From: Greg Kroah-Hartman Date: Fri, 27 Dec 2024 16:08:59 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.1.123~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b941703b079e3a13b50e11abbe043dc523ee9cf7;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch dmaengine-dw-select-only-supported-masters-for-acpi-devices.patch dmaengine-mv_xor-fix-child-node-refcount-handling-in-early-exit.patch dmaengine-tegra-return-correct-dma-status-when-paused.patch mtd-rawnand-arasan-fix-double-assertion-of-chip-select.patch mtd-rawnand-arasan-fix-missing-de-registration-of-nand.patch mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch phy-core-fix-an-of-node-refcount-leakage-in-_of_phy_get.patch phy-core-fix-an-of-node-refcount-leakage-in-of_phy_provider_lookup.patch phy-core-fix-that-api-devm_of_phy_provider_unregister-fails-to-unregister-the-phy-provider.patch phy-core-fix-that-api-devm_phy_destroy-fails-to-destroy-the-phy.patch phy-core-fix-that-api-devm_phy_put-fails-to-release-the-phy.patch phy-qcom-qmp-fix-register-name-in-rx-lane-config-of-sc8280xp.patch phy-rockchip-naneng-combphy-fix-phy-reset.patch phy-usb-toggle-the-phy-power-during-init.patch --- diff --git a/queue-6.1/dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch b/queue-6.1/dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch new file mode 100644 index 00000000000..259d2e857d8 --- /dev/null +++ b/queue-6.1/dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch @@ -0,0 +1,47 @@ +From 8d55e8a16f019211163f1180fd9f9fbe05901900 Mon Sep 17 00:00:00 2001 +From: Sasha Finkelstein +Date: Sun, 24 Nov 2024 16:48:28 +0100 +Subject: dmaengine: apple-admac: Avoid accessing registers in probe + +From: Sasha Finkelstein + +commit 8d55e8a16f019211163f1180fd9f9fbe05901900 upstream. + +The ADMAC attached to the AOP has complex power sequencing, and is +power gated when the probe callback runs. Move the register reads +to other functions, where we can guarantee that the hardware is +switched on. + +Fixes: 568aa6dd641f ("dmaengine: apple-admac: Allocate cache SRAM to channels") +Signed-off-by: Sasha Finkelstein +Link: https://lore.kernel.org/r/20241124-admac-power-v1-1-58f2165a4d55@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/apple-admac.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/dma/apple-admac.c ++++ b/drivers/dma/apple-admac.c +@@ -152,6 +152,8 @@ static int admac_alloc_sram_carveout(str + { + struct admac_sram *sram; + int i, ret = 0, nblocks; ++ ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE); ++ ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE); + + if (dir == DMA_MEM_TO_DEV) + sram = &ad->txcache; +@@ -911,12 +913,7 @@ static int admac_probe(struct platform_d + goto free_irq; + } + +- ad->txcache.size = readl_relaxed(ad->base + REG_TX_SRAM_SIZE); +- ad->rxcache.size = readl_relaxed(ad->base + REG_RX_SRAM_SIZE); +- + dev_info(&pdev->dev, "Audio DMA Controller\n"); +- dev_info(&pdev->dev, "imprint %x TX cache %u RX cache %u\n", +- readl_relaxed(ad->base + REG_IMPRINT), ad->txcache.size, ad->rxcache.size); + + return 0; + diff --git a/queue-6.1/dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch b/queue-6.1/dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch new file mode 100644 index 00000000000..3c6fb4c6c41 --- /dev/null +++ b/queue-6.1/dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch @@ -0,0 +1,34 @@ +From c43ec96e8d34399bd9dab2f2dc316b904892133f Mon Sep 17 00:00:00 2001 +From: Chen Ridong +Date: Tue, 29 Oct 2024 08:28:45 +0000 +Subject: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset + +From: Chen Ridong + +commit c43ec96e8d34399bd9dab2f2dc316b904892133f upstream. + +The at_xdmac_memset_create_desc may return NULL, which will lead to a +null pointer dereference. For example, the len input is error, or the +atchan->free_descs_list is empty and memory is exhausted. Therefore, add +check to avoid this. + +Fixes: b206d9a23ac7 ("dmaengine: xdmac: Add memset support") +Signed-off-by: Chen Ridong +Link: https://lore.kernel.org/r/20241029082845.1185380-1-chenridong@huaweicloud.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_xdmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1287,6 +1287,8 @@ at_xdmac_prep_dma_memset(struct dma_chan + return NULL; + + desc = at_xdmac_memset_create_desc(chan, atchan, dest, len, value); ++ if (!desc) ++ return NULL; + list_add_tail(&desc->desc_node, &desc->descs_list); + + desc->tx_dma_desc.cookie = -EBUSY; diff --git a/queue-6.1/dmaengine-dw-select-only-supported-masters-for-acpi-devices.patch b/queue-6.1/dmaengine-dw-select-only-supported-masters-for-acpi-devices.patch new file mode 100644 index 00000000000..8d61ed6d471 --- /dev/null +++ b/queue-6.1/dmaengine-dw-select-only-supported-masters-for-acpi-devices.patch @@ -0,0 +1,124 @@ +From f0e870a0e9c5521f2952ea9f3ea9d3d122631a89 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 4 Nov 2024 11:50:50 +0200 +Subject: dmaengine: dw: Select only supported masters for ACPI devices + +From: Andy Shevchenko + +commit f0e870a0e9c5521f2952ea9f3ea9d3d122631a89 upstream. + +The recently submitted fix-commit revealed a problem in the iDMA 32-bit +platform code. Even though the controller supported only a single master +the dw_dma_acpi_filter() method hard-coded two master interfaces with IDs +0 and 1. As a result the sanity check implemented in the commit +b336268dde75 ("dmaengine: dw: Add peripheral bus width verification") +got incorrect interface data width and thus prevented the client drivers +from configuring the DMA-channel with the EINVAL error returned. E.g., +the next error was printed for the PXA2xx SPI controller driver trying +to configure the requested channels: + +> [ 164.525604] pxa2xx_spi_pci 0000:00:07.1: DMA slave config failed +> [ 164.536105] pxa2xx_spi_pci 0000:00:07.1: failed to get DMA TX descriptor +> [ 164.543213] spidev spi-SPT0001:00: SPI transfer failed: -16 + +The problem would have been spotted much earlier if the iDMA 32-bit +controller supported more than one master interfaces. But since it +supports just a single master and the iDMA 32-bit specific code just +ignores the master IDs in the CTLLO preparation method, the issue has +been gone unnoticed so far. + +Fix the problem by specifying the default master ID for both memory +and peripheral devices in the driver data. Thus the issue noticed for +the iDMA 32-bit controllers will be eliminated and the ACPI-probed +DW DMA controllers will be configured with the correct master ID by +default. + +Cc: stable@vger.kernel.org +Fixes: b336268dde75 ("dmaengine: dw: Add peripheral bus width verification") +Fixes: 199244d69458 ("dmaengine: dw: add support of iDMA 32-bit hardware") +Reported-by: Ferry Toth +Closes: https://lore.kernel.org/dmaengine/ZuXbCKUs1iOqFu51@black.fi.intel.com/ +Reported-by: Andy Shevchenko +Closes: https://lore.kernel.org/dmaengine/ZuXgI-VcHpMgbZ91@black.fi.intel.com/ +Tested-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20241104095142.157925-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dw/acpi.c | 6 ++++-- + drivers/dma/dw/internal.h | 8 ++++++++ + drivers/dma/dw/pci.c | 4 ++-- + 3 files changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/dma/dw/acpi.c ++++ b/drivers/dma/dw/acpi.c +@@ -8,13 +8,15 @@ + + static bool dw_dma_acpi_filter(struct dma_chan *chan, void *param) + { ++ struct dw_dma *dw = to_dw_dma(chan->device); ++ struct dw_dma_chip_pdata *data = dev_get_drvdata(dw->dma.dev); + struct acpi_dma_spec *dma_spec = param; + struct dw_dma_slave slave = { + .dma_dev = dma_spec->dev, + .src_id = dma_spec->slave_id, + .dst_id = dma_spec->slave_id, +- .m_master = 0, +- .p_master = 1, ++ .m_master = data->m_master, ++ .p_master = data->p_master, + }; + + return dw_dma_filter(chan, &slave); +--- a/drivers/dma/dw/internal.h ++++ b/drivers/dma/dw/internal.h +@@ -51,11 +51,15 @@ struct dw_dma_chip_pdata { + int (*probe)(struct dw_dma_chip *chip); + int (*remove)(struct dw_dma_chip *chip); + struct dw_dma_chip *chip; ++ u8 m_master; ++ u8 p_master; + }; + + static __maybe_unused const struct dw_dma_chip_pdata dw_dma_chip_pdata = { + .probe = dw_dma_probe, + .remove = dw_dma_remove, ++ .m_master = 0, ++ .p_master = 1, + }; + + static const struct dw_dma_platform_data idma32_pdata = { +@@ -72,6 +76,8 @@ static __maybe_unused const struct dw_dm + .pdata = &idma32_pdata, + .probe = idma32_dma_probe, + .remove = idma32_dma_remove, ++ .m_master = 0, ++ .p_master = 0, + }; + + static const struct dw_dma_platform_data xbar_pdata = { +@@ -88,6 +94,8 @@ static __maybe_unused const struct dw_dm + .pdata = &xbar_pdata, + .probe = idma32_dma_probe, + .remove = idma32_dma_remove, ++ .m_master = 0, ++ .p_master = 0, + }; + + #endif /* _DMA_DW_INTERNAL_H */ +--- a/drivers/dma/dw/pci.c ++++ b/drivers/dma/dw/pci.c +@@ -56,10 +56,10 @@ static int dw_pci_probe(struct pci_dev * + if (ret) + return ret; + +- dw_dma_acpi_controller_register(chip->dw); +- + pci_set_drvdata(pdev, data); + ++ dw_dma_acpi_controller_register(chip->dw); ++ + return 0; + } + diff --git a/queue-6.1/dmaengine-mv_xor-fix-child-node-refcount-handling-in-early-exit.patch b/queue-6.1/dmaengine-mv_xor-fix-child-node-refcount-handling-in-early-exit.patch new file mode 100644 index 00000000000..714e7443a91 --- /dev/null +++ b/queue-6.1/dmaengine-mv_xor-fix-child-node-refcount-handling-in-early-exit.patch @@ -0,0 +1,44 @@ +From 362f1bf98a3ecb5a2a4fcbdaa9718c8403beceb2 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Fri, 11 Oct 2024 22:57:59 +0200 +Subject: dmaengine: mv_xor: fix child node refcount handling in early exit + +From: Javier Carrasco + +commit 362f1bf98a3ecb5a2a4fcbdaa9718c8403beceb2 upstream. + +The for_each_child_of_node() loop requires explicit calls to +of_node_put() to decrement the child's refcount upon early exits (break, +goto, return). + +Add the missing calls in the two early exits before the goto +instructions. + +Cc: stable@vger.kernel.org +Fixes: f7d12ef53ddf ("dma: mv_xor: add Device Tree binding") +Signed-off-by: Javier Carrasco +Link: https://lore.kernel.org/r/20241011-dma_mv_xor_of_node_put-v1-1-3c2de819f463@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/mv_xor.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -1393,6 +1393,7 @@ static int mv_xor_probe(struct platform_ + irq = irq_of_parse_and_map(np, 0); + if (!irq) { + ret = -ENODEV; ++ of_node_put(np); + goto err_channel_add; + } + +@@ -1401,6 +1402,7 @@ static int mv_xor_probe(struct platform_ + if (IS_ERR(chan)) { + ret = PTR_ERR(chan); + irq_dispose_mapping(irq); ++ of_node_put(np); + goto err_channel_add; + } + diff --git a/queue-6.1/dmaengine-tegra-return-correct-dma-status-when-paused.patch b/queue-6.1/dmaengine-tegra-return-correct-dma-status-when-paused.patch new file mode 100644 index 00000000000..f9c330ab958 --- /dev/null +++ b/queue-6.1/dmaengine-tegra-return-correct-dma-status-when-paused.patch @@ -0,0 +1,81 @@ +From ebc008699fd95701c9af5ebaeb0793eef81a71d5 Mon Sep 17 00:00:00 2001 +From: Akhil R +Date: Thu, 12 Dec 2024 18:14:12 +0530 +Subject: dmaengine: tegra: Return correct DMA status when paused + +From: Akhil R + +commit ebc008699fd95701c9af5ebaeb0793eef81a71d5 upstream. + +Currently, the driver does not return the correct DMA status when a DMA +pause is issued by the client drivers. This causes GPCDMA users to +assume that DMA is still running, while in reality, the DMA is paused. + +Return DMA_PAUSED for tx_status() if the channel is paused in the middle +of a transfer. + +Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") +Cc: stable@vger.kernel.org +Signed-off-by: Akhil R +Signed-off-by: Kartik Rajput +Link: https://lore.kernel.org/r/20241212124412.5650-1-kkartik@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/tegra186-gpc-dma.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/dma/tegra186-gpc-dma.c ++++ b/drivers/dma/tegra186-gpc-dma.c +@@ -228,6 +228,7 @@ struct tegra_dma_channel { + bool config_init; + char name[30]; + enum dma_transfer_direction sid_dir; ++ enum dma_status status; + int id; + int irq; + int slave_id; +@@ -389,6 +390,8 @@ static int tegra_dma_pause(struct tegra_ + tegra_dma_dump_chan_regs(tdc); + } + ++ tdc->status = DMA_PAUSED; ++ + return ret; + } + +@@ -415,6 +418,8 @@ static void tegra_dma_resume(struct tegr + val = tdc_read(tdc, TEGRA_GPCDMA_CHAN_CSRE); + val &= ~TEGRA_GPCDMA_CHAN_CSRE_PAUSE; + tdc_write(tdc, TEGRA_GPCDMA_CHAN_CSRE, val); ++ ++ tdc->status = DMA_IN_PROGRESS; + } + + static int tegra_dma_device_resume(struct dma_chan *dc) +@@ -540,6 +545,7 @@ static void tegra_dma_xfer_complete(stru + + tegra_dma_sid_free(tdc); + tdc->dma_desc = NULL; ++ tdc->status = DMA_COMPLETE; + } + + static void tegra_dma_chan_decode_error(struct tegra_dma_channel *tdc, +@@ -712,6 +718,7 @@ static int tegra_dma_terminate_all(struc + tdc->dma_desc = NULL; + } + ++ tdc->status = DMA_COMPLETE; + tegra_dma_sid_free(tdc); + vchan_get_all_descriptors(&tdc->vc, &head); + spin_unlock_irqrestore(&tdc->vc.lock, flags); +@@ -765,6 +772,9 @@ static enum dma_status tegra_dma_tx_stat + if (ret == DMA_COMPLETE) + return ret; + ++ if (tdc->status == DMA_PAUSED) ++ ret = DMA_PAUSED; ++ + spin_lock_irqsave(&tdc->vc.lock, flags); + vd = vchan_find_desc(&tdc->vc, cookie); + if (vd) { diff --git a/queue-6.1/mtd-rawnand-arasan-fix-double-assertion-of-chip-select.patch b/queue-6.1/mtd-rawnand-arasan-fix-double-assertion-of-chip-select.patch new file mode 100644 index 00000000000..ed35c5abce3 --- /dev/null +++ b/queue-6.1/mtd-rawnand-arasan-fix-double-assertion-of-chip-select.patch @@ -0,0 +1,47 @@ +From b086a46dae48829e11c0c02580e30d920b76743c Mon Sep 17 00:00:00 2001 +From: Maciej Andrzejewski +Date: Mon, 2 Dec 2024 13:51:07 +0100 +Subject: mtd: rawnand: arasan: Fix double assertion of chip-select + +From: Maciej Andrzejewski + +commit b086a46dae48829e11c0c02580e30d920b76743c upstream. + +When two chip-selects are configured in the device tree, and the second is +a non-native GPIO, both the GPIO-based chip-select and the first native +chip-select may be asserted simultaneously. This double assertion causes +incorrect read and write operations. + +The issue occurs because when nfc->ncs <= 2, nfc->spare_cs is always +initialized to 0 due to static initialization. Consequently, when the +second chip-select (GPIO-based) is selected in anfc_assert_cs(), it is +detected by anfc_is_gpio_cs(), and nfc->native_cs is assigned the value 0. +This results in both the GPIO-based chip-select being asserted and the +NAND controller register receiving 0, erroneously selecting the native +chip-select. + +This patch resolves the issue, as confirmed by oscilloscope testing with +configurations involving two or more chip-selects in the device tree. + +Fixes: acbd3d0945f9 ("mtd: rawnand: arasan: Leverage additional GPIO CS") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej Andrzejewski +Signed-off-by: Miquel Raynal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -1425,8 +1425,8 @@ static int anfc_parse_cs(struct arasan_n + * case, the "not" chosen CS is assigned to nfc->spare_cs and selected + * whenever a GPIO CS must be asserted. + */ +- if (nfc->cs_array && nfc->ncs > 2) { +- if (!nfc->cs_array[0] && !nfc->cs_array[1]) { ++ if (nfc->cs_array) { ++ if (nfc->ncs > 2 && !nfc->cs_array[0] && !nfc->cs_array[1]) { + dev_err(nfc->dev, + "Assign a single native CS when using GPIOs\n"); + return -EINVAL; diff --git a/queue-6.1/mtd-rawnand-arasan-fix-missing-de-registration-of-nand.patch b/queue-6.1/mtd-rawnand-arasan-fix-missing-de-registration-of-nand.patch new file mode 100644 index 00000000000..feeb59450f2 --- /dev/null +++ b/queue-6.1/mtd-rawnand-arasan-fix-missing-de-registration-of-nand.patch @@ -0,0 +1,41 @@ +From 11e6831fd81468cf48155b9b3c11295c391da723 Mon Sep 17 00:00:00 2001 +From: Maciej Andrzejewski +Date: Mon, 2 Dec 2024 19:58:36 +0100 +Subject: mtd: rawnand: arasan: Fix missing de-registration of NAND + +From: Maciej Andrzejewski + +commit 11e6831fd81468cf48155b9b3c11295c391da723 upstream. + +The NAND chip-selects are registered for the Arasan driver during +initialization but are not de-registered when the driver is unloaded. As a +result, if the driver is loaded again, the chip-selects remain registered +and busy, making them unavailable for use. + +Fixes: 197b88fecc50 ("mtd: rawnand: arasan: Add new Arasan NAND controller") +Cc: stable@vger.kernel.org +Signed-off-by: Maciej Andrzejewski ICEYE +Signed-off-by: Miquel Raynal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -1510,8 +1510,15 @@ disable_controller_clk: + + static int anfc_remove(struct platform_device *pdev) + { ++ int i; + struct arasan_nfc *nfc = platform_get_drvdata(pdev); + ++ for (i = 0; i < nfc->ncs; i++) { ++ if (nfc->cs_array[i]) { ++ gpiod_put(nfc->cs_array[i]); ++ } ++ } ++ + anfc_chips_cleanup(nfc); + + clk_disable_unprepare(nfc->bus_clk); diff --git a/queue-6.1/mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch b/queue-6.1/mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch new file mode 100644 index 00000000000..1027c415aa4 --- /dev/null +++ b/queue-6.1/mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch @@ -0,0 +1,35 @@ +From d8e4771f99c0400a1873235704b28bb803c83d17 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 23 Oct 2024 11:40:56 +0300 +Subject: mtd: rawnand: fix double free in atmel_pmecc_create_user() + +From: Dan Carpenter + +commit d8e4771f99c0400a1873235704b28bb803c83d17 upstream. + +The "user" pointer was converted from being allocated with kzalloc() to +being allocated by devm_kzalloc(). Calling kfree(user) will lead to a +double free. + +Fixes: 6d734f1bfc33 ("mtd: rawnand: atmel: Fix possible memory leak") +Signed-off-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/atmel/pmecc.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/mtd/nand/raw/atmel/pmecc.c ++++ b/drivers/mtd/nand/raw/atmel/pmecc.c +@@ -380,10 +380,8 @@ atmel_pmecc_create_user(struct atmel_pme + user->delta = user->dmu + req->ecc.strength + 1; + + gf_tables = atmel_pmecc_get_gf_tables(req); +- if (IS_ERR(gf_tables)) { +- kfree(user); ++ if (IS_ERR(gf_tables)) + return ERR_CAST(gf_tables); +- } + + user->gf_tables = gf_tables; + diff --git a/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-_of_phy_get.patch b/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-_of_phy_get.patch new file mode 100644 index 00000000000..8547011f47b --- /dev/null +++ b/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-_of_phy_get.patch @@ -0,0 +1,50 @@ +From 5ebdc6be16c2000e37fcb8b4072d442d268ad492 Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Fri, 13 Dec 2024 20:36:44 +0800 +Subject: phy: core: Fix an OF node refcount leakage in _of_phy_get() + +From: Zijun Hu + +commit 5ebdc6be16c2000e37fcb8b4072d442d268ad492 upstream. + +_of_phy_get() will directly return when suffers of_device_is_compatible() +error, but it forgets to decrease refcount of OF node @args.np before error +return, the refcount was increased by previous of_parse_phandle_with_args() +so causes the OF node's refcount leakage. + +Fix by decreasing the refcount via of_node_put() before the error return. + +Fixes: b7563e2796f8 ("phy: work around 'phys' references to usb-nop-xceiv devices") +Cc: stable@vger.kernel.org +Reviewed-by: Johan Hovold +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20241213-phy_core_fix-v6-4-40ae28f5015a@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/phy-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -575,8 +575,10 @@ static struct phy *_of_phy_get(struct de + return ERR_PTR(-ENODEV); + + /* This phy type handled by the usb-phy subsystem for now */ +- if (of_device_is_compatible(args.np, "usb-nop-xceiv")) +- return ERR_PTR(-ENODEV); ++ if (of_device_is_compatible(args.np, "usb-nop-xceiv")) { ++ phy = ERR_PTR(-ENODEV); ++ goto out_put_node; ++ } + + mutex_lock(&phy_provider_mutex); + phy_provider = of_phy_provider_lookup(args.np); +@@ -598,6 +600,7 @@ out_put_module: + + out_unlock: + mutex_unlock(&phy_provider_mutex); ++out_put_node: + of_node_put(args.np); + + return phy; diff --git a/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-of_phy_provider_lookup.patch b/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-of_phy_provider_lookup.patch new file mode 100644 index 00000000000..da8bdcb1ed2 --- /dev/null +++ b/queue-6.1/phy-core-fix-an-of-node-refcount-leakage-in-of_phy_provider_lookup.patch @@ -0,0 +1,52 @@ +From a2d633cb1421e679b56f1a9fe1f42f089706f1ed Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Fri, 13 Dec 2024 20:36:45 +0800 +Subject: phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() + +From: Zijun Hu + +commit a2d633cb1421e679b56f1a9fe1f42f089706f1ed upstream. + +For macro for_each_child_of_node(parent, child), refcount of @child has +been increased before entering its loop body, so normally needs to call +of_node_put(@child) before returning from the loop body to avoid refcount +leakage. + +of_phy_provider_lookup() has such usage but does not call of_node_put() +before returning, so cause leakage of the OF node refcount. + +Fix by simply calling of_node_put() before returning from the loop body. + +The APIs affected by this issue are shown below since they indirectly +invoke problematic of_phy_provider_lookup(). +phy_get() +of_phy_get() +devm_phy_get() +devm_of_phy_get() +devm_of_phy_get_by_index() + +Fixes: 2a4c37016ca9 ("phy: core: Fix of_phy_provider_lookup to return PHY provider for sub node") +Cc: stable@vger.kernel.org +Reviewed-by: Johan Hovold +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20241213-phy_core_fix-v6-5-40ae28f5015a@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/phy-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -138,8 +138,10 @@ static struct phy_provider *of_phy_provi + return phy_provider; + + for_each_child_of_node(phy_provider->children, child) +- if (child == node) ++ if (child == node) { ++ of_node_put(child); + return phy_provider; ++ } + } + + return ERR_PTR(-EPROBE_DEFER); diff --git a/queue-6.1/phy-core-fix-that-api-devm_of_phy_provider_unregister-fails-to-unregister-the-phy-provider.patch b/queue-6.1/phy-core-fix-that-api-devm_of_phy_provider_unregister-fails-to-unregister-the-phy-provider.patch new file mode 100644 index 00000000000..9903c2c71c4 --- /dev/null +++ b/queue-6.1/phy-core-fix-that-api-devm_of_phy_provider_unregister-fails-to-unregister-the-phy-provider.patch @@ -0,0 +1,50 @@ +From c0b82ab95b4f1fbc3e3aeab9d829d012669524b6 Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Fri, 13 Dec 2024 20:36:42 +0800 +Subject: phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider + +From: Zijun Hu + +commit c0b82ab95b4f1fbc3e3aeab9d829d012669524b6 upstream. + +For devm_of_phy_provider_unregister(), its comment says it needs to invoke +of_phy_provider_unregister() to unregister the phy provider, but it will +not actually invoke the function since devres_destroy() does not call +devm_phy_provider_release(), and the missing of_phy_provider_unregister() +call will cause: + +- The phy provider fails to be unregistered. +- Leak both memory and the OF node refcount. + +Fortunately, the faulty API has not been used by current kernel tree. +Fix by using devres_release() instead of devres_destroy() within the API. + +Fixes: ff764963479a ("drivers: phy: add generic PHY framework") +Reviewed-by: Johan Hovold +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/stable/20241213-phy_core_fix-v6-2-40ae28f5015a%40quicinc.com +Link: https://lore.kernel.org/r/20241213-phy_core_fix-v6-2-40ae28f5015a@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/phy-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -1199,12 +1199,12 @@ EXPORT_SYMBOL_GPL(of_phy_provider_unregi + * of_phy_provider_unregister to unregister the phy provider. + */ + void devm_of_phy_provider_unregister(struct device *dev, +- struct phy_provider *phy_provider) ++ struct phy_provider *phy_provider) + { + int r; + +- r = devres_destroy(dev, devm_phy_provider_release, devm_phy_match, +- phy_provider); ++ r = devres_release(dev, devm_phy_provider_release, devm_phy_match, ++ phy_provider); + dev_WARN_ONCE(dev, r, "couldn't find PHY provider device resource\n"); + } + EXPORT_SYMBOL_GPL(devm_of_phy_provider_unregister); diff --git a/queue-6.1/phy-core-fix-that-api-devm_phy_destroy-fails-to-destroy-the-phy.patch b/queue-6.1/phy-core-fix-that-api-devm_phy_destroy-fails-to-destroy-the-phy.patch new file mode 100644 index 00000000000..b2067300390 --- /dev/null +++ b/queue-6.1/phy-core-fix-that-api-devm_phy_destroy-fails-to-destroy-the-phy.patch @@ -0,0 +1,38 @@ +From 4dc48c88fcf82b89fdebd83a906aaa64f40fb8a9 Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Fri, 13 Dec 2024 20:36:43 +0800 +Subject: phy: core: Fix that API devm_phy_destroy() fails to destroy the phy + +From: Zijun Hu + +commit 4dc48c88fcf82b89fdebd83a906aaa64f40fb8a9 upstream. + +For devm_phy_destroy(), its comment says it needs to invoke phy_destroy() +to destroy the phy, but it will not actually invoke the function since +devres_destroy() does not call devm_phy_consume(), and the missing +phy_destroy() call will cause that the phy fails to be destroyed. + +Fortunately, the faulty API has not been used by current kernel tree. +Fix by using devres_release() instead of devres_destroy() within the API. + +Fixes: ff764963479a ("drivers: phy: add generic PHY framework") +Reviewed-by: Johan Hovold +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20241213-phy_core_fix-v6-3-40ae28f5015a@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/phy-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -1061,7 +1061,7 @@ void devm_phy_destroy(struct device *dev + { + int r; + +- r = devres_destroy(dev, devm_phy_consume, devm_phy_match, phy); ++ r = devres_release(dev, devm_phy_consume, devm_phy_match, phy); + dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); + } + EXPORT_SYMBOL_GPL(devm_phy_destroy); diff --git a/queue-6.1/phy-core-fix-that-api-devm_phy_put-fails-to-release-the-phy.patch b/queue-6.1/phy-core-fix-that-api-devm_phy_put-fails-to-release-the-phy.patch new file mode 100644 index 00000000000..32abfdf74ca --- /dev/null +++ b/queue-6.1/phy-core-fix-that-api-devm_phy_put-fails-to-release-the-phy.patch @@ -0,0 +1,66 @@ +From fe4bfa9b6d7bd752bfe4700c937f235aa8ce997b Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Fri, 13 Dec 2024 20:36:41 +0800 +Subject: phy: core: Fix that API devm_phy_put() fails to release the phy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zijun Hu + +commit fe4bfa9b6d7bd752bfe4700c937f235aa8ce997b upstream. + +For devm_phy_put(), its comment says it needs to invoke phy_put() to +release the phy, but it will not actually invoke the function since +devres_destroy() does not call devm_phy_release(), and the missing +phy_put() call will cause: + +- The phy fails to be released. +- devm_phy_put() can not fully undo what API devm_phy_get() does. +- Leak refcount of both the module and device for below typical usage: + + devm_phy_get(); // or its variant + ... + err = do_something(); + if (err) + goto err_out; + ... + err_out: + devm_phy_put(); // leak refcount here + + The file(s) affected by this issue are shown below since they have such + typical usage. + drivers/pci/controller/cadence/pcie-cadence.c + drivers/net/ethernet/ti/am65-cpsw-nuss.c + +Fix by using devres_release() instead of devres_destroy() within the API. + +Fixes: ff764963479a ("drivers: phy: add generic PHY framework") +Cc: stable@vger.kernel.org +Cc: Lorenzo Pieralisi +Cc: Krzysztof Wilczyński +Cc: Bjorn Helgaas +Cc: David S. Miller +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Reviewed-by: Johan Hovold +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20241213-phy_core_fix-v6-1-40ae28f5015a@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/phy-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -688,7 +688,7 @@ void devm_phy_put(struct device *dev, st + if (!phy) + return; + +- r = devres_destroy(dev, devm_phy_release, devm_phy_match, phy); ++ r = devres_release(dev, devm_phy_release, devm_phy_match, phy); + dev_WARN_ONCE(dev, r, "couldn't find PHY resource\n"); + } + EXPORT_SYMBOL_GPL(devm_phy_put); diff --git a/queue-6.1/phy-qcom-qmp-fix-register-name-in-rx-lane-config-of-sc8280xp.patch b/queue-6.1/phy-qcom-qmp-fix-register-name-in-rx-lane-config-of-sc8280xp.patch new file mode 100644 index 00000000000..9b33d779c70 --- /dev/null +++ b/queue-6.1/phy-qcom-qmp-fix-register-name-in-rx-lane-config-of-sc8280xp.patch @@ -0,0 +1,37 @@ +From 8886fb3240931a0afce82dea87edfe46bcb0a586 Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati +Date: Tue, 12 Nov 2024 14:58:31 +0530 +Subject: phy: qcom-qmp: Fix register name in RX Lane config of SC8280XP + +From: Krishna Kurapati + +commit 8886fb3240931a0afce82dea87edfe46bcb0a586 upstream. + +In RX Lane configuration sequence of SC8280XP, the register +V5_RX_UCDR_FO_GAIN is incorrectly spelled as RX_UCDR_SO_GAIN and +hence the programming sequence is wrong. Fix the register sequence +accordingly to avoid any compliance failures. This has been tested +on SA8775P by checking device mode enumeration in SuperSpeed. + +Cc: stable@vger.kernel.org +Fixes: c0c7769cdae2 ("phy: qcom-qmp: Add SC8280XP USB3 UNI phy") +Signed-off-by: Krishna Kurapati +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20241112092831.4110942-1-quic_kriskura@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +@@ -1393,7 +1393,7 @@ static const struct qmp_phy_init_tbl sc8 + QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_FO_GAIN, 0x2f), + QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_LOW, 0xff), + QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x0f), +- QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_SO_GAIN, 0x0a), ++ QMP_PHY_INIT_CFG(QSERDES_V5_RX_UCDR_FO_GAIN, 0x0a), + QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL1, 0x54), + QMP_PHY_INIT_CFG(QSERDES_V5_RX_VGA_CAL_CNTRL2, 0x0f), + QMP_PHY_INIT_CFG(QSERDES_V5_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f), diff --git a/queue-6.1/phy-rockchip-naneng-combphy-fix-phy-reset.patch b/queue-6.1/phy-rockchip-naneng-combphy-fix-phy-reset.patch new file mode 100644 index 00000000000..71fca7333a4 --- /dev/null +++ b/queue-6.1/phy-rockchip-naneng-combphy-fix-phy-reset.patch @@ -0,0 +1,42 @@ +From fbcbffbac994aca1264e3c14da96ac9bfd90466e Mon Sep 17 00:00:00 2001 +From: Chukun Pan +Date: Fri, 22 Nov 2024 15:30:06 +0800 +Subject: phy: rockchip: naneng-combphy: fix phy reset + +From: Chukun Pan + +commit fbcbffbac994aca1264e3c14da96ac9bfd90466e upstream. + +Currently, the USB port via combophy on the RK3528/RK3588 SoC is broken. + + usb usb8-port1: Cannot enable. Maybe the USB cable is bad? + +This is due to the combphy of RK3528/RK3588 SoC has multiple resets, but +only "phy resets" need assert and deassert, "apb resets" don't need. +So change the driver to only match the phy resets, which is also what +the vendor kernel does. + +Fixes: 7160820d742a ("phy: rockchip: add naneng combo phy for RK3568") +Cc: FUKAUMI Naoki +Cc: Michael Zimmermann +Signed-off-by: Chukun Pan +Reviewed-by: Heiko Stuebner +Tested-by: FUKAUMI Naoki +Link: https://lore.kernel.org/r/20241122073006.99309-2-amadeus@jmu.edu.cn +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/rockchip/phy-rockchip-naneng-combphy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c ++++ b/drivers/phy/rockchip/phy-rockchip-naneng-combphy.c +@@ -299,7 +299,7 @@ static int rockchip_combphy_parse_dt(str + + priv->ext_refclk = device_property_present(dev, "rockchip,ext-refclk"); + +- priv->phy_rst = devm_reset_control_array_get_exclusive(dev); ++ priv->phy_rst = devm_reset_control_get(dev, "phy"); + if (IS_ERR(priv->phy_rst)) + return dev_err_probe(dev, PTR_ERR(priv->phy_rst), "failed to get phy reset\n"); + diff --git a/queue-6.1/phy-usb-toggle-the-phy-power-during-init.patch b/queue-6.1/phy-usb-toggle-the-phy-power-during-init.patch new file mode 100644 index 00000000000..96d434f1e20 --- /dev/null +++ b/queue-6.1/phy-usb-toggle-the-phy-power-during-init.patch @@ -0,0 +1,38 @@ +From 0a92ea87bdd6f77ca4e17fe19649882cf5209edd Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Thu, 24 Oct 2024 14:35:40 -0700 +Subject: phy: usb: Toggle the PHY power during init + +From: Justin Chen + +commit 0a92ea87bdd6f77ca4e17fe19649882cf5209edd upstream. + +When bringing up the PHY, it might be in a bad state if left powered. +One case is we lose the PLL lock if the PLL is gated while the PHY +is powered. Toggle the PHY power so we can start from a known state. + +Fixes: 4e5b9c9a73b3 ("phy: usb: Add support for new Synopsys USB controller on the 7216") +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20241024213540.1059412-1-justin.chen@broadcom.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +@@ -309,6 +309,12 @@ static void usb_init_common_7216(struct + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; + + USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ ++ /* ++ * The PHY might be in a bad state if it is already powered ++ * up. Toggle the power just in case. ++ */ ++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); + USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); + + /* 1 millisecond - for USB clocks to settle down */ diff --git a/queue-6.1/series b/queue-6.1/series index d4f4f0f76b2..1a6692ce432 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -5,3 +5,19 @@ tcp_bpf-add-sk_rmem_alloc-related-logic-for-tcp_bpf-.patch bpf-check-negative-offsets-in-__bpf_skb_min_len.patch nfsd-restore-callback-functionality-for-nfsv4.0.patch mtd-diskonchip-cast-an-operand-to-prevent-potential-overflow.patch +mtd-rawnand-arasan-fix-double-assertion-of-chip-select.patch +mtd-rawnand-arasan-fix-missing-de-registration-of-nand.patch +phy-qcom-qmp-fix-register-name-in-rx-lane-config-of-sc8280xp.patch +phy-core-fix-an-of-node-refcount-leakage-in-_of_phy_get.patch +phy-core-fix-an-of-node-refcount-leakage-in-of_phy_provider_lookup.patch +phy-core-fix-that-api-devm_phy_put-fails-to-release-the-phy.patch +phy-core-fix-that-api-devm_of_phy_provider_unregister-fails-to-unregister-the-phy-provider.patch +phy-core-fix-that-api-devm_phy_destroy-fails-to-destroy-the-phy.patch +phy-usb-toggle-the-phy-power-during-init.patch +phy-rockchip-naneng-combphy-fix-phy-reset.patch +dmaengine-mv_xor-fix-child-node-refcount-handling-in-early-exit.patch +dmaengine-dw-select-only-supported-masters-for-acpi-devices.patch +dmaengine-tegra-return-correct-dma-status-when-paused.patch +dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch +dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch +mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch