From: Greg Kroah-Hartman Date: Sat, 24 May 2025 15:51:59 +0000 (+0200) Subject: 6.14-stable patches X-Git-Tag: v6.12.31~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=21f01096dde68db7b3b35bcb7f5997a3b968b5d6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.14-stable patches added patches: alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch asoc-sof-topology-connect-dai-to-a-single-dai-link.patch can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch can-kvaser_pciefd-fix-echo_skb-race.patch io_uring-net-only-retry-recv-bundle-for-a-full-transfer.patch llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch mmc-sdhci_am654-add-sdhci_quirk2_suppress_v1p8_ena-quirk-to-am62-compatible.patch net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch vmxnet3-update-mtu-after-device-quiesce.patch --- diff --git a/queue-6.14/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch b/queue-6.14/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch new file mode 100644 index 0000000000..dd21e200f0 --- /dev/null +++ b/queue-6.14/alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch @@ -0,0 +1,32 @@ +From 8d70503068510e6080c2c649cccb154f16de26c9 Mon Sep 17 00:00:00 2001 +From: Ed Burcher +Date: Mon, 19 May 2025 23:49:07 +0100 +Subject: ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ASP10 + +From: Ed Burcher + +commit 8d70503068510e6080c2c649cccb154f16de26c9 upstream. + +Lenovo Yoga Pro 7 (gen 10) with Realtek ALC3306 and combined CS35L56 +amplifiers need quirk ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN to +enable bass + +Signed-off-by: Ed Burcher +Cc: +Link: https://patch.msgid.link/20250519224907.31265-2-git@edburcher.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11234,6 +11234,7 @@ static const struct hda_quirk alc269_fix + SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_MG_RTKC_CSAMP_CS35L41_I2C_THINKPAD), + SND_PCI_QUIRK(0x17aa, 0x38fd, "ThinkBook plus Gen5 Hybrid", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), ++ SND_PCI_QUIRK(0x17aa, 0x390d, "Lenovo Yoga Pro 7 14ASP10", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x3913, "Lenovo 145", ALC236_FIXUP_LENOVO_INV_DMIC), + SND_PCI_QUIRK(0x17aa, 0x391f, "Yoga S990-16 pro Quad YC Quad", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x3920, "Yoga S990-16 pro Quad VECO Quad", ALC287_FIXUP_TAS2781_I2C), diff --git a/queue-6.14/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch b/queue-6.14/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch new file mode 100644 index 0000000000..330ac852fd --- /dev/null +++ b/queue-6.14/alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch @@ -0,0 +1,74 @@ +From 93a81ca0657758b607c3f4ba889ae806be9beb73 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 16 May 2025 10:08:16 +0200 +Subject: ALSA: pcm: Fix race of buffer access at PCM OSS layer + +From: Takashi Iwai + +commit 93a81ca0657758b607c3f4ba889ae806be9beb73 upstream. + +The PCM OSS layer tries to clear the buffer with the silence data at +initialization (or reconfiguration) of a stream with the explicit call +of snd_pcm_format_set_silence() with runtime->dma_area. But this may +lead to a UAF because the accessed runtime->dma_area might be freed +concurrently, as it's performed outside the PCM ops. + +For avoiding it, move the code into the PCM core and perform it inside +the buffer access lock, so that it won't be changed during the +operation. + +Reported-by: syzbot+32d4647f551007595173@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/68164d8e.050a0220.11da1b.0019.GAE@google.com +Cc: +Link: https://patch.msgid.link/20250516080817.20068-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + include/sound/pcm.h | 2 ++ + sound/core/oss/pcm_oss.c | 3 +-- + sound/core/pcm_native.c | 11 +++++++++++ + 3 files changed, 14 insertions(+), 2 deletions(-) + +--- a/include/sound/pcm.h ++++ b/include/sound/pcm.h +@@ -1404,6 +1404,8 @@ int snd_pcm_lib_mmap_iomem(struct snd_pc + #define snd_pcm_lib_mmap_iomem NULL + #endif + ++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime); ++ + /** + * snd_pcm_limit_isa_dma_size - Get the max size fitting with ISA DMA transfer + * @dma: DMA number +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1074,8 +1074,7 @@ static int snd_pcm_oss_change_params_loc + runtime->oss.params = 0; + runtime->oss.prepare = 1; + runtime->oss.buffer_used = 0; +- if (runtime->dma_area) +- snd_pcm_format_set_silence(runtime->format, runtime->dma_area, bytes_to_samples(runtime, runtime->dma_bytes)); ++ snd_pcm_runtime_buffer_set_silence(runtime); + + runtime->oss.period_frames = snd_pcm_alsa_frames(substream, oss_period_size); + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -723,6 +723,17 @@ static void snd_pcm_buffer_access_unlock + atomic_inc(&runtime->buffer_accessing); + } + ++/* fill the PCM buffer with the current silence format; called from pcm_oss.c */ ++void snd_pcm_runtime_buffer_set_silence(struct snd_pcm_runtime *runtime) ++{ ++ snd_pcm_buffer_access_lock(runtime); ++ if (runtime->dma_area) ++ snd_pcm_format_set_silence(runtime->format, runtime->dma_area, ++ bytes_to_samples(runtime, runtime->dma_bytes)); ++ snd_pcm_buffer_access_unlock(runtime); ++} ++EXPORT_SYMBOL_GPL(snd_pcm_runtime_buffer_set_silence); ++ + #if IS_ENABLED(CONFIG_SND_PCM_OSS) + #define is_oss_stream(substream) ((substream)->oss.oss) + #else diff --git a/queue-6.14/asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch b/queue-6.14/asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch new file mode 100644 index 0000000000..11e3787e89 --- /dev/null +++ b/queue-6.14/asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch @@ -0,0 +1,35 @@ +From 4e7010826e96702d7fad13dbe85de4e94052f833 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 