From: Greg Kroah-Hartman Date: Wed, 8 Oct 2025 07:00:37 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=34e9f8903decc555c50a09222df0fe98a7c4ef65;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch serial-stm32-allow-selecting-console-when-the-driver-is-module.patch staging-axis-fifo-fix-maximum-tx-packet-length-check.patch staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch staging-axis-fifo-flush-rx-fifo-on-read-errors.patch --- diff --git a/queue-6.6/driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch b/queue-6.6/driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch new file mode 100644 index 0000000000..5577ec9fa4 --- /dev/null +++ b/queue-6.6/driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch @@ -0,0 +1,41 @@ +From c2ce2453413d429e302659abc5ace634e873f6f5 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 28 Aug 2025 12:59:24 +0200 +Subject: driver core/PM: Set power.no_callbacks along with power.no_pm + +From: Rafael J. Wysocki + +commit c2ce2453413d429e302659abc5ace634e873f6f5 upstream. + +Devices with power.no_pm set are not expected to need any power +management at all, so modify device_set_pm_not_required() to set +power.no_callbacks for them too in case runtime PM will be enabled +for any of them (which in principle may be done for convenience if +such a device participates in a dependency chain). + +Since device_set_pm_not_required() must be called before device_add() +or it would not have any effect, it can update power.no_callbacks +without locking, unlike pm_runtime_no_callbacks() that can be called +after registering the target device. + +Signed-off-by: Rafael J. Wysocki +Cc: stable +Reviewed-by: Sudeep Holla +Link: https://lore.kernel.org/r/1950054.tdWV9SEqCh@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/device.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -968,6 +968,9 @@ static inline bool device_pm_not_require + static inline void device_set_pm_not_required(struct device *dev) + { + dev->power.no_pm = true; ++#ifdef CONFIG_PM ++ dev->power.no_callbacks = true; ++#endif + } + + static inline void dev_pm_syscore_device(struct device *dev, bool val) diff --git a/queue-6.6/serial-stm32-allow-selecting-console-when-the-driver-is-module.patch b/queue-6.6/serial-stm32-allow-selecting-console-when-the-driver-is-module.patch new file mode 100644 index 0000000000..5a1de24316 --- /dev/null +++ b/queue-6.6/serial-stm32-allow-selecting-console-when-the-driver-is-module.patch @@ -0,0 +1,32 @@ +From cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a Mon Sep 17 00:00:00 2001 +From: Raphael Gallais-Pou +Date: Fri, 22 Aug 2025 16:19:23 +0200 +Subject: serial: stm32: allow selecting console when the driver is module + +From: Raphael Gallais-Pou + +commit cc4d900d0d6d8dd5c41832a93ff3cfa629a78f9a upstream. + +Console can be enabled on the UART compile as module. +Change dependency to allow console mode when the driver is built as module. + +Fixes: 48a6092fb41fa ("serial: stm32-usart: Add STM32 USART Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Raphael Gallais-Pou +Link: https://lore.kernel.org/r/20250822141923.61133-1-raphael.gallais-pou@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/Kconfig ++++ b/drivers/tty/serial/Kconfig +@@ -1405,7 +1405,7 @@ config SERIAL_STM32 + + config SERIAL_STM32_CONSOLE + bool "Support for console on STM32" +- depends on SERIAL_STM32=y ++ depends on SERIAL_STM32 + select SERIAL_CORE_CONSOLE + select SERIAL_EARLYCON + diff --git a/queue-6.6/series b/queue-6.6/series index 98c06d9496..e28e89cb08 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -16,3 +16,8 @@ platform-x86-amd-pmc-add-stellaris-slim-gen6-amd-to-.patch alsa-usb-audio-kill-timer-properly-at-removal.patch alsa-usb-audio-fix-race-condition-to-uaf-in-snd_usbmidi_free.patch hid-fix-i2c-read-buffer-overflow-in-raw_event-for-mcp2221.patch +serial-stm32-allow-selecting-console-when-the-driver-is-module.patch +staging-axis-fifo-fix-maximum-tx-packet-length-check.patch +staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch +staging-axis-fifo-flush-rx-fifo-on-read-errors.patch +driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch diff --git a/queue-6.6/staging-axis-fifo-fix-maximum-tx-packet-length-check.patch b/queue-6.6/staging-axis-fifo-fix-maximum-tx-packet-length-check.patch new file mode 100644 index 0000000000..9ababe26f8 --- /dev/null +++ b/queue-6.6/staging-axis-fifo-fix-maximum-tx-packet-length-check.patch @@ -0,0 +1,71 @@ +From 52ff2b840bc723f3be1f096f8017c78e0515858c Mon Sep 17 00:00:00 2001 +From: Ovidiu Panait +Date: Sun, 17 Aug 2025 20:13:50 +0300 +Subject: staging: axis-fifo: fix maximum TX packet length check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ovidiu Panait + +commit 52ff2b840bc723f3be1f096f8017c78e0515858c upstream. + +Since commit 2ca34b508774 ("staging: axis-fifo: Correct handling of +tx_fifo_depth for size validation"), write() operations with packets +larger than 'tx_fifo_depth - 4' words are no longer rejected with -EINVAL. + +Fortunately, the packets are not actually getting transmitted to hardware, +otherwise they would be raising a 'Transmit Packet Overrun Error' +interrupt, which requires a reset of the TX circuit to recover from. + +Instead, the request times out inside wait_event_interruptible_timeout() +and always returns -EAGAIN, since the wake up condition can never be true +for these packets. But still, they unnecessarily block other tasks from +writing to the FIFO and the EAGAIN return code signals userspace to retry +the write() call, even though it will always fail and time out. + +According to the AXI4-Stream FIFO reference manual (PG080), the maximum +valid packet length is 'tx_fifo_depth - 4' words, so attempting to send +larger packets is invalid and should not be happening in the first place: + +> The maximum packet that can be transmitted is limited by the size of +> the FIFO, which is (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. + +Therefore, bring back the old behavior and outright reject packets larger +than 'tx_fifo_depth - 4' with -EINVAL. Add a comment to explain why the +check is necessary. The dev_err() message was removed to avoid cluttering +the dmesg log if an invalid packet is received from userspace. + +Fixes: 2ca34b508774 ("staging: axis-fifo: Correct handling of tx_fifo_depth for size validation") +Cc: stable@vger.kernel.org +Signed-off-by: Ovidiu Panait +Link: https://lore.kernel.org/r/20250817171350.872105-1-ovidiu.panait.oss@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/axis-fifo/axis-fifo.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/staging/axis-fifo/axis-fifo.c ++++ b/drivers/staging/axis-fifo/axis-fifo.c +@@ -491,11 +491,17 @@ static ssize_t axis_fifo_write(struct fi + return -EINVAL; + } + +- if (words_to_write > fifo->tx_fifo_depth) { +- dev_err(fifo->dt_device, "tried to write more words [%u] than slots in the fifo buffer [%u]\n", +- words_to_write, fifo->tx_fifo_depth); ++ /* ++ * In 'Store-and-Forward' mode, the maximum packet that can be ++ * transmitted is limited by the size of the FIFO, which is ++ * (C_TX_FIFO_DEPTH–4)*(data interface width/8) bytes. ++ * ++ * Do not attempt to send a packet larger than 'tx_fifo_depth - 4', ++ * otherwise a 'Transmit Packet Overrun Error' interrupt will be ++ * raised, which requires a reset of the TX circuit to recover. ++ */ ++ if (words_to_write > (fifo->tx_fifo_depth - 4)) + return -EINVAL; +- } + + if (fifo->write_flags & O_NONBLOCK) { + /* diff --git a/queue-6.6/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch b/queue-6.6/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch new file mode 100644 index 0000000000..3ab574c452 --- /dev/null +++ b/queue-6.6/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch @@ -0,0 +1,97 @@ +From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001 +From: Ovidiu Panait +Date: Fri, 12 Sep 2025 13:13:21 +0300 +Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure + +From: Ovidiu Panait + +commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream. + +If copy_from_user() fails, write() currently returns -EFAULT, but any +partially written data leaves the TX FIFO in an inconsistent state. +Subsequent write() calls then fail with "transmit length mismatch" +errors. + +Once partial data is written to the hardware FIFO, it cannot be removed +without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove +hardware resets for user errors") removed a full FIFO reset for this case, +which fixed a potential RX data loss, but introduced this TX issue. + +Fix this by introducing a bounce buffer: copy the full packet from +userspace first, and write to the hardware FIFO only if the copy +was successful. + +Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") +Cc: stable@vger.kernel.org +Signed-off-by: Ovidiu Panait +Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++------------------------- + 1 file changed, 10 insertions(+), 26 deletions(-) + +--- a/drivers/staging/axis-fifo/axis-fifo.c ++++ b/drivers/staging/axis-fifo/axis-fifo.c +@@ -42,7 +42,6 @@ + #define DRIVER_NAME "axis_fifo" + + #define READ_BUF_SIZE 128U /* read buffer length in words */ +-#define WRITE_BUF_SIZE 128U /* write buffer length in words */ + + /* ---------------------------- + * IP register offsets +@@ -471,11 +470,8 @@ static ssize_t axis_fifo_write(struct fi + { + struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; + unsigned int words_to_write; +- unsigned int copied; +- unsigned int copy; +- unsigned int i; ++ u32 *txbuf; + int ret; +- u32 tmp_buf[WRITE_BUF_SIZE]; + + if (len % sizeof(u32)) { + dev_err(fifo->dt_device, +@@ -540,32 +536,20 @@ static ssize_t axis_fifo_write(struct fi + } + } + +- /* write data from an intermediate buffer into the fifo IP, refilling +- * the buffer with userspace data as needed +- */ +- copied = 0; +- while (words_to_write > 0) { +- copy = min(words_to_write, WRITE_BUF_SIZE); +- +- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), +- copy * sizeof(u32))) { +- ret = -EFAULT; +- goto end_unlock; +- } +- +- for (i = 0; i < copy; i++) +- iowrite32(tmp_buf[i], fifo->base_addr + +- XLLF_TDFD_OFFSET); +- +- copied += copy; +- words_to_write -= copy; ++ txbuf = vmemdup_user(buf, len); ++ if (IS_ERR(txbuf)) { ++ ret = PTR_ERR(txbuf); ++ goto end_unlock; + } + +- ret = copied * sizeof(u32); ++ for (int i = 0; i < words_to_write; ++i) ++ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); + + /* write packet size to fifo */ +- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); ++ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); + ++ ret = len; ++ kvfree(txbuf); + end_unlock: + mutex_unlock(&fifo->write_lock); + diff --git a/queue-6.6/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch b/queue-6.6/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch new file mode 100644 index 0000000000..3b34d425f0 --- /dev/null +++ b/queue-6.6/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch @@ -0,0 +1,84 @@ +From 82a051e2553b9e297cba82a975d9c538b882c79e Mon Sep 17 00:00:00 2001 +From: Ovidiu Panait +Date: Fri, 12 Sep 2025 13:13:22 +0300 +Subject: staging: axis-fifo: flush RX FIFO on read errors + +From: Ovidiu Panait + +commit 82a051e2553b9e297cba82a975d9c538b882c79e upstream. + +Flush stale data from the RX FIFO in case of errors, to avoid reading +old data when new packets arrive. + +Commit c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for +user errors") removed full FIFO resets from the read error paths, which +fixed potential TX data losses, but introduced this RX issue. + +Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") +Cc: stable@vger.kernel.org +Signed-off-by: Ovidiu Panait +Link: https://lore.kernel.org/r/20250912101322.1282507-2-ovidiu.panait.oss@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/axis-fifo/axis-fifo.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/drivers/staging/axis-fifo/axis-fifo.c ++++ b/drivers/staging/axis-fifo/axis-fifo.c +@@ -396,6 +396,7 @@ static ssize_t axis_fifo_read(struct fil + } + + bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); ++ words_available = bytes_available / sizeof(u32); + if (!bytes_available) { + dev_err(fifo->dt_device, "received a packet of length 0\n"); + ret = -EIO; +@@ -406,7 +407,7 @@ static ssize_t axis_fifo_read(struct fil + dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", + bytes_available, len); + ret = -EINVAL; +- goto end_unlock; ++ goto err_flush_rx; + } + + if (bytes_available % sizeof(u32)) { +@@ -415,11 +416,9 @@ static ssize_t axis_fifo_read(struct fil + */ + dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); + ret = -EIO; +- goto end_unlock; ++ goto err_flush_rx; + } + +- words_available = bytes_available / sizeof(u32); +- + /* read data into an intermediate buffer, copying the contents + * to userspace when the buffer is full + */ +@@ -431,18 +430,23 @@ static ssize_t axis_fifo_read(struct fil + tmp_buf[i] = ioread32(fifo->base_addr + + XLLF_RDFD_OFFSET); + } ++ words_available -= copy; + + if (copy_to_user(buf + copied * sizeof(u32), tmp_buf, + copy * sizeof(u32))) { + ret = -EFAULT; +- goto end_unlock; ++ goto err_flush_rx; + } + + copied += copy; +- words_available -= copy; + } ++ mutex_unlock(&fifo->read_lock); ++ ++ return bytes_available; + +- ret = bytes_available; ++err_flush_rx: ++ while (words_available--) ++ ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); + + end_unlock: + mutex_unlock(&fifo->read_lock);