From: Sasha Levin Date: Sat, 14 Jun 2025 13:34:09 +0000 (-0400) Subject: Fixes for 6.6 X-Git-Tag: v6.6.94~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=785b598a7a37c87fecf5fc9ca0f57931c15c4d12;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch b/queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch new file mode 100644 index 0000000000..0b0390ac24 --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch @@ -0,0 +1,41 @@ +From 1946c50e32f8ef2e5a694f1a69903ec46bd9c8de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Apr 2025 12:30:08 -0500 +Subject: arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0 + +From: Judith Mendez + +[ Upstream commit f55c9f087cc2e2252d44ffd9d58def2066fc176e ] + +For am65x, add missing ITAPDLYSEL values for Default Speed and High +Speed SDR modes to sdhci0 node according to the device datasheet [0]. + +[0] https://www.ti.com/lit/gpn/am6548 + +Fixes: eac99d38f861 ("arm64: dts: ti: k3-am654-main: Update otap-del-sel values") +Cc: stable@vger.kernel.org +Signed-off-by: Judith Mendez +Reviewed-by: Moteen Shah +Link: https://lore.kernel.org/r/20250429173009.33994-1-jm@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +index 9c5de448351e9..0523bd0da80c7 100644 +--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +@@ -448,6 +448,8 @@ sdhci0: mmc@4f80000 { + ti,otap-del-sel-ddr50 = <0x5>; + ti,otap-del-sel-ddr52 = <0x5>; + ti,otap-del-sel-hs200 = <0x5>; ++ ti,itap-del-sel-legacy = <0xa>; ++ ti,itap-del-sel-mmc-hs = <0x1>; + ti,itap-del-sel-ddr52 = <0x0>; + dma-coherent; + }; +-- +2.39.5 + diff --git a/queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch b/queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch new file mode 100644 index 0000000000..ef19153ebf --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch @@ -0,0 +1,83 @@ +From 0eb770016be5b83a90651fac365a4e2a0ec189ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Apr 2024 10:17:28 -0500 +Subject: arm64: dts: ti: k3-am65-main: Fix sdhci node properties + +From: Judith Mendez + +[ Upstream commit 8ffe9cb889f2b831a9d5bbb1f7ad42d30e31170f ] + +Update otap-del-sel properties as per datasheet [0]. + +Add missing clkbuf-sel and itap-del-sel values also as per +datasheet [0]. + +Move clkbuf-sel and ti,trm-icp above the otap-del-sel properties +so the sdhci nodes could be more uniform across platforms. + +[0] https://www.ti.com/lit/ds/symlink/am6548.pdf + +Fixes: eac99d38f861 ("arm64: dts: ti: k3-am654-main: Update otap-del-sel values") +Fixes: d7600d070fb0 ("arm64: dts: ti: k3-am65-main: Add support for sdhci1") +Signed-off-by: Judith Mendez +Link: https://lore.kernel.org/r/20240423151732.3541894-2-jm@ti.com +Signed-off-by: Nishanth Menon +Stable-dep-of: f55c9f087cc2 ("arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +index 57befcce93b97..9c5de448351e9 100644 +--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +@@ -436,6 +436,8 @@ sdhci0: mmc@4f80000 { + interrupts = ; + mmc-ddr-1_8v; + mmc-hs200-1_8v; ++ ti,clkbuf-sel = <0x7>; ++ ti,trm-icp = <0x8>; + ti,otap-del-sel-legacy = <0x0>; + ti,otap-del-sel-mmc-hs = <0x0>; + ti,otap-del-sel-sd-hs = <0x0>; +@@ -446,8 +448,7 @@ sdhci0: mmc@4f80000 { + ti,otap-del-sel-ddr50 = <0x5>; + ti,otap-del-sel-ddr52 = <0x5>; + ti,otap-del-sel-hs200 = <0x5>; +- ti,otap-del-sel-hs400 = <0x0>; +- ti,trm-icp = <0x8>; ++ ti,itap-del-sel-ddr52 = <0x0>; + dma-coherent; + }; + +@@ -458,18 +459,22 @@ sdhci1: mmc@4fa0000 { + clocks = <&k3_clks 48 0>, <&k3_clks 48 1>; + clock-names = "clk_ahb", "clk_xin"; + interrupts = ; ++ ti,clkbuf-sel = <0x7>; ++ ti,trm-icp = <0x8>; + ti,otap-del-sel-legacy = <0x0>; + ti,otap-del-sel-mmc-hs = <0x0>; + ti,otap-del-sel-sd-hs = <0x0>; +- ti,otap-del-sel-sdr12 = <0x0>; +- ti,otap-del-sel-sdr25 = <0x0>; ++ ti,otap-del-sel-sdr12 = <0xf>; ++ ti,otap-del-sel-sdr25 = <0xf>; + ti,otap-del-sel-sdr50 = <0x8>; + ti,otap-del-sel-sdr104 = <0x7>; + ti,otap-del-sel-ddr50 = <0x4>; + ti,otap-del-sel-ddr52 = <0x4>; + ti,otap-del-sel-hs200 = <0x7>; +- ti,clkbuf-sel = <0x7>; +- ti,trm-icp = <0x8>; ++ ti,itap-del-sel-legacy = <0xa>; ++ ti,itap-del-sel-sd-hs = <0x1>; ++ ti,itap-del-sel-sdr12 = <0xa>; ++ ti,itap-del-sel-sdr25 = <0x1>; + dma-coherent; + }; + +-- +2.39.5 + diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch new file mode 100644 index 0000000000..84980ee5d7 --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch @@ -0,0 +1,85 @@ +From daacaf31ecc4322c4000d91b03495eb8bc1377a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Apr 2025 16:43:22 +0530 +Subject: arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators + +From: Yemike Abhilash Chandra + +[ Upstream commit 97b67cc102dc2cc8aa39a569c22a196e21af5a21 ] + +Add device tree nodes for two power regulators on the J721E SK board. +vsys_5v0: A fixed regulator representing the 5V supply output from the +LM61460 and vdd_sd_dv: A GPIO-controlled TLV71033 regulator. + +J721E-SK schematics: https://www.ti.com/lit/zip/sprr438 + +Fixes: 1bfda92a3a36 ("arm64: dts: ti: Add support for J721E SK") +Cc: stable@vger.kernel.org +Signed-off-by: Yemike Abhilash Chandra +Reviewed-by: Udit Kumar +Link: https://lore.kernel.org/r/20250415111328.3847502-2-y-abhilashchandra@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 31 ++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +index 5e03a7f58faa4..952d2c72628ef 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +@@ -183,6 +183,17 @@ vsys_3v3: fixedregulator-vsys3v3 { + regulator-boot-on; + }; + ++ vsys_5v0: fixedregulator-vsys5v0 { ++ /* Output of LM61460 */ ++ compatible = "regulator-fixed"; ++ regulator-name = "vsys_5v0"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ vin-supply = <&vusb_main>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; ++ + vdd_mmc1: fixedregulator-sd { + compatible = "regulator-fixed"; + pinctrl-names = "default"; +@@ -210,6 +221,20 @@ vdd_sd_dv_alt: gpio-regulator-tps659411 { + <3300000 0x1>; + }; + ++ vdd_sd_dv: gpio-regulator-TLV71033 { ++ compatible = "regulator-gpio"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&vdd_sd_dv_pins_default>; ++ regulator-name = "tlv71033"; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-boot-on; ++ vin-supply = <&vsys_5v0>; ++ gpios = <&main_gpio0 118 GPIO_ACTIVE_HIGH>; ++ states = <1800000 0x0>, ++ <3300000 0x1>; ++ }; ++ + transceiver1: can-phy1 { + compatible = "ti,tcan1042"; + #phy-cells = <0>; +@@ -601,6 +626,12 @@ J721E_WKUP_IOPAD(0xd4, PIN_OUTPUT, 7) /* (G26) WKUP_GPIO0_9 */ + >; + }; + ++ vdd_sd_dv_pins_default: vdd-sd-dv-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */ ++ >; ++ }; ++ + wkup_uart0_pins_default: wkup-uart0-default-pins { + pinctrl-single,pins = < + J721E_WKUP_IOPAD(0xa0, PIN_INPUT, 0) /* (J29) WKUP_UART0_RXD */ +-- +2.39.5 + diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch new file mode 100644 index 0000000000..9ca5b1a58c --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch @@ -0,0 +1,179 @@ +From 1e547fa391bc60ec0ea2730538a187bde11c8566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2024 18:45:12 +0530 +Subject: arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances + +From: Beleswar Padhi + +[ Upstream commit 021d3d5f0741e5393a7a110ac909fc746b1e0a4d ] + +CAN instance 0 in the mcu domain is brought on the J721E-SK board +through header J1. Thus, add its respective transceiver 1 dt node to add +support for this CAN instance. + +CAN instances 0, 5 and 9 in the main domain are brought on the J721E-SK +board through headers J5, J6 and J2 respectively. Thus, add their +respective transceivers 2, 3 and 4 dt nodes to add support for these CAN +instances. + +Signed-off-by: Beleswar Padhi +Reviewed-by: Bhavya Kapoor +Link: https://lore.kernel.org/r/20240430131512.1327283-1-b-padhi@ti.com +Signed-off-by: Vignesh Raghavendra +Stable-dep-of: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 116 +++++++++++++++++++++++++ + 1 file changed, 116 insertions(+) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +index d967b384071cf..5e03a7f58faa4 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +@@ -210,6 +210,42 @@ vdd_sd_dv_alt: gpio-regulator-tps659411 { + <3300000 0x1>; + }; + ++ transceiver1: can-phy1 { ++ compatible = "ti,tcan1042"; ++ #phy-cells = <0>; ++ max-bitrate = <5000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mcu_mcan0_gpio_pins_default>; ++ standby-gpios = <&wkup_gpio0 3 GPIO_ACTIVE_HIGH>; ++ }; ++ ++ transceiver2: can-phy2 { ++ compatible = "ti,tcan1042"; ++ #phy-cells = <0>; ++ max-bitrate = <5000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan0_gpio_pins_default>; ++ standby-gpios = <&main_gpio0 65 GPIO_ACTIVE_HIGH>; ++ }; ++ ++ transceiver3: can-phy3 { ++ compatible = "ti,tcan1042"; ++ #phy-cells = <0>; ++ max-bitrate = <5000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan5_gpio_pins_default>; ++ standby-gpios = <&main_gpio0 66 GPIO_ACTIVE_HIGH>; ++ }; ++ ++ transceiver4: can-phy4 { ++ compatible = "ti,tcan1042"; ++ #phy-cells = <0>; ++ max-bitrate = <5000000>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan9_gpio_pins_default>; ++ standby-gpios = <&main_gpio0 67 GPIO_ACTIVE_HIGH>; ++ }; ++ + dp_pwr_3v3: fixedregulator-dp-prw { + compatible = "regulator-fixed"; + regulator-name = "dp-pwr"; +@@ -367,6 +403,45 @@ J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */ + >; + }; + ++ main_mcan0_pins_default: main-mcan0-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x208, PIN_INPUT, 0) /* (W5) MCAN0_RX */ ++ J721E_IOPAD(0x20c, PIN_OUTPUT, 0) /* (W6) MCAN0_TX */ ++ >; ++ }; ++ ++ main_mcan0_gpio_pins_default: main-mcan0-gpio-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x108, PIN_INPUT, 7) /* (AD27) PRG0_PRU1_GPO2.GPIO0_65 */ ++ >; ++ }; ++ ++ main_mcan5_pins_default: main-mcan5-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x050, PIN_INPUT, 6) /* (AE21) PRG1_PRU0_GPO18.MCAN5_RX */ ++ J721E_IOPAD(0x04c, PIN_OUTPUT, 6) /* (AJ21) PRG1_PRU0_GPO17.MCAN5_TX */ ++ >; ++ }; ++ ++ main_mcan5_gpio_pins_default: main-mcan5-gpio-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x10c, PIN_INPUT, 7) /* (AC25) PRG0_PRU1_GPO3.GPIO0_66 */ ++ >; ++ }; ++ ++ main_mcan9_pins_default: main-mcan9-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x0d0, PIN_INPUT, 6) /* (AC27) PRG0_PRU0_GPO8.MCAN9_RX */ ++ J721E_IOPAD(0x0cc, PIN_OUTPUT, 6) /* (AC28) PRG0_PRU0_GPO7.MCAN9_TX */ ++ >; ++ }; ++ ++ main_mcan9_gpio_pins_default: main-mcan9-gpio-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x110, PIN_INPUT, 7) /* (AD29) PRG0_PRU1_GPO4.GPIO0_67 */ ++ >; ++ }; ++ + dp0_pins_default: dp0-default-pins { + pinctrl-single,pins = < + J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */ +@@ -549,6 +624,19 @@ J721E_WKUP_IOPAD(0xfc, PIN_INPUT_PULLUP, 0) /* (H24) WKUP_I2C0_SDA */ + >; + }; + ++ mcu_mcan0_pins_default: mcu-mcan0-default-pins { ++ pinctrl-single,pins = < ++ J721E_WKUP_IOPAD(0x0ac, PIN_INPUT, 0) /* (C29) MCU_MCAN0_RX */ ++ J721E_WKUP_IOPAD(0x0a8, PIN_OUTPUT, 0) /* (D29) MCU_MCAN0_TX */ ++ >; ++ }; ++ ++ mcu_mcan0_gpio_pins_default: mcu-mcan0-gpio-default-pins { ++ pinctrl-single,pins = < ++ J721E_WKUP_IOPAD(0x0bc, PIN_INPUT, 7) /* (F27) WKUP_GPIO0_3 */ ++ >; ++ }; ++ + /* Reset for M.2 M Key slot on PCIe1 */ + mkey_reset_pins_default: mkey-reset-pns-default-pins { + pinctrl-single,pins = < +@@ -957,6 +1045,34 @@ &pcie1_rc { + num-lanes = <2>; + }; + ++&mcu_mcan0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mcu_mcan0_pins_default>; ++ phys = <&transceiver1>; ++ status = "okay"; ++}; ++ ++&main_mcan0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan0_pins_default>; ++ phys = <&transceiver2>; ++ status = "okay"; ++}; ++ ++&main_mcan5 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan5_pins_default>; ++ phys = <&transceiver3>; ++ status = "okay"; ++}; ++ ++&main_mcan9 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_mcan9_pins_default>; ++ phys = <&transceiver4>; ++ status = "okay"; ++}; ++ + &ufs_wrapper { + status = "disabled"; + }; +-- +2.39.5 + diff --git a/queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch b/queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch new file mode 100644 index 0000000000..9432e69d07 --- /dev/null +++ b/queue-6.6/arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch @@ -0,0 +1,80 @@ +From 2245986f4734e74fcdfa2af1ffefd3cc76c2d71a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 14:25:14 +0530 +Subject: arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux + +From: Vaishnav Achath + +[ Upstream commit f87c88947396674586a42a163b72efa3999e3dee ] + +J721E SK has the CSI2RX routed to a MIPI CSI connector and to 15-pin +RPi camera connector through an analog mux with GPIO control, model that +so that an overlay can control the mux state according to connected +cameras. Also provide labels to the I2C mux bus instances so that a +generic overlay can be used across multiple platforms. + +J721E SK schematics: https://www.ti.com/lit/zip/sprr438 + +Signed-off-by: Vaishnav Achath +Reviewed-by: Jai Luthra +Link: https://lore.kernel.org/r/20240215085518.552692-6-vaishnav.a@ti.com +Signed-off-by: Vignesh Raghavendra +Stable-dep-of: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +index ccacb65683b5b..d967b384071cf 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts ++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts +@@ -286,6 +286,15 @@ tfp410_out: endpoint { + }; + }; + }; ++ ++ csi_mux: mux-controller { ++ compatible = "gpio-mux"; ++ #mux-state-cells = <1>; ++ mux-gpios = <&main_gpio0 88 GPIO_ACTIVE_HIGH>; ++ idle-state = <0>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&main_csi_mux_sel_pins_default>; ++ }; + }; + + &main_pmx0 { +@@ -352,6 +361,12 @@ J721E_IOPAD(0x214, PIN_OUTPUT, 4) /* (V4) MCAN1_TX.USB1_DRVVBUS */ + >; + }; + ++ main_csi_mux_sel_pins_default: main-csi-mux-sel-default-pins { ++ pinctrl-single,pins = < ++ J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */ ++ >; ++ }; ++ + dp0_pins_default: dp0-default-pins { + pinctrl-single,pins = < + J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */ +@@ -707,14 +722,14 @@ i2c-mux@70 { + reg = <0x70>; + + /* CSI0 I2C */ +- i2c@0 { ++ cam0_i2c: i2c@0 { + #address-cells = <1>; + #size-cells = <0>; + reg = <0>; + }; + + /* CSI1 I2C */ +- i2c@1 { ++ cam1_i2c: i2c@1 { + #address-cells = <1>; + #size-cells = <0>; + reg = <1>; +-- +2.39.5 + diff --git a/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch b/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch new file mode 100644 index 0000000000..58815da6a7 --- /dev/null +++ b/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versi.patch @@ -0,0 +1,262 @@ +From 8614d55495ec4af442ff407c9cefc7556c59814c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 May 2025 15:49:59 -0700 +Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Torokhov + +[ Upstream commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 ] + +Sysfs interface for updating firmware for RMI devices is available even +when F34 probe fails. The code checks for presence of F34 "container" +pointer and then tries to use the function data attached to the +sub-device. F34 assigns the function data early, before it knows if +probe will succeed, leaving behind a stale pointer. + +Fix this by expanding checks to not only test for presence of F34 +"container" but also check if there is driver data assigned to the +sub-device, and call dev_set_drvdata() only after we are certain that +probe is successful. + +This is not a complete fix, since F34 will be freed during firmware +update, so there is still a race when fetching and accessing this +pointer. This race will be addressed in follow-up changes. + +Reported-by: Hanno Böck +Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/rmi4/rmi_f34.c | 135 ++++++++++++++++++++--------------- + 1 file changed, 76 insertions(+), 59 deletions(-) + +diff --git a/drivers/input/rmi4/rmi_f34.c b/drivers/input/rmi4/rmi_f34.c +index 0d9a5756e3f59..cae1e41664921 100644 +--- a/drivers/input/rmi4/rmi_f34.c ++++ b/drivers/input/rmi4/rmi_f34.c +@@ -4,6 +4,7 @@ + * Copyright (C) 2016 Zodiac Inflight Innovations + */ + ++#include "linux/device.h" + #include + #include + #include +@@ -298,39 +299,30 @@ static int rmi_f34_update_firmware(struct f34_data *f34, + return ret; + } + +-static int rmi_f34_status(struct rmi_function *fn) +-{ +- struct f34_data *f34 = dev_get_drvdata(&fn->dev); +- +- /* +- * The status is the percentage complete, or once complete, +- * zero for success or a negative return code. +- */ +- return f34->update_status; +-} +- + static ssize_t rmi_driver_bootloader_id_show(struct device *dev, + struct device_attribute *dattr, + char *buf) + { + struct rmi_driver_data *data = dev_get_drvdata(dev); +- struct rmi_function *fn = data->f34_container; ++ struct rmi_function *fn; + struct f34_data *f34; + +- if (fn) { +- f34 = dev_get_drvdata(&fn->dev); +- +- if (f34->bl_version == 5) +- return sysfs_emit(buf, "%c%c\n", +- f34->bootloader_id[0], +- f34->bootloader_id[1]); +- else +- return sysfs_emit(buf, "V%d.%d\n", +- f34->bootloader_id[1], +- f34->bootloader_id[0]); +- } ++ fn = data->f34_container; ++ if (!fn) ++ return -ENODEV; + +- return 0; ++ f34 = dev_get_drvdata(&fn->dev); ++ if (!f34) ++ return -ENODEV; ++ ++ if (f34->bl_version == 5) ++ return sysfs_emit(buf, "%c%c\n", ++ f34->bootloader_id[0], ++ f34->bootloader_id[1]); ++ else ++ return sysfs_emit(buf, "V%d.%d\n", ++ f34->bootloader_id[1], ++ f34->bootloader_id[0]); + } + + static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); +@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_id_show(struct device *dev, + struct rmi_function *fn = data->f34_container; + struct f34_data *f34; + +- if (fn) { +- f34 = dev_get_drvdata(&fn->dev); ++ fn = data->f34_container; ++ if (!fn) ++ return -ENODEV; + +- return sysfs_emit(buf, "%s\n", f34->configuration_id); +- } ++ f34 = dev_get_drvdata(&fn->dev); ++ if (!f34) ++ return -ENODEV; + +- return 0; ++ ++ return sysfs_emit(buf, "%s\n", f34->configuration_id); + } + + static DEVICE_ATTR(configuration_id, 0444, +@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rmi_driver_data *data, + + if (!data->f34_container) { + dev_warn(dev, "%s: No F34 present!\n", __func__); +- return -EINVAL; ++ return -ENODEV; + } + + f34 = dev_get_drvdata(&data->f34_container->dev); ++ if (!f34) { ++ dev_warn(dev, "%s: No valid F34 present!\n", __func__); ++ return -ENODEV; ++ } + + if (f34->bl_version >= 7) { + if (data->pdt_props & HAS_BSR) { +@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_status_show(struct device *dev, + char *buf) + { + struct rmi_driver_data *data = dev_get_drvdata(dev); +- int update_status = 0; ++ struct f34_data *f34; ++ int update_status = -ENODEV; + +- if (data->f34_container) +- update_status = rmi_f34_status(data->f34_container); ++ /* ++ * The status is the percentage complete, or once complete, ++ * zero for success or a negative return code. ++ */ ++ if (data->f34_container) { ++ f34 = dev_get_drvdata(&data->f34_container->dev); ++ if (f34) ++ update_status = f34->update_status; ++ } + + return sysfs_emit(buf, "%d\n", update_status); + } +@@ -517,33 +524,21 @@ static const struct attribute_group rmi_firmware_attr_group = { + .attrs = rmi_firmware_attrs, + }; + +-static int rmi_f34_probe(struct rmi_function *fn) ++static int rmi_f34v5_probe(struct f34_data *f34) + { +- struct f34_data *f34; +- unsigned char f34_queries[9]; ++ struct rmi_function *fn = f34->fn; ++ u8 f34_queries[9]; + bool has_config_id; +- u8 version = fn->fd.function_version; +- int ret; +- +- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); +- if (!f34) +- return -ENOMEM; +- +- f34->fn = fn; +- dev_set_drvdata(&fn->dev, f34); +- +- /* v5 code only supported version 0, try V7 probe */ +- if (version > 0) +- return rmi_f34v7_probe(f34); ++ int error; + + f34->bl_version = 5; + +- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, +- f34_queries, sizeof(f34_queries)); +- if (ret) { ++ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, ++ f34_queries, sizeof(f34_queries)); ++ if (error) { + dev_err(&fn->dev, "%s: Failed to query properties\n", + __func__); +- return ret; ++ return error; + } + + snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), +@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_function *fn) + f34->v5.config_blocks); + + if (has_config_id) { +- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, +- f34_queries, sizeof(f34_queries)); +- if (ret) { ++ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, ++ f34_queries, sizeof(f34_queries)); ++ if (error) { + dev_err(&fn->dev, "Failed to read F34 config ID\n"); +- return ret; ++ return error; + } + + snprintf(f34->configuration_id, sizeof(f34->configuration_id), +@@ -582,12 +577,34 @@ static int rmi_f34_probe(struct rmi_function *fn) + f34_queries[2], f34_queries[3]); + + rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", +- f34->configuration_id); ++ f34->configuration_id); + } + + return 0; + } + ++static int rmi_f34_probe(struct rmi_function *fn) ++{ ++ struct f34_data *f34; ++ u8 version = fn->fd.function_version; ++ int error; ++ ++ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); ++ if (!f34) ++ return -ENOMEM; ++ ++ f34->fn = fn; ++ ++ /* v5 code only supported version 0 */ ++ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); ++ if (error) ++ return error; ++ ++ dev_set_drvdata(&fn->dev, f34); ++ ++ return 0; ++} ++ + int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) + { + return sysfs_create_group(&rmi_dev->dev.kobj, &rmi_firmware_attr_group); +-- +2.39.5 + diff --git a/queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch b/queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch new file mode 100644 index 0000000000..31bad6fc6b --- /dev/null +++ b/queue-6.6/kasan-avoid-sleepable-page-allocation-from-atomic-co.patch @@ -0,0 +1,199 @@ +From 7c0f28ba8623633f20ff2b4575b6da259ae0fef6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 15:55:38 +0200 +Subject: kasan: avoid sleepable page allocation from atomic context + +From: Alexander Gordeev + +[ Upstream commit b6ea95a34cbd014ab6ade4248107b86b0aaf2d6c ] + +apply_to_pte_range() enters the lazy MMU mode and then invokes +kasan_populate_vmalloc_pte() callback on each page table walk iteration. +However, the callback can go into sleep when trying to allocate a single +page, e.g. if an architecutre disables preemption on lazy MMU mode enter. + +On s390 if make arch_enter_lazy_mmu_mode() -> preempt_enable() and +arch_leave_lazy_mmu_mode() -> preempt_disable(), such crash occurs: + +[ 0.663336] BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:321 +[ 0.663348] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2, name: kthreadd +[ 0.663358] preempt_count: 1, expected: 0 +[ 0.663366] RCU nest depth: 0, expected: 0 +[ 0.663375] no locks held by kthreadd/2. +[ 0.663383] Preemption disabled at: +[ 0.663386] [<0002f3284cbb4eda>] apply_to_pte_range+0xfa/0x4a0 +[ 0.663405] CPU: 0 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.15.0-rc5-gcc-kasan-00043-gd76bb1ebb558-dirty #162 PREEMPT +[ 0.663408] Hardware name: IBM 3931 A01 701 (KVM/Linux) +[ 0.663409] Call Trace: +[ 0.663410] [<0002f3284c385f58>] dump_stack_lvl+0xe8/0x140 +[ 0.663413] [<0002f3284c507b9e>] __might_resched+0x66e/0x700 +[ 0.663415] [<0002f3284cc4f6c0>] __alloc_frozen_pages_noprof+0x370/0x4b0 +[ 0.663419] [<0002f3284ccc73c0>] alloc_pages_mpol+0x1a0/0x4a0 +[ 0.663421] [<0002f3284ccc8518>] alloc_frozen_pages_noprof+0x88/0xc0 +[ 0.663424] [<0002f3284ccc8572>] alloc_pages_noprof+0x22/0x120 +[ 0.663427] [<0002f3284cc341ac>] get_free_pages_noprof+0x2c/0xc0 +[ 0.663429] [<0002f3284cceba70>] kasan_populate_vmalloc_pte+0x50/0x120 +[ 0.663433] [<0002f3284cbb4ef8>] apply_to_pte_range+0x118/0x4a0 +[ 0.663435] [<0002f3284cbc7c14>] apply_to_pmd_range+0x194/0x3e0 +[ 0.663437] [<0002f3284cbc99be>] __apply_to_page_range+0x2fe/0x7a0 +[ 0.663440] [<0002f3284cbc9e88>] apply_to_page_range+0x28/0x40 +[ 0.663442] [<0002f3284ccebf12>] kasan_populate_vmalloc+0x82/0xa0 +[ 0.663445] [<0002f3284cc1578c>] alloc_vmap_area+0x34c/0xc10 +[ 0.663448] [<0002f3284cc1c2a6>] __get_vm_area_node+0x186/0x2a0 +[ 0.663451] [<0002f3284cc1e696>] __vmalloc_node_range_noprof+0x116/0x310 +[ 0.663454] [<0002f3284cc1d950>] __vmalloc_node_noprof+0xd0/0x110 +[ 0.663457] [<0002f3284c454b88>] alloc_thread_stack_node+0xf8/0x330 +[ 0.663460] [<0002f3284c458d56>] dup_task_struct+0x66/0x4d0 +[ 0.663463] [<0002f3284c45be90>] copy_process+0x280/0x4b90 +[ 0.663465] [<0002f3284c460940>] kernel_clone+0xd0/0x4b0 +[ 0.663467] [<0002f3284c46115e>] kernel_thread+0xbe/0xe0 +[ 0.663469] [<0002f3284c4e440e>] kthreadd+0x50e/0x7f0 +[ 0.663472] [<0002f3284c38c04a>] __ret_from_fork+0x8a/0xf0 +[ 0.663475] [<0002f3284ed57ff2>] ret_from_fork+0xa/0x38 + +Instead of allocating single pages per-PTE, bulk-allocate the shadow +memory prior to applying kasan_populate_vmalloc_pte() callback on a page +range. + +Link: https://lkml.kernel.org/r/c61d3560297c93ed044f0b1af085610353a06a58.1747316918.git.agordeev@linux.ibm.com +Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") +Signed-off-by: Alexander Gordeev +Suggested-by: Andrey Ryabinin +Reviewed-by: Harry Yoo +Cc: Daniel Axtens +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/kasan/shadow.c | 92 +++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 78 insertions(+), 14 deletions(-) + +diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c +index d687f09a7ae37..7f97f34f38364 100644 +--- a/mm/kasan/shadow.c ++++ b/mm/kasan/shadow.c +@@ -311,33 +311,99 @@ void __init __weak kasan_populate_early_vm_area_shadow(void *start, + { + } + ++struct vmalloc_populate_data { ++ unsigned long start; ++ struct page **pages; ++}; ++ + static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr, +- void *unused) ++ void *_data) + { +- unsigned long page; ++ struct vmalloc_populate_data *data = _data; ++ struct page *page; + pte_t pte; ++ int index; + + if (likely(!pte_none(ptep_get(ptep)))) + return 0; + +- page = __get_free_page(GFP_KERNEL); +- if (!page) +- return -ENOMEM; +- +- __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); +- pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL); ++ index = PFN_DOWN(addr - data->start); ++ page = data->pages[index]; ++ __memset(page_to_virt(page), KASAN_VMALLOC_INVALID, PAGE_SIZE); ++ pte = pfn_pte(page_to_pfn(page), PAGE_KERNEL); + + spin_lock(&init_mm.page_table_lock); + if (likely(pte_none(ptep_get(ptep)))) { + set_pte_at(&init_mm, addr, ptep, pte); +- page = 0; ++ data->pages[index] = NULL; + } + spin_unlock(&init_mm.page_table_lock); +- if (page) +- free_page(page); ++ ++ return 0; ++} ++ ++static void ___free_pages_bulk(struct page **pages, int nr_pages) ++{ ++ int i; ++ ++ for (i = 0; i < nr_pages; i++) { ++ if (pages[i]) { ++ __free_pages(pages[i], 0); ++ pages[i] = NULL; ++ } ++ } ++} ++ ++static int ___alloc_pages_bulk(struct page **pages, int nr_pages) ++{ ++ unsigned long nr_populated, nr_total = nr_pages; ++ struct page **page_array = pages; ++ ++ while (nr_pages) { ++ nr_populated = alloc_pages_bulk(GFP_KERNEL, nr_pages, pages); ++ if (!nr_populated) { ++ ___free_pages_bulk(page_array, nr_total - nr_pages); ++ return -ENOMEM; ++ } ++ pages += nr_populated; ++ nr_pages -= nr_populated; ++ } ++ + return 0; + } + ++static int __kasan_populate_vmalloc(unsigned long start, unsigned long end) ++{ ++ unsigned long nr_pages, nr_total = PFN_UP(end - start); ++ struct vmalloc_populate_data data; ++ int ret = 0; ++ ++ data.pages = (struct page **)__get_free_page(GFP_KERNEL | __GFP_ZERO); ++ if (!data.pages) ++ return -ENOMEM; ++ ++ while (nr_total) { ++ nr_pages = min(nr_total, PAGE_SIZE / sizeof(data.pages[0])); ++ ret = ___alloc_pages_bulk(data.pages, nr_pages); ++ if (ret) ++ break; ++ ++ data.start = start; ++ ret = apply_to_page_range(&init_mm, start, nr_pages * PAGE_SIZE, ++ kasan_populate_vmalloc_pte, &data); ++ ___free_pages_bulk(data.pages, nr_pages); ++ if (ret) ++ break; ++ ++ start += nr_pages * PAGE_SIZE; ++ nr_total -= nr_pages; ++ } ++ ++ free_page((unsigned long)data.pages); ++ ++ return ret; ++} ++ + int kasan_populate_vmalloc(unsigned long addr, unsigned long size) + { + unsigned long shadow_start, shadow_end; +@@ -367,9 +433,7 @@ int kasan_populate_vmalloc(unsigned long addr, unsigned long size) + shadow_start = PAGE_ALIGN_DOWN(shadow_start); + shadow_end = PAGE_ALIGN(shadow_end); + +- ret = apply_to_page_range(&init_mm, shadow_start, +- shadow_end - shadow_start, +- kasan_populate_vmalloc_pte, NULL); ++ ret = __kasan_populate_vmalloc(shadow_start, shadow_end); + if (ret) + return ret; + +-- +2.39.5 + diff --git a/queue-6.6/kasan-use-unchecked-__memset-internally.patch b/queue-6.6/kasan-use-unchecked-__memset-internally.patch new file mode 100644 index 0000000000..62da009c5c --- /dev/null +++ b/queue-6.6/kasan-use-unchecked-__memset-internally.patch @@ -0,0 +1,69 @@ +From cca024d7c31186672372370524b46783bd5d2bf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 17:18:44 +0200 +Subject: kasan: use unchecked __memset internally + +From: Andrey Konovalov + +[ Upstream commit 01a5ad81637672940844052404678678a0ec8854 ] + +KASAN code is supposed to use the unchecked __memset implementation when +accessing its metadata. + +Change uses of memset to __memset in mm/kasan/. + +Link: https://lkml.kernel.org/r/6f621966c6f52241b5aaa7220c348be90c075371.1696605143.git.andreyknvl@google.com +Fixes: 59e6e098d1c1 ("kasan: introduce kasan_complete_mode_report_info") +Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") +Signed-off-by: Andrey Konovalov +Reviewed-by: Marco Elver +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Dmitry Vyukov +Cc: kernel test robot +Signed-off-by: Andrew Morton +Stable-dep-of: b6ea95a34cbd ("kasan: avoid sleepable page allocation from atomic context") +Signed-off-by: Sasha Levin +--- + mm/kasan/report.c | 4 ++-- + mm/kasan/shadow.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/mm/kasan/report.c b/mm/kasan/report.c +index ecced40e51032..465e6a53b3bf2 100644 +--- a/mm/kasan/report.c ++++ b/mm/kasan/report.c +@@ -538,7 +538,7 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty + + start_report(&flags, true); + +- memset(&info, 0, sizeof(info)); ++ __memset(&info, 0, sizeof(info)); + info.type = type; + info.access_addr = ptr; + info.access_size = 0; +@@ -576,7 +576,7 @@ bool kasan_report(const void *addr, size_t size, bool is_write, + + start_report(&irq_flags, true); + +- memset(&info, 0, sizeof(info)); ++ __memset(&info, 0, sizeof(info)); + info.type = KASAN_REPORT_ACCESS; + info.access_addr = addr; + info.access_size = size; +diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c +index dd772f9d0f080..d687f09a7ae37 100644 +--- a/mm/kasan/shadow.c ++++ b/mm/kasan/shadow.c +@@ -324,7 +324,7 @@ static int kasan_populate_vmalloc_pte(pte_t *ptep, unsigned long addr, + if (!page) + return -ENOMEM; + +- memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); ++ __memset((void *)page, KASAN_VMALLOC_INVALID, PAGE_SIZE); + pte = pfn_pte(PFN_DOWN(__pa(page)), PAGE_KERNEL); + + spin_lock(&init_mm.page_table_lock); +-- +2.39.5 + diff --git a/queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch b/queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch new file mode 100644 index 0000000000..018c05197d --- /dev/null +++ b/queue-6.6/net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch @@ -0,0 +1,98 @@ +From 647381dbd54840732fa1f9d3f61c39a5196ffbf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 May 2025 09:29:19 +0200 +Subject: net: dsa: microchip: linearize skb for tail-tagging switches + +From: Jakob Unterwurzacher + +[ Upstream commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 ] + +The pointer arithmentic for accessing the tail tag only works +for linear skbs. + +For nonlinear skbs, it reads uninitialized memory inside the +skb headroom, essentially randomizing the tag. I have observed +it gets set to 6 most of the time. + +Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6 +(which does not exist for the ksz9896 that's in use), dropping the packet. +Debug prints added by me (not included in this patch): + + [ 256.645337] ksz9477_rcv:323 tag0=6 + [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0 + mac=(64,14) mac_len=14 net=(78,0) trans=78 + shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) + csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0) + hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3 + priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0 + encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) + [ 256.645377] dev name=end1 feat=0x0002e10200114bb3 + [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06 + [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02 + [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00 + [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 + [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL + +Call skb_linearize before trying to access the tag. + +This patch fixes ksz9477_rcv which is used by the ksz9896 I have at +hand, and also applies the same fix to ksz8795_rcv which seems to have +the same problem. + +Signed-off-by: Jakob Unterwurzacher +CC: stable@vger.kernel.org +Fixes: 016e43a26bab ("net: dsa: ksz: Add KSZ8795 tag code") +Fixes: 8b8010fb7876 ("dsa: add support for Microchip KSZ tail tagging") +Reviewed-by: Vladimir Oltean +Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dsa/tag_ksz.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c +index 7bf87fa471a0c..0a16c04c4bfc4 100644 +--- a/net/dsa/tag_ksz.c ++++ b/net/dsa/tag_ksz.c +@@ -139,7 +139,12 @@ static struct sk_buff *ksz8795_xmit(struct sk_buff *skb, struct net_device *dev) + + static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev) + { +- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; ++ u8 *tag; ++ ++ if (skb_linearize(skb)) ++ return NULL; ++ ++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; + + return ksz_common_rcv(skb, dev, tag[0] & 7, KSZ_EGRESS_TAG_LEN); + } +@@ -301,10 +306,16 @@ static struct sk_buff *ksz9477_xmit(struct sk_buff *skb, + + static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev) + { +- /* Tag decoding */ +- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; +- unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; + unsigned int len = KSZ_EGRESS_TAG_LEN; ++ unsigned int port; ++ u8 *tag; ++ ++ if (skb_linearize(skb)) ++ return NULL; ++ ++ /* Tag decoding */ ++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; ++ port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; + + /* Extra 4-bytes PTP timestamp */ + if (tag[0] & KSZ9477_PTP_TAG_INDICATION) { +-- +2.39.5 + diff --git a/queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch b/queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch new file mode 100644 index 0000000000..d1adc2f79f --- /dev/null +++ b/queue-6.6/net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch @@ -0,0 +1,49 @@ +From 2123154cd68a07242d7203174814afb18ca32ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:42:59 +0200 +Subject: net: dsa: microchip: update tag_ksz masks for KSZ9477 family + +From: Pieter Van Trappen + +[ Upstream commit 3f464b193d40e49299dcd087b10cc3b77cbbea68 ] + +Remove magic number 7 by introducing a GENMASK macro instead. +Remove magic number 0x80 by using the BIT macro instead. + +Signed-off-by: Pieter Van Trappen +Reviewed-by: Florian Fainelli +Link: https://patch.msgid.link/20240909134301.75448-1-vtpieter@gmail.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: ba54bce747fa ("net: dsa: microchip: linearize skb for tail-tagging switches") +Signed-off-by: Sasha Levin +--- + net/dsa/tag_ksz.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c +index ea100bd25939b..7bf87fa471a0c 100644 +--- a/net/dsa/tag_ksz.c ++++ b/net/dsa/tag_ksz.c +@@ -176,8 +176,9 @@ MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_KSZ8795, KSZ8795_NAME); + + #define KSZ9477_INGRESS_TAG_LEN 2 + #define KSZ9477_PTP_TAG_LEN 4 +-#define KSZ9477_PTP_TAG_INDICATION 0x80 ++#define KSZ9477_PTP_TAG_INDICATION BIT(7) + ++#define KSZ9477_TAIL_TAG_EG_PORT_M GENMASK(2, 0) + #define KSZ9477_TAIL_TAG_PRIO GENMASK(8, 7) + #define KSZ9477_TAIL_TAG_OVERRIDE BIT(9) + #define KSZ9477_TAIL_TAG_LOOKUP BIT(10) +@@ -302,7 +303,7 @@ static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev) + { + /* Tag decoding */ + u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN; +- unsigned int port = tag[0] & 7; ++ unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M; + unsigned int len = KSZ_EGRESS_TAG_LEN; + + /* Extra 4-bytes PTP timestamp */ +-- +2.39.5 + diff --git a/queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch b/queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch new file mode 100644 index 0000000000..30076d8d6b --- /dev/null +++ b/queue-6.6/pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch @@ -0,0 +1,43 @@ +From d244a094a0cc50f074b309776ec38844683a1d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 09:29:23 +0300 +Subject: pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id() + +From: Dan Carpenter + +[ Upstream commit 0f5757667ec0aaf2456c3b76fcf0c6c3ea3591fe ] + +The error checking for of_count_phandle_with_args() does not handle +negative error codes correctly. The problem is that "index" is a u32 so +in the condition "if (index >= num_domains)" negative error codes stored +in "num_domains" are type promoted to very high positive values and +"index" is always going to be valid. + +Test for negative error codes first and then test if "index" is valid. + +Fixes: 3ccf3f0cd197 ("PM / Domains: Enable genpd_dev_pm_attach_by_id|name() for single PM domain") +Signed-off-by: Dan Carpenter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/aBxPQ8AI8N5v-7rL@stanley.mountain +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index d9d339b8b5710..d1dae47f3534b 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2856,7 +2856,7 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev, + /* Verify that the index is within a valid range. */ + num_domains = of_count_phandle_with_args(dev->of_node, "power-domains", + "#power-domain-cells"); +- if (index >= num_domains) ++ if (num_domains < 0 || index >= num_domains) + return NULL; + + /* Allocate and register device on the genpd bus. */ +-- +2.39.5 + diff --git a/queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch b/queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch new file mode 100644 index 0000000000..3a3ece27e3 --- /dev/null +++ b/queue-6.6/serial-sh-sci-check-if-tx-data-was-written-to-device.patch @@ -0,0 +1,155 @@ +From d31b1e0f0c90cd294160a4e673334b7505a8fd0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 08:05:49 +0300 +Subject: serial: sh-sci: Check if TX data was written to device in .tx_empty() + +From: Claudiu Beznea + +commit 7cc0e0a43a91052477c2921f924a37d9c3891f0c upstream. + +On the Renesas RZ/G3S, when doing suspend to RAM, the uart_suspend_port() +is called. The uart_suspend_port() calls 3 times the +struct uart_port::ops::tx_empty() before shutting down the port. + +According to the documentation, the struct uart_port::ops::tx_empty() +API tests whether the transmitter FIFO and shifter for the port is +empty. + +The Renesas RZ/G3S SCIFA IP reports the number of data units stored in the +transmit FIFO through the FDR (FIFO Data Count Register). The data units +in the FIFOs are written in the shift register and transmitted from there. +The TEND bit in the Serial Status Register reports if the data was +transmitted from the shift register. + +In the previous code, in the tx_empty() API implemented by the sh-sci +driver, it is considered that the TX is empty if the hardware reports the +TEND bit set and the number of data units in the FIFO is zero. + +According to the HW manual, the TEND bit has the following meaning: + +0: Transmission is in the waiting state or in progress. +1: Transmission is completed. + +It has been noticed that when opening the serial device w/o using it and +then switch to a power saving mode, the tx_empty() call in the +uart_port_suspend() function fails, leading to the "Unable to drain +transmitter" message being printed on the console. This is because the +TEND=0 if nothing has been transmitted and the FIFOs are empty. As the +TEND=0 has double meaning (waiting state, in progress) we can't +determined the scenario described above. + +Add a software workaround for this. This sets a variable if any data has +been sent on the serial console (when using PIO) or if the DMA callback has +been called (meaning something has been transmitted). In the tx_empty() +API the status of the DMA transaction is also checked and if it is +completed or in progress the code falls back in checking the hardware +registers instead of relying on the software variable. + +Fixes: 73a19e4c0301 ("serial: sh-sci: Add DMA support.") +Cc: stable@vger.kernel.org +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20241125115856.513642-1-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +[claudiu.beznea: fixed conflict by: + - keeping serial_port_out() instead of sci_port_out() in + sci_transmit_chars() + - keeping !uart_circ_empty(xmit) condition in sci_dma_tx_complete(), + after s->tx_occurred = true; assignement] +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 61d8f50676b1b..d57fa80b6f52a 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -174,6 +174,7 @@ struct sci_port { + + bool has_rtscts; + bool autorts; ++ bool tx_occurred; + }; + + #define SCI_NPORTS CONFIG_SERIAL_SH_SCI_NR_UARTS +@@ -838,6 +839,7 @@ static void sci_transmit_chars(struct uart_port *port) + { + struct circ_buf *xmit = &port->state->xmit; + unsigned int stopped = uart_tx_stopped(port); ++ struct sci_port *s = to_sci_port(port); + unsigned short status; + unsigned short ctrl; + int count; +@@ -874,6 +876,7 @@ static void sci_transmit_chars(struct uart_port *port) + } + + serial_port_out(port, SCxTDR, c); ++ s->tx_occurred = true; + + port->icount.tx++; + } while (--count > 0); +@@ -1230,6 +1233,8 @@ static void sci_dma_tx_complete(void *arg) + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); + ++ s->tx_occurred = true; ++ + if (!uart_circ_empty(xmit)) { + s->cookie_tx = 0; + schedule_work(&s->work_tx); +@@ -1719,6 +1724,19 @@ static void sci_flush_buffer(struct uart_port *port) + s->cookie_tx = -EINVAL; + } + } ++ ++static void sci_dma_check_tx_occurred(struct sci_port *s) ++{ ++ struct dma_tx_state state; ++ enum dma_status status; ++ ++ if (!s->chan_tx) ++ return; ++ ++ status = dmaengine_tx_status(s->chan_tx, s->cookie_tx, &state); ++ if (status == DMA_COMPLETE || status == DMA_IN_PROGRESS) ++ s->tx_occurred = true; ++} + #else /* !CONFIG_SERIAL_SH_SCI_DMA */ + static inline void sci_request_dma(struct uart_port *port) + { +@@ -1728,6 +1746,10 @@ static inline void sci_free_dma(struct uart_port *port) + { + } + ++static void sci_dma_check_tx_occurred(struct sci_port *s) ++{ ++} ++ + #define sci_flush_buffer NULL + #endif /* !CONFIG_SERIAL_SH_SCI_DMA */ + +@@ -2064,6 +2086,12 @@ static unsigned int sci_tx_empty(struct uart_port *port) + { + unsigned short status = serial_port_in(port, SCxSR); + unsigned short in_tx_fifo = sci_txfill(port); ++ struct sci_port *s = to_sci_port(port); ++ ++ sci_dma_check_tx_occurred(s); ++ ++ if (!s->tx_occurred) ++ return TIOCSER_TEMT; + + return (status & SCxSR_TEND(port)) && !in_tx_fifo ? TIOCSER_TEMT : 0; + } +@@ -2234,6 +2262,7 @@ static int sci_startup(struct uart_port *port) + + dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); + ++ s->tx_occurred = false; + sci_request_dma(port); + + ret = sci_request_irq(s); +-- +2.39.5 + diff --git a/queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch b/queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch new file mode 100644 index 0000000000..2925d34a9e --- /dev/null +++ b/queue-6.6/serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch @@ -0,0 +1,125 @@ +From c4dca2f6b2c2e990d88097d443262e04a638b6e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 08:05:51 +0300 +Subject: serial: sh-sci: Clean sci_ports[0] after at earlycon exit + +From: Claudiu Beznea + +commit 5f1017069933489add0c08659673443c9905659e upstream. + +The early_console_setup() function initializes sci_ports[0].port with an +object of type struct uart_port obtained from the struct earlycon_device +passed as an argument to early_console_setup(). + +Later, during serial port probing, the serial port used as earlycon +(e.g., port A) might be remapped to a different position in the sci_ports[] +array, and a different serial port (e.g., port B) might be assigned to slot +0. For example: + +sci_ports[0] = port B +sci_ports[X] = port A + +In this scenario, the new port mapped at index zero (port B) retains the +data associated with the earlycon configuration. Consequently, after the +Linux boot process, any access to the serial port now mapped to +sci_ports[0] (port B) will block the original earlycon port (port A). + +To address this, introduce an early_console_exit() function to clean up +sci_ports[0] when earlycon is exited. + +To prevent the cleanup of sci_ports[0] while the serial device is still +being used by earlycon, introduce the struct sci_port::probing flag and +account for it in early_console_exit(). + +Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support") +Cc: stable@vger.kernel.org +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20250116182249.3828577-5-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 32 ++++++++++++++++++++++++++++++-- + 1 file changed, 30 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 0071cb3043e14..be7e57e1d1e36 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -183,6 +183,7 @@ static struct sci_port sci_ports[SCI_NPORTS]; + static unsigned long sci_ports_in_use; + static struct uart_driver sci_uart_driver; + static bool sci_uart_earlycon; ++static bool sci_uart_earlycon_dev_probing; + + static inline struct sci_port * + to_sci_port(struct uart_port *uart) +@@ -3374,7 +3375,8 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev, + static int sci_probe_single(struct platform_device *dev, + unsigned int index, + struct plat_sci_port *p, +- struct sci_port *sciport) ++ struct sci_port *sciport, ++ struct resource *sci_res) + { + int ret; + +@@ -3421,6 +3423,14 @@ static int sci_probe_single(struct platform_device *dev, + sciport->port.flags |= UPF_HARD_FLOW; + } + ++ if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) { ++ /* ++ * Skip cleanup the sci_port[0] in early_console_exit(), this ++ * port is the same as the earlycon one. ++ */ ++ sci_uart_earlycon_dev_probing = true; ++ } ++ + return uart_add_one_port(&sci_uart_driver, &sciport->port); + } + +@@ -3479,7 +3489,7 @@ static int sci_probe(struct platform_device *dev) + + platform_set_drvdata(dev, sp); + +- ret = sci_probe_single(dev, dev_id, p, sp); ++ ret = sci_probe_single(dev, dev_id, p, sp, res); + if (ret) + return ret; + +@@ -3636,6 +3646,22 @@ sh_early_platform_init_buffer("earlyprintk", &sci_driver, + #ifdef CONFIG_SERIAL_SH_SCI_EARLYCON + static struct plat_sci_port port_cfg; + ++static int early_console_exit(struct console *co) ++{ ++ struct sci_port *sci_port = &sci_ports[0]; ++ ++ /* ++ * Clean the slot used by earlycon. A new SCI device might ++ * map to this slot. ++ */ ++ if (!sci_uart_earlycon_dev_probing) { ++ memset(sci_port, 0, sizeof(*sci_port)); ++ sci_uart_earlycon = false; ++ } ++ ++ return 0; ++} ++ + static int __init early_console_setup(struct earlycon_device *device, + int type) + { +@@ -3655,6 +3681,8 @@ static int __init early_console_setup(struct earlycon_device *device, + SCSCR_RE | SCSCR_TE | port_cfg.scscr); + + device->con->write = serial_console_write; ++ device->con->exit = early_console_exit; ++ + return 0; + } + static int __init sci_early_console_setup(struct earlycon_device *device, +-- +2.39.5 + diff --git a/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch b/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch new file mode 100644 index 0000000000..a7ac0bf51a --- /dev/null +++ b/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch @@ -0,0 +1,92 @@ +From 124c1b6097fb77fa32c2202976d004cf8d9269a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 08:05:52 +0300 +Subject: serial: sh-sci: Increment the runtime usage counter for the earlycon + device + +From: Claudiu Beznea + +commit 651dee03696e1dfde6d9a7e8664bbdcd9a10ea7f upstream. + +In the sh-sci driver, serial ports are mapped to the sci_ports[] array, +with earlycon mapped at index zero. + +The uart_add_one_port() function eventually calls __device_attach(), +which, in turn, calls pm_request_idle(). The identified code path is as +follows: + +uart_add_one_port() -> + serial_ctrl_register_port() -> + serial_core_register_port() -> + serial_core_port_device_add() -> + serial_base_port_add() -> + device_add() -> + bus_probe_device() -> + device_initial_probe() -> + __device_attach() -> + // ... + if (dev->p->dead) { + // ... + } else if (dev->driver) { + // ... + } else { + // ... + pm_request_idle(dev); + // ... + } + +The earlycon device clocks are enabled by the bootloader. However, the +pm_request_idle() call in __device_attach() disables the SCI port clocks +while earlycon is still active. + +The earlycon write function, serial_console_write(), calls +sci_poll_put_char() via serial_console_putchar(). If the SCI port clocks +are disabled, writing to earlycon may sometimes cause the SR.TDFE bit to +remain unset indefinitely, causing the while loop in sci_poll_put_char() +to never exit. On single-core SoCs, this can result in the system being +blocked during boot when this issue occurs. + +To resolve this, increment the runtime PM usage counter for the earlycon +SCI device before registering the UART port. + +Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support") +Cc: stable@vger.kernel.org +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20250116182249.3828577-6-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index be7e57e1d1e36..dab5658d9d54a 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -3424,6 +3424,22 @@ static int sci_probe_single(struct platform_device *dev, + } + + if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) { ++ /* ++ * In case: ++ * - this is the earlycon port (mapped on index 0 in sci_ports[]) and ++ * - it now maps to an alias other than zero and ++ * - the earlycon is still alive (e.g., "earlycon keep_bootcon" is ++ * available in bootargs) ++ * ++ * we need to avoid disabling clocks and PM domains through the runtime ++ * PM APIs called in __device_attach(). For this, increment the runtime ++ * PM reference counter (the clocks and PM domains were already enabled ++ * by the bootloader). Otherwise the earlycon may access the HW when it ++ * has no clocks enabled leading to failures (infinite loop in ++ * sci_poll_put_char()). ++ */ ++ pm_runtime_get_noresume(&dev->dev); ++ + /* + * Skip cleanup the sci_port[0] in early_console_exit(), this + * port is the same as the earlycon one. +-- +2.39.5 + diff --git a/queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch b/queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch new file mode 100644 index 0000000000..6f8e29a174 --- /dev/null +++ b/queue-6.6/serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch @@ -0,0 +1,93 @@ +From 86b7e81e96a0e781cc55125085522228bc3a6615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 08:05:50 +0300 +Subject: serial: sh-sci: Move runtime PM enable to sci_probe_single() + +From: Claudiu Beznea + +commit 239f11209e5f282e16f5241b99256e25dd0614b6 upstream. + +Relocate the runtime PM enable operation to sci_probe_single(). This change +prepares the codebase for upcoming fixes. + +While at it, replace the existing logic with a direct call to +devm_pm_runtime_enable() and remove sci_cleanup_single(). The +devm_pm_runtime_enable() function automatically handles disabling runtime +PM during driver removal. + +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20250116182249.3828577-3-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 24 ++++++------------------ + 1 file changed, 6 insertions(+), 18 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index d57fa80b6f52a..0071cb3043e14 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -3043,10 +3043,6 @@ static int sci_init_single(struct platform_device *dev, + ret = sci_init_clocks(sci_port, &dev->dev); + if (ret < 0) + return ret; +- +- port->dev = &dev->dev; +- +- pm_runtime_enable(&dev->dev); + } + + port->type = p->type; +@@ -3076,11 +3072,6 @@ static int sci_init_single(struct platform_device *dev, + return 0; + } + +-static void sci_cleanup_single(struct sci_port *port) +-{ +- pm_runtime_disable(port->port.dev); +-} +- + #if defined(CONFIG_SERIAL_SH_SCI_CONSOLE) || \ + defined(CONFIG_SERIAL_SH_SCI_EARLYCON) + static void serial_console_putchar(struct uart_port *port, unsigned char ch) +@@ -3250,8 +3241,6 @@ static int sci_remove(struct platform_device *dev) + sci_ports_in_use &= ~BIT(port->port.line); + uart_remove_one_port(&sci_uart_driver, &port->port); + +- sci_cleanup_single(port); +- + if (port->port.fifosize > 1) + device_remove_file(&dev->dev, &dev_attr_rx_fifo_trigger); + if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) +@@ -3414,6 +3403,11 @@ static int sci_probe_single(struct platform_device *dev, + if (ret) + return ret; + ++ sciport->port.dev = &dev->dev; ++ ret = devm_pm_runtime_enable(&dev->dev); ++ if (ret) ++ return ret; ++ + sciport->gpios = mctrl_gpio_init(&sciport->port, 0); + if (IS_ERR(sciport->gpios)) + return PTR_ERR(sciport->gpios); +@@ -3427,13 +3421,7 @@ static int sci_probe_single(struct platform_device *dev, + sciport->port.flags |= UPF_HARD_FLOW; + } + +- ret = uart_add_one_port(&sci_uart_driver, &sciport->port); +- if (ret) { +- sci_cleanup_single(sciport); +- return ret; +- } +- +- return 0; ++ return uart_add_one_port(&sci_uart_driver, &sciport->port); + } + + static int sci_probe(struct platform_device *dev) +-- +2.39.5 + diff --git a/queue-6.6/series b/queue-6.6/series index ca5c2d33b2..a5d4ad11a6 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -274,3 +274,18 @@ asoc-ti-omap-hdmi-re-add-dai_link-platform-to-fix-ca.patch path_overmount-avoid-false-negatives.patch fix-propagation-graph-breakage-by-move_mount_set_gro.patch do_change_type-refuse-to-operate-on-unmounted-not-ou.patch +net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-f.patch +net-dsa-microchip-linearize-skb-for-tail-tagging-swi.patch +pmdomain-core-fix-error-checking-in-genpd_dev_pm_att.patch +input-synaptics-rmi-fix-crash-with-unsupported-versi.patch +kasan-use-unchecked-__memset-internally.patch +kasan-avoid-sleepable-page-allocation-from-atomic-co.patch +arm64-dts-ti-k3-am65-main-fix-sdhci-node-properties.patch +arm64-dts-ti-k3-am65-main-add-missing-taps-to-sdhci0.patch +arm64-dts-ti-k3-j721e-sk-model-csi2rx-connector-mux.patch +arm64-dts-ti-k3-j721e-sk-add-support-for-multiple-ca.patch +arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch +serial-sh-sci-check-if-tx-data-was-written-to-device.patch +serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch +serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch +serial-sh-sci-increment-the-runtime-usage-counter-fo.patch