From: Greg Kroah-Hartman Date: Mon, 21 Oct 2024 08:25:03 +0000 (+0200) Subject: 6.11-stable patches X-Git-Tag: v5.10.228~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=756528c13b1a2d502a9f31ebfb90e857caffa7f1;p=thirdparty%2Fkernel%2Fstable-queue.git 6.11-stable patches added patches: irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch irqchip-sifive-plic-return-error-code-on-failure.patch irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch pinctrl-apple-check-devm_kasprintf-returned-value.patch pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch pinctrl-stm32-check-devm_kasprintf-returned-value.patch serial-qcom-geni-fix-dma-rx-cancellation.patch serial-qcom-geni-fix-polled-console-initialisation.patch serial-qcom-geni-fix-receiver-enable.patch serial-qcom-geni-fix-shutdown-race.patch serial-qcom-geni-revert-broken-hibernation-support.patch x86-bugs-use-code-segment-selector-for-verw-operand.patch --- diff --git a/queue-6.11/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch b/queue-6.11/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch new file mode 100644 index 00000000000..f1caddcdda2 --- /dev/null +++ b/queue-6.11/irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch @@ -0,0 +1,103 @@ +From 1442ee0011983f0c5c4b92380e6853afb513841a Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Wed, 2 Oct 2024 21:49:59 +0100 +Subject: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE + +From: Marc Zyngier + +commit 1442ee0011983f0c5c4b92380e6853afb513841a upstream. + +Kunkun Jiang reported that there is a small window of opportunity for +userspace to force a change of affinity for a VPE while the VPE has already +been unmapped, but the corresponding doorbell interrupt still visible in +/proc/irq/. + +Plug the race by checking the value of vmapp_count, which tracks whether +the VPE is mapped ot not, and returning an error in this case. + +This involves making vmapp_count common to both GICv4.1 and its v4.0 +ancestor. + +Fixes: 64edfaa9a234 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP") +Reported-by: Kunkun Jiang +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/c182ece6-2ba0-ce4f-3404-dba7a3ab6c52@huawei.com +Link: https://lore.kernel.org/all/20241002204959.2051709-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3-its.c | 18 ++++++++++++------ + include/linux/irqchip/arm-gic-v4.h | 4 +++- + 2 files changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -797,8 +797,8 @@ static struct its_vpe *its_build_vmapp_c + its_encode_valid(cmd, desc->its_vmapp_cmd.valid); + + if (!desc->its_vmapp_cmd.valid) { ++ alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count); + if (is_v4_1(its)) { +- alloc = !atomic_dec_return(&desc->its_vmapp_cmd.vpe->vmapp_count); + its_encode_alloc(cmd, alloc); + /* + * Unmapping a VPE is self-synchronizing on GICv4.1, +@@ -817,13 +817,13 @@ static struct its_vpe *its_build_vmapp_c + its_encode_vpt_addr(cmd, vpt_addr); + its_encode_vpt_size(cmd, LPI_NRBITS - 1); + ++ alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count); ++ + if (!is_v4_1(its)) + goto out; + + vconf_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->its_vm->vprop_page)); + +- alloc = !atomic_fetch_inc(&desc->its_vmapp_cmd.vpe->vmapp_count); +- + its_encode_alloc(cmd, alloc); + + /* +@@ -3807,6 +3807,13 @@ static int its_vpe_set_affinity(struct i + unsigned long flags; + + /* ++ * Check if we're racing against a VPE being destroyed, for ++ * which we don't want to allow a VMOVP. ++ */ ++ if (!atomic_read(&vpe->vmapp_count)) ++ return -EINVAL; ++ ++ /* + * Changing affinity is mega expensive, so let's be as lazy as + * we can and only do it if we really have to. Also, if mapped + * into the proxy device, we need to move the doorbell +@@ -4463,9 +4470,8 @@ static int its_vpe_init(struct its_vpe * + raw_spin_lock_init(&vpe->vpe_lock); + vpe->vpe_id = vpe_id; + vpe->vpt_page = vpt_page; +- if (gic_rdists->has_rvpeid) +- atomic_set(&vpe->vmapp_count, 0); +- else ++ atomic_set(&vpe->vmapp_count, 0); ++ if (!gic_rdists->has_rvpeid) + vpe->vpe_proxy_event = -1; + + return 0; +--- a/include/linux/irqchip/arm-gic-v4.h ++++ b/include/linux/irqchip/arm-gic-v4.h +@@ -66,10 +66,12 @@ struct its_vpe { + bool enabled; + bool group; + } sgi_config[16]; +- atomic_t vmapp_count; + }; + }; + ++ /* Track the VPE being mapped */ ++ atomic_t vmapp_count; ++ + /* + * Ensures mutual exclusion between affinity setting of the + * vPE and vLPI operations using vpe->col_idx. diff --git a/queue-6.11/irqchip-sifive-plic-return-error-code-on-failure.patch b/queue-6.11/irqchip-sifive-plic-return-error-code-on-failure.patch new file mode 100644 index 00000000000..3065a257d66 --- /dev/null +++ b/queue-6.11/irqchip-sifive-plic-return-error-code-on-failure.patch @@ -0,0 +1,53 @@ +From 6eabf656048d904d961584de2e1d45bc0854f9fb Mon Sep 17 00:00:00 2001 +From: Charlie Jenkins +Date: Tue, 3 Sep 2024 16:36:19 -0700 +Subject: irqchip/sifive-plic: Return error code on failure + +From: Charlie Jenkins + +commit 6eabf656048d904d961584de2e1d45bc0854f9fb upstream. + +Set error to -ENOMEM if kcalloc() fails or if irq_domain_add_linear() +fails inside of plic_probe() instead of returning 0. + +Fixes: 4d936f10ff80 ("irqchip/sifive-plic: Probe plic driver early for Allwinner D1 platform") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Charlie Jenkins +Signed-off-by: Thomas Gleixner +Reviewed-by: Anup Patel +Reviewed-by: Alexandre Ghiti +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20240903-correct_error_codes_sifive_plic-v1-1-d929b79663a2@rivosinc.com +Closes: https://lore.kernel.org/r/202409031122.yBh8HrxA-lkp@intel.com/ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-sifive-plic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/irqchip/irq-sifive-plic.c ++++ b/drivers/irqchip/irq-sifive-plic.c +@@ -578,8 +578,10 @@ static int plic_probe(struct fwnode_hand + + handler->enable_save = kcalloc(DIV_ROUND_UP(nr_irqs, 32), + sizeof(*handler->enable_save), GFP_KERNEL); +- if (!handler->enable_save) ++ if (!handler->enable_save) { ++ error = -ENOMEM; + goto fail_cleanup_contexts; ++ } + done: + for (hwirq = 1; hwirq <= nr_irqs; hwirq++) { + plic_toggle(handler, hwirq, 0); +@@ -591,8 +593,10 @@ done: + + priv->irqdomain = irq_domain_add_linear(to_of_node(fwnode), nr_irqs + 1, + &plic_irqdomain_ops, priv); +- if (WARN_ON(!priv->irqdomain)) ++ if (WARN_ON(!priv->irqdomain)) { ++ error = -ENOMEM; + goto fail_cleanup_contexts; ++ } + + /* + * We can have multiple PLIC instances so setup global state diff --git a/queue-6.11/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch b/queue-6.11/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch new file mode 100644 index 00000000000..6af0be7dbb9 --- /dev/null +++ b/queue-6.11/irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch @@ -0,0 +1,81 @@ +From 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 Mon Sep 17 00:00:00 2001 +From: Nam Cao +Date: Thu, 3 Oct 2024 10:41:52 +0200 +Subject: irqchip/sifive-plic: Unmask interrupt in plic_irq_enable() + +From: Nam Cao + +commit 6b1e0651e9ce8ce418ad4ff360e7b9925dc5da79 upstream. + +It is possible that an interrupt is disabled and masked at the same time. +When the interrupt is enabled again by enable_irq(), only plic_irq_enable() +is called, not plic_irq_unmask(). The interrupt remains masked and never +raises. + +An example where interrupt is both disabled and masked is when +handle_fasteoi_irq() is the handler, and IRQS_ONESHOT is set. The interrupt +handler: + + 1. Mask the interrupt + 2. Handle the interrupt + 3. Check if interrupt is still enabled, and unmask it (see + cond_unmask_eoi_irq()) + +If another task disables the interrupt in the middle of the above steps, +the interrupt will not get unmasked, and will remain masked when it is +enabled in the future. + +The problem is occasionally observed when PREEMPT_RT is enabled, because +PREEMPT_RT adds the IRQS_ONESHOT flag. But PREEMPT_RT only makes the problem +more likely to appear, the bug has been around since commit a1706a1c5062 +("irqchip/sifive-plic: Separate the enable and mask operations"). + +Fix it by unmasking interrupt in plic_irq_enable(). + +Fixes: a1706a1c5062 ("irqchip/sifive-plic: Separate the enable and mask operations") +Signed-off-by: Nam Cao +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20241003084152.2422969-1-namcao@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-sifive-plic.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/irqchip/irq-sifive-plic.c ++++ b/drivers/irqchip/irq-sifive-plic.c +@@ -123,16 +123,6 @@ static inline void plic_irq_toggle(const + } + } + +-static void plic_irq_enable(struct irq_data *d) +-{ +- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1); +-} +- +-static void plic_irq_disable(struct irq_data *d) +-{ +- plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0); +-} +- + static void plic_irq_unmask(struct irq_data *d) + { + struct plic_priv *priv = irq_data_get_irq_chip_data(d); +@@ -147,6 +137,17 @@ static void plic_irq_mask(struct irq_dat + writel(0, priv->regs + PRIORITY_BASE + d->hwirq * PRIORITY_PER_ID); + } + ++static void plic_irq_enable(struct irq_data *d) ++{ ++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 1); ++ plic_irq_unmask(d); ++} ++ ++static void plic_irq_disable(struct irq_data *d) ++{ ++ plic_irq_toggle(irq_data_get_effective_affinity_mask(d), d, 0); ++} ++ + static void plic_irq_eoi(struct irq_data *d) + { + struct plic_handler *handler = this_cpu_ptr(&plic_handlers); diff --git a/queue-6.11/pinctrl-apple-check-devm_kasprintf-returned-value.patch b/queue-6.11/pinctrl-apple-check-devm_kasprintf-returned-value.patch new file mode 100644 index 00000000000..145f6bffdfb --- /dev/null +++ b/queue-6.11/pinctrl-apple-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,37 @@ +From 665a58fe663ac7a9ea618dc0b29881649324b116 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 5 Sep 2024 10:09:17 +0800 +Subject: pinctrl: apple: check devm_kasprintf() returned value + +From: Ma Ke + +commit 665a58fe663ac7a9ea618dc0b29881649324b116 upstream. + +devm_kasprintf() can return a NULL pointer on failure but this returned +value is not checked. Fix this lack and check the returned value. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: a0f160ffcb83 ("pinctrl: add pinctrl/GPIO driver for Apple SoCs") +Signed-off-by: Ma Ke +Reviewed-by: Christophe JAILLET +Link: https://lore.kernel.org/20240905020917.356534-1-make24@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-apple-gpio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pinctrl/pinctrl-apple-gpio.c ++++ b/drivers/pinctrl/pinctrl-apple-gpio.c +@@ -474,6 +474,9 @@ static int apple_gpio_pinctrl_probe(stru + for (i = 0; i < npins; i++) { + pins[i].number = i; + pins[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "PIN%u", i); ++ if (!pins[i].name) ++ return -ENOMEM; ++ + pins[i].drv_data = pctl; + pin_names[i] = pins[i].name; + pin_nums[i] = i; diff --git a/queue-6.11/pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch b/queue-6.11/pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch new file mode 100644 index 00000000000..e439211af62 --- /dev/null +++ b/queue-6.11/pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch @@ -0,0 +1,51 @@ +From 16a6d2e685e8f9a2f51dd5a363d3f97fcad35e22 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 26 Sep 2024 16:11:02 +0200 +Subject: pinctrl: intel: platform: fix error path in device_for_each_child_node() + +From: Javier Carrasco + +commit 16a6d2e685e8f9a2f51dd5a363d3f97fcad35e22 upstream. + +The device_for_each_child_node() loop requires calls to +fwnode_handle_put() upon early returns to decrement the refcount of +the child node and avoid leaking memory if that error path is triggered. + +There is one early returns within that loop in +intel_platform_pinctrl_prepare_community(), but fwnode_handle_put() is +missing. + +Instead of adding the missing call, the scoped version of the loop can +be used to simplify the code and avoid mistakes in the future if new +early returns are added, as the child node is only used for parsing, and +it is never assigned. + +Cc: stable@vger.kernel.org +Fixes: c5860e4a2737 ("pinctrl: intel: Add a generic Intel pin control platform driver") +Signed-off-by: Javier Carrasco +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/intel/pinctrl-intel-platform.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/pinctrl/intel/pinctrl-intel-platform.c ++++ b/drivers/pinctrl/intel/pinctrl-intel-platform.c +@@ -90,7 +90,6 @@ static int intel_platform_pinctrl_prepar + struct intel_community *community, + struct intel_platform_pins *pins) + { +- struct fwnode_handle *child; + struct intel_padgroup *gpps; + unsigned int group; + size_t ngpps; +@@ -131,7 +130,7 @@ static int intel_platform_pinctrl_prepar + return -ENOMEM; + + group = 0; +- device_for_each_child_node(dev, child) { ++ device_for_each_child_node_scoped(dev, child) { + struct intel_padgroup *gpp = &gpps[group]; + + gpp->reg_num = group; diff --git a/queue-6.11/pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch b/queue-6.11/pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch new file mode 100644 index 00000000000..7a031da9b7f --- /dev/null +++ b/queue-6.11/pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch @@ -0,0 +1,46 @@ +From 3fd976afe9743110f20a23f93b7ff9693f2be4bf Mon Sep 17 00:00:00 2001 +From: Harshit Mogalapalli +Date: Thu, 10 Oct 2024 13:52:37 -0700 +Subject: pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() + +From: Harshit Mogalapalli + +commit 3fd976afe9743110f20a23f93b7ff9693f2be4bf upstream. + +'new_map' is allocated using devm_* which takes care of freeing the +allocated data on device removal, call to + + .dt_free_map = pinconf_generic_dt_free_map + +double frees the map as pinconf_generic_dt_free_map() calls +pinctrl_utils_free_map(). + +Fix this by using kcalloc() instead of auto-managed devm_kcalloc(). + +Cc: stable@vger.kernel.org +Fixes: f805e356313b ("pinctrl: nuvoton: Add ma35d1 pinctrl and GPIO driver") +Reported-by: Christophe JAILLET +Signed-off-by: Harshit Mogalapalli +Link: https://lore.kernel.org/20241010205237.1245318-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/nuvoton/pinctrl-ma35.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c b/drivers/pinctrl/nuvoton/pinctrl-ma35.c +index 1fa00a23534a..59c4e7c6cdde 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c +@@ -218,7 +218,7 @@ static int ma35_pinctrl_dt_node_to_map_func(struct pinctrl_dev *pctldev, + } + + map_num += grp->npins; +- new_map = devm_kcalloc(pctldev->dev, map_num, sizeof(*new_map), GFP_KERNEL); ++ new_map = kcalloc(map_num, sizeof(*new_map), GFP_KERNEL); + if (!new_map) + return -ENOMEM; + +-- +2.47.0 + diff --git a/queue-6.11/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch b/queue-6.11/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch new file mode 100644 index 00000000000..8e685c58cb0 --- /dev/null +++ b/queue-6.11/pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch @@ -0,0 +1,76 @@ +From 93b8ddc54507a227087c60a0013ed833b6ae7d3c Mon Sep 17 00:00:00 2001 +From: Sergey Matsievskiy +Date: Sat, 12 Oct 2024 13:57:43 +0300 +Subject: pinctrl: ocelot: fix system hang on level based interrupts + +From: Sergey Matsievskiy + +commit 93b8ddc54507a227087c60a0013ed833b6ae7d3c upstream. + +The current implementation only calls chained_irq_enter() and +chained_irq_exit() if it detects pending interrupts. + +``` +for (i = 0; i < info->stride; i++) { + uregmap_read(info->map, id_reg + 4 * i, ®); + if (!reg) + continue; + + chained_irq_enter(parent_chip, desc); +``` + +However, in case of GPIO pin configured in level mode and the parent +controller configured in edge mode, GPIO interrupt might be lowered by the +hardware. In the result, if the interrupt is short enough, the parent +interrupt is still pending while the GPIO interrupt is cleared; +chained_irq_enter() never gets called and the system hangs trying to +service the parent interrupt. + +Moving chained_irq_enter() and chained_irq_exit() outside the for loop +ensures that they are called even when GPIO interrupt is lowered by the +hardware. + +The similar code with chained_irq_enter() / chained_irq_exit() functions +wrapping interrupt checking loop may be found in many other drivers: +``` +grep -r -A 10 chained_irq_enter drivers/pinctrl +``` + +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Matsievskiy +Reviewed-by: Alexandre Belloni +Link: https://lore.kernel.org/20241012105743.12450-2-matsievskiysv@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-ocelot.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pinctrl/pinctrl-ocelot.c ++++ b/drivers/pinctrl/pinctrl-ocelot.c +@@ -1955,21 +1955,21 @@ static void ocelot_irq_handler(struct ir + unsigned int reg = 0, irq, i; + unsigned long irqs; + ++ chained_irq_enter(parent_chip, desc); ++ + for (i = 0; i < info->stride; i++) { + regmap_read(info->map, id_reg + 4 * i, ®); + if (!reg) + continue; + +- chained_irq_enter(parent_chip, desc); +- + irqs = reg; + + for_each_set_bit(irq, &irqs, + min(32U, info->desc->npins - 32 * i)) + generic_handle_domain_irq(chip->irq.domain, irq + 32 * i); +- +- chained_irq_exit(parent_chip, desc); + } ++ ++ chained_irq_exit(parent_chip, desc); + } + + static int ocelot_gpiochip_register(struct platform_device *pdev, diff --git a/queue-6.11/pinctrl-stm32-check-devm_kasprintf-returned-value.patch b/queue-6.11/pinctrl-stm32-check-devm_kasprintf-returned-value.patch new file mode 100644 index 00000000000..afb0047a522 --- /dev/null +++ b/queue-6.11/pinctrl-stm32-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,44 @@ +From b0f0e3f0552a566def55c844b0d44250c58e4df6 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 6 Sep 2024 18:03:26 +0800 +Subject: pinctrl: stm32: check devm_kasprintf() returned value + +From: Ma Ke + +commit b0f0e3f0552a566def55c844b0d44250c58e4df6 upstream. + +devm_kasprintf() can return a NULL pointer on failure but this returned +value is not checked. Fix this lack and check the returned value. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names") +Signed-off-by: Ma Ke +Link: https://lore.kernel.org/20240906100326.624445-1-make24@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1374,10 +1374,15 @@ static int stm32_gpiolib_register_bank(s + + for (i = 0; i < npins; i++) { + stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i); +- if (stm32_pin && stm32_pin->pin.name) ++ if (stm32_pin && stm32_pin->pin.name) { + names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name); +- else ++ if (!names[i]) { ++ err = -ENOMEM; ++ goto err_clk; ++ } ++ } else { + names[i] = NULL; ++ } + } + + bank->gpio_chip.names = (const char * const *)names; diff --git a/queue-6.11/serial-qcom-geni-fix-dma-rx-cancellation.patch b/queue-6.11/serial-qcom-geni-fix-dma-rx-cancellation.patch new file mode 100644 index 00000000000..009ef545bb0 --- /dev/null +++ b/queue-6.11/serial-qcom-geni-fix-dma-rx-cancellation.patch @@ -0,0 +1,68 @@ +From 23ee4a25661c33e6381d41e848a9060ed6d72845 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Oct 2024 16:51:05 +0200 +Subject: serial: qcom-geni: fix dma rx cancellation + +From: Johan Hovold + +commit 23ee4a25661c33e6381d41e848a9060ed6d72845 upstream. + +Make sure to wait for the DMA transfer to complete when cancelling the +rx command on stop_rx(). This specifically prevents the DMA completion +interrupt from firing after rx has been restarted, something which can +lead to an IOMMU fault and hosed rx when the interrupt handler unmaps +the DMA buffer for the new command: + + qcom_geni_serial 988000.serial: serial engine reports 0 RX bytes in! + arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x563 + arm-smmu 15000000.iommu: FSYNR0 = 00210013 [S1CBNDX=33 WNR PLVL=3] + Bluetooth: hci0: command 0xfc00 tx timeout + Bluetooth: hci0: Reading QCA version information failed (-110) + +Also add the missing state machine reset which is needed in case +cancellation fails. + +Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") +Cc: stable@vger.kernel.org # 6.3 +Cc: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20241009145110.16847-5-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -787,17 +787,27 @@ static void qcom_geni_serial_start_rx_fi + static void qcom_geni_serial_stop_rx_dma(struct uart_port *uport) + { + struct qcom_geni_serial_port *port = to_dev_port(uport); ++ bool done; + + if (!qcom_geni_serial_secondary_active(uport)) + return; + + geni_se_cancel_s_cmd(&port->se); +- qcom_geni_serial_poll_bit(uport, SE_GENI_S_IRQ_STATUS, +- S_CMD_CANCEL_EN, true); +- +- if (qcom_geni_serial_secondary_active(uport)) ++ done = qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT, ++ RX_EOT, true); ++ if (done) { ++ writel(RX_EOT | RX_DMA_DONE, ++ uport->membase + SE_DMA_RX_IRQ_CLR); ++ } else { + qcom_geni_serial_abort_rx(uport); + ++ writel(1, uport->membase + SE_DMA_RX_FSM_RST); ++ qcom_geni_serial_poll_bit(uport, SE_DMA_RX_IRQ_STAT, ++ RX_RESET_DONE, true); ++ writel(RX_RESET_DONE | RX_DMA_DONE, ++ uport->membase + SE_DMA_RX_IRQ_CLR); ++ } ++ + if (port->rx_dma_addr) { + geni_se_rx_dma_unprep(&port->se, port->rx_dma_addr, + DMA_RX_BUF_SIZE); diff --git a/queue-6.11/serial-qcom-geni-fix-polled-console-initialisation.patch b/queue-6.11/serial-qcom-geni-fix-polled-console-initialisation.patch new file mode 100644 index 00000000000..cb56df54e9c --- /dev/null +++ b/queue-6.11/serial-qcom-geni-fix-polled-console-initialisation.patch @@ -0,0 +1,70 @@ +From 4bef7c6f299910f19876ad8e7f5897514855f1d2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Oct 2024 16:51:02 +0200 +Subject: serial: qcom-geni: fix polled console initialisation + +From: Johan Hovold + +commit 4bef7c6f299910f19876ad8e7f5897514855f1d2 upstream. + +The polled console (KGDB/KDB) implementation must not call port setup +unconditionally as the port may already be in use by the console or a +getty. + +Only make sure that the receiver is enabled, but do not enable any +device interrupts. + +Fixes: d8851a96ba25 ("tty: serial: qcom-geni-serial: Add a poll_init() function") +Cc: stable@vger.kernel.org # 6.4 +Cc: Douglas Anderson +Signed-off-by: Johan Hovold +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20241009145110.16847-2-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -146,6 +146,7 @@ static struct uart_driver qcom_geni_cons + static struct uart_driver qcom_geni_uart_driver; + + static void qcom_geni_serial_cancel_tx_cmd(struct uart_port *uport); ++static int qcom_geni_serial_port_setup(struct uart_port *uport); + + static inline struct qcom_geni_serial_port *to_dev_port(struct uart_port *uport) + { +@@ -393,6 +394,23 @@ static void qcom_geni_serial_poll_put_ch + writel(M_TX_FIFO_WATERMARK_EN, uport->membase + SE_GENI_M_IRQ_CLEAR); + qcom_geni_serial_poll_tx_done(uport); + } ++ ++static int qcom_geni_serial_poll_init(struct uart_port *uport) ++{ ++ struct qcom_geni_serial_port *port = to_dev_port(uport); ++ int ret; ++ ++ if (!port->setup) { ++ ret = qcom_geni_serial_port_setup(uport); ++ if (ret) ++ return ret; ++ } ++ ++ if (!qcom_geni_serial_secondary_active(uport)) ++ geni_se_setup_s_cmd(&port->se, UART_START_READ, 0); ++ ++ return 0; ++} + #endif + + #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE +@@ -1564,7 +1582,7 @@ static const struct uart_ops qcom_geni_c + #ifdef CONFIG_CONSOLE_POLL + .poll_get_char = qcom_geni_serial_get_char, + .poll_put_char = qcom_geni_serial_poll_put_char, +- .poll_init = qcom_geni_serial_port_setup, ++ .poll_init = qcom_geni_serial_poll_init, + #endif + .pm = qcom_geni_serial_pm, + }; diff --git a/queue-6.11/serial-qcom-geni-fix-receiver-enable.patch b/queue-6.11/serial-qcom-geni-fix-receiver-enable.patch new file mode 100644 index 00000000000..2664e9385f1 --- /dev/null +++ b/queue-6.11/serial-qcom-geni-fix-receiver-enable.patch @@ -0,0 +1,88 @@ +From fa103d2599e11e802c818684cff821baefe7f206 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Oct 2024 16:51:06 +0200 +Subject: serial: qcom-geni: fix receiver enable + +From: Johan Hovold + +commit fa103d2599e11e802c818684cff821baefe7f206 upstream. + +The receiver is supposed to be enabled in the startup() callback and not +in set_termios() which is called also during console setup. + +This specifically avoids accepting input before the port has been opened +(and interrupts enabled), something which can also break the GENI +firmware (cancel fails and after abort, the "stale" counter handling +appears to be broken so that later input is not processed until twelve +chars have been received). + +There also does not appear to be any need to keep the receiver disabled +while updating the port settings. + +Since commit 6f3c3cafb115 ("serial: qcom-geni: disable interrupts during +console writes") the calls to manipulate the secondary interrupts, which +were done without holding the port lock, can also lead to the receiver +being left disabled when set_termios() races with the console code (e.g. +when init opens the tty during boot). This can manifest itself as a +serial getty not accepting input. + +The calls to stop and start rx in set_termios() can similarly race with +DMA completion and, for example, cause the DMA buffer to be unmapped +twice or the mapping to be leaked. + +Fix this by only enabling the receiver during startup and while holding +the port lock to avoid racing with the console code. + +Fixes: 6f3c3cafb115 ("serial: qcom-geni: disable interrupts during console writes") +Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") +Fixes: c4f528795d1a ("tty: serial: msm_geni_serial: Add serial driver support for GENI based QUP") +Cc: stable@vger.kernel.org # 6.3 +Cc: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20241009145110.16847-6-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1179,6 +1179,11 @@ static int qcom_geni_serial_startup(stru + if (ret) + return ret; + } ++ ++ uart_port_lock_irq(uport); ++ qcom_geni_serial_start_rx(uport); ++ uart_port_unlock_irq(uport); ++ + enable_irq(uport->irq); + + return 0; +@@ -1264,7 +1269,6 @@ static void qcom_geni_serial_set_termios + unsigned int avg_bw_core; + unsigned long timeout; + +- qcom_geni_serial_stop_rx(uport); + /* baud rate */ + baud = uart_get_baud_rate(uport, termios, old, 300, 4000000); + +@@ -1280,7 +1284,7 @@ static void qcom_geni_serial_set_termios + dev_err(port->se.dev, + "Couldn't find suitable clock rate for %u\n", + baud * sampling_rate); +- goto out_restart_rx; ++ return; + } + + dev_dbg(port->se.dev, "desired_rate = %u, clk_rate = %lu, clk_div = %u\n", +@@ -1371,8 +1375,6 @@ static void qcom_geni_serial_set_termios + writel(stop_bit_len, uport->membase + SE_UART_TX_STOP_BIT_LEN); + writel(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG); + writel(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG); +-out_restart_rx: +- qcom_geni_serial_start_rx(uport); + } + + #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE diff --git a/queue-6.11/serial-qcom-geni-fix-shutdown-race.patch b/queue-6.11/serial-qcom-geni-fix-shutdown-race.patch new file mode 100644 index 00000000000..29ac1e528f8 --- /dev/null +++ b/queue-6.11/serial-qcom-geni-fix-shutdown-race.patch @@ -0,0 +1,45 @@ +From 23f5f5debcaac1399cfeacec215278bf6dbc1d11 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Oct 2024 16:51:04 +0200 +Subject: serial: qcom-geni: fix shutdown race + +From: Johan Hovold + +commit 23f5f5debcaac1399cfeacec215278bf6dbc1d11 upstream. + +A commit adding back the stopping of tx on port shutdown failed to add +back the locking which had also been removed by commit e83766334f96 +("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART +shutdown"). + +Holding the port lock is needed to serialise against the console code, +which may update the interrupt enable register and access the port +state. + +Fixes: d8aca2f96813 ("tty: serial: qcom-geni-serial: stop operations in progress at shutdown") +Fixes: 947cc4ecc06c ("serial: qcom-geni: fix soft lockup on sw flow control and suspend") +Cc: stable@vger.kernel.org # 6.3 +Reviewed-by: Bartosz Golaszewski +Signed-off-by: Johan Hovold +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20241009145110.16847-4-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1096,10 +1096,12 @@ static void qcom_geni_serial_shutdown(st + { + disable_irq(uport->irq); + ++ uart_port_lock_irq(uport); + qcom_geni_serial_stop_tx(uport); + qcom_geni_serial_stop_rx(uport); + + qcom_geni_serial_cancel_tx_cmd(uport); ++ uart_port_unlock_irq(uport); + } + + static void qcom_geni_serial_flush_buffer(struct uart_port *uport) diff --git a/queue-6.11/serial-qcom-geni-revert-broken-hibernation-support.patch b/queue-6.11/serial-qcom-geni-revert-broken-hibernation-support.patch new file mode 100644 index 00000000000..73255032b88 --- /dev/null +++ b/queue-6.11/serial-qcom-geni-revert-broken-hibernation-support.patch @@ -0,0 +1,100 @@ +From 19df76662a33d2f2fc41a66607cb8285fc02d6ec Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Oct 2024 16:51:03 +0200 +Subject: serial: qcom-geni: revert broken hibernation support + +From: Johan Hovold + +commit 19df76662a33d2f2fc41a66607cb8285fc02d6ec upstream. + +This reverts commit 35781d8356a2eecaa6074ceeb80ee22e252fcdae. + +Hibernation is not supported on Qualcomm platforms with mainline +kernels yet a broken vendor implementation for the GENI serial driver +made it upstream. + +This is effectively dead code that cannot be tested and should just be +removed, but if these paths were ever hit for an open non-console port +they would crash the machine as the driver would fail to enable clocks +during restore() (i.e. all ports would have to be closed by drivers and +user space before hibernating the system to avoid this as a comment in +the code hinted at). + +The broken implementation also added a random call to enable the +receiver in the port setup code where it does not belong and which +enables the receiver prematurely for console ports. + +Fixes: 35781d8356a2 ("tty: serial: qcom-geni-serial: Add support for Hibernation feature") +Cc: stable@vger.kernel.org # 6.2 +Cc: Aniket Randive +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20241009145110.16847-3-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 41 +--------------------------------- + 1 file changed, 2 insertions(+), 39 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1152,7 +1152,6 @@ static int qcom_geni_serial_port_setup(s + false, true, true); + geni_se_init(&port->se, UART_RX_WM, port->rx_fifo_depth - 2); + geni_se_select_mode(&port->se, port->dev_data->mode); +- qcom_geni_serial_start_rx(uport); + port->setup = true; + + return 0; +@@ -1781,38 +1780,6 @@ static int qcom_geni_serial_sys_resume(s + return ret; + } + +-static int qcom_geni_serial_sys_hib_resume(struct device *dev) +-{ +- int ret = 0; +- struct uart_port *uport; +- struct qcom_geni_private_data *private_data; +- struct qcom_geni_serial_port *port = dev_get_drvdata(dev); +- +- uport = &port->uport; +- private_data = uport->private_data; +- +- if (uart_console(uport)) { +- geni_icc_set_tag(&port->se, QCOM_ICC_TAG_ALWAYS); +- geni_icc_set_bw(&port->se); +- ret = uart_resume_port(private_data->drv, uport); +- /* +- * For hibernation usecase clients for +- * console UART won't call port setup during restore, +- * hence call port setup for console uart. +- */ +- qcom_geni_serial_port_setup(uport); +- } else { +- /* +- * Peripheral register settings are lost during hibernation. +- * Update setup flag such that port setup happens again +- * during next session. Clients of HS-UART will close and +- * open the port during hibernation. +- */ +- port->setup = false; +- } +- return ret; +-} +- + static const struct qcom_geni_device_data qcom_geni_console_data = { + .console = true, + .mode = GENI_SE_FIFO, +@@ -1824,12 +1791,8 @@ static const struct qcom_geni_device_dat + }; + + static const struct dev_pm_ops qcom_geni_serial_pm_ops = { +- .suspend = pm_sleep_ptr(qcom_geni_serial_sys_suspend), +- .resume = pm_sleep_ptr(qcom_geni_serial_sys_resume), +- .freeze = pm_sleep_ptr(qcom_geni_serial_sys_suspend), +- .poweroff = pm_sleep_ptr(qcom_geni_serial_sys_suspend), +- .restore = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume), +- .thaw = pm_sleep_ptr(qcom_geni_serial_sys_hib_resume), ++ SYSTEM_SLEEP_PM_OPS(qcom_geni_serial_sys_suspend, ++ qcom_geni_serial_sys_resume) + }; + + static const struct of_device_id qcom_geni_serial_match_table[] = { diff --git a/queue-6.11/series b/queue-6.11/series index 1ed6552b93b..b41d02c6e07 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -117,3 +117,17 @@ x86-cpu-amd-only-apply-zenbleed-fix-for-zen2-during-late-microcode-load.patch x86-entry_32-do-not-clobber-user-eflags.zf.patch x86-entry_32-clear-cpu-buffers-after-register-restore-in-nmi-return.patch tty-n_gsm-fix-use-after-free-in-gsm_cleanup_mux.patch +x86-bugs-use-code-segment-selector-for-verw-operand.patch +pinctrl-nuvoton-fix-a-double-free-in-ma35_pinctrl_dt_node_to_map_func.patch +pinctrl-intel-platform-fix-error-path-in-device_for_each_child_node.patch +pinctrl-ocelot-fix-system-hang-on-level-based-interrupts.patch +pinctrl-stm32-check-devm_kasprintf-returned-value.patch +pinctrl-apple-check-devm_kasprintf-returned-value.patch +irqchip-gic-v4-don-t-allow-a-vmovp-on-a-dying-vpe.patch +irqchip-sifive-plic-unmask-interrupt-in-plic_irq_enable.patch +irqchip-sifive-plic-return-error-code-on-failure.patch +serial-qcom-geni-fix-polled-console-initialisation.patch +serial-qcom-geni-revert-broken-hibernation-support.patch +serial-qcom-geni-fix-shutdown-race.patch +serial-qcom-geni-fix-dma-rx-cancellation.patch +serial-qcom-geni-fix-receiver-enable.patch diff --git a/queue-6.11/x86-bugs-use-code-segment-selector-for-verw-operand.patch b/queue-6.11/x86-bugs-use-code-segment-selector-for-verw-operand.patch new file mode 100644 index 00000000000..b9177659417 --- /dev/null +++ b/queue-6.11/x86-bugs-use-code-segment-selector-for-verw-operand.patch @@ -0,0 +1,81 @@ +From e4d2102018542e3ae5e297bc6e229303abff8a0f Mon Sep 17 00:00:00 2001 +From: Pawan Gupta +Date: Thu, 26 Sep 2024 09:10:31 -0700 +Subject: x86/bugs: Use code segment selector for VERW operand + +From: Pawan Gupta + +commit e4d2102018542e3ae5e297bc6e229303abff8a0f upstream. + +Robert Gill reported below #GP in 32-bit mode when dosemu software was +executing vm86() system call: + + general protection fault: 0000 [#1] PREEMPT SMP + CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 + Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 + EIP: restore_all_switch_stack+0xbe/0xcf + EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 + ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc + DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 + CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 + Call Trace: + show_regs+0x70/0x78 + die_addr+0x29/0x70 + exc_general_protection+0x13c/0x348 + exc_bounds+0x98/0x98 + handle_exception+0x14d/0x14d + exc_bounds+0x98/0x98 + restore_all_switch_stack+0xbe/0xcf + exc_bounds+0x98/0x98 + restore_all_switch_stack+0xbe/0xcf + +This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS +are enabled. This is because segment registers with an arbitrary user value +can result in #GP when executing VERW. Intel SDM vol. 2C documents the +following behavior for VERW instruction: + + #GP(0) - If a memory operand effective address is outside the CS, DS, ES, + FS, or GS segment limit. + +CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user +space. Use %cs selector to reference VERW operand. This ensures VERW will +not #GP for an arbitrary user %ds. + +[ mingo: Fixed the SOB chain. ] + +Fixes: a0e2dab44d22 ("x86/entry_32: Add VERW just before userspace transition") +Reported-by: Robert Gill +Reviewed-by: Andrew Cooper +Suggested-by: Brian Gerst +Signed-off-by: Pawan Gupta +Signed-off-by: Dave Hansen +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/nospec-branch.h | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -323,7 +323,16 @@ + * Note: Only the memory operand variant of VERW clears the CPU buffers. + */ + .macro CLEAR_CPU_BUFFERS +- ALTERNATIVE "", __stringify(verw _ASM_RIP(mds_verw_sel)), X86_FEATURE_CLEAR_CPU_BUF ++#ifdef CONFIG_X86_64 ++ ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF ++#else ++ /* ++ * In 32bit mode, the memory operand must be a %cs reference. The data ++ * segments may not be usable (vm86 mode), and the stack segment may not ++ * be flat (ESPFIX32). ++ */ ++ ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF ++#endif + .endm + + #ifdef CONFIG_X86_64