]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.6
authorSasha Levin <sashal@kernel.org>
Sat, 14 Jun 2025 13:34:09 +0000 (09:34 -0400)
committerSasha Levin <sashal@kernel.org>
Sat, 14 Jun 2025 13:34:09 +0000 (09:34 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
16 files changed:
queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch [new file with mode: 0644]
queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch [new file with mode: 0644]
queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch [new file with mode: 0644]
queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch [new file with mode: 0644]
queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch [new file with mode: 0644]
queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch [new file with mode: 0644]
queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch [new file with mode: 0644]
queue-6.6/kasan-use-unchecked-__memset-internally.patch [new file with mode: 0644]
queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch [new file with mode: 0644]
queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch [new file with mode: 0644]
queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch [new file with mode: 0644]
queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch [new file with mode: 0644]
queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch [new file with mode: 0644]
queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch [new file with mode: 0644]
queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch [new file with mode: 0644]
queue-6.6/series

diff --git a/queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch b/queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch
new file mode 100644 (file)
index 0000000..0b0390a
--- /dev/null
@@ -0,0 +1,41 @@
+From 1946c50e32f8ef2e5a694f1a69903ec46bd9c8de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Apr 2025 12:30:08 -0500
+Subject: arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit f55c9f087cc2e2252d44ffd9d58def2066fc176e ]
+
+For am65x, add missing ITAPDLYSEL values for Default Speed and High
+Speed SDR modes to sdhci0 node according to the device datasheet [0].
+
+[0] https://www.ti.com/lit/gpn/am6548
+
+Fixes: eac99d38f861 ("arm64: dts: ti: k3-am654-main: Update otap-del-sel values")
+Cc: stable@vger.kernel.org
+Signed-off-by: Judith Mendez <jm@ti.com>
+Reviewed-by: Moteen Shah <m-shah@ti.com>
+Link: https://lore.kernel.org/r/20250429173009.33994-1-jm@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index 9c5de448351e9..0523bd0da80c7 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -448,6 +448,8 @@ sdhci0: mmc@4f80000 {
+               ti,otap-del-sel-ddr50 = <0x5>;
+               ti,otap-del-sel-ddr52 = <0x5>;
+               ti,otap-del-sel-hs200 = <0x5>;
++              ti,itap-del-sel-legacy = <0xa>;
++              ti,itap-del-sel-mmc-hs = <0x1>;
+               ti,itap-del-sel-ddr52 = <0x0>;
+               dma-coherent;
+       };
+-- 
+2.39.5
+
diff --git a/queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch b/queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch
new file mode 100644 (file)
index 0000000..ef19153
--- /dev/null
@@ -0,0 +1,83 @@
+From 0eb770016be5b83a90651fac365a4e2a0ec189ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 10:17:28 -0500
+Subject: arm64: dts: ti: k3-am65-main: Fix sdhci node properties
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 8ffe9cb889f2b831a9d5bbb1f7ad42d30e31170f ]
+
+Update otap-del-sel properties as per datasheet [0].
+
+Add missing clkbuf-sel and itap-del-sel values also as per
+datasheet [0].
+
+Move clkbuf-sel and ti,trm-icp above the otap-del-sel properties
+so the sdhci nodes could be more uniform across platforms.
+
+[0] https://www.ti.com/lit/ds/symlink/am6548.pdf
+
+Fixes: eac99d38f861 ("arm64: dts: ti: k3-am654-main: Update otap-del-sel values")
+Fixes: d7600d070fb0 ("arm64: dts: ti: k3-am65-main: Add support for sdhci1")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Link: https://lore.kernel.org/r/20240423151732.3541894-2-jm@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Stable-dep-of: f55c9f087cc2 ("arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index 57befcce93b97..9c5de448351e9 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -436,6 +436,8 @@ sdhci0: mmc@4f80000 {
+               interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
+               mmc-ddr-1_8v;
+               mmc-hs200-1_8v;
++              ti,clkbuf-sel = <0x7>;
++              ti,trm-icp = <0x8>;
+               ti,otap-del-sel-legacy = <0x0>;
+               ti,otap-del-sel-mmc-hs = <0x0>;
+               ti,otap-del-sel-sd-hs = <0x0>;
+@@ -446,8 +448,7 @@ sdhci0: mmc@4f80000 {
+               ti,otap-del-sel-ddr50 = <0x5>;
+               ti,otap-del-sel-ddr52 = <0x5>;
+               ti,otap-del-sel-hs200 = <0x5>;
+-              ti,otap-del-sel-hs400 = <0x0>;
+-              ti,trm-icp = <0x8>;
++              ti,itap-del-sel-ddr52 = <0x0>;
+               dma-coherent;
+       };
+@@ -458,18 +459,22 @@ sdhci1: mmc@4fa0000 {
+               clocks = <&k3_clks 48 0>, <&k3_clks 48 1>;
+               clock-names = "clk_ahb", "clk_xin";
+               interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
++              ti,clkbuf-sel = <0x7>;
++              ti,trm-icp = <0x8>;
+               ti,otap-del-sel-legacy = <0x0>;
+               ti,otap-del-sel-mmc-hs = <0x0>;
+               ti,otap-del-sel-sd-hs = <0x0>;
+-              ti,otap-del-sel-sdr12 = <0x0>;
+-              ti,otap-del-sel-sdr25 = <0x0>;
++              ti,otap-del-sel-sdr12 = <0xf>;
++              ti,otap-del-sel-sdr25 = <0xf>;
+               ti,otap-del-sel-sdr50 = <0x8>;
+               ti,otap-del-sel-sdr104 = <0x7>;
+               ti,otap-del-sel-ddr50 = <0x4>;
+               ti,otap-del-sel-ddr52 = <0x4>;
+               ti,otap-del-sel-hs200 = <0x7>;
+-              ti,clkbuf-sel = <0x7>;
+-              ti,trm-icp = <0x8>;
++              ti,itap-del-sel-legacy = <0xa>;
++              ti,itap-del-sel-sd-hs = <0x1>;
++              ti,itap-del-sel-sdr12 = <0xa>;
++              ti,itap-del-sel-sdr25 = <0x1>;
+               dma-coherent;
+       };
+-- 
+2.39.5
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch
new file mode 100644 (file)
index 0000000..84980ee
--- /dev/null
@@ -0,0 +1,85 @@
+From daacaf31ecc4322c4000d91b03495eb8bc1377a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Apr 2025 16:43:22 +0530
+Subject: arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
+
+From: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+
+[ Upstream commit 97b67cc102dc2cc8aa39a569c22a196e21af5a21 ]
+
+Add device tree nodes for two power regulators on the J721E SK board.
+vsys_5v0: A fixed regulator representing the 5V supply output from the
+LM61460 and vdd_sd_dv: A GPIO-controlled TLV71033 regulator.
+
+J721E-SK schematics: https://www.ti.com/lit/zip/sprr438
+
+Fixes: 1bfda92a3a36 ("arm64: dts: ti: Add support for J721E SK")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Link: https://lore.kernel.org/r/20250415111328.3847502-2-y-abhilashchandra@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 31 ++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index 5e03a7f58faa4..952d2c72628ef 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -183,6 +183,17 @@ vsys_3v3: fixedregulator-vsys3v3 {
+               regulator-boot-on;
+       };
++      vsys_5v0: fixedregulator-vsys5v0 {
++              /* Output of LM61460 */
++              compatible = "regulator-fixed";
++              regulator-name = "vsys_5v0";
++              regulator-min-microvolt = <5000000>;
++              regulator-max-microvolt = <5000000>;
++              vin-supply = <&vusb_main>;
++              regulator-always-on;
++              regulator-boot-on;
++      };
++
+       vdd_mmc1: fixedregulator-sd {
+               compatible = "regulator-fixed";
+               pinctrl-names = "default";
+@@ -210,6 +221,20 @@ vdd_sd_dv_alt: gpio-regulator-tps659411 {
+                        <3300000 0x1>;
+       };
++      vdd_sd_dv: gpio-regulator-TLV71033 {
++              compatible = "regulator-gpio";
++              pinctrl-names = "default";
++              pinctrl-0 = <&vdd_sd_dv_pins_default>;
++              regulator-name = "tlv71033";
++              regulator-min-microvolt = <1800000>;
++              regulator-max-microvolt = <3300000>;
++              regulator-boot-on;
++              vin-supply = <&vsys_5v0>;
++              gpios = <&main_gpio0 118 GPIO_ACTIVE_HIGH>;
++              states = <1800000 0x0>,
++                       <3300000 0x1>;
++      };
++
+       transceiver1: can-phy1 {
+               compatible = "ti,tcan1042";
+               #phy-cells = <0>;
+@@ -601,6 +626,12 @@ J721E_WKUP_IOPAD(0xd4, PIN_OUTPUT, 7) /* (G26) WKUP_GPIO0_9 */
+               >;
+       };
++      vdd_sd_dv_pins_default: vdd-sd-dv-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */
++              >;
++      };
++
+       wkup_uart0_pins_default: wkup-uart0-default-pins {
+               pinctrl-single,pins = <
+                       J721E_WKUP_IOPAD(0xa0, PIN_INPUT, 0) /* (J29) WKUP_UART0_RXD */
+-- 
+2.39.5
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch
new file mode 100644 (file)
index 0000000..9ca5b1a
--- /dev/null
@@ -0,0 +1,179 @@
+From 1e547fa391bc60ec0ea2730538a187bde11c8566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 18:45:12 +0530
+Subject: arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
+
+From: Beleswar Padhi <b-padhi@ti.com>
+
+[ Upstream commit 021d3d5f0741e5393a7a110ac909fc746b1e0a4d ]
+
+CAN instance 0 in the mcu domain is brought on the J721E-SK board
+through header J1. Thus, add its respective transceiver 1 dt node to add
+support for this CAN instance.
+
+CAN instances 0, 5 and 9 in the main domain are brought on the J721E-SK
+board through headers J5, J6 and J2 respectively. Thus, add their
+respective transceivers 2, 3 and 4 dt nodes to add support for these CAN
+instances.
+
+Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
+Reviewed-by: Bhavya Kapoor <b-kapoor@ti.com>
+Link: https://lore.kernel.org/r/20240430131512.1327283-1-b-padhi@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Stable-dep-of: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 116 +++++++++++++++++++++++++
+ 1 file changed, 116 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index d967b384071cf..5e03a7f58faa4 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -210,6 +210,42 @@ vdd_sd_dv_alt: gpio-regulator-tps659411 {
+                        <3300000 0x1>;
+       };
++      transceiver1: can-phy1 {
++              compatible = "ti,tcan1042";
++              #phy-cells = <0>;
++              max-bitrate = <5000000>;
++              pinctrl-names = "default";
++              pinctrl-0 = <&mcu_mcan0_gpio_pins_default>;
++              standby-gpios = <&wkup_gpio0 3 GPIO_ACTIVE_HIGH>;
++      };
++
++      transceiver2: can-phy2 {
++              compatible = "ti,tcan1042";
++              #phy-cells = <0>;
++              max-bitrate = <5000000>;
++              pinctrl-names = "default";
++              pinctrl-0 = <&main_mcan0_gpio_pins_default>;
++              standby-gpios = <&main_gpio0 65 GPIO_ACTIVE_HIGH>;
++      };
++
++      transceiver3: can-phy3 {
++              compatible = "ti,tcan1042";
++              #phy-cells = <0>;
++              max-bitrate = <5000000>;
++              pinctrl-names = "default";
++              pinctrl-0 = <&main_mcan5_gpio_pins_default>;
++              standby-gpios = <&main_gpio0 66 GPIO_ACTIVE_HIGH>;
++      };
++
++      transceiver4: can-phy4 {
++              compatible = "ti,tcan1042";
++              #phy-cells = <0>;
++              max-bitrate = <5000000>;
++              pinctrl-names = "default";
++              pinctrl-0 = <&main_mcan9_gpio_pins_default>;
++              standby-gpios = <&main_gpio0 67 GPIO_ACTIVE_HIGH>;
++      };
++
+       dp_pwr_3v3: fixedregulator-dp-prw {
+               compatible = "regulator-fixed";
+               regulator-name = "dp-pwr";
+@@ -367,6 +403,45 @@ J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */
+               >;
+       };
++      main_mcan0_pins_default: main-mcan0-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x208, PIN_INPUT, 0) /* (W5) MCAN0_RX */
++                      J721E_IOPAD(0x20c, PIN_OUTPUT, 0) /* (W6) MCAN0_TX */
++              >;
++      };
++
++      main_mcan0_gpio_pins_default: main-mcan0-gpio-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x108, PIN_INPUT, 7) /* (AD27) PRG0_PRU1_GPO2.GPIO0_65 */
++              >;
++      };
++
++      main_mcan5_pins_default: main-mcan5-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x050, PIN_INPUT, 6) /* (AE21) PRG1_PRU0_GPO18.MCAN5_RX */
++                      J721E_IOPAD(0x04c, PIN_OUTPUT, 6) /* (AJ21) PRG1_PRU0_GPO17.MCAN5_TX */
++              >;
++      };
++
++      main_mcan5_gpio_pins_default: main-mcan5-gpio-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x10c, PIN_INPUT, 7) /* (AC25) PRG0_PRU1_GPO3.GPIO0_66 */
++              >;
++      };
++
++      main_mcan9_pins_default: main-mcan9-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x0d0, PIN_INPUT, 6) /* (AC27) PRG0_PRU0_GPO8.MCAN9_RX */
++                      J721E_IOPAD(0x0cc, PIN_OUTPUT, 6) /* (AC28) PRG0_PRU0_GPO7.MCAN9_TX */
++              >;
++      };
++
++      main_mcan9_gpio_pins_default: main-mcan9-gpio-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x110, PIN_INPUT, 7) /* (AD29) PRG0_PRU1_GPO4.GPIO0_67 */
++              >;
++      };
++
+       dp0_pins_default: dp0-default-pins {
+               pinctrl-single,pins = <
+                       J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */
+@@ -549,6 +624,19 @@ J721E_WKUP_IOPAD(0xfc, PIN_INPUT_PULLUP, 0) /* (H24) WKUP_I2C0_SDA */
+               >;
+       };
++      mcu_mcan0_pins_default: mcu-mcan0-default-pins {
++              pinctrl-single,pins = <
++                      J721E_WKUP_IOPAD(0x0ac, PIN_INPUT, 0) /* (C29) MCU_MCAN0_RX */
++                      J721E_WKUP_IOPAD(0x0a8, PIN_OUTPUT, 0) /* (D29) MCU_MCAN0_TX */
++              >;
++      };
++
++      mcu_mcan0_gpio_pins_default: mcu-mcan0-gpio-default-pins {
++              pinctrl-single,pins = <
++                      J721E_WKUP_IOPAD(0x0bc, PIN_INPUT, 7) /* (F27) WKUP_GPIO0_3 */
++              >;
++      };
++
+       /* Reset for M.2 M Key slot on PCIe1  */
+       mkey_reset_pins_default: mkey-reset-pns-default-pins {
+               pinctrl-single,pins = <
+@@ -957,6 +1045,34 @@ &pcie1_rc {
+       num-lanes = <2>;
+ };
++&mcu_mcan0 {
++      pinctrl-names = "default";
++      pinctrl-0 = <&mcu_mcan0_pins_default>;
++      phys = <&transceiver1>;
++      status = "okay";
++};
++
++&main_mcan0 {
++      pinctrl-names = "default";
++      pinctrl-0 = <&main_mcan0_pins_default>;
++      phys = <&transceiver2>;
++      status = "okay";
++};
++
++&main_mcan5 {
++      pinctrl-names = "default";
++      pinctrl-0 = <&main_mcan5_pins_default>;
++      phys = <&transceiver3>;
++      status = "okay";
++};
++
++&main_mcan9 {
++      pinctrl-names = "default";
++      pinctrl-0 = <&main_mcan9_pins_default>;
++      phys = <&transceiver4>;
++      status = "okay";
++};
++
+ &ufs_wrapper {
+       status = "disabled";
+ };
+-- 
+2.39.5
+
diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch
new file mode 100644 (file)
index 0000000..9432e69
--- /dev/null
@@ -0,0 +1,80 @@
+From 2245986f4734e74fcdfa2af1ffefd3cc76c2d71a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 14:25:14 +0530
+Subject: arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
+
+From: Vaishnav Achath <vaishnav.a@ti.com>
+
+[ Upstream commit f87c88947396674586a42a163b72efa3999e3dee ]
+
+J721E SK has the CSI2RX routed to a MIPI CSI connector and to 15-pin
+RPi camera connector through an analog mux with GPIO control, model that
+so that an overlay can control the mux state according to connected
+cameras. Also provide labels to the I2C mux bus instances so that a
+generic overlay can be used across multiple platforms.
+
+J721E SK schematics: https://www.ti.com/lit/zip/sprr438
+
+Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
+Reviewed-by: Jai Luthra <j-luthra@ti.com>
+Link: https://lore.kernel.org/r/20240215085518.552692-6-vaishnav.a@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Stable-dep-of: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index ccacb65683b5b..d967b384071cf 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -286,6 +286,15 @@ tfp410_out: endpoint {
+                       };
+               };
+       };
++
++      csi_mux: mux-controller {
++              compatible = "gpio-mux";
++              #mux-state-cells = <1>;
++              mux-gpios = <&main_gpio0 88 GPIO_ACTIVE_HIGH>;
++              idle-state = <0>;
++              pinctrl-names = "default";
++              pinctrl-0 = <&main_csi_mux_sel_pins_default>;
++      };
+ };
+ &main_pmx0 {
+@@ -352,6 +361,12 @@ J721E_IOPAD(0x214, PIN_OUTPUT, 4) /* (V4) MCAN1_TX.USB1_DRVVBUS */
+               >;
+       };
++      main_csi_mux_sel_pins_default: main-csi-mux-sel-default-pins {
++              pinctrl-single,pins = <
++                      J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */
++              >;
++      };
++
+       dp0_pins_default: dp0-default-pins {
+               pinctrl-single,pins = <
+                       J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */
+@@ -707,14 +722,14 @@ i2c-mux@70 {
+               reg = <0x70>;
+               /* CSI0 I2C */
+-              i2c@0 {
++              cam0_i2c: i2c@0 {
+                       #address-cells = <1>;
+                       #size-cells = <0>;
+                       reg = <0>;
+               };
+               /* CSI1 I2C */
+-              i2c@1 {
++              cam1_i2c: i2c@1 {
+                       #address-cells = <1>;
+                       #size-cells = <0>;
+                       reg = <1>;
+-- 
+2.39.5
+
diff --git a/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch b/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch
new file mode 100644 (file)
index 0000000..58815da
--- /dev/null
@@ -0,0 +1,262 @@
+From 8614d55495ec4af442ff407c9cefc7556c59814c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 15:49:59 -0700
+Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ]
+
+Sysfs interface for updating firmware for RMI devices is available even
+when F34 probe fails. The code checks for presence of F34 "container"
+pointer and then tries to use the function data attached to the
+sub-device. F34 assigns the function data early, before it knows if
+probe will succeed, leaving behind a stale pointer.
+
+Fix this by expanding checks to not only test for presence of F34
+"container" but also check if there is driver data assigned to the
+sub-device, and call dev_set_drvdata() only after we are certain that
+probe is successful.
+
+This is not a complete fix, since F34 will be freed during firmware
+update, so there is still a race when fetching and accessing this
+pointer. This race will be addressed in follow-up changes.
+
+Reported-by: Hanno Böck <hanno@hboeck.de>
+Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_f34.c | 135 ++++++++++++++++++++---------------
+ 1 file changed, 76 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/input/rmi4/rmi_f34.c b/drivers/input/rmi4/rmi_f34.c
+index 0d9a5756e3f59..cae1e41664921 100644
+--- a/drivers/input/rmi4/rmi_f34.c
++++ b/drivers/input/rmi4/rmi_f34.c
+@@ -4,6 +4,7 @@
+  * Copyright (C) 2016 Zodiac Inflight Innovations
+  */
++#include "linux/device.h"
+ #include <linux/kernel.h>
+ #include <linux/rmi.h>
+ #include <linux/firmware.h>
+@@ -298,39 +299,30 @@ static int rmi_f34_update_firmware(struct f34_data *f34,
+       return ret;
+ }
+-static int rmi_f34_status(struct rmi_function *fn)
+-{
+-      struct f34_data *f34 = dev_get_drvdata(&fn->dev);
+-
+-      /*
+-       * The status is the percentage complete, or once complete,
+-       * zero for success or a negative return code.
+-       */
+-      return f34->update_status;
+-}
+-
+ static ssize_t rmi_driver_bootloader_id_show(struct device *dev,
+                                            struct device_attribute *dattr,
+                                            char *buf)
+ {
+       struct rmi_driver_data *data = dev_get_drvdata(dev);
+-      struct rmi_function *fn = data->f34_container;
++      struct rmi_function *fn;
+       struct f34_data *f34;
+-      if (fn) {
+-              f34 = dev_get_drvdata(&fn->dev);
+-
+-              if (f34->bl_version == 5)
+-                      return sysfs_emit(buf, "%c%c\n",
+-                                        f34->bootloader_id[0],
+-                                        f34->bootloader_id[1]);
+-              else
+-                      return sysfs_emit(buf, "V%d.%d\n",
+-                                        f34->bootloader_id[1],
+-                                        f34->bootloader_id[0]);
+-      }
++      fn = data->f34_container;
++      if (!fn)
++              return -ENODEV;
+-      return 0;
++      f34 = dev_get_drvdata(&fn->dev);
++      if (!f34)
++              return -ENODEV;
++
++      if (f34->bl_version == 5)
++              return sysfs_emit(buf, "%c%c\n",
++                                f34->bootloader_id[0],
++                                f34->bootloader_id[1]);
++      else
++              return sysfs_emit(buf, "V%d.%d\n",
++                                f34->bootloader_id[1],
++                                f34->bootloader_id[0]);
+ }
+ static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
+@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev,
+       struct rmi_function *fn = data->f34_container;
+       struct f34_data *f34;
+-      if (fn) {
+-              f34 = dev_get_drvdata(&fn->dev);
++      fn = data->f34_container;
++      if (!fn)
++              return -ENODEV;
+-              return sysfs_emit(buf, "%s\n", f34->configuration_id);
+-      }
++      f34 = dev_get_drvdata(&fn->dev);
++      if (!f34)
++              return -ENODEV;
+-      return 0;
++
++      return sysfs_emit(buf, "%s\n", f34->configuration_id);
+ }
+ static DEVICE_ATTR(configuration_id, 0444,
+@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rmi_driver_data *data,
+       if (!data->f34_container) {
+               dev_warn(dev, "%s: No F34 present!\n", __func__);
+-              return -EINVAL;
++              return -ENODEV;
+       }
+       f34 = dev_get_drvdata(&data->f34_container->dev);
++      if (!f34) {
++              dev_warn(dev, "%s: No valid F34 present!\n", __func__);
++              return -ENODEV;
++      }
+       if (f34->bl_version >= 7) {
+               if (data->pdt_props & HAS_BSR) {
+@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev,
+                                               char *buf)
+ {
+       struct rmi_driver_data *data = dev_get_drvdata(dev);
+-      int update_status = 0;
++      struct f34_data *f34;
++      int update_status = -ENODEV;
+-      if (data->f34_container)
+-              update_status = rmi_f34_status(data->f34_container);
++      /*
++       * The status is the percentage complete, or once complete,
++       * zero for success or a negative return code.
++       */
++      if (data->f34_container) {
++              f34 = dev_get_drvdata(&data->f34_container->dev);
++              if (f34)
++                      update_status = f34->update_status;
++      }
+       return sysfs_emit(buf, "%d\n", update_status);
+ }
+@@ -517,33 +524,21 @@ static const struct attribute_group rmi_firmware_attr_group = {
+       .attrs = rmi_firmware_attrs,
+ };
+-static int rmi_f34_probe(struct rmi_function *fn)
++static int rmi_f34v5_probe(struct f34_data *f34)
+ {
+-      struct f34_data *f34;
+-      unsigned char f34_queries[9];
++      struct rmi_function *fn = f34->fn;
++      u8 f34_queries[9];
+       bool has_config_id;
+-      u8 version = fn->fd.function_version;
+-      int ret;
+-
+-      f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
+-      if (!f34)
+-              return -ENOMEM;
+-
+-      f34->fn = fn;
+-      dev_set_drvdata(&fn->dev, f34);
+-
+-      /* v5 code only supported version 0, try V7 probe */
+-      if (version > 0)
+-              return rmi_f34v7_probe(f34);
++      int error;
+       f34->bl_version = 5;
+-      ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
+-                           f34_queries, sizeof(f34_queries));
+-      if (ret) {
++      error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
++                             f34_queries, sizeof(f34_queries));
++      if (error) {
+               dev_err(&fn->dev, "%s: Failed to query properties\n",
+                       __func__);
+-              return ret;
++              return error;
+       }
+       snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
+@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_function *fn)
+               f34->v5.config_blocks);
+       if (has_config_id) {
+-              ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
+-                                   f34_queries, sizeof(f34_queries));
+-              if (ret) {
++              error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
++                                     f34_queries, sizeof(f34_queries));
++              if (error) {
+                       dev_err(&fn->dev, "Failed to read F34 config ID\n");
+-                      return ret;
++                      return error;
+               }
+               snprintf(f34->configuration_id, sizeof(f34->configuration_id),
+@@ -582,12 +577,34 @@ static int rmi_f34_probe(struct rmi_function *fn)
+                        f34_queries[2], f34_queries[3]);
+               rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n",
+-                       f34->configuration_id);
++                      f34->configuration_id);
+       }
+       return 0;
+ }
++static int rmi_f34_probe(struct rmi_function *fn)
++{
++      struct f34_data *f34;
++      u8 version = fn->fd.function_version;
++      int error;
++
++      f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
++      if (!f34)
++              return -ENOMEM;
++
++      f34->fn = fn;
++
++      /* v5 code only supported version 0 */
++      error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34);
++      if (error)
++              return error;
++
++      dev_set_drvdata(&fn->dev, f34);
++
++      return 0;
++}
++
+ int rmi_f34_create_sysfs(struct rmi_device *rmi_dev)
+ {
+       return sysfs_create_group(&rmi_dev->dev.kobj, &rmi_firmware_attr_group);
+-- 
+2.39.5
+
diff --git a/queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch b/queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch
new file mode 100644 (file)
index 0000000..31bad6f
--- /dev/null
@@ -0,0 +1,199 @@
+From 7c0f28ba8623633f20ff2b4575b6da259ae0fef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 15:55:38 +0200
+Subject: kasan: avoid sleepable page allocation from atomic context
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit b6ea95a34cbd014ab6ade4248107b86b0aaf2d6c ]
+
+apply_to_pte_range() enters the lazy MMU mode and then invokes
+kasan_populate_vmalloc_pte() callback on each page table walk iteration.
+However, the callback can go into sleep when trying to allocate a single
+page, e.g.  if an architecutre disables preemption on lazy MMU mode enter.
+
+On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and
+arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs:
+
+[    0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321
+[    0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd
+[    0.663358] preempt_count: 1, expected: 0
+[    0.663366] RCU nest depth: 0, expected: 0
+[    0.663375] no locks held by kthreadd/2.
+[    0.663383] Preemption disabled at:
+[    0.663386] [<0002f3284cbb4eda>] apply_to_pte_range+0xfa/0x4a0
+[    0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT
+[    0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux)
+[    0.663409] Call Trace:
+[    0.663410]  [<0002f3284c385f58>] dump_stack_lvl+0xe8/0x140
+[    0.663413]  [<0002f3284c507b9e>] __might_resched+0x66e/0x700
+[    0.663415]  [<0002f3284cc4f6c0>] __alloc_frozen_pages_noprof+0x370/0x4b0
+[    0.663419]  [<0002f3284ccc73c0>] alloc_pages_mpol+0x1a0/0x4a0
+[    0.663421]  [<0002f3284ccc8518>] alloc_frozen_pages_noprof+0x88/0xc0
+[    0.663424]  [<0002f3284ccc8572>] alloc_pages_noprof+0x22/0x120
+[    0.663427]  [<0002f3284cc341ac>] get_free_pages_noprof+0x2c/0xc0
+[    0.663429]  [<0002f3284cceba70>] kasan_populate_vmalloc_pte+0x50/0x120
+[    0.663433]  [<0002f3284cbb4ef8>] apply_to_pte_range+0x118/0x4a0
+[    0.663435]  [<0002f3284cbc7c14>] apply_to_pmd_range+0x194/0x3e0
+[    0.663437]  [<0002f3284cbc99be>] __apply_to_page_range+0x2fe/0x7a0
+[    0.663440]  [<0002f3284cbc9e88>] apply_to_page_range+0x28/0x40
+[    0.663442]  [<0002f3284ccebf12>] kasan_populate_vmalloc+0x82/0xa0
+[    0.663445]  [<0002f3284cc1578c>] alloc_vmap_area+0x34c/0xc10
+[    0.663448]  [<0002f3284cc1c2a6>] __get_vm_area_node+0x186/0x2a0
+[    0.663451]  [<0002f3284cc1e696>] __vmalloc_node_range_noprof+0x116/0x310
+[    0.663454]  [<0002f3284cc1d950>] __vmalloc_node_noprof+0xd0/0x110
+[    0.663457]  [<0002f3284c454b88>] alloc_thread_stack_node+0xf8/0x330
+[    0.663460]  [<0002f3284c458d56>] dup_task_struct+0x66/0x4d0
+[    0.663463]  [<0002f3284c45be90>] copy_process+0x280/0x4b90
+[    0.663465]  [<0002f3284c460940>] kernel_clone+0xd0/0x4b0
+[    0.663467]  [<0002f3284c46115e>] kernel_thread+0xbe/0xe0
+[    0.663469]  [<0002f3284c4e440e>] kthreadd+0x50e/0x7f0
+[    0.663472]  [<0002f3284c38c04a>] __ret_from_fork+0x8a/0xf0
+[    0.663475]  [<0002f3284ed57ff2>] ret_from_fork+0xa/0x38
+
+Instead of allocating single pages per-PTE, bulk-allocate the shadow
+memory prior to applying kasan_populate_vmalloc_pte() callback on a page
+range.
+
+Link: https://lkml.kernel.org/r/c61d3560297c93ed044f0b1af085610353a06a58.1747316918.git.agordeev@linux.ibm.com
+Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory")
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Suggested-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
+Cc: Daniel Axtens <dja@axtens.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/kasan/shadow.c | 92 +++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 78 insertions(+), 14 deletions(-)
+
+diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
+index d687f09a7ae37..7f97f34f38364 100644
+--- a/mm/kasan/shadow.c
++++ b/mm/kasan/shadow.c
+@@ -311,33 +311,99 @@ void __init __weak kasan_populate_early_vm_area_shadow(void *start,
+ {
+ }
++struct vmalloc_populate_data {
++      unsigned long start;
++      struct page **pages;
++};
++
+ static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr,
+-                                    void *unused)
++                                    void *_data)
+ {
+-      unsigned long page;
++      struct vmalloc_populate_data *data = _data;
++      struct page *page;
+       pte_t pte;
++      int index;
+       if (likely(!pte_none(ptep_get(ptep))))
+               return 0;
+-      page = __get_free_page(GFP_KERNEL);
+-      if (!page)
+-              return -ENOMEM;
+-
+-      __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE);
+-      pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL);
++      index = PFN_DOWN(addr - data->start);
++      page = data->pages[index];
++      __memset(page_to_virt(page), KASAN_VMALLOC_INVALID, PAGE_SIZE);
++      pte = pfn_pte(page_to_pfn(page), PAGE_KERNEL);
+       spin_lock(&init_mm.page_table_lock);
+       if (likely(pte_none(ptep_get(ptep)))) {
+               set_pte_at(&init_mm, addr, ptep, pte);
+-              page = 0;
++              data->pages[index] = NULL;
+       }
+       spin_unlock(&init_mm.page_table_lock);
+-      if (page)
+-              free_page(page);
++
++      return 0;
++}
++
++static void ___free_pages_bulk(struct page **pages, int nr_pages)
++{
++      int i;
++
++      for (i = 0; i < nr_pages; i++) {
++              if (pages[i]) {
++                      __free_pages(pages[i], 0);
++                      pages[i] = NULL;
++              }
++      }
++}
++
++static int ___alloc_pages_bulk(struct page **pages, int nr_pages)
++{
++      unsigned long nr_populated, nr_total = nr_pages;
++      struct page **page_array = pages;
++
++      while (nr_pages) {
++              nr_populated = alloc_pages_bulk(GFP_KERNEL, nr_pages, pages);
++              if (!nr_populated) {
++                      ___free_pages_bulk(page_array, nr_total - nr_pages);
++                      return -ENOMEM;
++              }
++              pages += nr_populated;
++              nr_pages -= nr_populated;
++      }
++
+       return 0;
+ }
++static int __kasan_populate_vmalloc(unsigned long start, unsigned long end)
++{
++      unsigned long nr_pages, nr_total = PFN_UP(end - start);
++      struct vmalloc_populate_data data;
++      int ret = 0;
++
++      data.pages = (struct page **)__get_free_page(GFP_KERNEL | __GFP_ZERO);
++      if (!data.pages)
++              return -ENOMEM;
++
++      while (nr_total) {
++              nr_pages = min(nr_total, PAGE_SIZE / sizeof(data.pages[0]));
++              ret = ___alloc_pages_bulk(data.pages, nr_pages);
++              if (ret)
++                      break;
++
++              data.start = start;
++              ret = apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE,
++                                        kasan_populate_vmalloc_pte, &data);
++              ___free_pages_bulk(data.pages, nr_pages);
++              if (ret)
++                      break;
++
++              start += nr_pages * PAGE_SIZE;
++              nr_total -= nr_pages;
++      }
++
++      free_page((unsigned long)data.pages);
++
++      return ret;
++}
++
+ int kasan_populate_vmalloc(unsigned long addr, unsigned long size)
+ {
+       unsigned long shadow_start, shadow_end;
+@@ -367,9 +433,7 @@ int kasan_populate_vmalloc(unsigned long addr, unsigned long size)
+       shadow_start = PAGE_ALIGN_DOWN(shadow_start);
+       shadow_end = PAGE_ALIGN(shadow_end);
+-      ret = apply_to_page_range(&init_mm, shadow_start,
+-                                shadow_end - shadow_start,
+-                                kasan_populate_vmalloc_pte, NULL);
++      ret = __kasan_populate_vmalloc(shadow_start, shadow_end);
+       if (ret)
+               return ret;
+-- 
+2.39.5
+
diff --git a/queue-6.6/kasan-use-unchecked-__memset-internally.patch b/queue-6.6/kasan-use-unchecked-__memset-internally.patch
new file mode 100644 (file)
index 0000000..62da009
--- /dev/null
@@ -0,0 +1,69 @@
+From cca024d7c31186672372370524b46783bd5d2bf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 17:18:44 +0200
+Subject: kasan: use unchecked __memset internally
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+[ Upstream commit 01a5ad81637672940844052404678678a0ec8854 ]
+
+KASAN code is supposed to use the unchecked __memset implementation when
+accessing its metadata.
+
+Change uses of memset to __memset in mm/kasan/.
+
+Link: https://lkml.kernel.org/r/6f621966c6f52241b5aaa7220c348be90c075371.1696605143.git.andreyknvl@google.com
+Fixes: 59e6e098d1c1 ("kasan: introduce kasan_complete_mode_report_info")
+Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory")
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Marco Elver <elver@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: b6ea95a34cbd ("kasan: avoid sleepable page allocation from atomic context")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/kasan/report.c | 4 ++--
+ mm/kasan/shadow.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mm/kasan/report.c b/mm/kasan/report.c
+index ecced40e51032..465e6a53b3bf2 100644
+--- a/mm/kasan/report.c
++++ b/mm/kasan/report.c
+@@ -538,7 +538,7 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty
+       start_report(&flags, true);
+-      memset(&info, 0, sizeof(info));
++      __memset(&info, 0, sizeof(info));
+       info.type = type;
+       info.access_addr = ptr;
+       info.access_size = 0;
+@@ -576,7 +576,7 @@ bool kasan_report(const void *addr, size_t size, bool is_write,
+       start_report(&irq_flags, true);
+-      memset(&info, 0, sizeof(info));
++      __memset(&info, 0, sizeof(info));
+       info.type = KASAN_REPORT_ACCESS;
+       info.access_addr = addr;
+       info.access_size = size;
+diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
+index dd772f9d0f080..d687f09a7ae37 100644
+--- a/mm/kasan/shadow.c
++++ b/mm/kasan/shadow.c
+@@ -324,7 +324,7 @@ static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr,
+       if (!page)
+               return -ENOMEM;
+-      memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE);
++      __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE);
+       pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL);
+       spin_lock(&init_mm.page_table_lock);
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch b/queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch
new file mode 100644 (file)
index 0000000..018c051
--- /dev/null
@@ -0,0 +1,98 @@
+From 647381dbd54840732fa1f9d3f61c39a5196ffbf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 May 2025 09:29:19 +0200
+Subject: net: dsa: microchip: linearize skb for tail-tagging switches
+
+From: Jakob Unterwurzacher <jakobunt@gmail.com>
+
+[ Upstream commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 ]
+
+The pointer arithmentic for accessing the tail tag only works
+for linear skbs.
+
+For nonlinear skbs, it reads uninitialized memory inside the
+skb headroom, essentially randomizing the tag. I have observed
+it gets set to 6 most of the time.
+
+Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
+(which does not exist for the ksz9896 that's in use), dropping the packet.
+Debug prints added by me (not included in this patch):
+
+       [  256.645337] ksz9477_rcv:323 tag0=6
+       [  256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
+                      mac=(64,14) mac_len=14 net=(78,0) trans=78
+                      shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
+                      csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
+                      hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
+                      priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
+                      encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
+       [  256.645377] dev name=end1 feat=0x0002e10200114bb3
+       [  256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+       [  256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+       [  256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+       [  256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+       [  256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
+       [  256.645428] skb frag:     00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
+       [  256.645436] skb frag:     00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
+       [  256.645444] skb frag:     00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
+       [  256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL
+
+Call skb_linearize before trying to access the tag.
+
+This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
+hand, and also applies the same fix to ksz8795_rcv which seems to have
+the same problem.
+
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+CC: stable@vger.kernel.org
+Fixes: 016e43a26bab ("net: dsa: ksz: Add KSZ8795 tag code")
+Fixes: 8b8010fb7876 ("dsa: add support for Microchip KSZ tail tagging")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_ksz.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
+index 7bf87fa471a0c..0a16c04c4bfc4 100644
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -139,7 +139,12 @@ static struct sk_buff *ksz8795_xmit(struct sk_buff *skb, struct net_device *dev)
+ static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+-      u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++      u8 *tag;
++
++      if (skb_linearize(skb))
++              return NULL;
++
++      tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+       return ksz_common_rcv(skb, dev, tag[0] & 7, KSZ_EGRESS_TAG_LEN);
+ }
+@@ -301,10 +306,16 @@ static struct sk_buff *ksz9477_xmit(struct sk_buff *skb,
+ static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+-      /* Tag decoding */
+-      u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+-      unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+       unsigned int len = KSZ_EGRESS_TAG_LEN;
++      unsigned int port;
++      u8 *tag;
++
++      if (skb_linearize(skb))
++              return NULL;
++
++      /* Tag decoding */
++      tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++      port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+       /* Extra 4-bytes PTP timestamp */
+       if (tag[0] & KSZ9477_PTP_TAG_INDICATION) {
+-- 
+2.39.5
+
diff --git a/queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch b/queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch
new file mode 100644 (file)
index 0000000..d1adc2f
--- /dev/null
@@ -0,0 +1,49 @@
+From 2123154cd68a07242d7203174814afb18ca32ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 15:42:59 +0200
+Subject: net: dsa: microchip: update tag_ksz masks for KSZ9477 family
+
+From: Pieter Van Trappen <pieter.van.trappen@cern.ch>
+
+[ Upstream commit 3f464b193d40e49299dcd087b10cc3b77cbbea68 ]
+
+Remove magic number 7 by introducing a GENMASK macro instead.
+Remove magic number 0x80 by using the BIT macro instead.
+
+Signed-off-by: Pieter Van Trappen <pieter.van.trappen@cern.ch>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20240909134301.75448-1-vtpieter@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ba54bce747fa ("net: dsa: microchip: linearize skb for tail-tagging switches")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_ksz.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
+index ea100bd25939b..7bf87fa471a0c 100644
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -176,8 +176,9 @@ MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_KSZ8795, KSZ8795_NAME);
+ #define KSZ9477_INGRESS_TAG_LEN               2
+ #define KSZ9477_PTP_TAG_LEN           4
+-#define KSZ9477_PTP_TAG_INDICATION    0x80
++#define KSZ9477_PTP_TAG_INDICATION    BIT(7)
++#define KSZ9477_TAIL_TAG_EG_PORT_M    GENMASK(2, 0)
+ #define KSZ9477_TAIL_TAG_PRIO         GENMASK(8, 7)
+ #define KSZ9477_TAIL_TAG_OVERRIDE     BIT(9)
+ #define KSZ9477_TAIL_TAG_LOOKUP               BIT(10)
+@@ -302,7 +303,7 @@ static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+       /* Tag decoding */
+       u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+-      unsigned int port = tag[0] & 7;
++      unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+       unsigned int len = KSZ_EGRESS_TAG_LEN;
+       /* Extra 4-bytes PTP timestamp */
+-- 
+2.39.5
+
diff --git a/queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch b/queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch
new file mode 100644 (file)
index 0000000..30076d8
--- /dev/null
@@ -0,0 +1,43 @@
+From d244a094a0cc50f074b309776ec38844683a1d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 09:29:23 +0300
+Subject: pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe ]
+
+The error checking for of_count_phandle_with_args() does not handle
+negative error codes correctly.  The problem is that "index" is a u32 so
+in the condition "if (index >= num_domains)" negative error codes stored
+in "num_domains" are type promoted to very high positive values and
+"index" is always going to be valid.
+
+Test for negative error codes first and then test if "index" is valid.
+
+Fixes: 3ccf3f0cd197 ("PM / Domains: Enable genpd_dev_pm_attach_by_id|name() for single PM domain")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/aBxPQ8AI8N5v-7rL@stanley.mountain
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index d9d339b8b5710..d1dae47f3534b 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -2856,7 +2856,7 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev,
+       /* Verify that the index is within a valid range. */
+       num_domains = of_count_phandle_with_args(dev->of_node, "power-domains",
+                                                "#power-domain-cells");
+-      if (index >= num_domains)
++      if (num_domains < 0 || index >= num_domains)
+               return NULL;
+       /* Allocate and register device on the genpd bus. */
+-- 
+2.39.5
+
diff --git a/queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch b/queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch
new file mode 100644 (file)
index 0000000..3a3ece2
--- /dev/null
@@ -0,0 +1,155 @@
+From d31b1e0f0c90cd294160a4e673334b7505a8fd0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 08:05:49 +0300
+Subject: serial: sh-sci: Check if TX data was written to device in .tx_empty()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 7cc0e0a43a91052477c2921f924a37d9c3891f0c upstream.
+
+On the Renesas RZ/G3S, when doing suspend to RAM, the uart_suspend_port()
+is called. The uart_suspend_port() calls 3 times the
+struct uart_port::ops::tx_empty() before shutting down the port.
+
+According to the documentation, the struct uart_port::ops::tx_empty()
+API tests whether the transmitter FIFO and shifter for the port is
+empty.
+
+The Renesas RZ/G3S SCIFA IP reports the number of data units stored in the
+transmit FIFO through the FDR (FIFO Data Count Register). The data units
+in the FIFOs are written in the shift register and transmitted from there.
+The TEND bit in the Serial Status Register reports if the data was
+transmitted from the shift register.
+
+In the previous code, in the tx_empty() API implemented by the sh-sci
+driver, it is considered that the TX is empty if the hardware reports the
+TEND bit set and the number of data units in the FIFO is zero.
+
+According to the HW manual, the TEND bit has the following meaning:
+
+0: Transmission is in the waiting state or in progress.
+1: Transmission is completed.
+
+It has been noticed that when opening the serial device w/o using it and
+then switch to a power saving mode, the tx_empty() call in the
+uart_port_suspend() function fails, leading to the "Unable to drain
+transmitter" message being printed on the console. This is because the
+TEND=0 if nothing has been transmitted and the FIFOs are empty. As the
+TEND=0 has double meaning (waiting state, in progress) we can't
+determined the scenario described above.
+
+Add a software workaround for this. This sets a variable if any data has
+been sent on the serial console (when using PIO) or if the DMA callback has
+been called (meaning something has been transmitted). In the tx_empty()
+API the status of the DMA transaction is also checked and if it is
+completed or in progress the code falls back in checking the hardware
+registers instead of relying on the software variable.
+
+Fixes: 73a19e4c0301 ("serial: sh-sci: Add DMA support.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20241125115856.513642-1-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[claudiu.beznea: fixed conflict by:
+ - keeping serial_port_out() instead of sci_port_out() in
+   sci_transmit_chars()
+ - keeping !uart_circ_empty(xmit) condition in sci_dma_tx_complete(),
+   after s->tx_occurred = true; assignement]
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 61d8f50676b1b..d57fa80b6f52a 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -174,6 +174,7 @@ struct sci_port {
+       bool has_rtscts;
+       bool autorts;
++      bool tx_occurred;
+ };
+ #define SCI_NPORTS CONFIG_SERIAL_SH_SCI_NR_UARTS
+@@ -838,6 +839,7 @@ static void sci_transmit_chars(struct uart_port *port)
+ {
+       struct circ_buf *xmit = &port->state->xmit;
+       unsigned int stopped = uart_tx_stopped(port);
++      struct sci_port *s = to_sci_port(port);
+       unsigned short status;
+       unsigned short ctrl;
+       int count;
+@@ -874,6 +876,7 @@ static void sci_transmit_chars(struct uart_port *port)
+               }
+               serial_port_out(port, SCxTDR, c);
++              s->tx_occurred = true;
+               port->icount.tx++;
+       } while (--count > 0);
+@@ -1230,6 +1233,8 @@ static void sci_dma_tx_complete(void *arg)
+       if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+               uart_write_wakeup(port);
++      s->tx_occurred = true;
++
+       if (!uart_circ_empty(xmit)) {
+               s->cookie_tx = 0;
+               schedule_work(&s->work_tx);
+@@ -1719,6 +1724,19 @@ static void sci_flush_buffer(struct uart_port *port)
+               s->cookie_tx = -EINVAL;
+       }
+ }
++
++static void sci_dma_check_tx_occurred(struct sci_port *s)
++{
++      struct dma_tx_state state;
++      enum dma_status status;
++
++      if (!s->chan_tx)
++              return;
++
++      status = dmaengine_tx_status(s->chan_tx, s->cookie_tx, &state);
++      if (status == DMA_COMPLETE || status == DMA_IN_PROGRESS)
++              s->tx_occurred = true;
++}
+ #else /* !CONFIG_SERIAL_SH_SCI_DMA */
+ static inline void sci_request_dma(struct uart_port *port)
+ {
+@@ -1728,6 +1746,10 @@ static inline void sci_free_dma(struct uart_port *port)
+ {
+ }
++static void sci_dma_check_tx_occurred(struct sci_port *s)
++{
++}
++
+ #define sci_flush_buffer      NULL
+ #endif /* !CONFIG_SERIAL_SH_SCI_DMA */
+@@ -2064,6 +2086,12 @@ static unsigned int sci_tx_empty(struct uart_port *port)
+ {
+       unsigned short status = serial_port_in(port, SCxSR);
+       unsigned short in_tx_fifo = sci_txfill(port);
++      struct sci_port *s = to_sci_port(port);
++
++      sci_dma_check_tx_occurred(s);
++
++      if (!s->tx_occurred)
++              return TIOCSER_TEMT;
+       return (status & SCxSR_TEND(port)) && !in_tx_fifo ? TIOCSER_TEMT : 0;
+ }
+@@ -2234,6 +2262,7 @@ static int sci_startup(struct uart_port *port)
+       dev_dbg(port->dev, "%s(%d)\n", __func__, port->line);
++      s->tx_occurred = false;
+       sci_request_dma(port);
+       ret = sci_request_irq(s);
+-- 
+2.39.5
+
diff --git a/queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch b/queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch
new file mode 100644 (file)
index 0000000..2925d34
--- /dev/null
@@ -0,0 +1,125 @@
+From c4dca2f6b2c2e990d88097d443262e04a638b6e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 08:05:51 +0300
+Subject: serial: sh-sci: Clean sci_ports[0] after at earlycon exit
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 5f1017069933489add0c08659673443c9905659e upstream.
+
+The early_console_setup() function initializes sci_ports[0].port with an
+object of type struct uart_port obtained from the struct earlycon_device
+passed as an argument to early_console_setup().
+
+Later, during serial port probing, the serial port used as earlycon
+(e.g., port A) might be remapped to a different position in the sci_ports[]
+array, and a different serial port (e.g., port B) might be assigned to slot
+0. For example:
+
+sci_ports[0] = port B
+sci_ports[X] = port A
+
+In this scenario, the new port mapped at index zero (port B) retains the
+data associated with the earlycon configuration. Consequently, after the
+Linux boot process, any access to the serial port now mapped to
+sci_ports[0] (port B) will block the original earlycon port (port A).
+
+To address this, introduce an early_console_exit() function to clean up
+sci_ports[0] when earlycon is exited.
+
+To prevent the cleanup of sci_ports[0] while the serial device is still
+being used by earlycon, introduce the struct sci_port::probing flag and
+account for it in early_console_exit().
+
+Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250116182249.3828577-5-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 32 ++++++++++++++++++++++++++++++--
+ 1 file changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 0071cb3043e14..be7e57e1d1e36 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -183,6 +183,7 @@ static struct sci_port sci_ports[SCI_NPORTS];
+ static unsigned long sci_ports_in_use;
+ static struct uart_driver sci_uart_driver;
+ static bool sci_uart_earlycon;
++static bool sci_uart_earlycon_dev_probing;
+ static inline struct sci_port *
+ to_sci_port(struct uart_port *uart)
+@@ -3374,7 +3375,8 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev,
+ static int sci_probe_single(struct platform_device *dev,
+                                     unsigned int index,
+                                     struct plat_sci_port *p,
+-                                    struct sci_port *sciport)
++                                    struct sci_port *sciport,
++                                    struct resource *sci_res)
+ {
+       int ret;
+@@ -3421,6 +3423,14 @@ static int sci_probe_single(struct platform_device *dev,
+               sciport->port.flags |= UPF_HARD_FLOW;
+       }
++      if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) {
++              /*
++               * Skip cleanup the sci_port[0] in early_console_exit(), this
++               * port is the same as the earlycon one.
++               */
++              sci_uart_earlycon_dev_probing = true;
++      }
++
+       return uart_add_one_port(&sci_uart_driver, &sciport->port);
+ }
+@@ -3479,7 +3489,7 @@ static int sci_probe(struct platform_device *dev)
+       platform_set_drvdata(dev, sp);
+-      ret = sci_probe_single(dev, dev_id, p, sp);
++      ret = sci_probe_single(dev, dev_id, p, sp, res);
+       if (ret)
+               return ret;
+@@ -3636,6 +3646,22 @@ sh_early_platform_init_buffer("earlyprintk", &sci_driver,
+ #ifdef CONFIG_SERIAL_SH_SCI_EARLYCON
+ static struct plat_sci_port port_cfg;
++static int early_console_exit(struct console *co)
++{
++      struct sci_port *sci_port = &sci_ports[0];
++
++      /*
++       * Clean the slot used by earlycon. A new SCI device might
++       * map to this slot.
++       */
++      if (!sci_uart_earlycon_dev_probing) {
++              memset(sci_port, 0, sizeof(*sci_port));
++              sci_uart_earlycon = false;
++      }
++
++      return 0;
++}
++
+ static int __init early_console_setup(struct earlycon_device *device,
+                                     int type)
+ {
+@@ -3655,6 +3681,8 @@ static int __init early_console_setup(struct earlycon_device *device,
+                      SCSCR_RE | SCSCR_TE | port_cfg.scscr);
+       device->con->write = serial_console_write;
++      device->con->exit = early_console_exit;
++
+       return 0;
+ }
+ static int __init sci_early_console_setup(struct earlycon_device *device,
+-- 
+2.39.5
+
diff --git a/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch b/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch
new file mode 100644 (file)
index 0000000..a7ac0bf
--- /dev/null
@@ -0,0 +1,92 @@
+From 124c1b6097fb77fa32c2202976d004cf8d9269a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 08:05:52 +0300
+Subject: serial: sh-sci: Increment the runtime usage counter for the earlycon
+ device
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 651dee03696e1dfde6d9a7e8664bbdcd9a10ea7f upstream.
+
+In the sh-sci driver, serial ports are mapped to the sci_ports[] array,
+with earlycon mapped at index zero.
+
+The uart_add_one_port() function eventually calls __device_attach(),
+which, in turn, calls pm_request_idle(). The identified code path is as
+follows:
+
+uart_add_one_port() ->
+  serial_ctrl_register_port() ->
+    serial_core_register_port() ->
+      serial_core_port_device_add() ->
+        serial_base_port_add() ->
+          device_add() ->
+            bus_probe_device() ->
+              device_initial_probe() ->
+                __device_attach() ->
+                  // ...
+                  if (dev->p->dead) {
+                    // ...
+                  } else if (dev->driver) {
+                    // ...
+                  } else {
+                    // ...
+                    pm_request_idle(dev);
+                    // ...
+                  }
+
+The earlycon device clocks are enabled by the bootloader. However, the
+pm_request_idle() call in __device_attach() disables the SCI port clocks
+while earlycon is still active.
+
+The earlycon write function, serial_console_write(), calls
+sci_poll_put_char() via serial_console_putchar(). If the SCI port clocks
+are disabled, writing to earlycon may sometimes cause the SR.TDFE bit to
+remain unset indefinitely, causing the while loop in sci_poll_put_char()
+to never exit. On single-core SoCs, this can result in the system being
+blocked during boot when this issue occurs.
+
+To resolve this, increment the runtime PM usage counter for the earlycon
+SCI device before registering the UART port.
+
+Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250116182249.3828577-6-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index be7e57e1d1e36..dab5658d9d54a 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3424,6 +3424,22 @@ static int sci_probe_single(struct platform_device *dev,
+       }
+       if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) {
++              /*
++               * In case:
++               * - this is the earlycon port (mapped on index 0 in sci_ports[]) and
++               * - it now maps to an alias other than zero and
++               * - the earlycon is still alive (e.g., "earlycon keep_bootcon" is
++               *   available in bootargs)
++               *
++               * we need to avoid disabling clocks and PM domains through the runtime
++               * PM APIs called in __device_attach(). For this, increment the runtime
++               * PM reference counter (the clocks and PM domains were already enabled
++               * by the bootloader). Otherwise the earlycon may access the HW when it
++               * has no clocks enabled leading to failures (infinite loop in
++               * sci_poll_put_char()).
++               */
++              pm_runtime_get_noresume(&dev->dev);
++
+               /*
+                * Skip cleanup the sci_port[0] in early_console_exit(), this
+                * port is the same as the earlycon one.
+-- 
+2.39.5
+
diff --git a/queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch b/queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch
new file mode 100644 (file)
index 0000000..6f8e29a
--- /dev/null
@@ -0,0 +1,93 @@
+From 86b7e81e96a0e781cc55125085522228bc3a6615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jun 2025 08:05:50 +0300
+Subject: serial: sh-sci: Move runtime PM enable to sci_probe_single()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+commit 239f11209e5f282e16f5241b99256e25dd0614b6 upstream.
+
+Relocate the runtime PM enable operation to sci_probe_single(). This change
+prepares the codebase for upcoming fixes.
+
+While at it, replace the existing logic with a direct call to
+devm_pm_runtime_enable() and remove sci_cleanup_single(). The
+devm_pm_runtime_enable() function automatically handles disabling runtime
+PM during driver removal.
+
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Link: https://lore.kernel.org/r/20250116182249.3828577-3-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 24 ++++++------------------
+ 1 file changed, 6 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index d57fa80b6f52a..0071cb3043e14 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3043,10 +3043,6 @@ static int sci_init_single(struct platform_device *dev,
+               ret = sci_init_clocks(sci_port, &dev->dev);
+               if (ret < 0)
+                       return ret;
+-
+-              port->dev = &dev->dev;
+-
+-              pm_runtime_enable(&dev->dev);
+       }
+       port->type              = p->type;
+@@ -3076,11 +3072,6 @@ static int sci_init_single(struct platform_device *dev,
+       return 0;
+ }
+-static void sci_cleanup_single(struct sci_port *port)
+-{
+-      pm_runtime_disable(port->port.dev);
+-}
+-
+ #if defined(CONFIG_SERIAL_SH_SCI_CONSOLE) || \
+     defined(CONFIG_SERIAL_SH_SCI_EARLYCON)
+ static void serial_console_putchar(struct uart_port *port, unsigned char ch)
+@@ -3250,8 +3241,6 @@ static int sci_remove(struct platform_device *dev)
+       sci_ports_in_use &= ~BIT(port->port.line);
+       uart_remove_one_port(&sci_uart_driver, &port->port);
+-      sci_cleanup_single(port);
+-
+       if (port->port.fifosize > 1)
+               device_remove_file(&dev->dev, &dev_attr_rx_fifo_trigger);
+       if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF)
+@@ -3414,6 +3403,11 @@ static int sci_probe_single(struct platform_device *dev,
+       if (ret)
+               return ret;
++      sciport->port.dev = &dev->dev;
++      ret = devm_pm_runtime_enable(&dev->dev);
++      if (ret)
++              return ret;
++
+       sciport->gpios = mctrl_gpio_init(&sciport->port, 0);
+       if (IS_ERR(sciport->gpios))
+               return PTR_ERR(sciport->gpios);
+@@ -3427,13 +3421,7 @@ static int sci_probe_single(struct platform_device *dev,
+               sciport->port.flags |= UPF_HARD_FLOW;
+       }
+-      ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
+-      if (ret) {
+-              sci_cleanup_single(sciport);
+-              return ret;
+-      }
+-
+-      return 0;
++      return uart_add_one_port(&sci_uart_driver, &sciport->port);
+ }
+ static int sci_probe(struct platform_device *dev)
+-- 
+2.39.5
+
index ca5c2d33b252f53d753da59ff1d68710b8a236c0..a5d4ad11a6681c9bd8475f394658dd7d80f9d71e 100644 (file)
@@ -274,3 +274,18 @@ asoc-ti-omap-hdmi-re-add-dai_link-platform-to-fix-ca.patch
 path_overmount-avoid-false-negatives.patch
 fix-propagation-graph-breakage-by-move_mount_set_gro.patch
 do_change_type-refuse-to-operate-on-unmounted-not-ou.patch
+net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch
+net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch
+pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch
+input-synaptics-rmi-fix-crash-with-unsupported-versi.patch
+kasan-use-unchecked-__memset-internally.patch
+kasan-avoid-sleepable-page-allocation-from-atomic-co.patch
+arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch
+arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch
+arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch
+arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch
+arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch
+serial-sh-sci-check-if-tx-data-was-written-to-device.patch
+serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch
+serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch
+serial-sh-sci-increment-the-runtime-usage-counter-fo.patch