From: Greg Kroah-Hartman Date: Sun, 9 Mar 2025 10:37:08 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v5.4.291~109 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e40b86a8601e98a2f2714477aa0adc2cfe6b5a62;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-intel-add-dell-alc3271-to-power_save-denylist.patch alsa-hda-realtek-update-alc222-depop-optimize.patch drm-radeon-fix-rs400_gpu_init-for-ati-mobility-radeon-xpress-200m.patch gpio-aggregator-protect-driver-attr-handlers-against-module-unload.patch hid-appleir-fix-potential-null-dereference-at-raw-event-handle.patch platform-x86-thinkpad_acpi-add-battery-quirk-for-thinkpad-x131e.patch revert-of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch x86-cacheinfo-validate-cpuid-leaf-0x2-edx-output.patch x86-cpu-properly-parse-cpuid-leaf-0x2-tlb-descriptor-0x63.patch x86-cpu-validate-cpuid-leaf-0x2-edx-output.patch --- diff --git a/queue-5.10/alsa-hda-intel-add-dell-alc3271-to-power_save-denylist.patch b/queue-5.10/alsa-hda-intel-add-dell-alc3271-to-power_save-denylist.patch new file mode 100644 index 0000000000..7ee45d0fdf --- /dev/null +++ b/queue-5.10/alsa-hda-intel-add-dell-alc3271-to-power_save-denylist.patch @@ -0,0 +1,57 @@ +From 1ee5aa765c22a0577ec552d460bf2035300b4b51 Mon Sep 17 00:00:00 2001 +From: Hoku Ishibe +Date: Sun, 23 Feb 2025 21:05:17 -0500 +Subject: ALSA: hda: intel: Add Dell ALC3271 to power_save denylist + +From: Hoku Ishibe + +commit 1ee5aa765c22a0577ec552d460bf2035300b4b51 upstream. + +Dell XPS 13 7390 with the Realtek ALC3271 codec experiences +persistent humming noise when the power_save mode is enabled. +This issue occurs when the codec enters power saving mode, +leading to unwanted noise from the speakers. + +This patch adds the affected model (PCI ID 0x1028:0x0962) to the +power_save denylist to ensure power_save is disabled by default, +preventing power-off related noise issues. + +Steps to Reproduce +1. Boot the system with `snd_hda_intel` loaded. +2. Verify that `power_save` mode is enabled: +```sh +cat /sys/module/snd_hda_intel/parameters/power_save +```` +output: 10 (default power save timeout) +3. Wait for the power save timeout +4. Observe a persistent humming noise from the speakers +5. Disable `power_save` manually: +```sh +echo 0 | sudo tee /sys/module/snd_hda_intel/parameters/power_save +```` +6. Confirm that the noise disappears immediately. + +This issue has been observed on my system, and this patch +successfully eliminates the unwanted noise. If other users +experience similar issues, additional reports would be helpful. + +Signed-off-by: Hoku Ishibe +Cc: +Link: https://patch.msgid.link/20250224020517.51035-1-me@hokuishi.be +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2280,6 +2280,8 @@ static const struct snd_pci_quirk power_ + SND_PCI_QUIRK(0x1631, 0xe017, "Packard Bell NEC IMEDIA 5204", 0), + /* KONTRON SinglePC may cause a stall at runtime resume */ + SND_PCI_QUIRK(0x1734, 0x1232, "KONTRON SinglePC", 0), ++ /* Dell ALC3271 */ ++ SND_PCI_QUIRK(0x1028, 0x0962, "Dell ALC3271", 0), + {} + }; + #endif /* CONFIG_PM */ diff --git a/queue-5.10/alsa-hda-realtek-update-alc222-depop-optimize.patch b/queue-5.10/alsa-hda-realtek-update-alc222-depop-optimize.patch new file mode 100644 index 0000000000..6b48e54ce9 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-update-alc222-depop-optimize.patch @@ -0,0 +1,116 @@ +From ca0dedaff92307591f66c9206933fbdfe87add10 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Wed, 5 Mar 2025 13:54:34 +0800 +Subject: ALSA: hda/realtek: update ALC222 depop optimize + +From: Kailang Yang + +commit ca0dedaff92307591f66c9206933fbdfe87add10 upstream. + +Add ALC222 its own depop functions for alc_init and alc_shutup. + +[note: this fixes pop noise issues on the models with two headphone + jacks -- tiwai ] + +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 76 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 76 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3768,6 +3768,79 @@ static void alc225_shutup(struct hda_cod + } + } + ++static void alc222_init(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ hda_nid_t hp_pin = alc_get_hp_pin(spec); ++ bool hp1_pin_sense, hp2_pin_sense; ++ ++ if (!hp_pin) ++ return; ++ ++ msleep(30); ++ ++ hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); ++ hp2_pin_sense = snd_hda_jack_detect(codec, 0x14); ++ ++ if (hp1_pin_sense || hp2_pin_sense) { ++ msleep(2); ++ ++ if (hp1_pin_sense) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); ++ if (hp2_pin_sense) ++ snd_hda_codec_write(codec, 0x14, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); ++ msleep(75); ++ ++ if (hp1_pin_sense) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); ++ if (hp2_pin_sense) ++ snd_hda_codec_write(codec, 0x14, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); ++ ++ msleep(75); ++ } ++} ++ ++static void alc222_shutup(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ hda_nid_t hp_pin = alc_get_hp_pin(spec); ++ bool hp1_pin_sense, hp2_pin_sense; ++ ++ if (!hp_pin) ++ hp_pin = 0x21; ++ ++ hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin); ++ hp2_pin_sense = snd_hda_jack_detect(codec, 0x14); ++ ++ if (hp1_pin_sense || hp2_pin_sense) { ++ msleep(2); ++ ++ if (hp1_pin_sense) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); ++ if (hp2_pin_sense) ++ snd_hda_codec_write(codec, 0x14, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); ++ ++ msleep(75); ++ ++ if (hp1_pin_sense) ++ snd_hda_codec_write(codec, hp_pin, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ if (hp2_pin_sense) ++ snd_hda_codec_write(codec, 0x14, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ ++ msleep(75); ++ } ++ alc_auto_setup_eapd(codec, false); ++ alc_shutup_pins(codec); ++} ++ + static void alc_default_init(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -10289,8 +10362,11 @@ static int patch_alc269(struct hda_codec + spec->codec_variant = ALC269_TYPE_ALC300; + spec->gen.mixer_nid = 0; /* no loopback on ALC300 */ + break; ++ case 0x10ec0222: + case 0x10ec0623: + spec->codec_variant = ALC269_TYPE_ALC623; ++ spec->shutup = alc222_shutup; ++ spec->init_hook = alc222_init; + break; + case 0x10ec0700: + case 0x10ec0701: diff --git a/queue-5.10/drm-radeon-fix-rs400_gpu_init-for-ati-mobility-radeon-xpress-200m.patch b/queue-5.10/drm-radeon-fix-rs400_gpu_init-for-ati-mobility-radeon-xpress-200m.patch new file mode 100644 index 0000000000..16dbf705bd --- /dev/null +++ b/queue-5.10/drm-radeon-fix-rs400_gpu_init-for-ati-mobility-radeon-xpress-200m.patch @@ -0,0 +1,78 @@ +From 29ffeb73b216ce3eff10229eb077cf9b7812119d Mon Sep 17 00:00:00 2001 +From: Richard Thier +Date: Mon, 17 Jun 2019 23:46:27 +0200 +Subject: drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Richard Thier + +commit 29ffeb73b216ce3eff10229eb077cf9b7812119d upstream. + +num_gb_pipes was set to a wrong value using r420_pipe_config + +This have lead to HyperZ glitches on fast Z clearing. + +Closes: https://bugs.freedesktop.org/show_bug.cgi?id=110897 +Reviewed-by: Marek Olšák +Signed-off-by: Richard Thier +Signed-off-by: Alex Deucher +(cherry picked from commit 044e59a85c4d84e3c8d004c486e5c479640563a6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/r300.c | 3 ++- + drivers/gpu/drm/radeon/radeon_asic.h | 1 + + drivers/gpu/drm/radeon/rs400.c | 18 ++++++++++++++++-- + 3 files changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/radeon/r300.c ++++ b/drivers/gpu/drm/radeon/r300.c +@@ -361,7 +361,8 @@ int r300_mc_wait_for_idle(struct radeon_ + return -1; + } + +-static void r300_gpu_init(struct radeon_device *rdev) ++/* rs400_gpu_init also calls this! */ ++void r300_gpu_init(struct radeon_device *rdev) + { + uint32_t gb_tile_config, tmp; + +--- a/drivers/gpu/drm/radeon/radeon_asic.h ++++ b/drivers/gpu/drm/radeon/radeon_asic.h +@@ -165,6 +165,7 @@ void r200_set_safe_registers(struct rade + */ + extern int r300_init(struct radeon_device *rdev); + extern void r300_fini(struct radeon_device *rdev); ++extern void r300_gpu_init(struct radeon_device *rdev); + extern int r300_suspend(struct radeon_device *rdev); + extern int r300_resume(struct radeon_device *rdev); + extern int r300_asic_reset(struct radeon_device *rdev, bool hard); +--- a/drivers/gpu/drm/radeon/rs400.c ++++ b/drivers/gpu/drm/radeon/rs400.c +@@ -257,8 +257,22 @@ int rs400_mc_wait_for_idle(struct radeon + + static void rs400_gpu_init(struct radeon_device *rdev) + { +- /* FIXME: is this correct ? */ +- r420_pipes_init(rdev); ++ /* Earlier code was calling r420_pipes_init and then ++ * rs400_mc_wait_for_idle(rdev). The problem is that ++ * at least on my Mobility Radeon Xpress 200M RC410 card ++ * that ends up in this code path ends up num_gb_pipes == 3 ++ * while the card seems to have only one pipe. With the ++ * r420 pipe initialization method. ++ * ++ * Problems shown up as HyperZ glitches, see: ++ * https://bugs.freedesktop.org/show_bug.cgi?id=110897 ++ * ++ * Delegating initialization to r300 code seems to work ++ * and results in proper pipe numbers. The rs400 cards ++ * are said to be not r400, but r300 kind of cards. ++ */ ++ r300_gpu_init(rdev); ++ + if (rs400_mc_wait_for_idle(rdev)) { + pr_warn("rs400: Failed to wait MC idle while programming pipes. Bad things might happen. %08x\n", + RREG32(RADEON_MC_STATUS)); diff --git a/queue-5.10/gpio-aggregator-protect-driver-attr-handlers-against-module-unload.patch b/queue-5.10/gpio-aggregator-protect-driver-attr-handlers-against-module-unload.patch new file mode 100644 index 0000000000..b42057fc1c --- /dev/null +++ b/queue-5.10/gpio-aggregator-protect-driver-attr-handlers-against-module-unload.patch @@ -0,0 +1,132 @@ +From 12f65d1203507f7db3ba59930fe29a3b8eee9945 Mon Sep 17 00:00:00 2001 +From: Koichiro Den +Date: Mon, 24 Feb 2025 23:31:26 +0900 +Subject: gpio: aggregator: protect driver attr handlers against module unload + +From: Koichiro Den + +commit 12f65d1203507f7db3ba59930fe29a3b8eee9945 upstream. + +Both new_device_store and delete_device_store touch module global +resources (e.g. gpio_aggregator_lock). To prevent race conditions with +module unload, a reference needs to be held. + +Add try_module_get() in these handlers. + +For new_device_store, this eliminates what appears to be the most dangerous +scenario: if an id is allocated from gpio_aggregator_idr but +platform_device_register has not yet been called or completed, a concurrent +module unload could fail to unregister/delete the device, leaving behind a +dangling platform device/GPIO forwarder. This can result in various issues. +The following simple reproducer demonstrates these problems: + + #!/bin/bash + while :; do + # note: whether 'gpiochip0 0' exists or not does not matter. + echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device + done & + while :; do + modprobe gpio-aggregator + modprobe -r gpio-aggregator + done & + wait + + Starting with the following warning, several kinds of warnings will appear + and the system may become unstable: + + ------------[ cut here ]------------ + list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100) + WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120 + [...] + RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120 + [...] + Call Trace: + + ? __list_del_entry_valid_or_report+0xa3/0x120 + ? __warn.cold+0x93/0xf2 + ? __list_del_entry_valid_or_report+0xa3/0x120 + ? report_bug+0xe6/0x170 + ? __irq_work_queue_local+0x39/0xe0 + ? handle_bug+0x58/0x90 + ? exc_invalid_op+0x13/0x60 + ? asm_exc_invalid_op+0x16/0x20 + ? __list_del_entry_valid_or_report+0xa3/0x120 + gpiod_remove_lookup_table+0x22/0x60 + new_device_store+0x315/0x350 [gpio_aggregator] + kernfs_fop_write_iter+0x137/0x1f0 + vfs_write+0x262/0x430 + ksys_write+0x60/0xd0 + do_syscall_64+0x6c/0x180 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + [...] + + ---[ end trace 0000000000000000 ]--- + +Fixes: 828546e24280 ("gpio: Add GPIO Aggregator") +Cc: stable@vger.kernel.org +Signed-off-by: Koichiro Den +Link: https://lore.kernel.org/r/20250224143134.3024598-2-koichiro.den@canonical.com +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-aggregator.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/gpio/gpio-aggregator.c ++++ b/drivers/gpio/gpio-aggregator.c +@@ -173,10 +173,15 @@ static ssize_t new_device_store(struct d + struct platform_device *pdev; + int res, id; + ++ if (!try_module_get(THIS_MODULE)) ++ return -ENOENT; ++ + /* kernfs guarantees string termination, so count + 1 is safe */ + aggr = kzalloc(sizeof(*aggr) + count + 1, GFP_KERNEL); +- if (!aggr) +- return -ENOMEM; ++ if (!aggr) { ++ res = -ENOMEM; ++ goto put_module; ++ } + + memcpy(aggr->args, buf, count + 1); + +@@ -215,6 +220,7 @@ static ssize_t new_device_store(struct d + } + + aggr->pdev = pdev; ++ module_put(THIS_MODULE); + return count; + + remove_table: +@@ -229,6 +235,8 @@ free_table: + kfree(aggr->lookups); + free_ga: + kfree(aggr); ++put_module: ++ module_put(THIS_MODULE); + return res; + } + +@@ -257,13 +265,19 @@ static ssize_t delete_device_store(struc + if (error) + return error; + ++ if (!try_module_get(THIS_MODULE)) ++ return -ENOENT; ++ + mutex_lock(&gpio_aggregator_lock); + aggr = idr_remove(&gpio_aggregator_idr, id); + mutex_unlock(&gpio_aggregator_lock); +- if (!aggr) ++ if (!aggr) { ++ module_put(THIS_MODULE); + return -ENOENT; ++ } + + gpio_aggregator_free(aggr); ++ module_put(THIS_MODULE); + return count; + } + static DRIVER_ATTR_WO(delete_device); diff --git a/queue-5.10/hid-appleir-fix-potential-null-dereference-at-raw-event-handle.patch b/queue-5.10/hid-appleir-fix-potential-null-dereference-at-raw-event-handle.patch new file mode 100644 index 0000000000..28b0dd140d --- /dev/null +++ b/queue-5.10/hid-appleir-fix-potential-null-dereference-at-raw-event-handle.patch @@ -0,0 +1,100 @@ +From 2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1 Mon Sep 17 00:00:00 2001 +From: Daniil Dulov +Date: Mon, 24 Feb 2025 20:30:30 +0300 +Subject: HID: appleir: Fix potential NULL dereference at raw event handle + +From: Daniil Dulov + +commit 2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1 upstream. + +Syzkaller reports a NULL pointer dereference issue in input_event(). + +BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] +BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] +BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline] +BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395 +Read of size 8 at addr 0000000000000028 by task syz-executor199/2949 + +CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 + kasan_report+0xd9/0x110 mm/kasan/report.c:602 + check_region_inline mm/kasan/generic.c:183 [inline] + kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 + instrument_atomic_read include/linux/instrumented.h:68 [inline] + _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] + is_event_supported drivers/input/input.c:67 [inline] + input_event+0x42/0xa0 drivers/input/input.c:395 + input_report_key include/linux/input.h:439 [inline] + key_down drivers/hid/hid-appleir.c:159 [inline] + appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232 + __hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111 + hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484 + __usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650 + usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734 + dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993 + __run_hrtimer kernel/time/hrtimer.c:1739 [inline] + __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 + hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 + handle_softirqs+0x206/0x8d0 kernel/softirq.c:561 + __do_softirq kernel/softirq.c:595 [inline] + invoke_softirq kernel/softirq.c:435 [inline] + __irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] + sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049 + + + asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 + __mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185 + add_timer+0x62/0x90 kernel/time/timer.c:1295 + schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98 + usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645 + usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784 + hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:906 [inline] + __se_sys_ioctl fs/ioctl.c:892 [inline] + __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + +This happens due to the malformed report items sent by the emulated device +which results in a report, that has no fields, being added to the report list. +Due to this appleir_input_configured() is never called, hidinput_connect() +fails which results in the HID_CLAIMED_INPUT flag is not being set. However, +it does not make appleir_probe() fail and lets the event callback to be +called without the associated input device. + +Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook +early if the driver didn't claim any input_dev for some reason. Moreover, +some other hid drivers accessing input_dev in their event callbacks do have +similar checks, too. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 9a4a5574ce42 ("HID: appleir: add support for Apple ir devices") +Cc: stable@vger.kernel.org +Signed-off-by: Daniil Dulov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-appleir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-appleir.c ++++ b/drivers/hid/hid-appleir.c +@@ -188,7 +188,7 @@ static int appleir_raw_event(struct hid_ + static const u8 flatbattery[] = { 0x25, 0x87, 0xe0 }; + unsigned long flags; + +- if (len != 5) ++ if (len != 5 || !(hid->claimed & HID_CLAIMED_INPUT)) + goto out; + + if (!memcmp(data, keydown, sizeof(keydown))) { diff --git a/queue-5.10/platform-x86-thinkpad_acpi-add-battery-quirk-for-thinkpad-x131e.patch b/queue-5.10/platform-x86-thinkpad_acpi-add-battery-quirk-for-thinkpad-x131e.patch new file mode 100644 index 0000000000..abb90d9267 --- /dev/null +++ b/queue-5.10/platform-x86-thinkpad_acpi-add-battery-quirk-for-thinkpad-x131e.patch @@ -0,0 +1,43 @@ +From d0d10eaedcb53740883d7e5d53c5e15c879b48fb Mon Sep 17 00:00:00 2001 +From: Mingcong Bai +Date: Sat, 22 Feb 2025 00:48:24 +0800 +Subject: platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingcong Bai + +commit d0d10eaedcb53740883d7e5d53c5e15c879b48fb upstream. + +Based on the dmesg messages from the original reporter: + +[ 4.964073] ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error +[ 4.964083] thinkpad_acpi: Error probing battery 2 + +Lenovo ThinkPad X131e also needs this battery