From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 13:19:37 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.16.3~90 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ff737918af01afd9df30ca7d1f2e5749cafee8ae;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch pwm-imx-tpm-reset-counter-if-cmod-is-0.patch wifi-ath11k-fix-source-ring-buffer-corruption.patch wifi-brcmsmac-remove-const-from-tbl_ptr-parameter-in-wlc_lcnphy_common_read_table.patch zynq_fpga-use-sgtable-based-scatterlist-wrappers.patch --- diff --git a/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch b/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch new file mode 100644 index 0000000000..6d56699599 --- /dev/null +++ b/queue-5.15/hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch @@ -0,0 +1,59 @@ +From 9c62e2282900332c8b711d9f9e37af369a8ef71b Mon Sep 17 00:00:00 2001 +From: Tim Harvey +Date: Fri, 18 Jul 2025 13:02:59 -0700 +Subject: hwmon: (gsc-hwmon) fix fan pwm setpoint show functions + +From: Tim Harvey + +commit 9c62e2282900332c8b711d9f9e37af369a8ef71b upstream. + +The Linux hwmon sysfs API values for pwmX_auto_pointY_pwm represent an +integer value between 0 (0%) to 255 (100%) and the pwmX_auto_pointY_temp +represent millidegrees Celcius. + +Commit a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature +scaling") properly addressed the incorrect scaling in the +pwm_auto_point_temp_store implementation but erroneously scaled +the pwm_auto_point_pwm_show (pwm value) instead of the +pwm_auto_point_temp_show (temp value) resulting in: + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm + 25500 + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp + 4500 + +Fix the scaling of these attributes: + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm + 255 + # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp + 45000 + +Fixes: a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling") +Cc: stable@vger.kernel.org +Signed-off-by: Tim Harvey +Link: https://lore.kernel.org/r/20250718200259.1840792-1-tharvey@gateworks.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/gsc-hwmon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/gsc-hwmon.c ++++ b/drivers/hwmon/gsc-hwmon.c +@@ -65,7 +65,7 @@ static ssize_t pwm_auto_point_temp_show( + return ret; + + ret = regs[0] | regs[1] << 8; +- return sprintf(buf, "%d\n", ret * 10); ++ return sprintf(buf, "%d\n", ret * 100); + } + + static ssize_t pwm_auto_point_temp_store(struct device *dev, +@@ -100,7 +100,7 @@ static ssize_t pwm_auto_point_pwm_show(s + { + struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr); + +- return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10))); ++ return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100); + } + + static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0); diff --git a/queue-5.15/pwm-imx-tpm-reset-counter-if-cmod-is-0.patch b/queue-5.15/pwm-imx-tpm-reset-counter-if-cmod-is-0.patch new file mode 100644 index 0000000000..5c685fc4b0 --- /dev/null +++ b/queue-5.15/pwm-imx-tpm-reset-counter-if-cmod-is-0.patch @@ -0,0 +1,58 @@ +From 65c6f742ab14ab1a2679fba72b82dcc0289d96f1 Mon Sep 17 00:00:00 2001 +From: Laurentiu Mihalcea +Date: Mon, 28 Jul 2025 15:41:44 -0400 +Subject: pwm: imx-tpm: Reset counter if CMOD is 0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Laurentiu Mihalcea + +commit 65c6f742ab14ab1a2679fba72b82dcc0289d96f1 upstream. + +As per the i.MX93 TRM, section 67.3.2.1 "MOD register update", the value +of the TPM counter does NOT get updated when writing MOD.MOD unless +SC.CMOD != 0. Therefore, with the current code, assuming the following +sequence: + + 1) pwm_disable() + 2) pwm_apply_might_sleep() /* period is changed here */ + 3) pwm_enable() + +and assuming only one channel is active, if CNT.COUNT is higher than the +MOD.MOD value written during the pwm_apply_might_sleep() call then, when +re-enabling the PWM during pwm_enable(), the counter will end up resetting +after UINT32_MAX - CNT.COUNT + MOD.MOD cycles instead of MOD.MOD cycles as +normally expected. + +Fix this problem by forcing a reset of the TPM counter before MOD.MOD is +written. + +Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") +Cc: stable@vger.kernel.org +Signed-off-by: Laurentiu Mihalcea +Link: https://lore.kernel.org/r/20250728194144.22884-1-laurentiumihalcea111@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-imx-tpm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -203,6 +203,15 @@ static int pwm_imx_tpm_apply_hw(struct p + writel(val, tpm->base + PWM_IMX_TPM_SC); + + /* ++ * if the counter is disabled (CMOD == 0), programming the new ++ * period length (MOD) will not reset the counter (CNT). If ++ * CNT.COUNT happens to be bigger than the new MOD value then ++ * the counter will end up being reset way too late. Therefore, ++ * manually reset it to 0. ++ */ ++ if (!cmod) ++ writel(0x0, tpm->base + PWM_IMX_TPM_CNT); ++ /* + * set period count: + * if the PWM is disabled (CMOD[1:0] = 2b00), then MOD register + * is updated when MOD register is written. diff --git a/queue-5.15/series b/queue-5.15/series index b56662b371..4090a01bc9 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -473,3 +473,8 @@ ext4-use-kmalloc_array-for-array-space-allocation.patch ext4-fix-hole-length-calculation-overflow-in-non-extent-inodes.patch scsi-mpi3mr-fix-race-between-config-read-submit-and-interrupt-completion.patch ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch +zynq_fpga-use-sgtable-based-scatterlist-wrappers.patch +wifi-brcmsmac-remove-const-from-tbl_ptr-parameter-in-wlc_lcnphy_common_read_table.patch +wifi-ath11k-fix-source-ring-buffer-corruption.patch +pwm-imx-tpm-reset-counter-if-cmod-is-0.patch +hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch diff --git a/queue-5.15/wifi-ath11k-fix-source-ring-buffer-corruption.patch b/queue-5.15/wifi-ath11k-fix-source-ring-buffer-corruption.patch new file mode 100644 index 0000000000..05253a13de --- /dev/null +++ b/queue-5.15/wifi-ath11k-fix-source-ring-buffer-corruption.patch @@ -0,0 +1,56 @@ +From 6efa0df54022c6c9fd4d294b87622c7fcdc418c8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 4 Jun 2025 16:34:56 +0200 +Subject: wifi: ath11k: fix source ring-buffer corruption + +From: Johan Hovold + +commit 6efa0df54022c6c9fd4d294b87622c7fcdc418c8 upstream. + +Add the missing memory barrier to make sure that LMAC source ring +descriptors are written before updating the head pointer to avoid +passing stale data to the firmware on weakly ordered architectures like +aarch64. + +Note that non-LMAC rings use MMIO write accessors which have the +required write memory barrier. + +Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Cc: stable@vger.kernel.org # 5.6 +Signed-off-by: Johan Hovold +Reviewed-by: Baochen Qiang +Link: https://patch.msgid.link/20250604143457.26032-5-johan+linaro@kernel.org +Signed-off-by: Jeff Johnson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath11k/hal.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath11k/hal.c ++++ b/drivers/net/wireless/ath/ath11k/hal.c +@@ -797,7 +797,11 @@ void ath11k_hal_srng_access_end(struct a + if (srng->ring_dir == HAL_SRNG_DIR_SRC) { + srng->u.src_ring.last_tp = + *(volatile u32 *)srng->u.src_ring.tp_addr; +- *srng->u.src_ring.hp_addr = srng->u.src_ring.hp; ++ /* Make sure descriptor is written before updating the ++ * head pointer. ++ */ ++ dma_wmb(); ++ WRITE_ONCE(*srng->u.src_ring.hp_addr, srng->u.src_ring.hp); + } else { + srng->u.dst_ring.last_hp = *srng->u.dst_ring.hp_addr; + *srng->u.dst_ring.tp_addr = srng->u.dst_ring.tp; +@@ -806,6 +810,10 @@ void ath11k_hal_srng_access_end(struct a + if (srng->ring_dir == HAL_SRNG_DIR_SRC) { + srng->u.src_ring.last_tp = + *(volatile u32 *)srng->u.src_ring.tp_addr; ++ /* Assume implementation use an MMIO write accessor ++ * which has the required wmb() so that the descriptor ++ * is written before the updating the head pointer. ++ */ + ath11k_hif_write32(ab, + (unsigned long)srng->u.src_ring.hp_addr - + (unsigned long)ab->mem, diff --git a/queue-5.15/wifi-brcmsmac-remove-const-from-tbl_ptr-parameter-in-wlc_lcnphy_common_read_table.patch b/queue-5.15/wifi-brcmsmac-remove-const-from-tbl_ptr-parameter-in-wlc_lcnphy_common_read_table.patch new file mode 100644 index 0000000000..a22e24ea6b --- /dev/null +++ b/queue-5.15/wifi-brcmsmac-remove-const-from-tbl_ptr-parameter-in-wlc_lcnphy_common_read_table.patch @@ -0,0 +1,46 @@ +From 81284e86bf8849f8e98e8ead3ff5811926b2107f Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 15 Jul 2025 19:45:23 -0700 +Subject: wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() + +From: Nathan Chancellor + +commit 81284e86bf8849f8e98e8ead3ff5811926b2107f upstream. + +A new warning in clang [1] complains that diq_start in +wlc_lcnphy_tx_iqlo_cal() is passed uninitialized as a const pointer to +wlc_lcnphy_common_read_table(): + + drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c:2728:13: error: variable 'diq_start' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] + 2728 | &diq_start, 1, 16, 69); + | ^~~~~~~~~ + +The table pointer passed to wlc_lcnphy_common_read_table() should not be +considered constant, as wlc_phy_read_table() is ultimately going to +update it. Remove the const qualifier from the tbl_ptr to clear up the +warning. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2108 +Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") +Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] +Signed-off-by: Nathan Chancellor +Acked-by: Arend van Spriel > +Link: https://patch.msgid.link/20250715-brcmsmac-fix-uninit-const-pointer-v1-1-16e6a51a8ef4@kernel.org +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +@@ -919,7 +919,7 @@ void wlc_lcnphy_read_table(struct brcms_ + + static void + wlc_lcnphy_common_read_table(struct brcms_phy *pi, u32 tbl_id, +- const u16 *tbl_ptr, u32 tbl_len, ++ u16 *tbl_ptr, u32 tbl_len, + u32 tbl_width, u32 tbl_offset) + { + struct phytbl_info tab; diff --git a/queue-5.15/zynq_fpga-use-sgtable-based-scatterlist-wrappers.patch b/queue-5.15/zynq_fpga-use-sgtable-based-scatterlist-wrappers.patch new file mode 100644 index 0000000000..288b4ed10b --- /dev/null +++ b/queue-5.15/zynq_fpga-use-sgtable-based-scatterlist-wrappers.patch @@ -0,0 +1,46 @@ +From 37e00703228ab44d0aacc32a97809a4f6f58df1b Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Mon, 16 Jun 2025 14:09:32 +0200 +Subject: zynq_fpga: use sgtable-based scatterlist wrappers + +From: Marek Szyprowski + +commit 37e00703228ab44d0aacc32a97809a4f6f58df1b upstream. + +Use common wrappers operating directly on the struct sg_table objects to +fix incorrect use of statterlists related calls. dma_unmap_sg() function +has to be called with the number of elements originally passed to the +dma_map_sg() function, not the one returned in sgtable's nents. + +CC: stable@vger.kernel.org +Fixes: 425902f5c8e3 ("fpga zynq: Use the scatterlist interface") +Signed-off-by: Marek Szyprowski +Reviewed-by: Jason Gunthorpe +Reviewed-by: Xu Yilun +Link: https://lore.kernel.org/r/20250616120932.1090614-1-m.szyprowski@samsung.com +Signed-off-by: Xu Yilun +Signed-off-by: Greg Kroah-Hartman +--- + drivers/fpga/zynq-fpga.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/fpga/zynq-fpga.c ++++ b/drivers/fpga/zynq-fpga.c +@@ -406,7 +406,7 @@ static int zynq_fpga_ops_write(struct fp + } + + priv->dma_nelms = +- dma_map_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE); ++ dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); + if (priv->dma_nelms == 0) { + dev_err(&mgr->dev, "Unable to DMA map (TO_DEVICE)\n"); + return -ENOMEM; +@@ -478,7 +478,7 @@ out_clk: + clk_disable(priv->clk); + + out_free: +- dma_unmap_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE); ++ dma_unmap_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); + return err; + } +