9 May 2025 11:13:08 +0300 +Subject: ASoC: SOF: Intel: hda-bus: Use PIO mode on ACE2+ platforms + +From: Peter Ujfalusi + +commit 4e7010826e96702d7fad13dbe85de4e94052f833 upstream. + +Keep using the PIO mode for commands on ACE2+ platforms, similarly how +the legacy stack is configured. + +Fixes: 05cf17f1bf6d ("ASoC: SOF: Intel: hda-bus: Use PIO mode for Lunar Lake") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250509081308.13784-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/intel/hda-bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/sof/intel/hda-bus.c ++++ b/sound/soc/sof/intel/hda-bus.c +@@ -76,7 +76,7 @@ void sof_hda_bus_init(struct snd_sof_dev + + snd_hdac_ext_bus_init(bus, dev, &bus_core_ops, sof_hda_ext_ops); + +- if (chip && chip->hw_ip_version == SOF_INTEL_ACE_2_0) ++ if (chip && chip->hw_ip_version >= SOF_INTEL_ACE_2_0) + bus->use_pio_for_commands = true; + #else + snd_hdac_ext_bus_init(bus, dev, NULL, NULL); diff --git a/queue-6.14/asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch b/queue-6.14/asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch new file mode 100644 index 0000000000..6a411a4ad8 --- /dev/null +++ b/queue-6.14/asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch @@ -0,0 +1,64 @@ +From 4d14b1069e9e672dbe1adab52594076da6f4a62d Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 9 May 2025 11:56:33 +0300 +Subject: ASoC: SOF: ipc4-control: Use SOF_CTRL_CMD_BINARY as numid for bytes_ext + +From: Peter Ujfalusi + +commit 4d14b1069e9e672dbe1adab52594076da6f4a62d upstream. + +The header.numid is set to scontrol->comp_id in bytes_ext_get and it is +ignored during bytes_ext_put. +The use of comp_id is not quite great as it is kernel internal +identification number. + +Set the header.numid to SOF_CTRL_CMD_BINARY during get and validate the +numid during put to provide consistent and compatible identification +number as IPC3. + +For IPC4 existing tooling also ignored the numid but with the use of +SOF_CTRL_CMD_BINARY the different handling of the blobs can be dropped, +providing better user experience. + +Reported-by: Seppo Ingalsuo +Closes: https://github.com/thesofproject/linux/issues/5282 +Fixes: a062c8899fed ("ASoC: SOF: ipc4-control: Add support for bytes control get and put") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Seppo Ingalsuo +Reviewed-by: Ranjani Sridharan +Reviewed-by: Liam Girdwood +Link: https://patch.msgid.link/20250509085633.14930-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc4-control.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/sound/soc/sof/ipc4-control.c ++++ b/sound/soc/sof/ipc4-control.c +@@ -531,6 +531,14 @@ static int sof_ipc4_bytes_ext_put(struct + return -EINVAL; + } + ++ /* Check header id */ ++ if (header.numid != SOF_CTRL_CMD_BINARY) { ++ dev_err_ratelimited(scomp->dev, ++ "Incorrect numid for bytes put %d\n", ++ header.numid); ++ return -EINVAL; ++ } ++ + /* Verify the ABI header first */ + if (copy_from_user(&abi_hdr, tlvd->tlv, sizeof(abi_hdr))) + return -EFAULT; +@@ -613,7 +621,8 @@ static int _sof_ipc4_bytes_ext_get(struc + if (data_size > size) + return -ENOSPC; + +- header.numid = scontrol->comp_id; ++ /* Set header id and length */ ++ header.numid = SOF_CTRL_CMD_BINARY; + header.length = data_size; + + if (copy_to_user(tlvd, &header, sizeof(struct snd_ctl_tlv))) diff --git a/queue-6.14/asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch b/queue-6.14/asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch new file mode 100644 index 0000000000..1413bd5d6d --- /dev/null +++ b/queue-6.14/asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch @@ -0,0 +1,39 @@ +From 98db16f314b3a0d6e5acd94708ea69751436467f Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 9 May 2025 11:59:51 +0300 +Subject: ASoC: SOF: ipc4-pcm: Delay reporting is only supported for playback direction + +From: Peter Ujfalusi + +commit 98db16f314b3a0d6e5acd94708ea69751436467f upstream. + +The firmware does not provide any information for capture streams via the +shared pipeline registers. + +To avoid reporting invalid delay value for capture streams to user space +we need to disable it. + +Fixes: af74dbd0dbcf ("ASoC: SOF: ipc4-pcm: allocate time info for pcm delay feature") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Reviewed-by: Bard Liao +Reviewed-by: Liam Girdwood +Link: https://patch.msgid.link/20250509085951.15696-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/ipc4-pcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/soc/sof/ipc4-pcm.c ++++ b/sound/soc/sof/ipc4-pcm.c +@@ -797,7 +797,8 @@ static int sof_ipc4_pcm_setup(struct snd + + spcm->stream[stream].private = stream_priv; + +- if (!support_info) ++ /* Delay reporting is only supported on playback */ ++ if (!support_info || stream == SNDRV_PCM_STREAM_CAPTURE) + continue; + + time_info = kzalloc(sizeof(*time_info), GFP_KERNEL); diff --git a/queue-6.14/asoc-sof-topology-connect-dai-to-a-single-dai-link.patch b/queue-6.14/asoc-sof-topology-connect-dai-to-a-single-dai-link.patch new file mode 100644 index 0000000000..dff904b176 --- /dev/null +++ b/queue-6.14/asoc-sof-topology-connect-dai-to-a-single-dai-link.patch @@ -0,0 +1,70 @@ +From 6052f05254b4fe7b16bbd8224779af52fba98b71 Mon Sep 17 00:00:00 2001 +From: Kai Vehmanen +Date: Fri, 9 May 2025 11:53:18 +0300 +Subject: ASoc: SOF: topology: connect DAI to a single DAI link +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai Vehmanen + +commit 6052f05254b4fe7b16bbd8224779af52fba98b71 upstream. + +The partial matching of DAI widget to link names, can cause problems if +one of the widget names is a substring of another. E.g. with names +"Foo1" and Foo10", it's not possible to correctly link up "Foo1". + +Modify the logic so that if multiple DAI links match the widget stream +name, prioritize a full match if one is found. + +Fixes: fe88788779fc ("ASoC: SOF: topology: Use partial match for connecting DAI link and DAI widget") +Link: https://github.com/thesofproject/linux/issues/5308 +Signed-off-by: Kai Vehmanen +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Cc: stable@vger.kernel.org +Signed-off-by: Peter Ujfalusi +Link: https://patch.msgid.link/20250509085318.13936-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sof/topology.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -1063,7 +1063,7 @@ static int sof_connect_dai_widget(struct + struct snd_sof_dai *dai) + { + struct snd_soc_card *card = scomp->card; +- struct snd_soc_pcm_runtime *rtd; ++ struct snd_soc_pcm_runtime *rtd, *full, *partial; + struct snd_soc_dai *cpu_dai; + int stream; + int i; +@@ -1080,12 +1080,22 @@ static int sof_connect_dai_widget(struct + else + goto end; + ++ full = NULL; ++ partial = NULL; + list_for_each_entry(rtd, &card->rtd_list, list) { + /* does stream match DAI link ? */ +- if (!rtd->dai_link->stream_name || +- !strstr(rtd->dai_link->stream_name, w->sname)) +- continue; ++ if (rtd->dai_link->stream_name) { ++ if (!strcmp(rtd->dai_link->stream_name, w->sname)) { ++ full = rtd; ++ break; ++ } else if (strstr(rtd->dai_link->stream_name, w->sname)) { ++ partial = rtd; ++ } ++ } ++ } + ++ rtd = full ? full : partial; ++ if (rtd) { + for_each_rtd_cpu_dais(rtd, i, cpu_dai) { + /* + * Please create DAI widget in the right order diff --git a/queue-6.14/can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch b/queue-6.14/can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch new file mode 100644 index 0000000000..21548d0392 --- /dev/null +++ b/queue-6.14/can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch @@ -0,0 +1,62 @@ +From 6d820b81c4dc4a4023e45c3cd6707a07dd838649 Mon Sep 17 00:00:00 2001 +From: Axel Forsman +Date: Tue, 20 May 2025 13:43:32 +0200 +Subject: can: kvaser_pciefd: Continue parsing DMA buf after dropped RX + +From: Axel Forsman + +commit 6d820b81c4dc4a4023e45c3cd6707a07dd838649 upstream. + +Going bus-off on a channel doing RX could result in dropped packets. + +As netif_running() gets cleared before the channel abort procedure, +the handling of any last RDATA packets would see netif_rx() return +non-zero to signal a dropped packet. kvaser_pciefd_read_buffer() dealt +with this "error" by breaking out of processing the remaining DMA RX +buffer. + +Only return an error from kvaser_pciefd_read_buffer() due to packet +corruption, otherwise handle it internally. + +Cc: stable@vger.kernel.org +Signed-off-by: Axel Forsman +Tested-by: Jimmy Assarsson +Reviewed-by: Jimmy Assarsson +Link: https://patch.msgid.link/20250520114332.8961-4-axfo@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/kvaser_pciefd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -1201,7 +1201,7 @@ static int kvaser_pciefd_handle_data_pac + skb = alloc_canfd_skb(priv->dev, &cf); + if (!skb) { + priv->dev->stats.rx_dropped++; +- return -ENOMEM; ++ return 0; + } + + cf->len = can_fd_dlc2len(dlc); +@@ -1213,7 +1213,7 @@ static int kvaser_pciefd_handle_data_pac + skb = alloc_can_skb(priv->dev, (struct can_frame **)&cf); + if (!skb) { + priv->dev->stats.rx_dropped++; +- return -ENOMEM; ++ return 0; + } + can_frame_set_cc_len((struct can_frame *)cf, dlc, priv->ctrlmode); + } +@@ -1231,7 +1231,9 @@ static int kvaser_pciefd_handle_data_pac + priv->dev->stats.rx_packets++; + kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); + +- return netif_rx(skb); ++ netif_rx(skb); ++ ++ return 0; + } + + static void kvaser_pciefd_change_state(struct kvaser_pciefd_can *can, diff --git a/queue-6.14/can-kvaser_pciefd-fix-echo_skb-race.patch b/queue-6.14/can-kvaser_pciefd-fix-echo_skb-race.patch new file mode 100644 index 0000000000..7ce9b1d6dd --- /dev/null +++ b/queue-6.14/can-kvaser_pciefd-fix-echo_skb-race.patch @@ -0,0 +1,237 @@ +From 8256e0ca601051933e9395746817f3801fa9a6bf Mon Sep 17 00:00:00 2001 +From: Axel Forsman +Date: Tue, 20 May 2025 13:43:31 +0200 +Subject: can: kvaser_pciefd: Fix echo_skb race + +From: Axel Forsman + +commit 8256e0ca601051933e9395746817f3801fa9a6bf upstream. + +The functions kvaser_pciefd_start_xmit() and +kvaser_pciefd_handle_ack_packet() raced to stop/wake TX queues and +get/put echo skbs, as kvaser_pciefd_can->echo_lock was only ever taken +when transmitting and KCAN_TX_NR_PACKETS_CURRENT gets decremented +prior to handling of ACKs. E.g., this caused the following error: + + can_put_echo_skb: BUG! echo_skb 5 is occupied! + +Instead, use the synchronization helpers in netdev_queues.h. As those +piggyback on BQL barriers, start updating in-flight packets and bytes +counts as well. + +Cc: stable@vger.kernel.org +Signed-off-by: Axel Forsman +Tested-by: Jimmy Assarsson +Reviewed-by: Jimmy Assarsson +Link: https://patch.msgid.link/20250520114332.8961-3-axfo@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/kvaser_pciefd.c | 93 +++++++++++++++++++++++++--------------- + 1 file changed, 59 insertions(+), 34 deletions(-) + +--- a/drivers/net/can/kvaser_pciefd.c ++++ b/drivers/net/can/kvaser_pciefd.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + MODULE_LICENSE("Dual BSD/GPL"); + MODULE_AUTHOR("Kvaser AB "); +@@ -410,10 +411,13 @@ struct kvaser_pciefd_can { + void __iomem *reg_base; + struct can_berr_counter bec; + u8 cmd_seq; ++ u8 tx_max_count; ++ u8 tx_idx; ++ u8 ack_idx; + int err_rep_cnt; +- int echo_idx; ++ unsigned int completed_tx_pkts; ++ unsigned int completed_tx_bytes; + spinlock_t lock; /* Locks sensitive registers (e.g. MODE) */ +- spinlock_t echo_lock; /* Locks the message echo buffer */ + struct timer_list bec_poll_timer; + struct completion start_comp, flush_comp; + }; +@@ -714,6 +718,9 @@ static int kvaser_pciefd_open(struct net + int ret; + struct kvaser_pciefd_can *can = netdev_priv(netdev); + ++ can->tx_idx = 0; ++ can->ack_idx = 0; ++ + ret = open_candev(netdev); + if (ret) + return ret; +@@ -745,21 +752,26 @@ static int kvaser_pciefd_stop(struct net + del_timer(&can->bec_poll_timer); + } + can->can.state = CAN_STATE_STOPPED; ++ netdev_reset_queue(netdev); + close_candev(netdev); + + return ret; + } + ++static unsigned int kvaser_pciefd_tx_avail(const struct kvaser_pciefd_can *can) ++{ ++ return can->tx_max_count - (READ_ONCE(can->tx_idx) - READ_ONCE(can->ack_idx)); ++} ++ + static int kvaser_pciefd_prepare_tx_packet(struct kvaser_pciefd_tx_packet *p, +- struct kvaser_pciefd_can *can, ++ struct can_priv *can, u8 seq, + struct sk_buff *skb) + { + struct canfd_frame *cf = (struct canfd_frame *)skb->data; + int packet_size; +- int seq = can->echo_idx; + + memset(p, 0, sizeof(*p)); +- if (can->can.ctrlmode & CAN_CTRLMODE_ONE_SHOT) ++ if (can->ctrlmode & CAN_CTRLMODE_ONE_SHOT) + p->header[1] |= KVASER_PCIEFD_TPACKET_SMS; + + if (cf->can_id & CAN_RTR_FLAG) +@@ -782,7 +794,7 @@ static int kvaser_pciefd_prepare_tx_pack + } else { + p->header[1] |= + FIELD_PREP(KVASER_PCIEFD_RPACKET_DLC_MASK, +- can_get_cc_dlc((struct can_frame *)cf, can->can.ctrlmode)); ++ can_get_cc_dlc((struct can_frame *)cf, can->ctrlmode)); + } + + p->header[1] |= FIELD_PREP(KVASER_PCIEFD_PACKET_SEQ_MASK, seq); +@@ -797,22 +809,24 @@ static netdev_tx_t kvaser_pciefd_start_x + struct net_device *netdev) + { + struct kvaser_pciefd_can *can = netdev_priv(netdev); +- unsigned long irq_flags; + struct kvaser_pciefd_tx_packet packet; ++ unsigned int seq = can->tx_idx & (can->can.echo_skb_max - 1); ++ unsigned int frame_len; + int nr_words; +- u8 count; + + if (can_dev_dropped_skb(netdev, skb)) + return NETDEV_TX_OK; ++ if (!netif_subqueue_maybe_stop(netdev, 0, kvaser_pciefd_tx_avail(can), 1, 1)) ++ return NETDEV_TX_BUSY; + +- nr_words = kvaser_pciefd_prepare_tx_packet(&packet, can, skb); ++ nr_words = kvaser_pciefd_prepare_tx_packet(&packet, &can->can, seq, skb); + +- spin_lock_irqsave(&can->echo_lock, irq_flags); + /* Prepare and save echo skb in internal slot */ +- can_put_echo_skb(skb, netdev, can->echo_idx, 0); +- +- /* Move echo index to the next slot */ +- can->echo_idx = (can->echo_idx + 1) % can->can.echo_skb_max; ++ WRITE_ONCE(can->can.echo_skb[seq], NULL); ++ frame_len = can_skb_get_frame_len(skb); ++ can_put_echo_skb(skb, netdev, seq, frame_len); ++ netdev_sent_queue(netdev, frame_len); ++ WRITE_ONCE(can->tx_idx, can->tx_idx + 1); + + /* Write header to fifo */ + iowrite32(packet.header[0], +@@ -836,14 +850,7 @@ static netdev_tx_t kvaser_pciefd_start_x + KVASER_PCIEFD_KCAN_FIFO_LAST_REG); + } + +- count = FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_CURRENT_MASK, +- ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG)); +- /* No room for a new message, stop the queue until at least one +- * successful transmit +- */ +- if (count >= can->can.echo_skb_max || can->can.echo_skb[can->echo_idx]) +- netif_stop_queue(netdev); +- spin_unlock_irqrestore(&can->echo_lock, irq_flags); ++ netif_subqueue_maybe_stop(netdev, 0, kvaser_pciefd_tx_avail(can), 1, 1); + + return NETDEV_TX_OK; + } +@@ -970,6 +977,8 @@ static int kvaser_pciefd_setup_can_ctrls + can->kv_pcie = pcie; + can->cmd_seq = 0; + can->err_rep_cnt = 0; ++ can->completed_tx_pkts = 0; ++ can->completed_tx_bytes = 0; + can->bec.txerr = 0; + can->bec.rxerr = 0; + +@@ -983,11 +992,10 @@ static int kvaser_pciefd_setup_can_ctrls + tx_nr_packets_max = + FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_MAX_MASK, + ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG)); ++ can->tx_max_count = min(KVASER_PCIEFD_CAN_TX_MAX_COUNT, tx_nr_packets_max - 1); + + can->can.clock.freq = pcie->freq; +- can->can.echo_skb_max = min(KVASER_PCIEFD_CAN_TX_MAX_COUNT, tx_nr_packets_max - 1); +- can->echo_idx = 0; +- spin_lock_init(&can->echo_lock); ++ can->can.echo_skb_max = roundup_pow_of_two(can->tx_max_count); + spin_lock_init(&can->lock); + + can->can.bittiming_const = &kvaser_pciefd_bittiming_const; +@@ -1512,19 +1520,21 @@ static int kvaser_pciefd_handle_ack_pack + netdev_dbg(can->can.dev, "Packet was flushed\n"); + } else { + int echo_idx = FIELD_GET(KVASER_PCIEFD_PACKET_SEQ_MASK, p->header[0]); +- int len; +- u8 count; ++ unsigned int len, frame_len = 0; + struct sk_buff *skb; + ++ if (echo_idx != (can->ack_idx & (can->can.echo_skb_max - 1))) ++ return 0; + skb = can->can.echo_skb[echo_idx]; +- if (skb) +- kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); +- len = can_get_echo_skb(can->can.dev, echo_idx, NULL); +- count = FIELD_GET(KVASER_PCIEFD_KCAN_TX_NR_PACKETS_CURRENT_MASK, +- ioread32(can->reg_base + KVASER_PCIEFD_KCAN_TX_NR_PACKETS_REG)); ++ if (!skb) ++ return 0; ++ kvaser_pciefd_set_skb_timestamp(pcie, skb, p->timestamp); ++ len = can_get_echo_skb(can->can.dev, echo_idx, &frame_len); + +- if (count < can->can.echo_skb_max && netif_queue_stopped(can->can.dev)) +- netif_wake_queue(can->can.dev); ++ /* Pairs with barrier in kvaser_pciefd_start_xmit() */ ++ smp_store_release(&can->ack_idx, can->ack_idx + 1); ++ can->completed_tx_pkts++; ++ can->completed_tx_bytes += frame_len; + + if (!one_shot_fail) { + can->can.dev->stats.tx_bytes += len; +@@ -1640,11 +1650,26 @@ static int kvaser_pciefd_read_buffer(str + { + int pos = 0; + int res = 0; ++ unsigned int i; + + do { + res = kvaser_pciefd_read_packet(pcie, &pos, dma_buf); + } while (!res && pos > 0 && pos < KVASER_PCIEFD_DMA_SIZE); + ++ /* Report ACKs in this buffer to BQL en masse for correct periods */ ++ for (i = 0; i < pcie->nr_channels; ++i) { ++ struct kvaser_pciefd_can *can = pcie->can[i]; ++ ++ if (!can->completed_tx_pkts) ++ continue; ++ netif_subqueue_completed_wake(can->can.dev, 0, ++ can->completed_tx_pkts, ++ can->completed_tx_bytes, ++ kvaser_pciefd_tx_avail(can), 1); ++ can->completed_tx_pkts = 0; ++ can->completed_tx_bytes = 0; ++ } ++ + return res; + } + diff --git a/queue-6.14/io_uring-net-only-retry-recv-bundle-for-a-full-transfer.patch b/queue-6.14/io_uring-net-only-retry-recv-bundle-for-a-full-transfer.patch new file mode 100644 index 0000000000..7c41e25c2e --- /dev/null +++ b/queue-6.14/io_uring-net-only-retry-recv-bundle-for-a-full-transfer.patch @@ -0,0 +1,60 @@ +From 3a08988123c868dbfdd054541b1090fb891fa49e Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Wed, 21 May 2025 18:51:49 -0600 +Subject: io_uring/net: only retry recv bundle for a full transfer + +From: Jens Axboe + +commit 3a08988123c868dbfdd054541b1090fb891fa49e upstream. + +If a shorter than assumed transfer was seen, a partial buffer will have +been filled. For that case it isn't sane to attempt to fill more into +the bundle before posting a completion, as that will cause a gap in +the received data. + +Check if the iterator has hit zero and only allow to continue a bundle +operation if that is the case. + +Also ensure that for putting finished buffers, only the current transfer +is accounted. Otherwise too many buffers may be put for a short transfer. + +Link: https://github.com/axboe/liburing/issues/1409 +Cc: stable@vger.kernel.org +Fixes: 7c71a0af81ba ("io_uring/net: improve recv bundles") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/net.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/io_uring/net.c ++++ b/io_uring/net.c +@@ -860,18 +860,24 @@ static inline bool io_recv_finish(struct + cflags |= IORING_CQE_F_SOCK_NONEMPTY; + + if (sr->flags & IORING_RECVSEND_BUNDLE) { +- cflags |= io_put_kbufs(req, *ret, io_bundle_nbufs(kmsg, *ret), ++ size_t this_ret = *ret - sr->done_io; ++ ++ cflags |= io_put_kbufs(req, *ret, io_bundle_nbufs(kmsg, this_ret), + issue_flags); + if (sr->retry) + cflags = req->cqe.flags | (cflags & CQE_F_MASK); + /* bundle with no more immediate buffers, we're done */ + if (req->flags & REQ_F_BL_EMPTY) + goto finish; +- /* if more is available, retry and append to this one */ +- if (!sr->retry && kmsg->msg.msg_inq > 0 && *ret > 0) { ++ /* ++ * If more is available AND it was a full transfer, retry and ++ * append to this one ++ */ ++ if (!sr->retry && kmsg->msg.msg_inq > 0 && this_ret > 0 && ++ !iov_iter_count(&kmsg->msg.msg_iter)) { + req->cqe.flags = cflags & ~CQE_F_MASK; + sr->len = kmsg->msg.msg_inq; +- sr->done_io += *ret; ++ sr->done_io += this_ret; + sr->retry = true; + return false; + } diff --git a/queue-6.14/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch b/queue-6.14/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch new file mode 100644 index 0000000000..dc581d2030 --- /dev/null +++ b/queue-6.14/llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch @@ -0,0 +1,49 @@ +From 239af1970bcb039a1551d2c438d113df0010c149 Mon Sep 17 00:00:00 2001 +From: Ilia Gavrilov +Date: Thu, 15 May 2025 12:20:15 +0000 +Subject: llc: fix data loss when reading from a socket in llc_ui_recvmsg() + +From: Ilia Gavrilov + +commit 239af1970bcb039a1551d2c438d113df0010c149 upstream. + +For SOCK_STREAM sockets, if user buffer size (len) is less +than skb size (skb->len), the remaining data from skb +will be lost after calling kfree_skb(). + +To fix this, move the statement for partial reading +above skb deletion. + +Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) + +Fixes: 30a584d944fb ("[LLX]: SOCK_DGRAM interface fixes") +Cc: stable@vger.kernel.org +Signed-off-by: Ilia Gavrilov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -887,15 +887,15 @@ static int llc_ui_recvmsg(struct socket + if (sk->sk_type != SOCK_STREAM) + goto copy_uaddr; + ++ /* Partial read */ ++ if (used + offset < skb_len) ++ continue; ++ + if (!(flags & MSG_PEEK)) { + skb_unlink(skb, &sk->sk_receive_queue); + kfree_skb(skb); + *seq = 0; + } +- +- /* Partial read */ +- if (used + offset < skb_len) +- continue; + } while (len > 0); + + out: diff --git a/queue-6.14/mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch b/queue-6.14/mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch new file mode 100644 index 0000000000..9f0119769f --- /dev/null +++ b/queue-6.14/mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch @@ -0,0 +1,113 @@ +From 08f959759e1e6e9c4b898c51a7d387ac3480630b Mon Sep 17 00:00:00 2001 +From: Nicolas Frattaroli +Date: Wed, 23 Apr 2025 09:53:32 +0200 +Subject: mmc: sdhci-of-dwcmshc: add PD workaround on RK3576 + +From: Nicolas Frattaroli + +commit 08f959759e1e6e9c4b898c51a7d387ac3480630b upstream. + +RK3576's power domains have a peculiar design where the PD_NVM power +domain, of which the sdhci controller is a part, seemingly does not have +idempotent runtime disable/enable. The end effect is that if PD_NVM gets +turned off by the generic power domain logic because all the devices +depending on it are suspended, then the next time the sdhci device is +unsuspended, it'll hang the SoC as soon as it tries accessing the CQHCI +registers. + +RK3576's UFS support needed a new dev_pm_genpd_rpm_always_on function +added to the generic power domains API to handle what appears to be a +similar hardware design. + +Use this new function to ask for the same treatment in the sdhci +controller by giving rk3576 its own platform data with its own postinit +function. The benefit of doing this instead of marking the power domains +always on in the power domain core is that we only do this if we know +the platform we're running on actually uses the sdhci controller. For +others, keeping PD_NVM always on would be a waste, as they won't run +into this specific issue. The only other IP in PD_NVM that could be +affected is FSPI0. If it gets a mainline driver, it will probably want +to do the same thing. + +Acked-by: Adrian Hunter +Signed-off-by: Nicolas Frattaroli +Reviewed-by: Shawn Lin +Fixes: cfee1b507758 ("pmdomain: rockchip: Add support for RK3576 SoC") +Cc: # v6.15+ +Link: https://lore.kernel.org/r/20250423-rk3576-emmc-fix-v3-1-0bf80e29967f@collabora.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-of-dwcmshc.c | 40 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +--- a/drivers/mmc/host/sdhci-of-dwcmshc.c ++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -787,6 +788,29 @@ static void dwcmshc_rk35xx_postinit(stru + } + } + ++static void dwcmshc_rk3576_postinit(struct sdhci_host *host, struct dwcmshc_priv *dwc_priv) ++{ ++ struct device *dev = mmc_dev(host->mmc); ++ int ret; ++ ++ /* ++ * This works around the design of the RK3576's power domains, which ++ * makes the PD_NVM power domain, which the sdhci controller on the ++ * RK3576 is in, never come back the same way once it's run-time ++ * suspended once. This can happen during early kernel boot if no driver ++ * is using either PD_NVM or its child power domain PD_SDGMAC for a ++ * short moment, leading to it being turned off to save power. By ++ * keeping it on, sdhci suspending won't lead to PD_NVM becoming a ++ * candidate for getting turned off. ++ */ ++ ret = dev_pm_genpd_rpm_always_on(dev, true); ++ if (ret && ret != -EOPNOTSUPP) ++ dev_warn(dev, "failed to set PD rpm always on, SoC may hang later: %pe\n", ++ ERR_PTR(ret)); ++ ++ dwcmshc_rk35xx_postinit(host, dwc_priv); ++} ++ + static int th1520_execute_tuning(struct sdhci_host *host, u32 opcode) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); +@@ -1218,6 +1242,18 @@ static const struct dwcmshc_pltfm_data s + .postinit = dwcmshc_rk35xx_postinit, + }; + ++static const struct dwcmshc_pltfm_data sdhci_dwcmshc_rk3576_pdata = { ++ .pdata = { ++ .ops = &sdhci_dwcmshc_rk35xx_ops, ++ .quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN | ++ SDHCI_QUIRK_BROKEN_TIMEOUT_VAL, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN, ++ }, ++ .init = dwcmshc_rk35xx_init, ++ .postinit = dwcmshc_rk3576_postinit, ++}; ++ + static const struct dwcmshc_pltfm_data sdhci_dwcmshc_th1520_pdata = { + .pdata = { + .ops = &sdhci_dwcmshc_th1520_ops, +@@ -1317,6 +1353,10 @@ static const struct of_device_id sdhci_d + .data = &sdhci_dwcmshc_rk35xx_pdata, + }, + { ++ .compatible = "rockchip,rk3576-dwcmshc", ++ .data = &sdhci_dwcmshc_rk3576_pdata, ++ }, ++ { + .compatible = "rockchip,rk3568-dwcmshc", + .data = &sdhci_dwcmshc_rk35xx_pdata, + }, diff --git a/queue-6.14/mmc-sdhci_am654-add-sdhci_quirk2_suppress_v1p8_ena-quirk-to-am62-compatible.patch b/queue-6.14/mmc-sdhci_am654-add-sdhci_quirk2_suppress_v1p8_ena-quirk-to-am62-compatible.patch new file mode 100644 index 0000000000..3e7a65b22d --- /dev/null +++ b/queue-6.14/mmc-sdhci_am654-add-sdhci_quirk2_suppress_v1p8_ena-quirk-to-am62-compatible.patch @@ -0,0 +1,118 @@ +From 71c9475b1e2cc4d31370b1b7a328bdfeea5d53b4 Mon Sep 17 00:00:00 2001 +From: Judith Mendez +Date: Fri, 16 May 2025 15:31:21 -0500 +Subject: mmc: sdhci_am654: Add SDHCI_QUIRK2_SUPPRESS_V1P8_ENA quirk to am62 compatible + +From: Judith Mendez + +commit 71c9475b1e2cc4d31370b1b7a328bdfeea5d53b4 upstream. + +Add a new struct for platform data for the ti,am62-sdhci compatible to +apply additional quirks, namely "SDHCI_QUIRK2_SUPPRESS_V1P8_ENA", to +host controllers with am62 compatible. + +Note, the fix was originally introduced by commit 941a7abd4666 +("mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch") but was +found to be applied too broadly and had to be reverted. + +This fixes MMC init failures seen across am62x boards. + +Fixes: ac5a41b472b4 ("Revert "mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch"") +Fixes: 941a7abd4666 ("mmc: sdhci_am654: Add sdhci_am654_start_signal_voltage_switch") +Cc: stable@vger.kernel.org +Suggested-by: Nishanth Menon +Signed-off-by: Judith Mendez +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20250516203121.3736379-1-jm@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci_am654.c | 35 ++++++++++++++++++++++++++++++++++- + 1 file changed, 34 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -155,6 +155,7 @@ struct sdhci_am654_data { + u32 tuning_loop; + + #define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) ++#define SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA BIT(1) + }; + + struct window { +@@ -166,6 +167,7 @@ struct window { + struct sdhci_am654_driver_data { + const struct sdhci_pltfm_data *pdata; + u32 flags; ++ u32 quirks; + #define IOMUX_PRESENT (1 << 0) + #define FREQSEL_2_BIT (1 << 1) + #define STRBSEL_4_BIT (1 << 2) +@@ -356,6 +358,29 @@ static void sdhci_j721e_4bit_set_clock(s + sdhci_set_clock(host, clock); + } + ++static int sdhci_am654_start_signal_voltage_switch(struct mmc_host *mmc, struct mmc_ios *ios) ++{ ++ struct sdhci_host *host = mmc_priv(mmc); ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ int ret; ++ ++ if ((sdhci_am654->quirks & SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA) && ++ ios->signal_voltage == MMC_SIGNAL_VOLTAGE_180) { ++ if (!IS_ERR(mmc->supply.vqmmc)) { ++ ret = mmc_regulator_set_vqmmc(mmc, ios); ++ if (ret < 0) { ++ pr_err("%s: Switching to 1.8V signalling voltage failed,\n", ++ mmc_hostname(mmc)); ++ return -EIO; ++ } ++ } ++ return 0; ++ } ++ ++ return sdhci_start_signal_voltage_switch(mmc, ios); ++} ++ + static u8 sdhci_am654_write_power_on(struct sdhci_host *host, u8 val, int reg) + { + writeb(val, host->ioaddr + reg); +@@ -650,6 +675,12 @@ static const struct sdhci_am654_driver_d + .flags = IOMUX_PRESENT, + }; + ++static const struct sdhci_am654_driver_data sdhci_am62_4bit_drvdata = { ++ .pdata = &sdhci_j721e_4bit_pdata, ++ .flags = IOMUX_PRESENT, ++ .quirks = SDHCI_AM654_QUIRK_SUPPRESS_V1P8_ENA, ++}; ++ + static const struct soc_device_attribute sdhci_am654_devices[] = { + { .family = "AM65X", + .revision = "SR1.0", +@@ -872,7 +903,7 @@ static const struct of_device_id sdhci_a + }, + { + .compatible = "ti,am62-sdhci", +- .data = &sdhci_j721e_4bit_drvdata, ++ .data = &sdhci_am62_4bit_drvdata, + }, + { /* sentinel */ } + }; +@@ -906,6 +937,7 @@ static int sdhci_am654_probe(struct plat + pltfm_host = sdhci_priv(host); + sdhci_am654 = sdhci_pltfm_priv(pltfm_host); + sdhci_am654->flags = drvdata->flags; ++ sdhci_am654->quirks = drvdata->quirks; + + clk_xin = devm_clk_get(dev, "clk_xin"); + if (IS_ERR(clk_xin)) { +@@ -940,6 +972,7 @@ static int sdhci_am654_probe(struct plat + goto err_pltfm_free; + } + ++ host->mmc_host_ops.start_signal_voltage_switch = sdhci_am654_start_signal_voltage_switch; + host->mmc_host_ops.execute_tuning = sdhci_am654_execute_tuning; + + pm_runtime_get_noresume(dev); diff --git a/queue-6.14/net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch b/queue-6.14/net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch new file mode 100644 index 0000000000..33e47b85be --- /dev/null +++ b/queue-6.14/net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch @@ -0,0 +1,93 @@ +From ba54bce747fa9e07896c1abd9b48545f7b4b31d2 Mon Sep 17 00:00:00 2001 +From: Jakob Unterwurzacher +Date: Thu, 15 May 2025 09:29:19 +0200 +Subject: net: dsa: microchip: linearize skb for tail-tagging switches + +From: Jakob Unterwurzacher + +commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 upstream. + +The pointer arithmentic for accessing the tail tag only works +for linear skbs. + +For nonlinear skbs, it reads uninitialized memory inside the +skb headroom, essentially randomizing the tag. I have observed +it gets set to 6 most of the time. + +Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6 +(which does not exist for the ksz9896 that's in use), dropping the packet. +Debug prints added by me (not included in this patch): + + [ 256.645337] ksz9477_rcv:323 tag0=6 + [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0 + mac=(64,14) mac_len=14 net=(78,0) trans=78 + shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) + csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) + hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3 + priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 + encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) + [ 256.645377] dev name=end1 feat=0x0002e10200114bb3 + [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06 + [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02 + [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00 + [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 + [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL + +Call skb_linearize before trying to access the tag. + +This patch fixes ksz9477_rcv which is used by the ksz9896 I have at +hand, and also applies the same fix to ksz8795_rcv which seems to have +the same problem. + +Signed-off-by: Jakob Unterwurzacher +CC: stable@vger.kernel.org +Fixes: 016e43a26bab ("net: dsa: ksz: Add KSZ8795 tag code") +Fixes: 8b8010fb7876 ("dsa: add support for Microchip KSZ tail tagging") +Reviewed-by: Vladimir Oltean +Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/tag_ksz.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/net/dsa/tag_ksz.c ++++ b/net/dsa/tag_ksz.c +@@ -140,7 +140,12 @@ static struct sk_buff *ksz8795_xmit(stru + + static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev) + { +- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; ++ u8 *tag; ++ ++ if (skb_linearize(skb)) ++ return NULL; ++ ++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; + + return ksz_common_rcv(skb, dev, tag[0] & KSZ8795_TAIL_TAG_EG_PORT_M, + KSZ_EGRESS_TAG_LEN); +@@ -311,10 +316,16 @@ static struct sk_buff *ksz9477_xmit(stru + + static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev) + { +- /* Tag decoding */ +- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; +- unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; + unsigned int len = KSZ_EGRESS_TAG_LEN; ++ unsigned int port; ++ u8 *tag; ++ ++ if (skb_linearize(skb)) ++ return NULL; ++ ++ /* Tag decoding */ ++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; ++ port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; + + /* Extra 4-bytes PTP timestamp */ + if (tag[0] & KSZ9477_PTP_TAG_INDICATION) { diff --git a/queue-6.14/pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch b/queue-6.14/pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch new file mode 100644 index 0000000000..c6e1529f37 --- /dev/null +++ b/queue-6.14/pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch @@ -0,0 +1,38 @@ +From 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 8 May 2025 09:29:23 +0300 +Subject: pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() + +From: Dan Carpenter + +commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe upstream. + +The error checking for of_count_phandle_with_args() does not handle +negative error codes correctly. The problem is that "index" is a u32 so +in the condition "if (index >= num_domains)" negative error codes stored +in "num_domains" are type promoted to very high positive values and +"index" is always going to be valid. + +Test for negative error codes first and then test if "index" is valid. + +Fixes: 3ccf3f0cd197 ("PM / Domains: Enable genpd_dev_pm_attach_by_id|name() for single PM domain") +Signed-off-by: Dan Carpenter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/aBxPQ8AI8N5v-7rL@stanley.mountain +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pmdomain/core.c ++++ b/drivers/pmdomain/core.c +@@ -3091,7 +3091,7 @@ struct device *genpd_dev_pm_attach_by_id + /* Verify that the index is within a valid range. */ + num_domains = of_count_phandle_with_args(dev->of_node, "power-domains", + "#power-domain-cells"); +- if (index >= num_domains) ++ if (num_domains < 0 || index >= num_domains) + return NULL; + + /* Allocate and register device on the genpd bus. */ diff --git a/queue-6.14/pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch b/queue-6.14/pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch new file mode 100644 index 0000000000..2750e5f842 --- /dev/null +++ b/queue-6.14/pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch @@ -0,0 +1,51 @@ +From 13a6d4265665201a795a2ff5a3e6e4d183fc9c33 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 28 Apr 2025 13:47:52 +0200 +Subject: pmdomain: renesas: rcar: Remove obsolete nullify checks + +From: Geert Uytterhoeven + +commit 13a6d4265665201a795a2ff5a3e6e4d183fc9c33 upstream. + +All nullify users and helpers were removed, but the R-Car SYSC drivers +still checked for nullified domains. Remove the obsolete checks. + +Fixes: c8d87704444a8ac7 ("pmdomain: renesas: rcar-sysc: Remove rcar_sysc_nullify() helper") +Signed-off-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/107f2bf9f13b29f0f623d2959a5347ec151fb089.1745840768.git.geert+renesas@glider.be +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/renesas/rcar-gen4-sysc.c | 5 ----- + drivers/pmdomain/renesas/rcar-sysc.c | 5 ----- + 2 files changed, 10 deletions(-) + +--- a/drivers/pmdomain/renesas/rcar-gen4-sysc.c ++++ b/drivers/pmdomain/renesas/rcar-gen4-sysc.c +@@ -338,11 +338,6 @@ static int __init rcar_gen4_sysc_pd_init + struct rcar_gen4_sysc_pd *pd; + size_t n; + +- if (!area->name) { +- /* Skip NULLified area */ +- continue; +- } +- + n = strlen(area->name) + 1; + pd = kzalloc(sizeof(*pd) + n, GFP_KERNEL); + if (!pd) { +--- a/drivers/pmdomain/renesas/rcar-sysc.c ++++ b/drivers/pmdomain/renesas/rcar-sysc.c +@@ -396,11 +396,6 @@ static int __init rcar_sysc_pd_init(void + struct rcar_sysc_pd *pd; + size_t n; + +- if (!area->name) { +- /* Skip NULLified area */ +- continue; +- } +- + n = strlen(area->name) + 1; + pd = kzalloc(sizeof(*pd) + n, GFP_KERNEL); + if (!pd) { diff --git a/queue-6.14/series b/queue-6.14/series index 9f7a365127..f23249b09c 100644 --- a/queue-6.14/series +++ b/queue-6.14/series @@ -730,3 +730,19 @@ padata-do-not-leak-refcount-in-reorder_work.patch can-slcan-allow-reception-of-short-error-messages.patch can-bcm-add-locking-for-bcm_op-runtime-updates.patch can-bcm-add-missing-rcu-read-protection-for-procfs-content.patch +asoc-sof-ipc4-control-use-sof_ctrl_cmd_binary-as-numid-for-bytes_ext.patch +asoc-sof-intel-hda-bus-use-pio-mode-on-ace2-platforms.patch +asoc-sof-topology-connect-dai-to-a-single-dai-link.patch +asoc-sof-ipc4-pcm-delay-reporting-is-only-supported-for-playback-direction.patch +alsa-pcm-fix-race-of-buffer-access-at-pcm-oss-layer.patch +alsa-hda-realtek-add-quirk-for-lenovo-yoga-pro-7-14asp10.patch +llc-fix-data-loss-when-reading-from-a-socket-in-llc_ui_recvmsg.patch +can-kvaser_pciefd-continue-parsing-dma-buf-after-dropped-rx.patch +can-kvaser_pciefd-fix-echo_skb-race.patch +io_uring-net-only-retry-recv-bundle-for-a-full-transfer.patch +net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch +vmxnet3-update-mtu-after-device-quiesce.patch +mmc-sdhci_am654-add-sdhci_quirk2_suppress_v1p8_ena-quirk-to-am62-compatible.patch +mmc-sdhci-of-dwcmshc-add-pd-workaround-on-rk3576.patch +pmdomain-renesas-rcar-remove-obsolete-nullify-checks.patch +pmdomain-core-fix-error-checking-in-genpd_dev_pm_attach_by_id.patch diff --git a/queue-6.14/vmxnet3-update-mtu-after-device-quiesce.patch b/queue-6.14/vmxnet3-update-mtu-after-device-quiesce.patch new file mode 100644 index 0000000000..91a88071a0 --- /dev/null +++ b/queue-6.14/vmxnet3-update-mtu-after-device-quiesce.patch @@ -0,0 +1,59 @@ +From 43f0999af011fba646e015f0bb08b6c3002a0170 Mon Sep 17 00:00:00 2001 +From: Ronak Doshi +Date: Thu, 15 May 2025 19:04:56 +0000 +Subject: vmxnet3: update MTU after device quiesce + +From: Ronak Doshi + +commit 43f0999af011fba646e015f0bb08b6c3002a0170 upstream. + +Currently, when device mtu is updated, vmxnet3 updates netdev mtu, quiesces +the device and then reactivates it for the ESXi to know about the new mtu. +So, technically the OS stack can start using the new mtu before ESXi knows +about the new mtu. + +This can lead to issues for TSO packets which use mss as per the new mtu +configured. This patch fixes this issue by moving the mtu write after +device quiesce. + +Cc: stable@vger.kernel.org +Fixes: d1a890fa37f2 ("net: VMware virtual Ethernet NIC driver: vmxnet3") +Signed-off-by: Ronak Doshi +Acked-by: Guolin Yang +Changes v1-> v2: + Moved MTU write after destroy of rx rings +Link: https://patch.msgid.link/20250515190457.8597-1-ronak.doshi@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -3607,8 +3607,6 @@ vmxnet3_change_mtu(struct net_device *ne + struct vmxnet3_adapter *adapter = netdev_priv(netdev); + int err = 0; + +- WRITE_ONCE(netdev->mtu, new_mtu); +- + /* + * Reset_work may be in the middle of resetting the device, wait for its + * completion. +@@ -3622,6 +3620,7 @@ vmxnet3_change_mtu(struct net_device *ne + + /* we need to re-create the rx queue based on the new mtu */ + vmxnet3_rq_destroy_all(adapter); ++ WRITE_ONCE(netdev->mtu, new_mtu); + vmxnet3_adjust_rx_ring_size(adapter); + err = vmxnet3_rq_create_all(adapter); + if (err) { +@@ -3638,6 +3637,8 @@ vmxnet3_change_mtu(struct net_device *ne + "Closing it\n", err); + goto out; + } ++ } else { ++ WRITE_ONCE(netdev->mtu, new_mtu); + } + + out: