From: Sasha Levin Date: Mon, 26 May 2025 12:28:33 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.12.31~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3783c8fc1dcad6761670ae358dcc8c562d3e23d3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/ksmbd-fix-stream-write-failure.patch b/queue-6.1/ksmbd-fix-stream-write-failure.patch new file mode 100644 index 0000000000..d504a5b825 --- /dev/null +++ b/queue-6.1/ksmbd-fix-stream-write-failure.patch @@ -0,0 +1,60 @@ +From 995b8d778f3b01b7002ca4dacdeddd18cb462339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 16:46:11 +0900 +Subject: ksmbd: fix stream write failure + +From: Namjae Jeon + +[ Upstream commit 1f4bbedd4e5a69b01cde2cc21d01151ab2d0884f ] + +If there is no stream data in file, v_len is zero. +So, If position(*pos) is zero, stream write will fail +due to stream write position validation check. +This patch reorganize stream write position validation. + +Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos") +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/server/vfs.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c +index cf1b241a15789..fa647b75fba8a 100644 +--- a/fs/smb/server/vfs.c ++++ b/fs/smb/server/vfs.c +@@ -423,10 +423,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, + ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n", + *pos, count); + ++ if (*pos >= XATTR_SIZE_MAX) { ++ pr_err("stream write position %lld is out of bounds\n", *pos); ++ return -EINVAL; ++ } ++ + size = *pos + count; + if (size > XATTR_SIZE_MAX) { + size = XATTR_SIZE_MAX; +- count = (*pos + count) - XATTR_SIZE_MAX; ++ count = XATTR_SIZE_MAX - *pos; + } + + v_len = ksmbd_vfs_getcasexattr(user_ns, +@@ -440,13 +445,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos, + goto out; + } + +- if (v_len <= *pos) { +- pr_err("stream write position %lld is out of bounds (stream length: %zd)\n", +- *pos, v_len); +- err = -EINVAL; +- goto out; +- } +- + if (v_len < size) { + wbuf = kvzalloc(size, GFP_KERNEL); + if (!wbuf) { +-- +2.39.5 + diff --git a/queue-6.1/revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch b/queue-6.1/revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch new file mode 100644 index 0000000000..763d44aba2 --- /dev/null +++ b/queue-6.1/revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch @@ -0,0 +1,168 @@ +From 27a4fc1592a044bf018119fb1b5975929b17c6d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Apr 2025 15:58:48 +0200 +Subject: Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC + connection" + +From: Jernej Skrabec + +[ Upstream commit 573f99c7585f597630f14596550c79e73ffaeef4 ] + +This reverts commit 531fdbeedeb89bd32018a35c6e137765c9cc9e97. + +Hardware that uses I2C wasn't designed with high speeds in mind, so +communication with PMIC via RSB can intermittently fail. Go back to I2C +as higher speed and efficiency isn't worth the trouble. + +Fixes: 531fdbeedeb8 ("arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection") +Link: https://github.com/LibreELEC/LibreELEC.tv/issues/7731 +Signed-off-by: Jernej Skrabec +Link: https://patch.msgid.link/20250413135848.67283-1-jernej.skrabec@gmail.com +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + .../dts/allwinner/sun50i-h6-beelink-gs1.dts | 38 +++++++++---------- + .../dts/allwinner/sun50i-h6-orangepi-3.dts | 14 +++---- + .../dts/allwinner/sun50i-h6-orangepi.dtsi | 22 +++++------ + 3 files changed, 37 insertions(+), 37 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +index 381d58cea092d..c854c7e310519 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts +@@ -151,28 +151,12 @@ + vcc-pg-supply = <®_aldo1>; + }; + +-&r_ir { +- linux,rc-map-name = "rc-beelink-gs1"; +- status = "okay"; +-}; +- +-&r_pio { +- /* +- * FIXME: We can't add that supply for now since it would +- * create a circular dependency between pinctrl, the regulator +- * and the RSB Bus. +- * +- * vcc-pl-supply = <®_aldo1>; +- */ +- vcc-pm-supply = <®_aldo1>; +-}; +- +-&r_rsb { ++&r_i2c { + status = "okay"; + +- axp805: pmic@745 { ++ axp805: pmic@36 { + compatible = "x-powers,axp805", "x-powers,axp806"; +- reg = <0x745>; ++ reg = <0x36>; + interrupt-parent = <&r_intc>; + interrupts = ; + interrupt-controller; +@@ -290,6 +274,22 @@ + }; + }; + ++&r_ir { ++ linux,rc-map-name = "rc-beelink-gs1"; ++ status = "okay"; ++}; ++ ++&r_pio { ++ /* ++ * PL0 and PL1 are used for PMIC I2C ++ * don't enable the pl-supply else ++ * it will fail at boot ++ * ++ * vcc-pl-supply = <®_aldo1>; ++ */ ++ vcc-pm-supply = <®_aldo1>; ++}; ++ + &spdif { + pinctrl-names = "default"; + pinctrl-0 = <&spdif_tx_pin>; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts +index 6fc65e8db2206..8c476e089185b 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts +@@ -175,16 +175,12 @@ + vcc-pg-supply = <®_vcc_wifi_io>; + }; + +-&r_ir { +- status = "okay"; +-}; +- +-&r_rsb { ++&r_i2c { + status = "okay"; + +- axp805: pmic@745 { ++ axp805: pmic@36 { + compatible = "x-powers,axp805", "x-powers,axp806"; +- reg = <0x745>; ++ reg = <0x36>; + interrupt-parent = <&r_intc>; + interrupts = ; + interrupt-controller; +@@ -295,6 +291,10 @@ + }; + }; + ++&r_ir { ++ status = "okay"; ++}; ++ + &rtc { + clocks = <&ext_osc32k>; + }; +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi +index 92745128fcfeb..4ec4996592bef 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi +@@ -112,20 +112,12 @@ + vcc-pg-supply = <®_aldo1>; + }; + +-&r_ir { +- status = "okay"; +-}; +- +-&r_pio { +- vcc-pm-supply = <®_bldo3>; +-}; +- +-&r_rsb { ++&r_i2c { + status = "okay"; + +- axp805: pmic@745 { ++ axp805: pmic@36 { + compatible = "x-powers,axp805", "x-powers,axp806"; +- reg = <0x745>; ++ reg = <0x36>; + interrupt-parent = <&r_intc>; + interrupts = ; + interrupt-controller; +@@ -240,6 +232,14 @@ + }; + }; + ++&r_ir { ++ status = "okay"; ++}; ++ ++&r_pio { ++ vcc-pm-supply = <®_bldo3>; ++}; ++ + &rtc { + clocks = <&ext_osc32k>; + }; +-- +2.39.5 + diff --git a/queue-6.1/series b/queue-6.1/series index f03c4c0201..68586fab6c 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -266,3 +266,8 @@ revert-drm-amd-keep-display-off-while-going-into-s4.patch input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch memcg-always-call-cond_resched-after-fn.patch mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch +revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch +ksmbd-fix-stream-write-failure.patch +spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch +spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch +spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch diff --git a/queue-6.1/spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch b/queue-6.1/spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch new file mode 100644 index 0000000000..e2c18850b5 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch @@ -0,0 +1,108 @@ +From 76bbe1943f3f1431adb5a01a7bc0b0fb11ac6a3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:31 +0100 +Subject: spi: spi-fsl-dspi: Halt the module after a new message transfer + +From: Bogdan-Gabriel Roman + +[ Upstream commit 8a30a6d35a11ff5ccdede7d6740765685385a917 ] + +The XSPI mode implementation in this driver still uses the EOQ flag to +signal the last word in a transmission and deassert the PCS signal. +However, at speeds lower than ~200kHZ, the PCS signal seems to remain +asserted even when SR[EOQF] = 1 indicates the end of a transmission. +This is a problem for target devices which require the deassertation of +the PCS signal between transfers. + +Hence, this commit 'forces' the deassertation of the PCS by stopping the +module through MCR[HALT] after completing a new transfer. According to +the reference manual, the module stops or transitions from the Running +state to the Stopped state after the current frame, when any one of the +following conditions exist: +- The value of SR[EOQF] = 1. +- The chip is in Debug mode and the value of MCR[FRZ] = 1. +- The value of MCR[HALT] = 1. + +This shouldn't be done if the last transfer in the message has cs_change +set. + +Fixes: ea93ed4c181b ("spi: spi-fsl-dspi: Use EOQ for last word in buffer even for XSPI mode") +Signed-off-by: Bogdan-Gabriel Roman +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-2-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 3f9609edac944..93cdc52f0fb06 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -61,6 +61,7 @@ + #define SPI_SR_TFIWF BIT(18) + #define SPI_SR_RFDF BIT(17) + #define SPI_SR_CMDFFF BIT(16) ++#define SPI_SR_TXRXS BIT(30) + #define SPI_SR_CLEAR (SPI_SR_TCFQF | \ + SPI_SR_TFUF | SPI_SR_TFFF | \ + SPI_SR_CMDTCF | SPI_SR_SPEF | \ +@@ -907,9 +908,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + struct spi_device *spi = message->spi; + struct spi_transfer *transfer; + int status = 0; ++ u32 val = 0; ++ bool cs_change = false; + + message->actual_length = 0; + ++ /* Put DSPI in running mode if halted. */ ++ regmap_read(dspi->regmap, SPI_MCR, &val); ++ if (val & SPI_MCR_HALT) { ++ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, 0); ++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 && ++ !(val & SPI_SR_TXRXS)) ++ ; ++ } ++ + list_for_each_entry(transfer, &message->transfers, transfer_list) { + dspi->cur_transfer = transfer; + dspi->cur_msg = message; +@@ -934,6 +946,7 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + dspi->tx_cmd |= SPI_PUSHR_CMD_CONT; + } + ++ cs_change = transfer->cs_change; + dspi->tx = transfer->tx_buf; + dspi->rx = transfer->rx_buf; + dspi->len = transfer->len; +@@ -966,6 +979,15 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + spi_transfer_delay_exec(transfer); + } + ++ if (status || !cs_change) { ++ /* Put DSPI in stop mode */ ++ regmap_update_bits(dspi->regmap, SPI_MCR, ++ SPI_MCR_HALT, SPI_MCR_HALT); ++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 && ++ val & SPI_SR_TXRXS) ++ ; ++ } ++ + message->status = status; + spi_finalize_current_message(ctlr); + +@@ -1206,6 +1228,8 @@ static int dspi_init(struct fsl_dspi *dspi) + if (!spi_controller_is_slave(dspi->ctlr)) + mcr |= SPI_MCR_MASTER; + ++ mcr |= SPI_MCR_HALT; ++ + regmap_write(dspi->regmap, SPI_MCR, mcr); + regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR); + +-- +2.39.5 + diff --git a/queue-6.1/spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch b/queue-6.1/spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch new file mode 100644 index 0000000000..70fb96bb05 --- /dev/null +++ b/queue-6.1/spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch @@ -0,0 +1,45 @@ +From a125a7978836ad12ebf3dea07d2768f23f298942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:32 +0100 +Subject: spi: spi-fsl-dspi: Reset SR flags before sending a new message + +From: Larisa Grigore + +[ Upstream commit 7aba292eb15389073c7f3bd7847e3862dfdf604d ] + +If, in a previous transfer, the controller sends more data than expected +by the DSPI target, SR.RFDF (RX FIFO is not empty) will remain asserted. +When flushing the FIFOs at the beginning of a new transfer (writing 1 +into MCR.CLR_TXF and MCR.CLR_RXF), SR.RFDF should also be cleared. +Otherwise, when running in target mode with DMA, if SR.RFDF remains +asserted, the DMA callback will be fired before the controller sends any +data. + +Take this opportunity to reset all Status Register fields. + +Fixes: 5ce3cc567471 ("spi: spi-fsl-dspi: Provide support for DSPI slave mode operation (Vybryd vf610)") +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-3-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 93cdc52f0fb06..5374c6d44519a 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -956,6 +956,8 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr, + SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF, + SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF); + ++ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR); ++ + spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer, + dspi->progress, !dspi->irq); + +-- +2.39.5 + diff --git a/queue-6.1/spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch b/queue-6.1/spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch new file mode 100644 index 0000000000..928828147f --- /dev/null +++ b/queue-6.1/spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch @@ -0,0 +1,94 @@ +From 5b32ce5d593f6120da8c000f40e85bc152c4f0e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 May 2025 15:51:30 +0100 +Subject: spi: spi-fsl-dspi: restrict register range for regmap access + +From: Larisa Grigore + +[ Upstream commit 283ae0c65e9c592f4a1ba4f31917f5e766da7f31 ] + +DSPI registers are NOT continuous, some registers are reserved and +accessing them from userspace will trigger external abort, add regmap +register access table to avoid below abort. + + For example on S32G: + + # cat /sys/kernel/debug/regmap/401d8000.spi/registers + + Internal error: synchronous external abort: 96000210 1 PREEMPT SMP + ... + Call trace: + regmap_mmio_read32le+0x24/0x48 + regmap_mmio_read+0x48/0x70 + _regmap_bus_reg_read+0x38/0x48 + _regmap_read+0x68/0x1b0 + regmap_read+0x50/0x78 + regmap_read_debugfs+0x120/0x338 + +Fixes: 1acbdeb92c87 ("spi/fsl-dspi: Convert to use regmap and add big-endian support") +Co-developed-by: Xulin Sun +Signed-off-by: Xulin Sun +Signed-off-by: Larisa Grigore +Signed-off-by: James Clark +Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-1-bea884630cfb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 01930b52c4fb8..3f9609edac944 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0+ + // + // Copyright 2013 Freescale Semiconductor, Inc. +-// Copyright 2020 NXP ++// Copyright 2020-2025 NXP + // + // Freescale DSPI driver + // This file contains a driver for the Freescale DSPI +@@ -1128,6 +1128,20 @@ static int dspi_resume(struct device *dev) + + static SIMPLE_DEV_PM_OPS(dspi_pm, dspi_suspend, dspi_resume); + ++static const struct regmap_range dspi_yes_ranges[] = { ++ regmap_reg_range(SPI_MCR, SPI_MCR), ++ regmap_reg_range(SPI_TCR, SPI_CTAR(3)), ++ regmap_reg_range(SPI_SR, SPI_TXFR3), ++ regmap_reg_range(SPI_RXFR0, SPI_RXFR3), ++ regmap_reg_range(SPI_CTARE(0), SPI_CTARE(3)), ++ regmap_reg_range(SPI_SREX, SPI_SREX), ++}; ++ ++static const struct regmap_access_table dspi_access_table = { ++ .yes_ranges = dspi_yes_ranges, ++ .n_yes_ranges = ARRAY_SIZE(dspi_yes_ranges), ++}; ++ + static const struct regmap_range dspi_volatile_ranges[] = { + regmap_reg_range(SPI_MCR, SPI_TCR), + regmap_reg_range(SPI_SR, SPI_SR), +@@ -1145,6 +1159,8 @@ static const struct regmap_config dspi_regmap_config = { + .reg_stride = 4, + .max_register = 0x88, + .volatile_table = &dspi_volatile_table, ++ .rd_table = &dspi_access_table, ++ .wr_table = &dspi_access_table, + }; + + static const struct regmap_range dspi_xspi_volatile_ranges[] = { +@@ -1166,6 +1182,8 @@ static const struct regmap_config dspi_xspi_regmap_config[] = { + .reg_stride = 4, + .max_register = 0x13c, + .volatile_table = &dspi_xspi_volatile_table, ++ .rd_table = &dspi_access_table, ++ .wr_table = &dspi_access_table, + }, + { + .name = "pushr", +-- +2.39.5 +