From 15b8ffdae1ceac1f394191bf10485296efd3f734 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Mar 2024 08:34:44 +0100 Subject: [PATCH] 6.7-stable patches added patches: efivarfs-request-at-most-512-bytes-for-variable-names.patch iommufd-fix-iopt_access_list_id-overwrite-bug.patch iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch power-supply-mm8013-select-regmap_i2c.patch risc-v-drop-invalid-test-from-config_as_has_option_arch.patch riscv-add-caller_addrx-support.patch riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch riscv-save-restore-envcfg-csr-during-cpu-suspend.patch --- ...at-most-512-bytes-for-variable-names.patch | 74 +++++++++++ ...ix-iopt_access_list_id-overwrite-bug.patch | 76 +++++++++++ ...-fault-in-iommufd_test_syz_conv_iova.patch | 111 ++++++++++++++++ ...atal-warnings-to-as-instr-invocation.patch | 60 +++++++++ ...eference-on-scmi_perf_domain-removal.patch | 65 ++++++++++ ...pmhpd-fix-enabled_corner-aggregation.patch | 70 ++++++++++ ...ower-supply-mm8013-select-regmap_i2c.patch | 40 ++++++ ...-test-from-config_as_has_option_arch.patch | 71 ++++++++++ .../riscv-add-caller_addrx-support.patch | 122 ++++++++++++++++++ ...ling-cbo.zero-when-running-in-m-mode.patch | 54 ++++++++ ...estore-envcfg-csr-during-cpu-suspend.patch | 55 ++++++++ queue-6.7/series | 11 ++ 12 files changed, 809 insertions(+) create mode 100644 queue-6.7/efivarfs-request-at-most-512-bytes-for-variable-names.patch create mode 100644 queue-6.7/iommufd-fix-iopt_access_list_id-overwrite-bug.patch create mode 100644 queue-6.7/iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch create mode 100644 queue-6.7/kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch create mode 100644 queue-6.7/pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch create mode 100644 queue-6.7/pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch create mode 100644 queue-6.7/power-supply-mm8013-select-regmap_i2c.patch create mode 100644 queue-6.7/risc-v-drop-invalid-test-from-config_as_has_option_arch.patch create mode 100644 queue-6.7/riscv-add-caller_addrx-support.patch create mode 100644 queue-6.7/riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch create mode 100644 queue-6.7/riscv-save-restore-envcfg-csr-during-cpu-suspend.patch diff --git a/queue-6.7/efivarfs-request-at-most-512-bytes-for-variable-names.patch b/queue-6.7/efivarfs-request-at-most-512-bytes-for-variable-names.patch new file mode 100644 index 00000000000..3e53993e24f --- /dev/null +++ b/queue-6.7/efivarfs-request-at-most-512-bytes-for-variable-names.patch @@ -0,0 +1,74 @@ +From f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a Mon Sep 17 00:00:00 2001 +From: Tim Schumacher +Date: Fri, 26 Jan 2024 17:25:23 +0100 +Subject: efivarfs: Request at most 512 bytes for variable names + +From: Tim Schumacher + +commit f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a upstream. + +Work around a quirk in a few old (2011-ish) UEFI implementations, where +a call to `GetNextVariableName` with a buffer size larger than 512 bytes +will always return EFI_INVALID_PARAMETER. + +There is some lore around EFI variable names being up to 1024 bytes in +size, but this has no basis in the UEFI specification, and the upper +bounds are typically platform specific, and apply to the entire variable +(name plus payload). + +Given that Linux does not permit creating files with names longer than +NAME_MAX (255) bytes, 512 bytes (== 256 UTF-16 characters) is a +reasonable limit. + +Cc: # 6.1+ +Signed-off-by: Tim Schumacher +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + fs/efivarfs/vars.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/fs/efivarfs/vars.c ++++ b/fs/efivarfs/vars.c +@@ -372,7 +372,7 @@ static void dup_variable_bug(efi_char16_ + int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *), + void *data, bool duplicates, struct list_head *head) + { +- unsigned long variable_name_size = 1024; ++ unsigned long variable_name_size = 512; + efi_char16_t *variable_name; + efi_status_t status; + efi_guid_t vendor_guid; +@@ -389,12 +389,13 @@ int efivar_init(int (*func)(efi_char16_t + goto free; + + /* +- * Per EFI spec, the maximum storage allocated for both +- * the variable name and variable data is 1024 bytes. ++ * A small set of old UEFI implementations reject sizes ++ * above a certain threshold, the lowest seen in the wild ++ * is 512. + */ + + do { +- variable_name_size = 1024; ++ variable_name_size = 512; + + status = efivar_get_next_variable(&variable_name_size, + variable_name, +@@ -431,9 +432,13 @@ int efivar_init(int (*func)(efi_char16_t + break; + case EFI_NOT_FOUND: + break; ++ case EFI_BUFFER_TOO_SMALL: ++ pr_warn("efivars: Variable name size exceeds maximum (%lu > 512)\n", ++ variable_name_size); ++ status = EFI_NOT_FOUND; ++ break; + default: +- printk(KERN_WARNING "efivars: get_next_variable: status=%lx\n", +- status); ++ pr_warn("efivars: get_next_variable: status=%lx\n", status); + status = EFI_NOT_FOUND; + break; + } diff --git a/queue-6.7/iommufd-fix-iopt_access_list_id-overwrite-bug.patch b/queue-6.7/iommufd-fix-iopt_access_list_id-overwrite-bug.patch new file mode 100644 index 00000000000..42ff52f9b9a --- /dev/null +++ b/queue-6.7/iommufd-fix-iopt_access_list_id-overwrite-bug.patch @@ -0,0 +1,76 @@ +From aeb004c0cd6958e910123a1607634401009c9539 Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Thu, 22 Feb 2024 13:23:45 -0800 +Subject: iommufd: Fix iopt_access_list_id overwrite bug + +From: Nicolin Chen + +commit aeb004c0cd6958e910123a1607634401009c9539 upstream. + +Syzkaller reported the following WARN_ON: + WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 + + Call Trace: + iommufd_access_change_ioas+0x2fe/0x4e0 + iommufd_access_destroy_object+0x50/0xb0 + iommufd_object_remove+0x2a3/0x490 + iommufd_object_destroy_user + iommufd_access_destroy+0x71/0xb0 + iommufd_test_staccess_release+0x89/0xd0 + __fput+0x272/0xb50 + __fput_sync+0x4b/0x60 + __do_sys_close + __se_sys_close + __x64_sys_close+0x8b/0x110 + do_syscall_x64 + +The mismatch between the access pointer in the list and the passed-in +pointer is resulting from an overwrite of access->iopt_access_list_id, in +iopt_add_access(). Called from iommufd_access_change_ioas() when +xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. + +Add a new_id in iopt_add_access() and only update iopt_access_list_id when +returning successfully. + +Cc: stable@vger.kernel.org +Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers") +Link: https://lore.kernel.org/r/2dda7acb25b8562ec5f1310de828ef5da9ef509c.1708636627.git.nicolinc@nvidia.com +Reported-by: Jason Gunthorpe +Suggested-by: Jason Gunthorpe +Signed-off-by: Nicolin Chen +Reviewed-by: Kevin Tian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iommufd/io_pagetable.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/iommu/iommufd/io_pagetable.c ++++ b/drivers/iommu/iommufd/io_pagetable.c +@@ -1330,20 +1330,23 @@ out_unlock: + + int iopt_add_access(struct io_pagetable *iopt, struct iommufd_access *access) + { ++ u32 new_id; + int rc; + + down_write(&iopt->domains_rwsem); + down_write(&iopt->iova_rwsem); +- rc = xa_alloc(&iopt->access_list, &access->iopt_access_list_id, access, +- xa_limit_16b, GFP_KERNEL_ACCOUNT); ++ rc = xa_alloc(&iopt->access_list, &new_id, access, xa_limit_16b, ++ GFP_KERNEL_ACCOUNT); ++ + if (rc) + goto out_unlock; + + rc = iopt_calculate_iova_alignment(iopt); + if (rc) { +- xa_erase(&iopt->access_list, access->iopt_access_list_id); ++ xa_erase(&iopt->access_list, new_id); + goto out_unlock; + } ++ access->iopt_access_list_id = new_id; + + out_unlock: + up_write(&iopt->iova_rwsem); diff --git a/queue-6.7/iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch b/queue-6.7/iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch new file mode 100644 index 00000000000..4eb73b136be --- /dev/null +++ b/queue-6.7/iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch @@ -0,0 +1,111 @@ +From cf7c2789822db8b5efa34f5ebcf1621bc0008d48 Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Thu, 22 Feb 2024 13:23:47 -0800 +Subject: iommufd: Fix protection fault in iommufd_test_syz_conv_iova + +From: Nicolin Chen + +commit cf7c2789822db8b5efa34f5ebcf1621bc0008d48 upstream. + +Syzkaller reported the following bug: + + general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN + KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] + Call Trace: + lock_acquire + lock_acquire+0x1ce/0x4f0 + down_read+0x93/0x4a0 + iommufd_test_syz_conv_iova+0x56/0x1f0 + iommufd_test_access_rw.isra.0+0x2ec/0x390 + iommufd_test+0x1058/0x1e30 + iommufd_fops_ioctl+0x381/0x510 + vfs_ioctl + __do_sys_ioctl + __se_sys_ioctl + __x64_sys_ioctl+0x170/0x1e0 + do_syscall_x64 + do_syscall_64+0x71/0x140 + +This is because the new iommufd_access_change_ioas() sets access->ioas to +NULL during its process, so the lock might be gone in a concurrent racing +context. + +Fix this by doing the same access->ioas sanity as iommufd_access_rw() and +iommufd_access_pin_pages() functions do. + +Cc: stable@vger.kernel.org +Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers") +Link: https://lore.kernel.org/r/3f1932acaf1dd494d404c04364d73ce8f57f3e5e.1708636627.git.nicolinc@nvidia.com +Reported-by: Jason Gunthorpe +Signed-off-by: Nicolin Chen +Reviewed-by: Kevin Tian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/iommufd/selftest.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +--- a/drivers/iommu/iommufd/selftest.c ++++ b/drivers/iommu/iommufd/selftest.c +@@ -48,8 +48,8 @@ enum { + * In syzkaller mode the 64 bit IOVA is converted into an nth area and offset + * value. This has a much smaller randomization space and syzkaller can hit it. + */ +-static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt, +- u64 *iova) ++static unsigned long __iommufd_test_syz_conv_iova(struct io_pagetable *iopt, ++ u64 *iova) + { + struct syz_layout { + __u32 nth_area; +@@ -73,6 +73,21 @@ static unsigned long iommufd_test_syz_co + return 0; + } + ++static unsigned long iommufd_test_syz_conv_iova(struct iommufd_access *access, ++ u64 *iova) ++{ ++ unsigned long ret; ++ ++ mutex_lock(&access->ioas_lock); ++ if (!access->ioas) { ++ mutex_unlock(&access->ioas_lock); ++ return 0; ++ } ++ ret = __iommufd_test_syz_conv_iova(&access->ioas->iopt, iova); ++ mutex_unlock(&access->ioas_lock); ++ return ret; ++} ++ + void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd, + unsigned int ioas_id, u64 *iova, u32 *flags) + { +@@ -85,7 +100,7 @@ void iommufd_test_syz_conv_iova_id(struc + ioas = iommufd_get_ioas(ucmd->ictx, ioas_id); + if (IS_ERR(ioas)) + return; +- *iova = iommufd_test_syz_conv_iova(&ioas->iopt, iova); ++ *iova = __iommufd_test_syz_conv_iova(&ioas->iopt, iova); + iommufd_put_object(ucmd->ictx, &ioas->obj); + } + +@@ -1045,7 +1060,7 @@ static int iommufd_test_access_pages(str + } + + if (flags & MOCK_FLAGS_ACCESS_SYZ) +- iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt, ++ iova = iommufd_test_syz_conv_iova(staccess->access, + &cmd->access_pages.iova); + + npages = (ALIGN(iova + length, PAGE_SIZE) - +@@ -1147,8 +1162,8 @@ static int iommufd_test_access_rw(struct + } + + if (flags & MOCK_FLAGS_ACCESS_SYZ) +- iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt, +- &cmd->access_rw.iova); ++ iova = iommufd_test_syz_conv_iova(staccess->access, ++ &cmd->access_rw.iova); + + rc = iommufd_access_rw(staccess->access, iova, tmp, length, flags); + if (rc) diff --git a/queue-6.7/kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch b/queue-6.7/kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch new file mode 100644 index 00000000000..c6e6f5ab0c8 --- /dev/null +++ b/queue-6.7/kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch @@ -0,0 +1,60 @@ +From 0ee695a471a750cad4fff22286d91e038b1ef62f Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 25 Jan 2024 10:32:11 -0700 +Subject: kbuild: Add -Wa,--fatal-warnings to as-instr invocation + +From: Nathan Chancellor + +commit 0ee695a471a750cad4fff22286d91e038b1ef62f upstream. + +Certain assembler instruction tests may only induce warnings from the +assembler on an unsupported instruction or option, which causes as-instr +to succeed when it was expected to fail. Some tests workaround this +limitation by additionally testing that invalid input fails as expected. +However, this is fragile if the assembler is changed to accept the +invalid input, as it will cause the instruction/option to be unavailable +like it was unsupported even when it is. + +Use '-Wa,--fatal-warnings' in the as-instr macro to turn these warnings +into hard errors, which avoids this fragility and makes tests more +robust and well formed. + +Cc: stable@vger.kernel.org +Suggested-by: Eric Biggers +Signed-off-by: Nathan Chancellor +Tested-by: Eric Biggers +Tested-by: Andy Chiu +Reviewed-by: Andy Chiu +Tested-by: Conor Dooley +Reviewed-by: Conor Dooley +Acked-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20240125-fix-riscv-option-arch-llvm-18-v1-1-390ac9cc3cd0@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + scripts/Kconfig.include | 2 +- + scripts/Makefile.compiler | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/scripts/Kconfig.include ++++ b/scripts/Kconfig.include +@@ -33,7 +33,7 @@ ld-option = $(success,$(LD) -v $(1)) + + # $(as-instr,) + # Return y if the assembler supports , n otherwise +-as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -c -x assembler-with-cpp -o /dev/null -) ++as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -) + + # check if $(CC) and $(LD) exist + $(error-if,$(failure,command -v $(CC)),C compiler '$(CC)' not found) +--- a/scripts/Makefile.compiler ++++ b/scripts/Makefile.compiler +@@ -38,7 +38,7 @@ as-option = $(call try-run,\ + # Usage: aflags-y += $(call as-instr,instr,option1,option2) + + as-instr = $(call try-run,\ +- printf "%b\n" "$(1)" | $(CC) -Werror $(CLANG_FLAGS) $(KBUILD_AFLAGS) -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3)) ++ printf "%b\n" "$(1)" | $(CC) -Werror $(CLANG_FLAGS) $(KBUILD_AFLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3)) + + # __cc-option + # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586) diff --git a/queue-6.7/pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch b/queue-6.7/pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch new file mode 100644 index 00000000000..356ccc9169d --- /dev/null +++ b/queue-6.7/pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch @@ -0,0 +1,65 @@ +From eb5555d422d0fc325e1574a7353d3c616f82d8b5 Mon Sep 17 00:00:00 2001 +From: Cristian Marussi +Date: Thu, 25 Jan 2024 19:17:56 +0000 +Subject: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal + +From: Cristian Marussi + +commit eb5555d422d0fc325e1574a7353d3c616f82d8b5 upstream. + +On unloading of the scmi_perf_domain module got the below splat, when in +the DT provided to the system under test the '#power-domain-cells' property +was missing. Indeed, this particular setup causes the probe to bail out +early without giving any error, which leads to the ->remove() callback gets +to run too, but without all the expected initialized structures in place. + +Add a check and bail out early on remove too. + + Call trace: + scmi_perf_domain_remove+0x28/0x70 [scmi_perf_domain] + scmi_dev_remove+0x28/0x40 [scmi_core] + device_remove+0x54/0x90 + device_release_driver_internal+0x1dc/0x240 + driver_detach+0x58/0xa8 + bus_remove_driver+0x78/0x108 + driver_unregister+0x38/0x70 + scmi_driver_unregister+0x28/0x180 [scmi_core] + scmi_perf_domain_driver_exit+0x18/0xb78 [scmi_perf_domain] + __arm64_sys_delete_module+0x1a8/0x2c0 + invoke_syscall+0x50/0x128 + el0_svc_common.constprop.0+0x48/0xf0 + do_el0_svc+0x24/0x38 + el0_svc+0x34/0xb8 + el0t_64_sync_handler+0x100/0x130 + el0t_64_sync+0x190/0x198 + Code: a90153f3 f9403c14 f9414800 955f8a05 (b9400a80) + ---[ end trace 0000000000000000 ]--- + +Fixes: 2af23ceb8624 ("pmdomain: arm: Add the SCMI performance domain") +Signed-off-by: Cristian Marussi +Reviewed-by: Sudeep Holla +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240125191756.868860-1-cristian.marussi@arm.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/arm/scmi_perf_domain.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pmdomain/arm/scmi_perf_domain.c b/drivers/pmdomain/arm/scmi_perf_domain.c +index 709bbc448fad..d7ef46ccd9b8 100644 +--- a/drivers/pmdomain/arm/scmi_perf_domain.c ++++ b/drivers/pmdomain/arm/scmi_perf_domain.c +@@ -159,6 +159,9 @@ static void scmi_perf_domain_remove(struct scmi_device *sdev) + struct genpd_onecell_data *scmi_pd_data = dev_get_drvdata(dev); + int i; + ++ if (!scmi_pd_data) ++ return; ++ + of_genpd_del_provider(dev->of_node); + + for (i = 0; i < scmi_pd_data->num_domains; i++) +-- +2.44.0 + diff --git a/queue-6.7/pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch b/queue-6.7/pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch new file mode 100644 index 00000000000..eee2669105a --- /dev/null +++ b/queue-6.7/pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch @@ -0,0 +1,70 @@ +From 2a93c6cbd5a703d44c414a3c3945a87ce11430ba Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Mon, 26 Feb 2024 17:49:57 -0800 +Subject: pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation + +From: Bjorn Andersson + +commit 2a93c6cbd5a703d44c414a3c3945a87ce11430ba upstream. + +Commit 'e3e56c050ab6 ("soc: qcom: rpmhpd: Make power_on actually enable +the domain")' aimed to make sure that a power-domain that is being +enabled without any particular performance-state requested will at least +turn the rail on, to avoid filling DeviceTree with otherwise unnecessary +required-opps properties. + +But in the event that aggregation happens on a disabled power-domain, with +an enabled peer without performance-state, both the local and peer +corner are 0. The peer's enabled_corner is not considered, with the +result that the underlying (shared) resource is disabled. + +One case where this can be observed is when the display stack keeps mmcx +enabled (but without a particular performance-state vote) in order to +access registers and sync_state happens in the rpmhpd driver. As mmcx_ao +is flushed the state of the peer (mmcx) is not considered and mmcx_ao +ends up turning off "mmcx.lvl" underneath mmcx. This has been observed +several times, but has been painted over in DeviceTree by adding an +explicit vote for the lowest non-disabled performance-state. + +Fixes: e3e56c050ab6 ("soc: qcom: rpmhpd: Make power_on actually enable the domain") +Reported-by: Johan Hovold +Closes: https://lore.kernel.org/linux-arm-msm/ZdMwZa98L23mu3u6@hovoldconsulting.com/ +Cc: +Signed-off-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Reviewed-by: Stephen Boyd +Tested-by: Johan Hovold +Link: https://lore.kernel.org/r/20240226-rpmhpd-enable-corner-fix-v1-1-68c004cec48c@quicinc.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pmdomain/qcom/rpmhpd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/pmdomain/qcom/rpmhpd.c ++++ b/drivers/pmdomain/qcom/rpmhpd.c +@@ -692,6 +692,7 @@ static int rpmhpd_aggregate_corner(struc + unsigned int active_corner, sleep_corner; + unsigned int this_active_corner = 0, this_sleep_corner = 0; + unsigned int peer_active_corner = 0, peer_sleep_corner = 0; ++ unsigned int peer_enabled_corner; + + if (pd->state_synced) { + to_active_sleep(pd, corner, &this_active_corner, &this_sleep_corner); +@@ -701,9 +702,11 @@ static int rpmhpd_aggregate_corner(struc + this_sleep_corner = pd->level_count - 1; + } + +- if (peer && peer->enabled) +- to_active_sleep(peer, peer->corner, &peer_active_corner, ++ if (peer && peer->enabled) { ++ peer_enabled_corner = max(peer->corner, peer->enable_corner); ++ to_active_sleep(peer, peer_enabled_corner, &peer_active_corner, + &peer_sleep_corner); ++ } + + active_corner = max(this_active_corner, peer_active_corner); + diff --git a/queue-6.7/power-supply-mm8013-select-regmap_i2c.patch b/queue-6.7/power-supply-mm8013-select-regmap_i2c.patch new file mode 100644 index 00000000000..0984f72933b --- /dev/null +++ b/queue-6.7/power-supply-mm8013-select-regmap_i2c.patch @@ -0,0 +1,40 @@ +From 30d5297862410418bb8f8b4c0a87fa55c3063dd7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= +Date: Sun, 4 Feb 2024 18:30:43 +0100 +Subject: power: supply: mm8013: select REGMAP_I2C +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +commit 30d5297862410418bb8f8b4c0a87fa55c3063dd7 upstream. + +The driver uses regmap APIs so it should make sure they are available. + +Fixes: c75f4bf6800b ("power: supply: Introduce MM8013 fuel gauge driver") +Cc: +Signed-off-by: Thomas Weißschuh +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20240204-mm8013-regmap-v1-1-7cc6b619b7d3@weissschuh.net +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig +index f21cb05815ec..3e31375491d5 100644 +--- a/drivers/power/supply/Kconfig ++++ b/drivers/power/supply/Kconfig +@@ -978,6 +978,7 @@ config CHARGER_QCOM_SMB2 + config FUEL_GAUGE_MM8013 + tristate "Mitsumi MM8013 fuel gauge driver" + depends on I2C ++ select REGMAP_I2C + help + Say Y here to enable the Mitsumi MM8013 fuel gauge driver. + It enables the monitoring of many battery parameters, including +-- +2.44.0 + diff --git a/queue-6.7/risc-v-drop-invalid-test-from-config_as_has_option_arch.patch b/queue-6.7/risc-v-drop-invalid-test-from-config_as_has_option_arch.patch new file mode 100644 index 00000000000..568ad6aa305 --- /dev/null +++ b/queue-6.7/risc-v-drop-invalid-test-from-config_as_has_option_arch.patch @@ -0,0 +1,71 @@ +From 3aff0c459e77ac0fb1c4d6884433467f797f7357 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 25 Jan 2024 10:32:12 -0700 +Subject: RISC-V: Drop invalid test from CONFIG_AS_HAS_OPTION_ARCH + +From: Nathan Chancellor + +commit 3aff0c459e77ac0fb1c4d6884433467f797f7357 upstream. + +Commit e4bb020f3dbb ("riscv: detect assembler support for .option arch") +added two tests, one for a valid value to '.option arch' that should +succeed and one for an invalid value that is expected to fail to make +sure that support for '.option arch' is properly detected because Clang +does not error when '.option arch' is not supported: + + $ clang --target=riscv64-linux-gnu -Werror -x assembler -c -o /dev/null <(echo '.option arch, +m') + /dev/fd/63:1:9: warning: unknown option, expected 'push', 'pop', 'rvc', 'norvc', 'relax' or 'norelax' + .option arch, +m + ^ + $ echo $? + 0 + +Unfortunately, the invalid test started being accepted by Clang after +the linked llvm-project change, which causes CONFIG_AS_HAS_OPTION_ARCH +and configurations that depend on it to be silently disabled, even +though those versions do support '.option arch'. + +The invalid test can be avoided altogether by using +'-Wa,--fatal-warnings', which will turn all assembler warnings into +errors, like '-Werror' does for the compiler: + + $ clang --target=riscv64-linux-gnu -Werror -Wa,--fatal-warnings -x assembler -c -o /dev/null <(echo '.option arch, +m') + /dev/fd/63:1:9: error: unknown option, expected 'push', 'pop', 'rvc', 'norvc', 'relax' or 'norelax' + .option arch, +m + ^ + $ echo $? + 1 + +The as-instr macros have been updated to make use of this flag, so +remove the invalid test, which allows CONFIG_AS_HAS_OPTION_ARCH to work +for all compiler versions. + +Cc: stable@vger.kernel.org +Fixes: e4bb020f3dbb ("riscv: detect assembler support for .option arch") +Link: https://github.com/llvm/llvm-project/commit/3ac9fe69f70a2b3541266daedbaaa7dc9c007a2a +Reported-by: Eric Biggers +Closes: https://lore.kernel.org/r/20240121011341.GA97368@sol.localdomain/ +Signed-off-by: Nathan Chancellor +Tested-by: Eric Biggers +Tested-by: Andy Chiu +Reviewed-by: Andy Chiu +Tested-by: Conor Dooley +Reviewed-by: Conor Dooley +Acked-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20240125-fix-riscv-option-arch-llvm-18-v1-2-390ac9cc3cd0@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -294,7 +294,6 @@ config AS_HAS_OPTION_ARCH + # https://reviews.llvm.org/D123515 + def_bool y + depends on $(as-instr, .option arch$(comma) +m) +- depends on !$(as-instr, .option arch$(comma) -i) + + source "arch/riscv/Kconfig.socs" + source "arch/riscv/Kconfig.errata" diff --git a/queue-6.7/riscv-add-caller_addrx-support.patch b/queue-6.7/riscv-add-caller_addrx-support.patch new file mode 100644 index 00000000000..d64c77ce5f0 --- /dev/null +++ b/queue-6.7/riscv-add-caller_addrx-support.patch @@ -0,0 +1,122 @@ +From 680341382da56bd192ebfa4e58eaf4fec2e5bca7 Mon Sep 17 00:00:00 2001 +From: Zong Li +Date: Fri, 2 Feb 2024 01:51:02 +0000 +Subject: riscv: add CALLER_ADDRx support + +From: Zong Li + +commit 680341382da56bd192ebfa4e58eaf4fec2e5bca7 upstream. + +CALLER_ADDRx returns caller's address at specified level, they are used +for several tracers. These macros eventually use +__builtin_return_address(n) to get the caller's address if arch doesn't +define their own implementation. + +In RISC-V, __builtin_return_address(n) only works when n == 0, we need +to walk the stack frame to get the caller's address at specified level. + +data.level started from 'level + 3' due to the call flow of getting +caller's address in RISC-V implementation. If we don't have additional +three iteration, the level is corresponding to follows: + +callsite -> return_address -> arch_stack_walk -> walk_stackframe +| | | | +level 3 level 2 level 1 level 0 + +Fixes: 10626c32e382 ("riscv/ftrace: Add basic support") +Cc: stable@vger.kernel.org +Reviewed-by: Alexandre Ghiti +Signed-off-by: Zong Li +Link: https://lore.kernel.org/r/20240202015102.26251-1-zong.li@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/ftrace.h | 5 +++ + arch/riscv/kernel/Makefile | 2 + + arch/riscv/kernel/return_address.c | 48 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 55 insertions(+) + create mode 100644 arch/riscv/kernel/return_address.c + +--- a/arch/riscv/include/asm/ftrace.h ++++ b/arch/riscv/include/asm/ftrace.h +@@ -25,6 +25,11 @@ + + #define ARCH_SUPPORTS_FTRACE_OPS 1 + #ifndef __ASSEMBLY__ ++ ++extern void *return_address(unsigned int level); ++ ++#define ftrace_return_address(n) return_address(n) ++ + void MCOUNT_NAME(void); + static inline unsigned long ftrace_call_adjust(unsigned long addr) + { +--- a/arch/riscv/kernel/Makefile ++++ b/arch/riscv/kernel/Makefile +@@ -7,6 +7,7 @@ ifdef CONFIG_FTRACE + CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE) + CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE) + CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE) ++CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE) + endif + CFLAGS_syscall_table.o += $(call cc-option,-Wno-override-init,) + CFLAGS_compat_syscall_table.o += $(call cc-option,-Wno-override-init,) +@@ -46,6 +47,7 @@ obj-y += irq.o + obj-y += process.o + obj-y += ptrace.o + obj-y += reset.o ++obj-y += return_address.o + obj-y += setup.o + obj-y += signal.o + obj-y += syscall_table.o +--- /dev/null ++++ b/arch/riscv/kernel/return_address.c +@@ -0,0 +1,48 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* ++ * This code come from arch/arm64/kernel/return_address.c ++ * ++ * Copyright (C) 2023 SiFive. ++ */ ++ ++#include ++#include ++#include ++ ++struct return_address_data { ++ unsigned int level; ++ void *addr; ++}; ++ ++static bool save_return_addr(void *d, unsigned long pc) ++{ ++ struct return_address_data *data = d; ++ ++ if (!data->level) { ++ data->addr = (void *)pc; ++ return false; ++ } ++ ++ --data->level; ++ ++ return true; ++} ++NOKPROBE_SYMBOL(save_return_addr); ++ ++noinline void *return_address(unsigned int level) ++{ ++ struct return_address_data data; ++ ++ data.level = level + 3; ++ data.addr = NULL; ++ ++ arch_stack_walk(save_return_addr, &data, current, NULL); ++ ++ if (!data.level) ++ return data.addr; ++ else ++ return NULL; ++ ++} ++EXPORT_SYMBOL_GPL(return_address); ++NOKPROBE_SYMBOL(return_address); diff --git a/queue-6.7/riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch b/queue-6.7/riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch new file mode 100644 index 00000000000..9a2d62e5cf9 --- /dev/null +++ b/queue-6.7/riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch @@ -0,0 +1,54 @@ +From 3fb3f7164edc467450e650dca51dbe4823315a56 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Tue, 27 Feb 2024 22:55:33 -0800 +Subject: riscv: Fix enabling cbo.zero when running in M-mode + +From: Samuel Holland + +commit 3fb3f7164edc467450e650dca51dbe4823315a56 upstream. + +When the kernel is running in M-mode, the CBZE bit must be set in the +menvcfg CSR, not in senvcfg. + +Cc: +Fixes: 43c16d51a19b ("RISC-V: Enable cbo.zero in usermode") +Reviewed-by: Andrew Jones +Signed-off-by: Samuel Holland +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20240228065559.3434837-2-samuel.holland@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/csr.h | 2 ++ + arch/riscv/kernel/cpufeature.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/riscv/include/asm/csr.h ++++ b/arch/riscv/include/asm/csr.h +@@ -415,6 +415,7 @@ + # define CSR_STATUS CSR_MSTATUS + # define CSR_IE CSR_MIE + # define CSR_TVEC CSR_MTVEC ++# define CSR_ENVCFG CSR_MENVCFG + # define CSR_SCRATCH CSR_MSCRATCH + # define CSR_EPC CSR_MEPC + # define CSR_CAUSE CSR_MCAUSE +@@ -439,6 +440,7 @@ + # define CSR_STATUS CSR_SSTATUS + # define CSR_IE CSR_SIE + # define CSR_TVEC CSR_STVEC ++# define CSR_ENVCFG CSR_SENVCFG + # define CSR_SCRATCH CSR_SSCRATCH + # define CSR_EPC CSR_SEPC + # define CSR_CAUSE CSR_SCAUSE +--- a/arch/riscv/kernel/cpufeature.c ++++ b/arch/riscv/kernel/cpufeature.c +@@ -740,7 +740,7 @@ arch_initcall(check_unaligned_access_all + void riscv_user_isa_enable(void) + { + if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_ZICBOZ)) +- csr_set(CSR_SENVCFG, ENVCFG_CBZE); ++ csr_set(CSR_ENVCFG, ENVCFG_CBZE); + } + + #ifdef CONFIG_RISCV_ALTERNATIVE diff --git a/queue-6.7/riscv-save-restore-envcfg-csr-during-cpu-suspend.patch b/queue-6.7/riscv-save-restore-envcfg-csr-during-cpu-suspend.patch new file mode 100644 index 00000000000..ff362163615 --- /dev/null +++ b/queue-6.7/riscv-save-restore-envcfg-csr-during-cpu-suspend.patch @@ -0,0 +1,55 @@ +From 05ab803d1ad8ac505ade77c6bd3f86b1b4ea0dc4 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Tue, 27 Feb 2024 22:55:35 -0800 +Subject: riscv: Save/restore envcfg CSR during CPU suspend + +From: Samuel Holland + +commit 05ab803d1ad8ac505ade77c6bd3f86b1b4ea0dc4 upstream. + +The value of the [ms]envcfg CSR is lost when entering a nonretentive +idle state, so the CSR must be rewritten when resuming the CPU. + +Cc: # v6.7+ +Fixes: 43c16d51a19b ("RISC-V: Enable cbo.zero in usermode") +Signed-off-by: Samuel Holland +Reviewed-by: Conor Dooley +Reviewed-by: Andrew Jones +Link: https://lore.kernel.org/r/20240228065559.3434837-4-samuel.holland@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/suspend.h | 1 + + arch/riscv/kernel/suspend.c | 4 ++++ + 2 files changed, 5 insertions(+) + +--- a/arch/riscv/include/asm/suspend.h ++++ b/arch/riscv/include/asm/suspend.h +@@ -14,6 +14,7 @@ struct suspend_context { + struct pt_regs regs; + /* Saved and restored by high-level functions */ + unsigned long scratch; ++ unsigned long envcfg; + unsigned long tvec; + unsigned long ie; + #ifdef CONFIG_MMU +--- a/arch/riscv/kernel/suspend.c ++++ b/arch/riscv/kernel/suspend.c +@@ -11,6 +11,8 @@ + void suspend_save_csrs(struct suspend_context *context) + { + context->scratch = csr_read(CSR_SCRATCH); ++ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG)) ++ context->envcfg = csr_read(CSR_ENVCFG); + context->tvec = csr_read(CSR_TVEC); + context->ie = csr_read(CSR_IE); + +@@ -32,6 +34,8 @@ void suspend_save_csrs(struct suspend_co + void suspend_restore_csrs(struct suspend_context *context) + { + csr_write(CSR_SCRATCH, context->scratch); ++ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG)) ++ csr_write(CSR_ENVCFG, context->envcfg); + csr_write(CSR_TVEC, context->tvec); + csr_write(CSR_IE, context->ie); + diff --git a/queue-6.7/series b/queue-6.7/series index 78f5fdedf9b..cadb7f42ca5 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -102,3 +102,14 @@ mmc-core-fix-emmc-initialization-with-1-bit-bus-connection.patch mmc-sdhci-xenon-add-timeout-for-phy-init-complete.patch mmc-sdhci-xenon-fix-phy-init-clock-stability.patch ceph-switch-to-corrected-encoding-of-max_xattr_size-in-mdsmap.patch +risc-v-drop-invalid-test-from-config_as_has_option_arch.patch +riscv-add-caller_addrx-support.patch +riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch +riscv-save-restore-envcfg-csr-during-cpu-suspend.patch +power-supply-mm8013-select-regmap_i2c.patch +kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch +iommufd-fix-iopt_access_list_id-overwrite-bug.patch +iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch +efivarfs-request-at-most-512-bytes-for-variable-names.patch +pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch +pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch -- 2.47.3