Charlie Jenkins <charlie@rivosinc.com>
+Date: Tue, 3 Sep 2024 16:36:19 -0700
+Subject: irqchip/sifive-plic: Return error code on failure
+
+From: Charlie Jenkins <charlie@rivosinc.com>
+
+commit 6eabf656048d904d961584de2e1d45bc0854f9fb upstream.
+
+Set error to -ENOMEM if kcalloc() fails or if irq_domain_add_linear()
+fails inside of plic_probe() instead of returning 0.
+
+Fixes: 4d936f10ff80 ("irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20240903-correct_error_codes_sifive_plic-v1-1-d929b79663a2@rivosinc.com
+Closes: https://lore.kernel.org/r/202409031122.yBh8HrxA-lkp@intel.com/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -578,8 +578,10 @@ static int plic_probe(struct fwnode_hand
+
+ handler->enable_save = kcalloc(DIV_ROUND_UP(nr_irqs, 32),
+ sizeof(*handler->enable_save), GFP_KERNEL);
+- if (!handler->enable_save)
++ if (!handler->enable_save) {
++ error = -ENOMEM;
+ goto fail_cleanup_contexts;
++ }
+ done:
+ for (hwirq = 1; hwirq <= nr_irqs; hwirq++) {
+ plic_toggle(handler, hwirq, 0);
+@@ -591,8 +593,10 @@ done:
+
+ priv->irqdomain = irq_domain_add_linear(to_of_node(fwnode), nr_irqs + 1,
+ &plic_irqdomain_ops, priv);
+- if (WARN_ON(!priv->irqdomain))
++ if (WARN_ON(!priv->irqdomain)) {
++ error = -ENOMEM;
+ goto fail_cleanup_contexts;
++ }
+
+ /*
+ * We can have multiple PLIC instances so setup global state
--- /dev/null
+From 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 Mon Sep 17 00:00:00 2001
+From: Nam Cao <namcao@linutronix.de>
+Date: Thu, 3 Oct 2024 10:41:52 +0200
+Subject: irqchip/sifive-plic: Unmask interrupt in plic_irq_enable()
+
+From: Nam Cao <namcao@linutronix.de>
+
+commit 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 upstream.
+
+It is possible that an interrupt is disabled and masked at the same time.
+When the interrupt is enabled again by enable_irq(), only plic_irq_enable()
+is called, not plic_irq_unmask(). The interrupt remains masked and never
+raises.
+
+An example where interrupt is both disabled and masked is when
+handle_fasteoi_irq() is the handler, and IRQS_ONESHOT is set. The interrupt
+handler:
+
+ 1. Mask the interrupt
+ 2. Handle the interrupt
+ 3. Check if interrupt is still enabled, and unmask it (see
+ cond_unmask_eoi_irq())
+
+If another task disables the interrupt in the middle of the above steps,
+the interrupt will not get unmasked, and will remain masked when it is
+enabled in the future.
+
+The problem is occasionally observed when PREEMPT_RT is enabled, because
+PREEMPT_RT adds the IRQS_ONESHOT flag. But PREEMPT_RT only makes the problem
+more likely to appear, the bug has been around since commit a1706a1c5062
+("irqchip/sifive-plic: Separate the enable and mask operations").
+
+Fix it by unmasking interrupt in plic_irq_enable().
+
+Fixes: a1706a1c5062 ("irqchip/sifive-plic: Separate the enable and mask operations")
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20241003084152.2422969-1-namcao@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -123,16 +123,6 @@ static inline void plic_irq_toggle(const
+ }
+ }
+
+-static void plic_irq_enable(struct irq_data *d)
+-{
+- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
+-}
+-
+-static void plic_irq_disable(struct irq_data *d)
+-{
+- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
+-}
+-
+ static void plic_irq_unmask(struct irq_data *d)
+ {
+ struct plic_priv *priv = irq_data_get_irq_chip_data(d);
+@@ -147,6 +137,17 @@ static void plic_irq_mask(struct irq_dat
+ writel(0, priv->regs + PRIORITY_BASE + d->hwirq * PRIORITY_PER_ID);
+ }
+
++static void plic_irq_enable(struct irq_data *d)
++{
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1);
++ plic_irq_unmask(d);
++}
++
++static void plic_irq_disable(struct irq_data *d)
++{
++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0);
++}
++
+ static void plic_irq_eoi(struct irq_data *d)
+ {
+ struct plic_handler *handler = this_cpu_ptr(&plic_handlers);
--- /dev/null
+From 665a58fe663ac7a9ea618dc0b29881649324b116 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Thu, 5 Sep 2024 10:09:17 +0800
+Subject: pinctrl: apple: check devm_kasprintf() returned value
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 665a58fe663ac7a9ea618dc0b29881649324b116 upstream.
+
+devm_kasprintf() can return a NULL pointer on failure but this returned
+value is not checked. Fix this lack and check the returned value.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: a0f160ffcb83 ("pinctrl: add pinctrl/GPIO driver for Apple SoCs")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Reviewed-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/20240905020917.356534-1-make24@iscas.ac.cn
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-apple-gpio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pinctrl/pinctrl-apple-gpio.c
++++ b/drivers/pinctrl/pinctrl-apple-gpio.c
+@@ -474,6 +474,9 @@ static int apple_gpio_pinctrl_probe(stru
+ for (i = 0; i < npins; i++) {
+ pins[i].number = i;
+ pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i);
++ if (!pins[i].name)
++ return -ENOMEM;
++
+ pins[i].drv_data = pctl;
+ pin_names[i] = pins[i].name;
+ pin_nums[i] = i;
--- /dev/null
+From 16a6d2e685e8f9a2f51dd5a363d3f97fcad35e22 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 26 Sep 2024 16:11:02 +0200
+Subject: pinctrl: intel: platform: fix error path in device_for_each_child_node()
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 16a6d2e685e8f9a2f51dd5a363d3f97fcad35e22 upstream.
+
+The device_for_each_child_node() loop requires calls to
+fwnode_handle_put() upon early returns to decrement the refcount of
+the child node and avoid leaking memory if that error path is triggered.
+
+There is one early returns within that loop in
+intel_platform_pinctrl_prepare_community(), but fwnode_handle_put() is
+missing.
+
+Instead of adding the missing call, the scoped version of the loop can
+be used to simplify the code and avoid mistakes in the future if new
+early returns are added, as the child node is only used for parsing, and
+it is never assigned.
+
+Cc: stable@vger.kernel.org
+Fixes: c5860e4a2737 ("pinctrl: intel: Add a generic Intel pin control platform driver")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/intel/pinctrl-intel-platform.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-intel-platform.c
++++ b/drivers/pinctrl/intel/pinctrl-intel-platform.c
+@@ -90,7 +90,6 @@ static int intel_platform_pinctrl_prepar
+ struct intel_community *community,
+ struct intel_platform_pins *pins)
+ {
+- struct fwnode_handle *child;
+ struct intel_padgroup *gpps;
+ unsigned int group;
+ size_t ngpps;
+@@ -131,7 +130,7 @@ static int intel_platform_pinctrl_prepar
+ return -ENOMEM;
+
+ group = 0;
+- device_for_each_child_node(dev, child) {
++ device_for_each_child_node_scoped(dev, child) {
+ struct intel_padgroup *gpp = &gpps[group];
+
+ gpp->reg_num = group;
--- /dev/null
+From 3fd976afe9743110f20a23f93b7ff9693f2be4bf Mon Sep 17 00:00:00 2001
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Date: Thu, 10 Oct 2024 13:52:37 -0700
+Subject: pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+commit 3fd976afe9743110f20a23f93b7ff9693f2be4bf upstream.
+
+'new_map' is allocated using devm_* which takes care of freeing the
+allocated data on device removal, call to
+
+ .dt_free_map = pinconf_generic_dt_free_map
+
+double frees the map as pinconf_generic_dt_free_map() calls
+pinctrl_utils_free_map().
+
+Fix this by using kcalloc() instead of auto-managed devm_kcalloc().
+
+Cc: stable@vger.kernel.org
+Fixes: f805e356313b ("pinctrl: nuvoton: Add ma35d1 pinctrl and GPIO driver")
+Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Link: https://lore.kernel.org/20241010205237.1245318-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/nuvoton/pinctrl-ma35.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
+index 1fa00a23534a..59c4e7c6cdde 100644
+--- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
++++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
+@@ -218,7 +218,7 @@ static int ma35_pinctrl_dt_node_to_map_func(struct pinctrl_dev *pctldev,
+ }
+
+ map_num += grp->npins;
+- new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map), GFP_KERNEL);
++ new_map = kcalloc(map_num, sizeof(*new_map), GFP_KERNEL);
+ if (!new_map)
+ return -ENOMEM;
+
+--
+2.47.0
+
--- /dev/null
+From 93b8ddc54507a227087c60a0013ed833b6ae7d3c Mon Sep 17 00:00:00 2001
+From: Sergey Matsievskiy <matsievskiysv@gmail.com>
+Date: Sat, 12 Oct 2024 13:57:43 +0300
+Subject: pinctrl: ocelot: fix system hang on level based interrupts
+
+From: Sergey Matsievskiy <matsievskiysv@gmail.com>
+
+commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c upstream.
+
+The current implementation only calls chained_irq_enter() and
+chained_irq_exit() if it detects pending interrupts.
+
+```
+for (i = 0; i < info->stride; i++) {
+ uregmap_read(info->map, id_reg + 4 * i, ®);
+ if (!reg)
+ continue;
+
+ chained_irq_enter(parent_chip, desc);
+```
+
+However, in case of GPIO pin configured in level mode and the parent
+controller configured in edge mode, GPIO interrupt might be lowered by the
+hardware. In the result, if the interrupt is short enough, the parent
+interrupt is still pending while the GPIO interrupt is cleared;
+chained_irq_enter() never gets called and the system hangs trying to
+service the parent interrupt.
+
+Moving chained_irq_enter() and chained_irq_exit() outside the for loop
+ensures that they are called even when GPIO interrupt is lowered by the
+hardware.
+
+The similar code with chained_irq_enter() / chained_irq_exit() functions
+wrapping interrupt checking loop may be found in many other drivers:
+```
+grep -r -A 10 chained_irq_enter drivers/pinctrl
+```
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Sergey Matsievskiy <matsievskiysv@gmail.com>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-ocelot.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-ocelot.c
++++ b/drivers/pinctrl/pinctrl-ocelot.c
+@@ -1955,21 +1955,21 @@ static void ocelot_irq_handler(struct ir
+ unsigned int reg = 0, irq, i;
+ unsigned long irqs;
+
++ chained_irq_enter(parent_chip, desc);
++
+ for (i = 0; i < info->stride; i++) {
+ regmap_read(info->map, id_reg + 4 * i, ®);
+ if (!reg)
+ continue;
+
+- chained_irq_enter(parent_chip, desc);
+-
+ irqs = reg;
+
+ for_each_set_bit(irq, &irqs,
+ min(32U, info->desc->npins - 32 * i))
+ generic_handle_domain_irq(chip->irq.domain, irq + 32 * i);
+-
+- chained_irq_exit(parent_chip, desc);
+ }
++
++ chained_irq_exit(parent_chip, desc);
+ }
+
+ static int ocelot_gpiochip_register(struct platform_device *pdev,
--- /dev/null
+From b0f0e3f0552a566def55c844b0d44250c58e4df6 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 6 Sep 2024 18:03:26 +0800
+Subject: pinctrl: stm32: check devm_kasprintf() returned value
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit b0f0e3f0552a566def55c844b0d44250c58e4df6 upstream.
+
+devm_kasprintf() can return a NULL pointer on failure but this returned
+value is not checked. Fix this lack and check the returned value.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://lore.kernel.org/20240906100326.624445-1-make24@iscas.ac.cn
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1374,10 +1374,15 @@ static int stm32_gpiolib_register_bank(s
+
+ for (i = 0; i < npins; i++) {
+ stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
+- if (stm32_pin && stm32_pin->pin.name)
++ if (stm32_pin && stm32_pin->pin.name) {
+ names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name);
+- else
++ if (!names[i]) {
++ err = -ENOMEM;
++ goto err_clk;
++ }
++ } else {
+ names[i] = NULL;
++ }
+ }
+
+ bank->gpio_chip.names = (const char * const *)names;
--- /dev/null
+From 23ee4a25661c33e6381d41e848a9060ed6d72845 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 9 Oct 2024 16:51:05 +0200
+Subject: serial: qcom-geni: fix dma rx cancellation
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 23ee4a25661c33e6381d41e848a9060ed6d72845 upstream.
+
+Make sure to wait for the DMA transfer to complete when cancelling the
+rx command on stop_rx(). This specifically prevents the DMA completion
+interrupt from firing after rx has been restarted, something which can
+lead to an IOMMU fault and hosed rx when the interrupt handler unmaps
+the DMA buffer for the new command:
+
+ qcom_geni_serial 988000.serial: serial engine reports 0 RX bytes in!
+ arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x563
+ arm-smmu 15000000.iommu: FSYNR0 = 00210013 [S1CBNDX=33 WNR PLVL=3]
+ Bluetooth: hci0: command 0xfc00 tx timeout
+ Bluetooth: hci0: Reading QCA version information failed (-110)
+
+Also add the missing state machine reset which is needed in case
+cancellation fails.
+
+Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
+Cc: stable@vger.kernel.org # 6.3
+Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20241009145110.16847-5-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -787,17 +787,27 @@ static void qcom_geni_serial_start_rx_fi
+ static void qcom_geni_serial_stop_rx_dma(struct uart_port *uport)
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport);
++ bool done;
+
+ if (!qcom_geni_serial_secondary_active(uport))
+ return;
+
+ geni_se_cancel_s_cmd(&port->se);
+- qcom_geni_serial_poll_bit(uport, SE_GENI_S_IRQ_STATUS,
+- S_CMD_CANCEL_EN, true);
+-
+- if (qcom_geni_serial_secondary_active(uport))
++ done = qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT,
++ RX_EOT, true);
++ if (done) {
++ writel(RX_EOT | RX_DMA_DONE,
++ uport->membase + SE_DMA_RX_IRQ_CLR);
++ } else {
+ qcom_geni_serial_abort_rx(uport);
+
++ writel(1, uport->membase + SE_DMA_RX_FSM_RST);
++ qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT,
++ RX_RESET_DONE, true);
++ writel(RX_RESET_DONE | RX_DMA_DONE,
++ uport->membase + SE_DMA_RX_IRQ_CLR);
++ }
++
+ if (port->rx_dma_addr) {
+ geni_se_rx_dma_unprep(&port->se, port->rx_dma_addr,
+ DMA_RX_BUF_SIZE);
--- /dev/null
+From 4bef7c6f299910f19876ad8e7f5897514855f1d2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 9 Oct 2024 16:51:02 +0200
+Subject: serial: qcom-geni: fix polled console initialisation
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 4bef7c6f299910f19876ad8e7f5897514855f1d2 upstream.
+
+The polled console (KGDB/KDB) implementation must not call port setup
+unconditionally as the port may already be in use by the console or a
+getty.
+
+Only make sure that the receiver is enabled, but do not enable any
+device interrupts.
+
+Fixes: d8851a96ba25 ("tty: serial: qcom-geni-serial: Add a poll_init() function")
+Cc: stable@vger.kernel.org # 6.4
+Cc: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20241009145110.16847-2-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -146,6 +146,7 @@ static struct uart_driver qcom_geni_cons
+ static struct uart_driver qcom_geni_uart_driver;
+
+ static void qcom_geni_serial_cancel_tx_cmd(struct uart_port *uport);
++static int qcom_geni_serial_port_setup(struct uart_port *uport);
+
+ static inline struct qcom_geni_serial_port *to_dev_port(struct uart_port *uport)
+ {
+@@ -393,6 +394,23 @@ static void qcom_geni_serial_poll_put_ch
+ writel(M_TX_FIFO_WATERMARK_EN, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ qcom_geni_serial_poll_tx_done(uport);
+ }
++
++static int qcom_geni_serial_poll_init(struct uart_port *uport)
++{
++ struct qcom_geni_serial_port *port = to_dev_port(uport);
++ int ret;
++
++ if (!port->setup) {
++ ret = qcom_geni_serial_port_setup(uport);
++ if (ret)
++ return ret;
++ }
++
++ if (!qcom_geni_serial_secondary_active(uport))
++ geni_se_setup_s_cmd(&port->se, UART_START_READ, 0);
++
++ return 0;
++}
+ #endif
+
+ #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
+@@ -1564,7 +1582,7 @@ static const struct uart_ops qcom_geni_c
+ #ifdef CONFIG_CONSOLE_POLL
+ .poll_get_char = qcom_geni_serial_get_char,
+ .poll_put_char = qcom_geni_serial_poll_put_char,
+- .poll_init = qcom_geni_serial_port_setup,
++ .poll_init = qcom_geni_serial_poll_init,
+ #endif
+ .pm = qcom_geni_serial_pm,
+ };
--- /dev/null
+From fa103d2599e11e802c818684cff821baefe7f206 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 9 Oct 2024 16:51:06 +0200
+Subject: serial: qcom-geni: fix receiver enable
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit fa103d2599e11e802c818684cff821baefe7f206 upstream.
+
+The receiver is supposed to be enabled in the startup() callback and not
+in set_termios() which is called also during console setup.
+
+This specifically avoids accepting input before the port has been opened
+(and interrupts enabled), something which can also break the GENI
+firmware (cancel fails and after abort, the "stale" counter handling
+appears to be broken so that later input is not processed until twelve
+chars have been received).
+
+There also does not appear to be any need to keep the receiver disabled
+while updating the port settings.
+
+Since commit 6f3c3cafb115 ("serial: qcom-geni: disable interrupts during
+console writes") the calls to manipulate the secondary interrupts, which
+were done without holding the port lock, can also lead to the receiver
+being left disabled when set_termios() races with the console code (e.g.
+when init opens the tty during boot). This can manifest itself as a
+serial getty not accepting input.
+
+The calls to stop and start rx in set_termios() can similarly race with
+DMA completion and, for example, cause the DMA buffer to be unmapped
+twice or the mapping to be leaked.
+
+Fix this by only enabling the receiver during startup and while holding
+the port lock to avoid racing with the console code.
+
+Fixes: 6f3c3cafb115 ("serial: qcom-geni: disable interrupts during console writes")
+Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA")
+Fixes: c4f528795d1a ("tty: serial: msm_geni_serial: Add serial driver support for GENI based QUP")
+Cc: stable@vger.kernel.org # 6.3
+Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20241009145110.16847-6-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1179,6 +1179,11 @@ static int qcom_geni_serial_startup(stru
+ if (ret)
+ return ret;
+ }
++
++ uart_port_lock_irq(uport);
++ qcom_geni_serial_start_rx(uport);
++ uart_port_unlock_irq(uport);
++
+ enable_irq(uport->irq);
+
+ return 0;
+@@ -1264,7 +1269,6 @@ static void qcom_geni_serial_set_termios
+ unsigned int avg_bw_core;
+ unsigned long timeout;
+
+- qcom_geni_serial_stop_rx(uport);
+ /* baud rate */
+ baud = uart_get_baud_rate(uport, termios, old, 300, 4000000);
+
+@@ -1280,7 +1284,7 @@ static void qcom_geni_serial_set_termios
+ dev_err(port->se.dev,
+ "Couldn't find suitable clock rate for %u\n",
+ baud * sampling_rate);
+- goto out_restart_rx;
++ return;
+ }
+
+ dev_dbg(port->se.dev, "desired_rate = %u, clk_rate = %lu, clk_div = %u\n",
+@@ -1371,8 +1375,6 @@ static void qcom_geni_serial_set_termios
+ writel(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN);
+ writel(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG);
+ writel(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG);
+-out_restart_rx:
+- qcom_geni_serial_start_rx(uport);
+ }
+
+ #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE
--- /dev/null
+From 23f5f5debcaac1399cfeacec215278bf6dbc1d11 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 9 Oct 2024 16:51:04 +0200
+Subject: serial: qcom-geni: fix shutdown race
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 23f5f5debcaac1399cfeacec215278bf6dbc1d11 upstream.
+
+A commit adding back the stopping of tx on port shutdown failed to add
+back the locking which had also been removed by commit e83766334f96
+("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART
+shutdown").
+
+Holding the port lock is needed to serialise against the console code,
+which may update the interrupt enable register and access the port
+state.
+
+Fixes: d8aca2f96813 ("tty: serial: qcom-geni-serial: stop operations in progress at shutdown")
+Fixes: 947cc4ecc06c ("serial: qcom-geni: fix soft lockup on sw flow control and suspend")
+Cc: stable@vger.kernel.org # 6.3
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20241009145110.16847-4-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1096,10 +1096,12 @@ static void qcom_geni_serial_shutdown(st
+ {
+ disable_irq(uport->irq);
+
++ uart_port_lock_irq(uport);
+ qcom_geni_serial_stop_tx(uport);
+ qcom_geni_serial_stop_rx(uport);
+
+ qcom_geni_serial_cancel_tx_cmd(uport);
++ uart_port_unlock_irq(uport);
+ }
+
+ static void qcom_geni_serial_flush_buffer(struct uart_port *uport)
--- /dev/null
+From 19df76662a33d2f2fc41a66607cb8285fc02d6ec Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 9 Oct 2024 16:51:03 +0200
+Subject: serial: qcom-geni: revert broken hibernation support
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 19df76662a33d2f2fc41a66607cb8285fc02d6ec upstream.
+
+This reverts commit 35781d8356a2eecaa6074ceeb80ee22e252fcdae.
+
+Hibernation is not supported on Qualcomm platforms with mainline
+kernels yet a broken vendor implementation for the GENI serial driver
+made it upstream.
+
+This is effectively dead code that cannot be tested and should just be
+removed, but if these paths were ever hit for an open non-console port
+they would crash the machine as the driver would fail to enable clocks
+during restore() (i.e. all ports would have to be closed by drivers and
+user space before hibernating the system to avoid this as a comment in
+the code hinted at).
+
+The broken implementation also added a random call to enable the
+receiver in the port setup code where it does not belong and which
+enables the receiver prematurely for console ports.
+
+Fixes: 35781d8356a2 ("tty: serial: qcom-geni-serial: Add support for Hibernation feature")
+Cc: stable@vger.kernel.org # 6.2
+Cc: Aniket Randive <quic_arandive@quicinc.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20241009145110.16847-3-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 41 +---------------------------------
+ 1 file changed, 2 insertions(+), 39 deletions(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1152,7 +1152,6 @@ static int qcom_geni_serial_port_setup(s
+ false, true, true);
+ geni_se_init(&port->se, UART_RX_WM, port->rx_fifo_depth - 2);
+ geni_se_select_mode(&port->se, port->dev_data->mode);
+- qcom_geni_serial_start_rx(uport);
+ port->setup = true;
+
+ return 0;
+@@ -1781,38 +1780,6 @@ static int qcom_geni_serial_sys_resume(s
+ return ret;
+ }
+
+-static int qcom_geni_serial_sys_hib_resume(struct device *dev)
+-{
+- int ret = 0;
+- struct uart_port *uport;
+- struct qcom_geni_private_data *private_data;
+- struct qcom_geni_serial_port *port = dev_get_drvdata(dev);
+-
+- uport = &port->uport;
+- private_data = uport->private_data;
+-
+- if (uart_console(uport)) {
+- geni_icc_set_tag(&port->se, QCOM_ICC_TAG_ALWAYS);
+- geni_icc_set_bw(&port->se);
+- ret = uart_resume_port(private_data->drv, uport);
+- /*
+- * For hibernation usecase clients for
+- * console UART won't call port setup during restore,
+- * hence call port setup for console uart.
+- */
+- qcom_geni_serial_port_setup(uport);
+- } else {
+- /*
+- * Peripheral register settings are lost during hibernation.
+- * Update setup flag such that port setup happens again
+- * during next session. Clients of HS-UART will close and
+- * open the port during hibernation.
+- */
+- port->setup = false;
+- }
+- return ret;
+-}
+-
+ static const struct qcom_geni_device_data qcom_geni_console_data = {
+ .console = true,
+ .mode = GENI_SE_FIFO,
+@@ -1824,12 +1791,8 @@ static const struct qcom_geni_device_dat
+ };
+
+ static const struct dev_pm_ops qcom_geni_serial_pm_ops = {
+- .suspend = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
+- .resume = pm_sleep_ptr(qcom_geni_serial_sys_resume),
+- .freeze = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
+- .poweroff = pm_sleep_ptr(qcom_geni_serial_sys_suspend),
+- .restore = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume),
+- .thaw = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume),
++ SYSTEM_SLEEP_PM_OPS(qcom_geni_serial_sys_suspend,
++ qcom_geni_serial_sys_resume)
+ };
+
+ static const struct of_device_id qcom_geni_serial_match_table[] = {
x86-entry_32-do-not-clobber-user-eflags.zf.patch
x86-entry_32-clear-cpu-buffers-after-register-restore-in-nmi-return.patch
tty-n_gsm-fix-use-after-free-in-gsm_cleanup_mux.patch
+x86-bugs-use-code-segment-selector-for-verw-operand.patch
+pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch
+pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch
+pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch
+pinctrl-stm32-check-devm_kasprintf-returned-value.patch
+pinctrl-apple-check-devm_kasprintf-returned-value.patch
+irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch
+irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch
+irqchip-sifive-plic-return-error-code-on-failure.patch
+serial-qcom-geni-fix-polled-console-initialisation.patch
+serial-qcom-geni-revert-broken-hibernation-support.patch
+serial-qcom-geni-fix-shutdown-race.patch
+serial-qcom-geni-fix-dma-rx-cancellation.patch
+serial-qcom-geni-fix-receiver-enable.patch
--- /dev/null
+From e4d2102018542e3ae5e297bc6e229303abff8a0f Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Thu, 26 Sep 2024 09:10:31 -0700
+Subject: x86/bugs: Use code segment selector for VERW operand
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+commit e4d2102018542e3ae5e297bc6e229303abff8a0f upstream.
+
+Robert Gill reported below #GP in 32-bit mode when dosemu software was
+executing vm86() system call:
+
+ general protection fault: 0000 [#1] PREEMPT SMP
+ CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1
+ Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010
+ EIP: restore_all_switch_stack+0xbe/0xcf
+ EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000
+ ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc
+ DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046
+ CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0
+ Call Trace:
+ show_regs+0x70/0x78
+ die_addr+0x29/0x70
+ exc_general_protection+0x13c/0x348
+ exc_bounds+0x98/0x98
+ handle_exception+0x14d/0x14d
+ exc_bounds+0x98/0x98
+ restore_all_switch_stack+0xbe/0xcf
+ exc_bounds+0x98/0x98
+ restore_all_switch_stack+0xbe/0xcf
+
+This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS
+are enabled. This is because segment registers with an arbitrary user value
+can result in #GP when executing VERW. Intel SDM vol. 2C documents the
+following behavior for VERW instruction:
+
+ #GP(0) - If a memory operand effective address is outside the CS, DS, ES,
+ FS, or GS segment limit.
+
+CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user
+space. Use %cs selector to reference VERW operand. This ensures VERW will
+not #GP for an arbitrary user %ds.
+
+[ mingo: Fixed the SOB chain. ]
+
+Fixes: a0e2dab44d22 ("x86/entry_32: Add VERW just before userspace transition")
+Reported-by: Robert Gill <rtgill82@gmail.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com
+Cc: stable@vger.kernel.org # 5.10+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218707
+Closes: https://lore.kernel.org/all/8c77ccfd-d561-45a1-8ed5-6b75212c7a58@leemhuis.info/
+Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
+Suggested-by: Brian Gerst <brgerst@gmail.com>
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/nospec-branch.h | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -323,7 +323,16 @@
+ * Note: Only the memory operand variant of VERW clears the CPU buffers.
+ */
+ .macro CLEAR_CPU_BUFFERS
+- ALTERNATIVE "", __stringify(verw _ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF
++#ifdef CONFIG_X86_64
++ ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF
++#else
++ /*
++ * In 32bit mode, the memory operand must be a %cs reference. The data
++ * segments may not be usable (vm86 mode), and the stack segment may not
++ * be flat (ESPFIX32).
++ */
++ ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF
++#endif
+ .endm
+
+ #ifdef CONFIG_X86_64
projects / thirdparty / kernel / stable-queue.git / commitdiff