quirk. + +Reported-by: Fan Yang <804284660@qq.com> +Tested-by: Fan Yang <804284660@qq.com> +Co-developed-by: Xi Ruoyao +Signed-off-by: Xi Ruoyao +Signed-off-by: Mingcong Bai +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250221164825.77315-1-jeffbai@aosc.io +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/thinkpad_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -9718,6 +9718,7 @@ static const struct tpacpi_quirk battery + * Individual addressing is broken on models that expose the + * primary battery as BAT1. + */ ++ TPACPI_Q_LNV('G', '8', true), /* ThinkPad X131e */ + TPACPI_Q_LNV('8', 'F', true), /* Thinkpad X120e */ + TPACPI_Q_LNV('J', '7', true), /* B5400 */ + TPACPI_Q_LNV('J', 'I', true), /* Thinkpad 11e */ diff --git a/queue-5.10/revert-of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch b/queue-5.10/revert-of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch new file mode 100644 index 0000000000..6ff038a057 --- /dev/null +++ b/queue-5.10/revert-of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch @@ -0,0 +1,39 @@ +From 75f1f311d883dfaffb98be3c1da208d6ed5d4df9 Mon Sep 17 00:00:00 2001 +From: "Rob Herring (Arm)" +Date: Wed, 26 Feb 2025 13:38:19 -0600 +Subject: Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" + +From: Rob Herring (Arm) + +commit 75f1f311d883dfaffb98be3c1da208d6ed5d4df9 upstream. + +This reverts commit 267b21d0bef8e67dbe6c591c9991444e58237ec9. + +Turns out some DTs do depend on this behavior. Specifically, a +downstream Pixel 6 DT. Revert the change at least until we can decide if +the DT spec can be changed instead. + +Cc: stable@vger.kernel.org +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/of_reserved_mem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -94,12 +94,12 @@ static int __init __reserved_mem_alloc_s + + prop = of_get_flat_dt_prop(node, "alignment", &len); + if (prop) { +- if (len != dt_root_size_cells * sizeof(__be32)) { ++ if (len != dt_root_addr_cells * sizeof(__be32)) { + pr_err("invalid alignment property in '%s' node.\n", + uname); + return -EINVAL; + } +- align = dt_mem_next_cell(dt_root_size_cells, &prop); ++ align = dt_mem_next_cell(dt_root_addr_cells, &prop); + } + + nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL; diff --git a/queue-5.10/series b/queue-5.10/series index c1fd86d6e5..d3541e4094 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -404,3 +404,13 @@ riscv-cacheinfo-initialize-cacheinfo-s-level-and-typ.patch riscv-prevent-a-bad-reference-count-on-cpu-nodes.patch riscv-cacheinfo-use-of_property_present-for-non-bool.patch efi-don-t-map-the-entire-mokvar-table-to-determine-i.patch +revert-of-reserved-memory-fix-using-wrong-number-of-cells-to-get-property-alignment.patch +hid-appleir-fix-potential-null-dereference-at-raw-event-handle.patch +gpio-aggregator-protect-driver-attr-handlers-against-module-unload.patch +alsa-hda-intel-add-dell-alc3271-to-power_save-denylist.patch +alsa-hda-realtek-update-alc222-depop-optimize.patch +drm-radeon-fix-rs400_gpu_init-for-ati-mobility-radeon-xpress-200m.patch +platform-x86-thinkpad_acpi-add-battery-quirk-for-thinkpad-x131e.patch +x86-cacheinfo-validate-cpuid-leaf-0x2-edx-output.patch +x86-cpu-validate-cpuid-leaf-0x2-edx-output.patch +x86-cpu-properly-parse-cpuid-leaf-0x2-tlb-descriptor-0x63.patch diff --git a/queue-5.10/x86-cacheinfo-validate-cpuid-leaf-0x2-edx-output.patch b/queue-5.10/x86-cacheinfo-validate-cpuid-leaf-0x2-edx-output.patch new file mode 100644 index 0000000000..f9090288b3 --- /dev/null +++ b/queue-5.10/x86-cacheinfo-validate-cpuid-leaf-0x2-edx-output.patch @@ -0,0 +1,44 @@ +From 8177c6bedb7013cf736137da586cf783922309dd Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Tue, 4 Mar 2025 09:51:12 +0100 +Subject: x86/cacheinfo: Validate CPUID leaf 0x2 EDX output + +From: Ahmed S. Darwish + +commit 8177c6bedb7013cf736137da586cf783922309dd upstream. + +CPUID leaf 0x2 emits one-byte descriptors in its four output registers +EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most +significant bit (MSB) of each register must be clear. + +The historical Git commit: + + 019361a20f016 ("- pre6: Intel: start to add Pentium IV specific stuff (128-byte cacheline etc)...") + +introduced leaf 0x2 output parsing. It only validated the MSBs of EAX, +EBX, and ECX, but left EDX unchecked. + +Validate EDX's most-significant bit. + +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Ingo Molnar +Cc: stable@vger.kernel.org +Cc: "H. Peter Anvin" +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250304085152.51092-2-darwi@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/cacheinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/cacheinfo.c ++++ b/arch/x86/kernel/cpu/cacheinfo.c +@@ -795,7 +795,7 @@ void init_intel_cacheinfo(struct cpuinfo + cpuid(2, ®s[0], ®s[1], ®s[2], ®s[3]); + + /* If bit 31 is set, this is an unknown format */ +- for (j = 0 ; j < 3 ; j++) ++ for (j = 0 ; j < 4 ; j++) + if (regs[j] & (1 << 31)) + regs[j] = 0; + diff --git a/queue-5.10/x86-cpu-properly-parse-cpuid-leaf-0x2-tlb-descriptor-0x63.patch b/queue-5.10/x86-cpu-properly-parse-cpuid-leaf-0x2-tlb-descriptor-0x63.patch new file mode 100644 index 0000000000..19e4017544 --- /dev/null +++ b/queue-5.10/x86-cpu-properly-parse-cpuid-leaf-0x2-tlb-descriptor-0x63.patch @@ -0,0 +1,119 @@ +From f6bdaab79ee4228a143ee1b4cb80416d6ffc0c63 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Tue, 4 Mar 2025 09:51:14 +0100 +Subject: x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 + +From: Ahmed S. Darwish + +commit f6bdaab79ee4228a143ee1b4cb80416d6ffc0c63 upstream. + +CPUID leaf 0x2's one-byte TLB descriptors report the number of entries +for specific TLB types, among other properties. + +Typically, each emitted descriptor implies the same number of entries +for its respective TLB type(s). An emitted 0x63 descriptor is an +exception: it implies 4 data TLB entries for 1GB pages and 32 data TLB +entries for 2MB or 4MB pages. + +For the TLB descriptors parsing code, the entry count for 1GB pages is +encoded at the intel_tlb_table[] mapping, but the 2MB/4MB entry count is +totally ignored. + +Update leaf 0x2's parsing logic 0x2 to account for 32 data TLB entries +for 2MB/4MB pages implied by the 0x63 descriptor. + +Fixes: e0ba94f14f74 ("x86/tlb_info: get last level TLB entry number of CPU") +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Ingo Molnar +Cc: stable@kernel.org +Cc: "H. Peter Anvin" +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250304085152.51092-4-darwi@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/intel.c | 60 ++++++++++++++++++++++++++++---------------- + 1 file changed, 39 insertions(+), 21 deletions(-) + +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -747,26 +747,37 @@ static unsigned int intel_size_cache(str + } + #endif + +-#define TLB_INST_4K 0x01 +-#define TLB_INST_4M 0x02 +-#define TLB_INST_2M_4M 0x03 +- +-#define TLB_INST_ALL 0x05 +-#define TLB_INST_1G 0x06 +- +-#define TLB_DATA_4K 0x11 +-#define TLB_DATA_4M 0x12 +-#define TLB_DATA_2M_4M 0x13 +-#define TLB_DATA_4K_4M 0x14 +- +-#define TLB_DATA_1G 0x16 +- +-#define TLB_DATA0_4K 0x21 +-#define TLB_DATA0_4M 0x22 +-#define TLB_DATA0_2M_4M 0x23 +- +-#define STLB_4K 0x41 +-#define STLB_4K_2M 0x42 ++#define TLB_INST_4K 0x01 ++#define TLB_INST_4M 0x02 ++#define TLB_INST_2M_4M 0x03 ++ ++#define TLB_INST_ALL 0x05 ++#define TLB_INST_1G 0x06 ++ ++#define TLB_DATA_4K 0x11 ++#define TLB_DATA_4M 0x12 ++#define TLB_DATA_2M_4M 0x13 ++#define TLB_DATA_4K_4M 0x14 ++ ++#define TLB_DATA_1G 0x16 ++#define TLB_DATA_1G_2M_4M 0x17 ++ ++#define TLB_DATA0_4K 0x21 ++#define TLB_DATA0_4M 0x22 ++#define TLB_DATA0_2M_4M 0x23 ++ ++#define STLB_4K 0x41 ++#define STLB_4K_2M 0x42 ++ ++/* ++ * All of leaf 0x2's one-byte TLB descriptors implies the same number of ++ * entries for their respective TLB types. The 0x63 descriptor is an ++ * exception: it implies 4 dTLB entries for 1GB pages 32 dTLB entries ++ * for 2MB or 4MB pages. Encode descriptor 0x63 dTLB entry count for ++ * 2MB/4MB pages here, as its count for dTLB 1GB pages is already at the ++ * intel_tlb_table[] mapping. ++ */ ++#define TLB_0x63_2M_4M_ENTRIES 32 + + static const struct _tlb_table intel_tlb_table[] = { + { 0x01, TLB_INST_4K, 32, " TLB_INST 4 KByte pages, 4-way set associative" }, +@@ -788,7 +799,8 @@ static const struct _tlb_table intel_tlb + { 0x5c, TLB_DATA_4K_4M, 128, " TLB_DATA 4 KByte and 4 MByte pages" }, + { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, + { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, +- { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, ++ { 0x63, TLB_DATA_1G_2M_4M, 4, " TLB_DATA 1 GByte pages, 4-way set associative" ++ " (plus 32 entries TLB_DATA 2 MByte or 4 MByte pages, not encoded here)" }, + { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, + { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, + { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, +@@ -888,6 +900,12 @@ static void intel_tlb_lookup(const unsig + if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries) + tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries; + break; ++ case TLB_DATA_1G_2M_4M: ++ if (tlb_lld_2m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) ++ tlb_lld_2m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; ++ if (tlb_lld_4m[ENTRIES] < TLB_0x63_2M_4M_ENTRIES) ++ tlb_lld_4m[ENTRIES] = TLB_0x63_2M_4M_ENTRIES; ++ fallthrough; + case TLB_DATA_1G: + if (tlb_lld_1g[ENTRIES] < intel_tlb_table[k].entries) + tlb_lld_1g[ENTRIES] = intel_tlb_table[k].entries; diff --git a/queue-5.10/x86-cpu-validate-cpuid-leaf-0x2-edx-output.patch b/queue-5.10/x86-cpu-validate-cpuid-leaf-0x2-edx-output.patch new file mode 100644 index 0000000000..aedb9ea3ff --- /dev/null +++ b/queue-5.10/x86-cpu-validate-cpuid-leaf-0x2-edx-output.patch @@ -0,0 +1,41 @@ +From 1881148215c67151b146450fb89ec22fd92337a7 Mon Sep 17 00:00:00 2001 +From: "Ahmed S. Darwish" +Date: Tue, 4 Mar 2025 09:51:13 +0100 +Subject: x86/cpu: Validate CPUID leaf 0x2 EDX output + +From: Ahmed S. Darwish + +commit 1881148215c67151b146450fb89ec22fd92337a7 upstream. + +CPUID leaf 0x2 emits one-byte descriptors in its four output registers +EAX, EBX, ECX, and EDX. For these descriptors to be valid, the most +significant bit (MSB) of each register must be clear. + +Leaf 0x2 parsing at intel.c only validated the MSBs of EAX, EBX, and +ECX, but left EDX unchecked. + +Validate EDX's most-significant bit as well. + +Fixes: e0ba94f14f74 ("x86/tlb_info: get last level TLB entry number of CPU") +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Ingo Molnar +Cc: stable@kernel.org +Cc: "H. Peter Anvin" +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20250304085152.51092-3-darwi@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/intel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -911,7 +911,7 @@ static void intel_detect_tlb(struct cpui + cpuid(2, ®s[0], ®s[1], ®s[2], ®s[3]); + + /* If bit 31 is set, this is an unknown format */ +- for (j = 0 ; j < 3 ; j++) ++ for (j = 0 ; j < 4 ; j++) + if (regs[j] & (1 << 31)) + regs[j] = 0; +